{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://sec.hypermedia.au/schemas/license-envelope/v1.schema.json",
  "title": "CyberBench License Envelope v1 Schema",
  "description": "Validates a .cblicense file. The signature covers the exact payload bytes carried here — verification never re-serializes the payload, so canonical-JSON ambiguity cannot arise. payload and signature are STANDARD base64 (not base64url). The algorithm field is self-description only: a verifier takes the authoritative algorithm from its trusted key and rejects a mismatch. Normative requirements: https://sec.hypermedia.au/standards/license-envelope/v1",
  "type": "object",
  "required": ["schema", "keyId", "algorithm", "payload", "signature"],
  "properties": {
    "schema": { "type": "string", "const": "cyberbench/license-envelope/v1" },
    "keyId": { "type": "string", "minLength": 1 },
    "algorithm": { "type": "string", "enum": ["ml-dsa-87"] },
    "payload": { "type": "string", "contentEncoding": "base64" },
    "signature": { "type": "string", "contentEncoding": "base64" }
  }
}