{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:oprp:experimental:0.1:application",
  "title": "OPRP experimental dev.7 decrypted requests",
  "description": "Structural contract for inner requests after envelope verification/decryption. Clinical subset, permissions, tokens, canonical encoding and cryptographic binding require separate validation. Migration operations require a verified Host sender and pre-admitted transfer; application senders cannot use them.",
  "oneOf": [
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "request"
      ],
      "properties": {
        "operation": {
          "const": "token"
        },
        "request": {
          "$ref": "./exchange.schema.json#/$defs/accessRequest"
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "request_id"
      ],
      "properties": {
        "operation": {
          "enum": [
            "authorization_status",
            "cancel_authorization"
          ]
        },
        "request_id": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "refresh_token",
        "request_id"
      ],
      "properties": {
        "operation": {
          "const": "refresh"
        },
        "request_id": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "refresh_token": {
          "$ref": "./exchange.schema.json#/$defs/base64url",
          "minLength": 43,
          "maxLength": 43
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "patient",
        "access_token"
      ],
      "properties": {
        "operation": {
          "enum": [
            "read_demographics",
            "list_labs",
            "export_record"
          ]
        },
        "patient": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "access_token": {
          "$ref": "#/$defs/accessToken"
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "patient",
        "access_token",
        "cursor",
        "limit"
      ],
      "properties": {
        "operation": {
          "const": "changes"
        },
        "patient": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "access_token": {
          "$ref": "#/$defs/accessToken"
        },
        "cursor": {
          "$ref": "#/$defs/cursor"
        },
        "limit": {
          "type": "integer",
          "minimum": 1,
          "maximum": 100
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "patient",
        "access_token",
        "operation_id",
        "resource",
        "base_version"
      ],
      "properties": {
        "operation": {
          "const": "update_demographics"
        },
        "patient": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "access_token": {
          "$ref": "#/$defs/accessToken"
        },
        "operation_id": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "base_version": {
          "type": "integer",
          "minimum": 0,
          "maximum": 9007199254740991
        },
        "resource": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "minLength": 1,
              "maxLength": 200
            }
          }
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "patient",
        "access_token",
        "operation_id",
        "resource"
      ],
      "properties": {
        "operation": {
          "const": "create_lab"
        },
        "patient": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "access_token": {
          "$ref": "#/$defs/accessToken"
        },
        "operation_id": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "resource": {
          "type": "object",
          "description": "Limited final laboratory Observation; see executable Host validation and wire profile. Not a full FHIR schema."
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "proof"
      ],
      "properties": {
        "operation": {
          "const": "rotate_requester"
        },
        "proof": {
          "$ref": "./trust.schema.json#/$defs/rotationProof"
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "grant_id"
      ],
      "properties": {
        "operation": {
          "const": "replace_token"
        },
        "grant_id": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "plan",
        "archive"
      ],
      "properties": {
        "operation": {
          "enum": [
            "migration_stage",
            "migration_stage_final"
          ]
        },
        "plan": {
          "$ref": "./migration.schema.json#/$defs/proof"
        },
        "archive": {
          "$ref": "./archive.schema.json#/$defs/archive"
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "transfer_id",
        "release"
      ],
      "properties": {
        "operation": {
          "const": "migration_activate"
        },
        "transfer_id": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "release": {
          "$ref": "./migration.schema.json#/$defs/proof"
        }
      }
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "transfer_id",
        "abort"
      ],
      "properties": {
        "operation": {
          "const": "migration_discard"
        },
        "transfer_id": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "abort": {
          "$ref": "./migration.schema.json#/$defs/proof"
        }
      }
    },
    {
      "$ref": "subscription.schema.json#/$defs/subscribe"
    },
    {
      "$ref": "subscription.schema.json#/$defs/control"
    },
    {
      "$ref": "clinical.schema.json"
    },
    {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "operation",
        "patient",
        "access_token"
      ],
      "properties": {
        "operation": {
          "const": "sync_snapshot"
        },
        "patient": {
          "$ref": "./exchange.schema.json#/$defs/identifier"
        },
        "access_token": {
          "$ref": "#/$defs/accessToken"
        },
        "limit": {
          "type": "integer",
          "minimum": 1,
          "maximum": 100
        },
        "page_cursor": {
          "type": [
            "string",
            "null"
          ],
          "maxLength": 12000
        }
      }
    }
  ],
  "$defs": {
    "accessToken": {
      "type": "string",
      "minLength": 1,
      "maxLength": 14000
    },
    "cursor": {
      "$ref": "./exchange.schema.json#/$defs/base64url",
      "minLength": 40,
      "maxLength": 12000
    },
    "decision": {
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "status",
            "grant_id",
            "access_token",
            "token_expires_at",
            "authorized_until",
            "scope"
          ],
          "properties": {
            "status": {
              "const": "granted"
            },
            "grant_id": {
              "$ref": "./exchange.schema.json#/$defs/identifier"
            },
            "access_token": {
              "$ref": "#/$defs/accessToken"
            },
            "token_expires_at": {
              "$ref": "#/$defs/time"
            },
            "authorized_until": {
              "$ref": "#/$defs/time"
            },
            "scope": {
              "type": "array",
              "minItems": 1,
              "maxItems": 6,
              "uniqueItems": true,
              "items": {
                "$ref": "./exchange.schema.json#/$defs/scope"
              }
            },
            "refresh_token": {
              "$ref": "./exchange.schema.json#/$defs/base64url",
              "minLength": 43,
              "maxLength": 43
            },
            "refresh_expires_at": {
              "$ref": "#/$defs/time"
            }
          },
          "dependentRequired": {
            "refresh_token": [
              "refresh_expires_at"
            ],
            "refresh_expires_at": [
              "refresh_token"
            ]
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "status",
            "request_id",
            "approval_required",
            "expires_at"
          ],
          "properties": {
            "status": {
              "const": "pending"
            },
            "request_id": {
              "$ref": "./exchange.schema.json#/$defs/identifier"
            },
            "expires_at": {
              "$ref": "#/$defs/time"
            },
            "approval_required": {
              "type": "array",
              "minItems": 1,
              "maxItems": 6,
              "uniqueItems": true,
              "items": {
                "$ref": "./exchange.schema.json#/$defs/scope"
              }
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "status",
            "reason"
          ],
          "properties": {
            "status": {
              "const": "denied"
            },
            "reason": {
              "type": "string"
            }
          }
        }
      ]
    },
    "time": {
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    }
  }
}