{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://verify.cloakapps.com/schemas/receipt-operations-recommended.json",
  "title": "Cloakapps Receipt — Recommended Operation Codes",
  "description": "Advisory list of operation codes used by cloakapps' own services. Self-hosted customers MAY use these codes for compatible operations OR define their own domain-specific codes (e.g. PAYMENT_APPROVED, CONTRACT_SIGNED, AGENT_ACTION). Receivers MUST treat unknown codes as opaque — verify the signature, surface the operation verbatim. This document is informational; the receipt schema (receipt-v1.json) does not enforce these values.",
  "type": "object",
  "properties": {
    "version": { "const": 1 },
    "namingGuidance": {
      "type": "string"
    },
    "operations": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["code", "description"],
        "properties": {
          "code":         { "type": "string" },
          "category":     { "type": "string" },
          "description":  { "type": "string" },
          "resourceTypes":{ "type": "array", "items": { "type": "string" } }
        }
      }
    }
  },
  "version": 1,
  "namingGuidance": "Use UPPER_SNAKE_CASE. Prefer NOUN_VERB_PASTTENSE so the code reads as 'a thing happened' (e.g. CONTRACT_SIGNED, not SIGN_CONTRACT). For ambiguous domains, prefix with the domain (e.g. ACME_PAYMENT_APPROVED). Avoid CRUD verbs like CREATE/UPDATE/DELETE on resources that are not state-changing in your domain.",
  "operations": [
    { "code": "FILE_ENCRYPT",     "category": "Cloak Encrypt", "description": "A file was encrypted with a recipient policy.",                "resourceTypes": ["file"] },
    { "code": "FILE_DECRYPT",     "category": "Cloak Encrypt", "description": "A .clk file was decrypted to plaintext.",                     "resourceTypes": ["file"] },
    { "code": "KEY_CREATE",       "category": "Cloak KMS",     "description": "An HSM masterkey was provisioned.",                           "resourceTypes": ["key"] },
    { "code": "KEY_DELETE",       "category": "Cloak KMS",     "description": "An HSM masterkey was deleted from one or more keystores.",   "resourceTypes": ["key"] },
    { "code": "KEY_SIGN",         "category": "Cloak KMS",     "description": "A SHA-256 digest was signed with an HSM masterkey.",         "resourceTypes": ["key"] },
    { "code": "KEY_ENCRYPT",      "category": "Cloak KMS",     "description": "Bytes were encrypted with an HSM-held key.",                 "resourceTypes": ["key"] },
    { "code": "KEY_DECRYPT",      "category": "Cloak KMS",     "description": "Bytes were decrypted with an HSM-held key.",                 "resourceTypes": ["key"] },
    { "code": "KEY_DERIVE",       "category": "Cloak KMS",     "description": "An ECDH shared secret was derived against an HSM ECC key.",  "resourceTypes": ["key"] },
    { "code": "PDF_SIGN",         "category": "Batchsign",     "description": "A PDF was AATL-signed.",                                     "resourceTypes": ["pdf"] },
    { "code": "RECIPIENT_REVOKE", "category": "Cloak Vault",   "description": "A recipient's access to a protected resource was revoked.", "resourceTypes": ["file", "license"] }
  ]
}