{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://mandateshield.com/schemas/cryptographic-evidence.json","title":"MandateShield Cryptographic Evidence","type":"object","required":["format","public_key"],"properties":{"format":{"type":"string","enum":["jws","sd-jwt","http-message-signature"]},"compact":{"type":"string","description":"Compact JWS or SD-JWT serialization."},"public_key":{"type":"object","description":"Public JSON Web Key used for signature verification. Production callers must pin this key or resolve it through their protocol trust registry."},"expected_audience":{"type":"string"},"expected_nonce":{"type":"string"},"expected_authority":{"type":"string"},"algorithm":{"type":"string","enum":["ES256","EdDSA","RS256","PS256"]},"signature":{"type":"string","description":"Base64url signature for TAP HTTP message evidence."},"signature_input":{"type":"object","description":"RFC 9421 signature parameters. The verifier reconstructs @signature-params in the documented field order.","properties":{"covered_components":{"type":"array","items":{"type":"string"}},"nonce":{"type":"string"},"created":{"type":"integer"},"expires":{"type":"integer"},"keyid":{"type":"string"},"tag":{"type":"string"}}},"components":{"type":"object"}},"allOf":[{"if":{"properties":{"format":{"enum":["jws","sd-jwt"]}}},"then":{"required":["compact"]}},{"if":{"properties":{"format":{"const":"http-message-signature"}}},"then":{"required":["algorithm","signature","signature_input","components"]}}]}