{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://schemas.logicsrc.com/logicsrc-credential-sync-plan.schema.json",
  "title": "LogicSRC Credential Sync Plan",
  "type": "object",
  "required": ["type", "id", "from", "to", "policy", "changes", "requiresApproval", "createdAt"],
  "additionalProperties": false,
  "$defs": {
    "endpoint": {
      "type": "object",
      "required": ["provider"],
      "additionalProperties": false,
      "properties": {
        "provider": { "type": "string", "minLength": 1 },
        "path": { "type": "string" },
        "project": { "type": "string" },
        "config": { "type": "string" },
        "service": { "type": "string" },
        "scope": { "type": "string" },
        "metadata": { "type": "object" }
      }
    },
    "change": {
      "type": "object",
      "required": ["key", "op", "destructive"],
      "additionalProperties": false,
      "properties": {
        "key": { "type": "string", "minLength": 1 },
        "op": { "enum": ["add", "update", "remove", "unchanged", "unknown"] },
        "sourceFingerprint": { "type": "string" },
        "targetFingerprint": { "type": "string" },
        "destructive": { "type": "boolean" }
      }
    }
  },
  "properties": {
    "type": { "const": "logicsrc.credential_sync_plan" },
    "id": { "type": "string", "minLength": 1 },
    "from": { "$ref": "#/$defs/endpoint" },
    "to": { "$ref": "#/$defs/endpoint" },
    "policy": {
      "type": "object",
      "required": ["redactValues", "requireApprovalForDestructive"],
      "additionalProperties": false,
      "properties": {
        "redactValues": { "const": true },
        "requireApprovalForDestructive": { "type": "boolean" },
        "denyKeys": { "type": "array", "items": { "type": "string" } }
      }
    },
    "changes": { "type": "array", "items": { "$ref": "#/$defs/change" } },
    "requiresApproval": { "type": "boolean" },
    "rollbackOfRunId": { "type": "string", "minLength": 1 },
    "createdAt": { "type": "string", "format": "date-time" }
  }
}
