{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://fortproof.dev/schemas/repo-contract/asvs.schema.json",
  "title": ".security/asvs.yaml",
  "description": "Status: DESIGNED. Declares the ASVS version, target level and capability profile that scopes applicable requirements (catalogue/frameworks/asvs-applicability.yaml). N/A requests take effect only when approved in the platform.",
  "type": "object",
  "additionalProperties": false,
  "required": ["schema_version", "asvs_version", "target_level", "capabilities"],
  "properties": {
    "schema_version": { "const": "1" },
    "asvs_version": { "type": "string", "pattern": "^5\\.[0-9]+\\.[0-9]+$" },
    "target_level": { "type": "integer", "minimum": 1, "maximum": 3, "description": "Must be ≥ the tier's asvs_target (ASC-REQ-01)" },
    "capabilities": {
      "type": "object",
      "additionalProperties": false,
      "required": ["web_frontend", "api", "authentication"],
      "properties": {
        "web_frontend": { "type": "boolean" },
        "api": { "type": "boolean" },
        "file_handling": { "type": "boolean", "default": false },
        "authentication": { "enum": ["none", "local", "federated", "mixed"] },
        "sessions": { "type": "boolean", "default": false },
        "self_contained_tokens": { "type": "boolean", "default": false },
        "oauth_oidc": {
          "type": "array",
          "uniqueItems": true,
          "items": { "enum": ["client", "resource_server", "authorization_server"] },
          "default": []
        },
        "webrtc": { "type": "boolean", "default": false }
      }
    },
    "not_applicable": {
      "type": "array",
      "description": "Requested N/A for requirements or sections; approved in the platform (AppSec for Tier 1)",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["ref", "justification"],
        "properties": {
          "ref": { "type": "string", "pattern": "^(v5\\.[0-9]+\\.[0-9]+-)?V?[0-9]{1,2}(\\.[0-9]+){0,2}$" },
          "justification": { "type": "string", "minLength": 20, "maxLength": 1000 }
        }
      }
    },
    "custom_requirements": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["id", "title", "verification"],
        "properties": {
          "id": { "type": "string", "pattern": "^CUSTOM-[0-9]{2,4}$" },
          "title": { "type": "string", "maxLength": 300 },
          "source": { "enum": ["threat_model", "regulatory", "contract", "other"] },
          "verification": { "enum": ["automated_test", "config_check", "manual_review", "pentest"] }
        }
      }
    }
  }
}