{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://emissar.ai/specs/schemas/mandate-v0.1.schema.json",
  "title": "Emissar Mandate v0.1: processed mandate payload",
  "description": "Emissar Mandate v0.1, a draft for comment (https://emissar.ai/specs/mandate/v0.1). The root schema validates the Processed SD-JWT Payload of an Emissar Mandate (RFC 9901 section 7.1): the issuer-signed claims after the presented Disclosures are applied and _sd, _sd_alg and undisclosed array placeholders are removed. The $defs describe the other objects in https://emissar.ai/specs/mandate/v0.1: the JOSE headers, the KB-JWT payload and its op claim, the A2A extension metadata entries, the AgentExtension params and the Status List Token payload. Schema validation does not replace the verification algorithm in section 9 of the specification.",
  "type": "object",
  "required": ["iss", "sub", "aud", "iat", "exp", "jti", "cnf", "status", "authorization_details"],
  "properties": {
    "iss": { "$ref": "#/$defs/httpsUri", "description": "Issuer identifier. Resolved to keys only through the verifier's trust configuration." },
    "sub": { "type": "string", "minLength": 1, "maxLength": 255, "description": "Principal identifier, unique within the issuer. SHOULD be pairwise per verifier." },
    "aud": {
      "description": "The verifier or verifiers that may accept this mandate. Cumulative limits require a single audience.",
      "oneOf": [
        { "$ref": "#/$defs/httpsUri" },
        { "type": "array", "items": { "$ref": "#/$defs/httpsUri" }, "minItems": 1, "uniqueItems": true }
      ]
    },
    "iat": { "$ref": "#/$defs/numericDate" },
    "nbf": { "$ref": "#/$defs/numericDate" },
    "exp": { "$ref": "#/$defs/numericDate" },
    "jti": { "type": "string", "minLength": 16, "maxLength": 128, "description": "Unique mandate identifier within the issuer; at least 128 bits of entropy." },
    "cnf": {
      "type": "object",
      "required": ["jkt"],
      "properties": {
        "jkt": { "$ref": "#/$defs/sha256B64u", "description": "RFC 9449 section 6.1: base64url SHA-256 JWK Thumbprint (RFC 7638) of the agent's public key." }
      }
    },
    "act": {
      "type": "object",
      "required": ["sub"],
      "properties": { "sub": { "type": "string", "format": "uri", "description": "Identifier of the acting agent, such as its Agent Card URL. Informational; the binding is cnf." } },
      "description": "RFC 8693 section 4.1 actor claim. Nested act (delegation history) is not defined in v0.1."
    },
    "status": { "$ref": "#/$defs/statusClaim" },
    "principal": {
      "type": "object",
      "required": ["type"],
      "properties": {
        "type": { "enum": ["person", "organization"] },
        "name": { "type": "string", "minLength": 1 },
        "account": { "type": "string", "minLength": 1, "description": "The principal's account reference at the verifier. Selectively disclosable." }
      },
      "additionalProperties": false
    },
    "authorization_details": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/authorizationDetail" }
    }
  },
  "not": { "anyOf": [{ "required": ["_sd"] }, { "required": ["_sd_alg"] }] },
  "$defs": {
    "httpsUri": { "type": "string", "format": "uri", "pattern": "^https://[^\\s]+$", "maxLength": 2048 },
    "numericDate": { "type": "integer", "minimum": 0, "description": "RFC 7519 NumericDate, whole seconds." },
    "sha256B64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43}$" },
    "amount": {
      "type": "object",
      "required": ["amount", "currency"],
      "properties": {
        "amount": { "type": "integer", "minimum": 0, "maximum": 9007199254740991, "description": "Minor units of the currency, as in AP2's Amount type." },
        "currency": { "type": "string", "pattern": "^[A-Z]{3}$", "description": "ISO 4217 alphabetic code." }
      },
      "additionalProperties": false
    },
    "limits": {
      "type": "object",
      "minProperties": 1,
      "properties": {
        "max_amount": { "$ref": "#/$defs/amount", "description": "Largest amount for one operation." },
        "total_amount": { "$ref": "#/$defs/amount", "description": "Largest sum over all operations under this detail." },
        "max_uses": { "type": "integer", "minimum": 1, "description": "Most operations under this detail." },
        "rate": {
          "type": "object",
          "required": ["count", "window"],
          "properties": {
            "count": { "type": "integer", "minimum": 1 },
            "window": { "type": "integer", "minimum": 1, "description": "Sliding window in seconds." }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    },
    "authorizationDetail": {
      "type": "object",
      "description": "RFC 9396 authorization details object, profiled. Unknown members make the detail unusable (fail closed).",
      "required": ["type", "actions"],
      "properties": {
        "type": { "type": "string", "minLength": 1, "description": "Defined by the verifier (or a published profile); a URI it controls is RECOMMENDED." },
        "actions": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true },
        "identifier": { "type": "string", "minLength": 1 },
        "limits": { "$ref": "#/$defs/limits" }
      },
      "additionalProperties": false
    },
    "statusClaim": {
      "type": "object",
      "required": ["status_list"],
      "properties": {
        "status_list": {
          "type": "object",
          "required": ["idx", "uri"],
          "properties": {
            "idx": { "type": "integer", "minimum": 0 },
            "uri": { "$ref": "#/$defs/httpsUri" }
          }
        }
      }
    },
    "publicEcJwk": {
      "type": "object",
