{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$ref": "#/definitions/Bundle",
  "$id": "https://ela.st/harp-v1-bundle.json",
  "definitions": {
    "Bundle": {
      "properties": {
        "labels": {
          "additionalProperties": {
            "type": "string"
          },
          "type": ["object", "null"],
          "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects.",
          "default": {
            "key": "value"
          }
        },
        "annotations": {
          "additionalProperties": {
            "type": "string"
          },
          "type": ["object", "null"],
          "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata.",
          "default": {
            "key": "value"
          }
        },
        "version": {
          "type": "integer",
          "description": "Version of the file",
          "minimum": 0
        },
        "packages": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.Package"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Secret package collection"
        },
        "template": {
          "$ref": "#/definitions/harp.bundle.v1.Template",
          "additionalProperties": false,
          "description": "Bundle template object"
        },
        "values": {
          "additionalProperties": false,
          "type": ["string", "null"],
          "description": "Associated values"
        },
        "merkleTreeRoot": {
          "type": "string",
          "description": "Merkle Tree root",
          "format": "binary",
          "binaryEncoding": "base64"
        },
        "userData": {
          "additionalProperties": {
            "properties": {
              "typeUrl": {
                "type": "string",
                "description": "A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][]   value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the   URL, or have them precompiled into a binary to avoid any   lookup. Therefore, binary compatibility needs to be preserved   on changes to types. (Use versioned type names to manage   breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics."
              },
              "value": {
                "type": "string",
                "description": "Must be a valid serialized protocol buffer of the above specified type.",
                "format": "binary",
                "binaryEncoding": "base64"
              }
            },
            "additionalProperties": false,
            "type": "object"
          },
          "type": "object",
          "description": "User data storage"
        }
      },
      "required": ["packages"],
      "additionalProperties": false,
      "type": "object",
      "title": "Bundle",
      "description": "Bundle is a concrete secret bundle."
    },
    "harp.bundle.v1.ApplicationComponentNS": {
      "properties": {
        "type": {
          "type": "string",
          "description": "Application type."
        },
        "name": {
          "type": "string",
          "description": "Application name."
        },
        "description": {
          "type": ["string", "null"],
          "description": "Application short description."
        },
        "secrets": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.SecretSuffix"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Secret definitions."
        }
      },
      "required": ["type", "name", "secrets"],
      "additionalProperties": false,
      "type": "object",
      "title": "Application Component NS",
      "description": "ApplicationComponentNS describes application components."
    },
    "harp.bundle.v1.InfrastructureNS": {
      "properties": {
        "provider": {
          "type": "string",
          "description": "Infrastructure provider",
          "default": "aws",
          "examples": [
            "aws",
            "azure",
            "gcp",
            "ibm",
            "local"
          ]
        },
        "account": {
          "type": "string",
          "description": "Infrastructure provider account",
          "default": "1234567890"
        },
        "name": {
          "type": ["string", "null"],
          "description": "Infrastructure provider account alias (user-friendly name)"
        },
        "description": {
          "type": "string",
          "description": "Short description for the infrastructure purpose."
        },
        "regions": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.InfrastructureRegionNS"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Cloud Provider Regions"
        }
      },
      "required": ["provider", "account", "regions"],
      "additionalProperties": false,
      "type": "object",
      "title": "Infrastructure NS",
      "description": "InfrastructureSpec is the container for R1 secret generators."
    },
    "harp.bundle.v1.InfrastructureRegionNS": {
      "properties": {
        "name": {
          "type": "string",
          "description": "Infrastructure provider region name",
          "default": "global",
          "examples": ["eu-central-1", "us-east-1"]
        },
        "services": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.InfrastructureServiceNS"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Service secret definitions"
        }
      },
      "required": ["name", "services"],
      "additionalProperties": false,
      "type": "object",
      "title": "Infrastructure Region NS",
      "description": "InfrastructureRegionSpec describes region partition."
    },
    "harp.bundle.v1.InfrastructureServiceNS": {
      "properties": {
        "type": {
          "type": "string",
          "description": "Service type."
        },
        "name": {
          "type": "string",
          "description": "Service name."
        },
        "description": {
          "type": ["string", "null"],
          "description": "Service usage short description."
        },
        "secrets": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.SecretSuffix"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Secret definitions."
        }
      },
      "required": ["type", "name", "secrets"],
      "additionalProperties": false,
      "type": "object",
      "title": "Infrastructure Service NS",
      "description": "InfrastructureServiceSpec describes infrastructure service."
    },
    "harp.bundle.v1.KV": {
      "properties": {
        "key": {
          "type": "string",
          "description": "Key"
        },
        "type": {
          "type": "string",
          "description": "Golang type of initial value before packing"
        },
        "value": {
          "type": "string",
          "description": "Value must be encoded using secret.Pack method",
          "format": "binary",
          "binaryEncoding": "base64"
        }
      },
      "required": ["key", "type", "value"],
      "additionalProperties": false,
      "type": "object",
      "title": "KV",
      "description": "KV contains the key, the value and the type of the value."
