{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/cross-acceptor-v1.json",
  "title": "Cross Acceptor Mandate Receipt, v1",
  "description": "Canonical schema for the Hive cross acceptor mandate receipt, canonical type mandate.crossacceptor.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": { "type": "string", "pattern": "^r_mandate\\.crossacceptor_[0-9]{10,}_[0-9a-f]{12}$" },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "cross_acceptor_window",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "mandate.crossacceptor" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "cross_acceptor_window": {
          "type": "object",
          "required": [
            "window_id",
            "window_start",
            "window_end",
            "window_index",
            "aggregation_key",
            "currency",
            "pseudonym_algorithm",
            "pseudonym_scope",
            "limit_commitment",
            "aggregated_notional_commitment",
            "checked_action_count_commitment",
            "salt_commitment",
            "contribution_set_digest",
            "coverage_set_digest",
            "distinct_acceptor_count",
            "reporting_acceptor_count",
            "expected_acceptor_count",
            "dispersion_class",
            "coverage_class",
            "evidence_access_class",
            "cumulative_relation",
            "prior_window",
            "closed_by"
          ],
          "additionalProperties": false,
          "properties": {
            "window_id": { "type": "string", "pattern": "^cw_[0-9a-f]{16,64}$" },
            "window_start": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$" },
            "window_end": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$" },
            "window_index": { "type": "integer", "minimum": 0, "maximum": 2147483647 },
            "aggregation_key": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "currency": { "type": "string", "pattern": "^[A-Z]{3}$" },
            "pseudonym_algorithm": { "type": "string", "const": "hmac_sha256_v1" },
            "pseudonym_scope": { "type": "string", "const": "per_authority_per_window" },
            "limit_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "aggregated_notional_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "checked_action_count_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "salt_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "contribution_set_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "coverage_set_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "distinct_acceptor_count": { "type": "integer", "minimum": 0, "maximum": 100000 },
            "reporting_acceptor_count": { "type": "integer", "minimum": 0, "maximum": 100000 },
            "expected_acceptor_count": { "type": "integer", "minimum": 1, "maximum": 100000 },
            "dispersion_class": { "type": "string", "enum": ["no_checked_actions", "concentrated", "moderately_distributed", "distributed", "highly_distributed", "indeterminate"] },
            "coverage_class": { "type": "string", "enum": ["complete", "declared_subset", "undeclared_subset"] },
            "evidence_access_class": { "type": "string", "enum": ["confidential_independent", "issuer_only", "public_commitment_only"] },
            "cumulative_relation": { "type": "string", "enum": ["within_constraint", "exceeds_constraint", "indeterminate"] },
            "prior_window": {
              "type": ["object", "null"],
              "required": ["receipt_id", "payload_sha256", "window_index"],
              "additionalProperties": false,
              "properties": {
                "receipt_id": { "type": "string", "pattern": "^r_mandate\\.crossacceptor_[0-9]{10,}_[0-9a-f]{12}$" },
                "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
                "window_index": { "type": "integer", "minimum": 0, "maximum": 2147483647 }
              }
            },
            "closed_by": { "type": "string", "enum": ["schedule", "constraint_reached"] }
          }
        },
        "boundary": {
          "type": "string",
          "minLength": 1,
          "const": "This receipt attests only that the issuing service, for the declared authority grouping and accounting window, receives the contribution and coverage evidence it describes, verifies the stated keyed pseudonym derivations under a committed window salt, recomputes the stated distinct acceptor count, dispersion class, commitments, cumulative relation, and coverage class, and signs that limited result. It does not attest that every action under the authority reaches the issuing service, that every acceptor reports, that a nonreporting acceptor is inactive, that the declared expected acceptor population is complete, that any acceptors are legally or institutionally unrelated, or that any pseudonym reveals an acceptor identity. It does not disclose the window salt, acceptor identities, contribution multiset, checked action count, exact dispersion ratio, cumulative constraint, or accumulated amount. It is not an authorization control and does not prevent, block, reverse, delay, ratify, or validate an underlying action. It does not decide whether an action, authority, constraint, report, acceptor, or actor is valid, authorized, proper, compliant, enforceable, or lawful. It does not deny, resolve, adjudicate, or affect any dispute or right."
        }
      }
    }
  }
}