{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://vishcore.com/api/test-library.schema.json",
  "title": "Vishcore public AWS test library",
  "description": "A curated, read-only subset of the Vishcore scanner's AWS test catalog. SOC 2 and CIS references are Vishcore's mapping guidance, not an auditor's determination. The file lists tests, not results, and carries no account, client, or scan data.",
  "type": "object",
  "additionalProperties": false,
  "required": ["areas", "catalog_hash", "catalog_size", "cis_benchmark", "controls", "library_size", "schema_version"],
  "properties": {
    "areas": {
      "description": "Per-area counts: tests in this library and tests in the full private catalog.",
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["catalog_count", "id", "library_count", "name"],
        "properties": {
          "catalog_count": { "type": "integer", "minimum": 1 },
          "id": { "type": "string", "enum": ["iam", "logging", "network", "edge", "data", "monitoring", "compute", "governance"] },
          "library_count": { "type": "integer", "minimum": 0 },
          "name": { "type": "string", "minLength": 1, "maxLength": 80 }
        }
      }
    },
    "catalog_hash": {
      "description": "SHA-256 of the full private catalog, so a stale copy is detectable.",
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "catalog_size": { "type": "integer", "minimum": 1 },
    "cis_benchmark": {
      "description": "The benchmark version every CIS id below was verified against.",
      "type": "string",
      "const": "CIS Amazon Web Services Foundations Benchmark v3.0.0"
    },
    "controls": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "area",
          "checks",
          "cis",
          "evidence_type",
          "fail_condition",
          "fsbp",
          "id",
          "name",
          "pass_condition",
          "read_only",
          "resource_family",
          "service",
          "severity",
          "soc2"
        ],
        "properties": {
          "area": { "type": "string", "enum": ["iam", "logging", "network", "edge", "data", "monitoring", "compute", "governance"] },
          "checks": { "type": "string", "minLength": 40, "maxLength": 240, "pattern": "\\.$" },
          "cis": {
            "description": "CIS AWS Foundations Benchmark v3.0.0 recommendation ids, verified, ids only.",
            "type": "array",
            "uniqueItems": true,
            "items": { "type": "string", "pattern": "^[1-9][0-9]?(?:\\.[0-9]{1,2}){1,2}$" }
          },
          "evidence_type": {
            "type": "string",
            "enum": ["configuration", "inventory", "logging", "monitoring", "encryption", "network", "identity"]
          },
          "fail_condition": { "type": "string", "minLength": 20, "maxLength": 200, "pattern": "^Fails when .+\\.$" },
          "fsbp": {
            "description": "AWS Foundational Security Best Practices control ids, ids only; empty until verified per control.",
            "type": "array",
            "uniqueItems": true,
            "items": { "type": "string", "pattern": "^[A-Za-z0-9]+\\.[0-9]{1,3}$" }
          },
          "id": { "type": "string", "pattern": "^aws(?:\\.[a-z0-9]+(?:_[a-z0-9]+)*){3}$" },
          "name": { "type": "string", "minLength": 8, "maxLength": 120 },
          "pass_condition": { "type": "string", "minLength": 20, "maxLength": 200, "pattern": "^Passes when .+\\.$" },
          "read_only": { "type": "boolean", "const": true },
          "resource_family": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
          "rollup_id": {
            "description": "The public scan-check id (api/scan-checks.json) this test rolls up to, when it has one.",
            "type": "string",
            "enum": [
              "s3.public_access_block",
              "iam.root_mfa_enabled",
              "cloudtrail.multi_region_logging",
              "rds.encryption_at_rest",
              "ec2.sg_open_ingress"
            ]
          },
          "service": { "type": "string", "minLength": 2, "maxLength": 40 },
          "severity": { "type": "string", "enum": ["blocker", "high", "medium", "advisory", "info"] },
          "soc2": {
            "description": "AICPA Trust Services Criteria ids, ids only.",
            "type": "array",
            "minItems": 1,
            "uniqueItems": true,
            "items": { "type": "string", "pattern": "^(?:CC|A|C|PI|P)[1-9][0-9]?\\.[1-9][0-9]?$" }
          }
        }
      }
    },
    "library_size": { "type": "integer", "minimum": 1 },
    "schema_version": { "type": "integer", "const": 1 }
  }
}