{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://keys.vlayer.xyz/schema.json",
  "title": "vlayer notary keys",
  "description": "List of signing keys used by vlayer notaries. Describes the fields verifiers rely on; fields not described here may appear and must be ignored. See https://github.com/vlayer-xyz/notary-keys#readme.",
  "type": "object",
  "required": ["schemaVersion", "updatedAt", "fingerprintAlgorithm", "keys"],
  "properties": {
    "schemaVersion": {
      "const": 1,
      "description": "Bumped only for changes that affect the verifier rule."
    },
    "updatedAt": {
      "$ref": "#/$defs/timestamp",
      "description": "When this version of the list was published."
    },
    "fingerprintAlgorithm": {
      "const": "sha256 over compressed SEC1 public key, lowercase hex"
    },
    "keys": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/key" }
    }
  },
  "$defs": {
    "timestamp": {
      "type": "string",
      "description": "RFC 3339 UTC timestamp with second precision and a literal Z.",
      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"
    },
    "key": {
      "type": "object",
      "required": ["fingerprint", "publicKeyPem", "curve", "validFrom", "validUntil"],
      "properties": {
        "fingerprint": {
          "type": "string",
          "description": "SHA-256 of the compressed SEC1 point, lowercase hex.",
          "pattern": "^[0-9a-f]{64}$"
        },
        "publicKeyPem": {
          "type": "string",
          "description": "Compressed-point SubjectPublicKeyInfo PEM, byte-identical to the notary's GET /info publicKey.",
          "pattern": "^-----BEGIN PUBLIC KEY-----\\n([A-Za-z0-9+/=]+\\n)+-----END PUBLIC KEY-----\\n$"
        },
        "curve": {
          "enum": ["secp256k1", "secp256r1"],
          "description": "Curve of the key, SEC 2 name."
        },
        "validFrom": {
          "$ref": "#/$defs/timestamp",
          "description": "Start of the window in which the key signed proofs (inclusive). Immutable once it has passed."
        },
        "validUntil": {
          "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/timestamp" }],
          "description": "End of the window (exclusive), or null while no end is set. Accept a proof only if validFrom <= tlsTimestamp < validUntil."
        },
        "meta": {
          "type": "object",
          "description": "Informational fields only; verifiers must not base decisions on them.",
          "properties": {
            "notaryUrls": {
              "type": "array",
              "description": "Origins of the notaries signing with this key; GET <origin>/info serves the key.",
              "minItems": 1,
              "uniqueItems": true,
              "items": { "type": "string", "pattern": "^https://[A-Za-z0-9.-]+(:[0-9]+)?$" }
            }
          }
        }
      }
    }
  }
}