{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/delegated-authority-v1.json",
  "title": "Delegated Authority v1, delegated authority chain link",
  "description": "Canonical schema for one link of the Hive delegated authority chain, canonical type authority.delegation. Binds an issuer, a subject, a scope, constraints, a validity window, a parent reference, attenuation rules, a maximum depth, and a revocation snapshot binding into one Ed25519 signature over a recomputable payload_sha256. A chain is a sequence of these links from a root grant to a leaf grant. Each link attests that its own scope and constraints do not exceed its parent's, and that it was issued inside its own validity window. It does not attest that any action later taken under this authority was itself proper.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_authority\\.delegation_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$",
      "description": "The signing key of the issuer of this delegation link. Must match signed_body.issuer."
    },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "delegation_id",
        "issuer",
        "subject",
        "scope",
        "validity",
        "depth",
        "max_depth",
        "revocation_snapshot",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "authority.delegation" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "delegation_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "issuer": {
          "type": "string",
          "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$",
          "description": "The identity granting this delegation. For the root link this is the ultimate authority. For a non root link this must equal parent.subject."
        },
        "subject": {
          "type": "string",
          "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$",
          "description": "The identity receiving this delegation."
        },
        "scope": {
          "type": "array",
          "minItems": 1,
          "maxItems": 256,
          "description": "The set of permission strings this link grants. A non root link's scope must be a subset of its parent's scope, never a superset. Attenuation only narrows.",
          "items": { "type": "string", "minLength": 1, "maxLength": 256 }
        },
        "constraints": {
          "type": "object",
          "description": "Optional numeric or enumerable limits, for example a spend cap. A non root link may only tighten a constraint present on its parent, never loosen it, and may not introduce a constraint absent from the parent to circumvent a narrower named limit.",
          "additionalProperties": false,
          "properties": {
            "max_amount": { "type": "number", "minimum": 0 },
            "currency": { "type": "string", "minLength": 1, "maxLength": 16 },
            "allowed_actions": {
              "type": "array",
              "minItems": 0,
              "maxItems": 256,
              "items": { "type": "string", "minLength": 1, "maxLength": 128 }
            }
          }
        },
        "validity": {
          "type": "object",
          "required": ["not_before", "not_after"],
          "additionalProperties": false,
          "properties": {
            "not_before": {
              "type": "string",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
            },
            "not_after": {
              "type": "string",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
            }
          }
        },
        "parent": {
          "type": "object",
          "description": "Absent only on the root link of a chain. A non root link must carry this, naming the exact parent receipt it attenuates.",
          "required": ["receipt_id", "payload_sha256"],
          "additionalProperties": false,
          "properties": {
            "receipt_id": { "type": "string", "minLength": 1, "maxLength": 300 },
            "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
          }
        },
        "depth": {
          "type": "integer",
          "minimum": 0,
          "description": "0 for the root link. Each child's depth is its parent's depth plus one."
        },
        "max_depth": {
          "type": "integer",
          "minimum": 0,
          "maximum": 64,
          "description": "The maximum chain depth this delegation permits below itself, fixed at the root and non increasing at every subsequent link."
        },
        "revocation_snapshot": {
          "type": "object",
          "description": "Binds this link to the state of the revocation registry at issuance, so a verifier can tell whether a later revocation applied to a chain the issuer already knew was intact.",
          "required": ["registry_id", "registry_sha256", "checked_at"],
          "additionalProperties": false,
          "properties": {
            "registry_id": { "type": "string", "minLength": 1, "maxLength": 256 },
            "registry_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$",
              "description": "Digest of the revocation registry contents at checked_at."
            },
            "checked_at": {
              "type": "string",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
            },
            "revoked_delegation_ids": {
              "type": "array",
              "minItems": 0,
              "maxItems": 4096,
              "items": { "type": "string", "minLength": 1, "maxLength": 256 }
            }
          }
        },
        "boundary": {
          "type": "string",
          "const": "This receipt attests that this delegation link's scope, constraints, validity window, and depth do not exceed what its named parent link grants, and that its own issuer signed it inside its own validity window. It does not attest that any action later taken under this authority was itself proper. Chain verification checks revocation only against revocation_snapshot.revoked_delegation_ids as recorded on the links actually supplied in the chain; it does not attest that those snapshots are current at the time a chain is checked, and it cannot see a revocation issued after the snapshot's checked_at or a revocation recorded only in a registry the caller did not supply as part of the chain."
        }
      }
    }
  }
}