{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "fvcms.cms-local.permissions.001",
  "title": "Local CMS Module — Permissions",
  "description": "Per-app role + permission rules. Replaces (not merges) the vendored role list — apps define their own roles.",
  "type": "object",
  "required": ["schema"],
  "properties": {
    "schema": { "const": "fvcms.cms-local.permissions.001" },
    "roles": {
      "type": "object",
      "description": "Map of role name → role definition",
      "additionalProperties": {
        "type": "object",
        "required": ["label"],
        "properties": {
          "label": { "type": "string" },
          "icon":  { "type": "string" },
          "color": { "type": "string" },
          "inherits": { "type": "string", "description": "Parent role to inherit rules from" }
        }
      }
    },
    "rules": {
      "type": "array",
      "description": "Allow/deny rules per (role, action, target)",
      "items": {
        "type": "object",
        "required": ["role", "action"],
        "properties": {
          "role":    { "type": "string" },
          "action":  { "type": "string", "enum": ["view", "edit", "create", "delete", "publish", "admin"] },
          "target":  { "type": "string", "description": "Resource path or type. '*' = wildcard." },
          "effect":  { "type": "string", "enum": ["allow", "deny"], "default": "allow" },
          "when":    { "type": "string", "description": "Optional JS expression evaluated in a sandbox" }
        }
      }
    }
  },
  "additionalProperties": true
}