    },
    "harp.bundle.v1.Namespaces": {
      "properties": {
        "infrastructure": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.InfrastructureNS"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Infrastructure secret definitions."
        },
        "platform": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.PlatformRegionNS"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Platform secret definitions."
        },
        "product": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.ProductComponentNS"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Product secret definitions."
        },
        "application": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.ApplicationComponentNS"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Application secret definitions."
        }
      },
      "anyOf": [
        {"required": ["infrastructure"]},
        {"required": ["platform"]},
        {"required": ["product"]},
        {"required": ["application"]}
      ],
      "additionalProperties": false,
      "type": "object",
      "title": "Namespaces",
      "description": "Namespaces defines secret generation template specification accoridng to CSO path naming."
    },
    "harp.bundle.v1.Package": {
      "properties": {
        "labels": {
          "additionalProperties": {
            "type": "string"
          },
          "type": ["object", "null"],
          "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects.",
          "default": {
            "key": "value"
          }
        },
        "annotations": {
          "additionalProperties": {
            "type": "string"
          },
          "type": ["object", "null"],
          "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata.",
          "default": {
            "key": "value"
          }
        },
        "name": {
          "type": "string",
          "description": "Package name as a complete secret path (CSO compliance recommended)",
          "default": "ring/path/subpath/prefix"
        },
        "secrets": {
          "$ref": "#/definitions/harp.bundle.v1.SecretChain",
          "additionalProperties": false,
          "description": "Active secret version"
        },
        "versions": {
          "additionalProperties": {
            "$ref": "#/definitions/harp.bundle.v1.SecretChain",
            "additionalProperties": false
          },
          "type": ["object", "null"],
          "description": "SecretChain versions"
        },
        "userData": {
          "additionalProperties": {
            "properties": {
              "typeUrl": {
                "type": "string",
                "description": "A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][]   value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the   URL, or have them precompiled into a binary to avoid any   lookup. Therefore, binary compatibility needs to be preserved   on changes to types. (Use versioned type names to manage   breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics."
              },
              "value": {
                "type": "string",
                "description": "Must be a valid serialized protocol buffer of the above specified type.",
                "format": "binary",
                "binaryEncoding": "base64"
              }
            },
            "additionalProperties": false,
            "type": "object"
          },
          "type": "object",
          "description": "User data storage"
        }
      },
      "required": ["name", "secrets"],
      "additionalProperties": false,
      "type": "object",
      "title": "Package",
      "description": "Package is a secret organizational unit."
    },
    "harp.bundle.v1.PlatformComponentNS": {
      "properties": {
        "type": {
          "type": "string",
          "description": "Component type. Try to use infrastructure independent type.",
          "default": "database",
          "examples": [
            "database",
            "persistence",
            "objectstorage",
            "filestorage",
            "apigateway",
            "loadbalancer"
          ]
        },
        "name": {
          "type": "string",
          "description": "Component name.",
          "default": ""
        },
        "description": {
          "type": ["string", "null"],
          "description": "Component short description."
        },
        "secrets": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.SecretSuffix"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Secret definitions."
        }
      },
      "required": ["type", "name", "secrets"],
      "additionalProperties": false,
      "type": "object",
      "title": "Platform Component NS",
      "description": "PlatformComponentSpec describes platform components."
    },
    "harp.bundle.v1.PlatformRegionNS": {
      "properties": {
        "region": {
          "type": "string",
          "description": "Platform region name.",
          "default": "global",
          "examples": ["eu-central-1", "us-east-1"]
        },
        "description": {
          "type": ["string", "null"],
          "description": "REQUIRED. Platform region short description."
        },
        "components": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.PlatformComponentNS"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "REQUIRED. Platform components deployed in the given region."
        }
      },
      "required": ["region", "components"],
      "additionalProperties": false,
      "type": "object",
      "title": "Platform Region NS",
      "description": "PlatformRegionNS is the container for R2 secret generators."
    },
    "harp.bundle.v1.ProductComponentNS": {
      "properties": {
        "type": {
          "type": "string",
          "description": "Product type."
        },
        "name": {
          "type": "string",
          "description": "Product name."
        },
        "description": {
          "type": "string",
          "description": "Product short description."
        },
        "secrets": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.SecretSuffix"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Secret definitions."
        }
      },
      "required": ["type", "name", "secrets"],
      "additionalProperties": false,
      "type": "object",
      "title": "Product Component NS",
      "description": "ProductComponentNS describes product components."
