{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/mandate-crossreference-v1.json",
  "title": "Mandate Cross Reference Receipt, v1",
  "description": "Canonical schema for the Hive mandate cross reference receipt, canonical type mandate.crossreference.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": { "type": "string", "pattern": "^r_mandate\\.crossreference_[0-9]{10,}_[0-9a-f]{12}$" },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "mandate_crossreference",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "mandate.crossreference" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "mandate_crossreference": {
          "type": "object",
          "required": [
            "crossreference_id",
            "recorded_at",
            "cross_reference_field_name",
            "window_salt_committed_at",
            "delegation_layer_commitment",
            "merchant_side",
            "payment_side",
            "artifact_relation",
            "equality_outcome",
            "precedence_class",
            "observer_role",
            "evidence_access_class",
            "salt_commitment"
          ],
          "additionalProperties": false,
          "properties": {
            "crossreference_id": { "type": "string", "pattern": "^mx_[0-9a-f]{16,64}$" },
            "recorded_at": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$" },
            "cross_reference_field_name": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" },
            "window_salt_committed_at": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$" },
            "delegation_layer_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "merchant_side": {
              "type": "object",
              "required": [
                "attestor_role",
                "attestor_key_id",
                "attestor_algorithm",
                "attestor_sig_b64u",
                "artifact_class",
                "artifact_commitment",
                "cross_reference_value_commitment",
                "presented_at"
              ],
              "additionalProperties": false,
              "properties": {
                "attestor_role": { "type": "string", "const": "merchant_side_attestor" },
                "attestor_key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
                "attestor_algorithm": { "type": "string", "const": "ed25519" },
                "attestor_sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
                "artifact_class": { "type": "string", "enum": ["merchant_credential", "checkout_mandate", "cart_mandate", "merchant_dispute_object"] },
                "artifact_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
                "cross_reference_value_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
                "presented_at": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$" }
              }
            },
            "payment_side": {
              "type": "object",
              "required": [
                "attestor_role",
                "attestor_key_id",
                "attestor_algorithm",
                "attestor_sig_b64u",
                "artifact_class",
                "artifact_commitment",
                "cross_reference_value_commitment",
                "presented_at"
              ],
              "additionalProperties": false,
              "properties": {
                "attestor_role": { "type": "string", "const": "payment_side_attestor" },
                "attestor_key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
                "attestor_algorithm": { "type": "string", "const": "ed25519" },
                "attestor_sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
                "artifact_class": { "type": "string", "enum": ["payment_network_credential", "payment_mandate", "network_token_record", "payment_dispute_object"] },
                "artifact_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
                "cross_reference_value_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
                "presented_at": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$" }
              }
            },
            "artifact_relation": { "type": "string", "enum": ["distinct_artifact_classes", "same_artifact_class"] },
            "equality_outcome": { "type": "string", "enum": ["cross_reference_match", "cross_reference_mismatch"] },
            "precedence_class": { "type": "string", "enum": ["salt_committed_before_both_artifacts", "salt_committed_after_an_artifact"] },
            "observer_role": { "type": "string", "const": "non_party_joiner" },
            "evidence_access_class": { "type": "string", "enum": ["confidential_independent", "issuer_only", "public_commitment_only"] },
            "salt_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
          }
        },
        "boundary": {
          "type": "string",
          "minLength": 1,
          "const": "This receipt attests only that two committed artifacts, each attested by a distinct registered attestor key, each declaring one cross reference field name and one keyed digest of that field value under a window salt committed before either artifact was presented, met or failed the declared equality relation, and that the equality outcome was recomputed by this service from the two commitments rather than supplied by the caller. It does not attest that either artifact is genuine, complete, or unaltered before commitment. It does not attest that either attestor is entitled to hold the artifact it committed. It does not attest that the transaction occurred, was authorised, settled, or was proper. It does not attest that the cross reference field is the right field for any purpose. A mismatch outcome does not mean that either side is wrong, and this receipt allocates no fault. It discloses neither artifact, neither field value, nor the salt."
        }
      }
    }
  }
}