{
 "$schema":"https://json-schema.org/draft/2020-12/schema","$id":"redaction-manifest.schema.json","title":"Signed sensitive data flow","type":"object","additionalProperties":false,
 "required":["schema_version","manifest_revision","generated_at","signature_algorithm","entries","security_owner","security_public_key","security_signature","closure_assertion"],
 "properties":{
  "schema_version":{"const":"1.0.0"},"manifest_revision":{"type":"string","minLength":1},"generated_at":{"type":"string","format":"date-time"},"signature_algorithm":{"const":"Ed25519"},
  "entries":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["hop_id","class","product","version","environment","owner","owner_public_key","upstream","downstream","data_classes","capture_policy","control_revision","retention","region","access_policy","probe_id","enabled","disabled_reason","owner_signature"],"properties":{
   "hop_id":{"type":"string","pattern":"^[A-Za-z0-9._-]+$"},"class":{"enum":["browser-client","service-worker","browser-extension","browser-automation","packet-debug-capture","api-gateway-load-balancer","edge-cdn-waf","reverse-proxy","service-mesh-sidecar","app-runtime","request-response-log","observability","database-log","process-dump","crash-reporter","session-replay","support-ticket","warehouse-siem","backup-archive","deletion","vendor-transit-storage","mail-provider","mailbox","mail-queue","mail-dead-letter","mail-template-renderer","mail-template-preview-log","mail-bounce-handler","mail-complaint-handler","mail-link-scanner","mail-security-gateway","mail-link-rewriter"]},
   "product":{"type":"string","minLength":1},"version":{"type":"string","minLength":1},"environment":{"const":"production"},"owner":{"type":"string","minLength":1},"owner_public_key":{"type":"string","pattern":"^[A-Za-z0-9+/]{43}=$"},
   "upstream":{"type":"array","uniqueItems":true,"items":{"type":"string","pattern":"^[A-Za-z0-9._-]+$"}},"downstream":{"type":"array","uniqueItems":true,"items":{"type":"string","pattern":"^[A-Za-z0-9._-]+$"}},"data_classes":{"type":"array","minItems":1,"uniqueItems":true,"items":{"enum":["cookie","authorization","ordinary-csrf","refresh-csrf","password","reset-token","csrf-response","refresh-csrf-response"]}},
   "capture_policy":{"enum":["forbidden","redacted"]},"control_revision":{"type":"string","minLength":1},"retention":{"type":"string","minLength":1},"region":{"type":"string","minLength":1},"access_policy":{"type":"string","minLength":1},"probe_id":{"type":["string","null"]},"enabled":{"type":"boolean"},"disabled_reason":{"type":["string","null"]},"owner_signature":{"type":"string","pattern":"^[A-Za-z0-9+/]{86}==$"}
  },"allOf":[{"if":{"properties":{"enabled":{"const":true}},"required":["enabled"]},"then":{"properties":{"probe_id":{"type":"string","minLength":1},"disabled_reason":{"const":null}}}},{"if":{"properties":{"enabled":{"const":false}},"required":["enabled"]},"then":{"properties":{"probe_id":{"const":null},"disabled_reason":{"type":"string","minLength":1}}}}]}},
  "security_owner":{"type":"string","minLength":1},"security_public_key":{"type":"string","pattern":"^[A-Za-z0-9+/]{43}=$"},"security_signature":{"type":"string","pattern":"^[A-Za-z0-9+/]{86}==$"},
  "closure_assertion":{"const":"Every byte path from browser creation or ingress through processing, observability, support, backup, and deletion is represented; there is no uninventoryed hop."}
 }
}