    },
    "harp.bundle.v1.SecretChain": {
      "properties": {
        "labels": {
          "additionalProperties": {
            "type": "string"
          },
          "type": ["object", "null"],
          "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects.",
          "default": {
            "key": "value"
          }
        },
        "annotations": {
          "additionalProperties": {
            "type": "string"
          },
          "type": ["object", "null"],
          "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata.",
          "default": {
            "key": "value"
          }
        },
        "version": {
          "type": "integer",
          "description": "Version identifier",
          "minimum": 0
        },
        "data": {
          "items": {
            "$ref": "#/definitions/harp.bundle.v1.KV"
          },
          "additionalProperties": false,
          "type": "array",
          "description": "Secret K/V collection"
        },
        "previousVersion": {
          "additionalProperties": false,
          "type": "integer",
          "description": "Link to previous version",
          "minimum": 0
        },
        "nextVersion": {
          "additionalProperties": false,
          "type": "integer",
          "description": "Link to next version",
          "minimum": 0
        },
        "locked": {
          "additionalProperties": false,
          "type": "string",
          "description": "Locked buffer when encryption is enabled"
        },
        "userData": {
          "additionalProperties": {
            "properties": {
              "typeUrl": {
                "type": "string",
                "description": "A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][]   value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the   URL, or have them precompiled into a binary to avoid any   lookup. Therefore, binary compatibility needs to be preserved   on changes to types. (Use versioned type names to manage   breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics."
              },
              "value": {
                "type": "string",
                "description": "Must be a valid serialized protocol buffer of the above specified type.",
                "format": "binary",
                "binaryEncoding": "base64"
              }
            },
            "additionalProperties": false,
            "type": "object"
          },
          "type": "object",
          "description": "User data storage"
        }
      },
      "required": ["data"],
      "additionalProperties": false,
      "type": "object",
      "title": "Secret Chain",
      "description": "SecretChain describe a secret version chain."
    },
    "harp.bundle.v1.SecretSuffix": {
      "properties": {
        "suffix": {
          "type": "string",
          "description": "CSO Suffix.",
          "default": "path/suffix"
        },
        "description": {
          "type": ["string", "null"],
          "description": "Short description of the purpose of the secret."
        },
        "vendor": {
          "type": "boolean",
          "description": "Defines if secret is managed or not (generated vs static secret).",
          "default": false
        },
        "template": {
          "type": ["string", "null"],
          "description": "JSON Template for K/V Generation."
        },
        "content": {
          "additionalProperties": {
            "type": "string"
          },
          "type": ["object", "null"],
          "description": "String Content for file embedding process. (filename / content)"
        },
        "labels": {
          "additionalProperties": {
            "type": "string"
          },
          "type": ["object", "null"],
          "description": "Secret labels contains identifying information used for query (i.e. Patch selector).",
          "default": {
            "key": "value"
          }
        },
        "annotations": {
          "additionalProperties": {
            "type": "string"
          },
          "type": ["object", "null"],
          "description": "Secret annotations not used internally used by external harp environments.",
          "default": {
            "key": "value"
          }
        }
      },
      "required": ["suffix"],
      "oneOf": [{
          "allOf": [{
              "required": ["template"]
            },
            {
              "not": {
                "required": ["content"]
              }
            }
          ]
        },
        {
          "allOf": [{
              "required": ["content"]
            },
            {
              "not": {
                "required": ["template"]
              }
            }
          ]
        },
        {
          "allOf": [{
              "required": ["template"]
            },
            {
              "required": ["content"]
            }
          ]
        }
      ],
      "additionalProperties": false,
      "type": "object",
      "title": "Secret Suffix",
      "description": "SecretSuffix holds secret value generation details."
    },
    "harp.bundle.v1.Selector": {
      "properties": {
        "quality": {
          "type": "string",
          "description": "Quality defines default quality value for CSO path builder."
        },
        "platform": {
          "type": "string",
          "description": "Platform defines default platform value in CSO path builder."
        },
        "product": {
          "type": "string",
          "description": "Product defines default product value in CSO path builder."
        },
        "application": {
          "type": "string",
          "description": "Application defines default application value in CSO path builder."
        },
        "version": {
          "type": "string",
          "description": "Version defines default version value in CSO path builder."
        },
        "component": {
          "type": "string",
          "description": "Component defines default component value in CSO path builder."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "title": "Selector",
      "description": "BundleTemplateSelector defines secret path generator default values."
    },
    "harp.bundle.v1.Template": {
      "properties": {
        "apiVersion": {
          "type": "string"
        },
        "kind": {
          "type": "string"
        },
        "meta": {
          "$ref": "#/definitions/harp.bundle.v1.TemplateMeta",
          "additionalProperties": false
        },
        "spec": {
          "$ref": "#/definitions/harp.bundle.v1.TemplateSpec",
          "additionalProperties": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "title": "Template",
      "description": "Template represents bundle template generation definition."
    },
    "harp.bundle.v1.TemplateMeta": {
      "properties": {
        "name": {
          "type": "string",
          "description": "REQUIRED. Template name."
        },
        "owner": {
          "type": "string",
          "description": "REQUIRED. Template owner."
        },
        "description": {
          "type": "string",
          "description": "REQUIRED. Short description for template role."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "title": "Template Meta",
      "description": "TemplateMeta handles bundle template metadata."
    },
    "harp.bundle.v1.TemplateSpec": {
      "properties": {
        "selector": {
          "$ref": "#/definitions/harp.bundle.v1.Selector",
          "additionalProperties": false
        },
        "namespaces": {
          "$ref": "#/definitions/harp.bundle.v1.Namespaces",
          "additionalProperties": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "title": "Template Spec",
      "description": "TemplateSpec handles bundle template specification."
    }
  }
}