      "required": ["kty", "crv", "x", "y"],
      "properties": {
        "kty": { "const": "EC" },
        "crv": { "const": "P-256" },
        "x": { "$ref": "#/$defs/sha256B64u" },
        "y": { "$ref": "#/$defs/sha256B64u" }
      },
      "not": { "required": ["d"] }
    },
    "issuerJwtHeader": {
      "type": "object",
      "required": ["alg", "typ", "kid"],
      "properties": {
        "alg": { "enum": ["ES256"] },
        "typ": { "const": "vnd.emissar.mandate+sd-jwt" },
        "kid": { "type": "string", "minLength": 1 }
      },
      "not": { "anyOf": [{ "required": ["jku"] }, { "required": ["jwk"] }, { "required": ["x5u"] }, { "required": ["crit"] }] }
    },
    "kbJwtHeader": {
      "type": "object",
      "required": ["typ", "alg", "jwk"],
      "properties": {
        "typ": { "const": "kb+jwt" },
        "alg": { "enum": ["ES256"] },
        "jwk": { "$ref": "#/$defs/publicEcJwk" }
      }
    },
    "operation": {
      "type": "object",
      "description": "The op claim: the single operation this presentation authorizes, signed by the agent key.",
      "required": ["type", "action"],
      "properties": {
        "type": { "type": "string", "minLength": 1 },
        "action": { "type": "string", "minLength": 1 },
        "identifier": { "type": "string", "minLength": 1 },
        "amount": { "$ref": "#/$defs/amount" }
      },
      "additionalProperties": false
    },
    "kbJwtPayload": {
      "type": "object",
      "required": ["iat", "aud", "nonce", "sd_hash", "op"],
      "properties": {
        "iat": { "$ref": "#/$defs/numericDate" },
        "aud": { "$ref": "#/$defs/httpsUri" },
        "nonce": { "type": "string", "minLength": 1, "maxLength": 256 },
        "sd_hash": { "$ref": "#/$defs/sha256B64u" },
        "op": { "$ref": "#/$defs/operation" }
      }
    },
    "presentationEnvelope": {
      "type": "object",
      "description": "Message.metadata[\"https://emissar.ai/ext/mandate/v1\"] sent by the client agent.",
      "required": ["presentation"],
      "properties": {
        "presentation": {
          "type": "string",
          "maxLength": 16384,
          "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+~([A-Za-z0-9_-]+~)*[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$"
        }
      },
      "additionalProperties": false
    },
    "errorCode": {
      "enum": [
        "mandate_required", "mandate_invalid", "proof_invalid", "mandate_expired", "mandate_not_yet_valid",
        "mandate_revoked", "mandate_suspended", "insufficient_scope", "unsupported_detail", "limit_exceeded",
        "status_unavailable"
      ]
    },
    "challengeEnvelope": {
      "type": "object",
      "description": "TaskStatus.message.metadata[\"https://emissar.ai/ext/mandate/v1\"] sent by the verifier. With TASK_STATE_AUTH_REQUIRED the challenge member is REQUIRED; with TASK_STATE_REJECTED it is absent.",
      "required": ["error"],
      "properties": {
        "error": { "$ref": "#/$defs/errorCode" },
        "errorDescription": { "type": "string", "maxLength": 512 },
        "challenge": {
          "type": "object",
          "required": ["nonce", "audience", "expiresAt"],
          "properties": {
            "nonce": { "type": "string", "minLength": 22, "maxLength": 256 },
            "audience": { "$ref": "#/$defs/httpsUri" },
            "expiresAt": { "type": "string", "format": "date-time" }
          },
          "additionalProperties": false
        },
        "authorizationDetails": { "type": "array", "items": { "$ref": "#/$defs/authorizationDetail" }, "minItems": 1 },
        "acceptedIssuers": { "type": "array", "items": { "$ref": "#/$defs/httpsUri" }, "uniqueItems": true }
      },
      "additionalProperties": false
    },
    "resultEnvelope": {
      "type": "object",
      "description": "Artifact.metadata (or final status message metadata) under the extension URI after an accepted presentation.",
      "required": ["result", "iss", "jti", "sdHash"],
      "properties": {
        "result": { "const": "accepted" },
        "iss": { "$ref": "#/$defs/httpsUri" },
        "jti": { "type": "string", "minLength": 16, "maxLength": 128 },
        "sdHash": { "$ref": "#/$defs/sha256B64u" },
        "jkt": { "$ref": "#/$defs/sha256B64u" }
      },
      "additionalProperties": false
    },
    "cardParams": {
      "type": "object",
      "description": "AgentExtension.params for https://emissar.ai/ext/mandate/v1 in the verifier's Agent Card.",
      "required": ["audience", "algorithms"],
      "properties": {
        "audience": { "$ref": "#/$defs/httpsUri" },
        "algorithms": { "type": "array", "items": { "enum": ["ES256"] }, "minItems": 1, "uniqueItems": true },
        "types": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
        "acceptedIssuers": { "type": "array", "items": { "$ref": "#/$defs/httpsUri" }, "uniqueItems": true }
      },
      "additionalProperties": false
    },
    "statusListTokenPayload": {
      "type": "object",
      "description": "Token Status List (draft-ietf-oauth-status-list-21) section 5.1 claims, as profiled here.",
      "required": ["sub", "iat", "status_list"],
      "properties": {
        "sub": { "$ref": "#/$defs/httpsUri" },
        "iat": { "$ref": "#/$defs/numericDate" },
        "exp": { "$ref": "#/$defs/numericDate" },
        "ttl": { "type": "integer", "minimum": 1 },
        "status_list": {
          "type": "object",
          "required": ["bits", "lst"],
          "properties": {
            "bits": { "enum": [1, 2, 4, 8] },
            "lst": { "type": "string", "pattern": "^[A-Za-z0-9_-]+$" },
            "aggregation_uri": { "type": "string", "format": "uri" }
          }
        }
      }
    }
  }
}