{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://mda.sno.dev/spec/v1.0/schemas/_defs/mda-keys.schema.json",
  "title": "MDA did:web public-keys document",
  "description": "Schema for the JSON document hosted at https://<domain>/.well-known/mda-keys.json used by the did:web signature verification path. See spec §09-5.",
  "type": "object",
  "required": ["keys"],
  "properties": {
    "keys": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": ["key-id", "algorithm", "public-key"],
        "properties": {
          "key-id": { "type": "string", "minLength": 1 },
          "algorithm": {
            "type": "string",
            "enum": ["ed25519", "ecdsa-p256", "rsa-pss-sha256"]
          },
          "public-key": {
            "type": "string",
            "description": "PEM-encoded public key, or base64 raw bytes for ed25519.",
            "minLength": 1
          },
          "not-before": { "type": "string", "format": "date-time" },
          "not-after": { "type": "string", "format": "date-time" }
        },
        "additionalProperties": false
      }
    }
  },
  "additionalProperties": false
}