{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:shiin:schema:policy-syntax:v1",
  "title": "Shiin policy syntax (TOML decoded to JSON)",
  "type": "object",
  "required": ["version"],
  "properties": {
    "version": { "const": 1 },
    "capabilities": {"type": "object", "additionalProperties": {"$ref": "urn:shiin:schema:capability:v1"}},
    "defaults": {
      "type": "object",
      "required": ["decision"],
      "properties": { "decision": { "enum": ["deny", "pending"] } },
      "additionalProperties": false
    },
    "rule": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["id", "effect"],
        "properties": {
          "id": { "type": "string", "minLength": 1 },
          "effect": { "type": "string", "enum": ["allow", "deny", "pending"] },
          "action_types": { "type": "array", "items": { "type": "string" } },
          "resources": { "type": "array", "items": { "type": "string" } },
          "commands": { "type": "array", "items": { "type": "string" } },
          "agents": { "type": "array", "items": { "type": "string" } },
          "sessions": { "type": "array", "items": { "type": "string" } },
          "tasks": { "type": "array", "items": { "type": "string" } },
          "reason": { "type": "string" }
        },
        "additionalProperties": false
      }
    },
    "risk": {
      "type": "object",
      "propertyNames": {
        "enum": ["opaque_command", "secret_path", "outside_workspace", "bulk_delete", "destructive_vcs", "privilege_escalation"]
      },
      "additionalProperties": {
        "oneOf": [
          { "enum": ["allow", "deny", "pending"] },
          {
            "type": "object",
            "required": ["decision"],
            "properties": {
              "decision": { "enum": ["allow", "deny", "pending"] },
              "threshold": { "type": "integer", "minimum": 1 }
            },
            "additionalProperties": false
          }
        ]
      }
    }
  },
  "additionalProperties": false
}