{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://stellaops.local/airgap/receipt.schema.json",
  "title": "AirGap Ingress/Egress Receipt",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schemaVersion",
    "receiptId",
    "direction",
    "bundleId",
    "tenant",
    "operator",
    "occurredAt",
    "decision",
    "hashes"
  ],
  "properties": {
    "schemaVersion": { "type": "string", "pattern": "^1\\.\\d+\\.\\d+$" },
    "receiptId": { "type": "string", "pattern": "^receipt:[A-Za-z0-9._:-]+$" },
    "direction": { "type": "string", "enum": ["ingress", "egress"] },
    "bundleId": { "type": "string", "pattern": "^offline-kit:[A-Za-z0-9._:-]+$" },
    "tenant": { "type": "string", "minLength": 1 },
    "operator": {
      "type": "object",
      "additionalProperties": false,
      "required": ["id", "role"],
      "properties": {
        "id": { "type": "string" },
        "role": { "type": "string" }
      }
    },
    "occurredAt": { "type": "string", "format": "date-time" },
    "decision": { "type": "string", "enum": ["allow", "deny", "quarantine"] },
    "hashes": {
      "type": "object",
      "additionalProperties": false,
      "required": ["bundleSha256", "manifestSha256"],
      "properties": {
        "bundleSha256": { "type": "string", "pattern": "^[A-Fa-f0-9]{64}$" },
        "manifestSha256": { "type": "string", "pattern": "^[A-Fa-f0-9]{64}$" }
      }
    },
    "dsse": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "envelopeDigest": { "type": "string", "pattern": "^sha256:[A-Fa-f0-9]{64}$" },
        "signer": { "type": "string" },
        "rekorUuid": { "type": "string" }
      }
    },
    "notes": { "type": "string" }
  }
}