{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$defs": {
    "Grant": {
      "properties": {
        "principal": {
          "type": "string"
        },
        "kind": {
          "type": "string"
        },
        "path": {
          "$ref": "#/$defs/Path"
        },
        "valid_until": {
          "type": "string"
        },
        "issuer": {
          "type": "string"
        },
        "signature": {
          "type": "string",
          "description": "base64 of the 64 Ed25519 signature bytes over the fact"
        }
      },
      "type": "object",
      "required": [
        "principal",
        "kind",
        "path",
        "valid_until",
        "issuer",
        "signature"
      ],
      "description": "Grant is what a principal carries to prove it may act: a kind on a subtree until an instant, issued by another principal (the root or a delegate)."
    },
    "Path": {
      "items": {
        "type": "string"
      },
      "type": "array",
      "description": "Path is a location in the world: labels from a root organizer down, relative to the world."
    },
    "Proof": {
      "properties": {
        "principal": {
          "type": "string"
        },
        "nonce": {
          "type": "string"
        },
        "timestamp": {
          "type": "string"
        },
        "audience": {
          "type": "string"
        },
        "signature": {
          "type": "string",
          "description": "base64 of the 64 Ed25519 signature bytes"
        }
      },
      "type": "object",
      "required": [
        "principal",
        "nonce",
        "timestamp",
        "audience",
        "signature"
      ],
      "description": "Proof authenticates one request attempt: the principal, a fresh nonce, the instant, the audience the proof is meant for, and the signature over the signing record."
    }
  },
  "properties": {
    "proof": {
      "$ref": "#/$defs/Proof"
    },
    "grants": {
      "items": {
        "$ref": "#/$defs/Grant"
      },
      "type": "array"
    }
  },
  "type": "object",
  "required": [
    "proof",
    "grants"
  ],
  "title": "Carriage",
  "description": "Carriage is the proof and the grants a request carries."
}