{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://autoagentprotocol.org/v3.2/schemas/poppy-session-jwt.schema.json",
  "title": "PoppySessionJWT",
  "description": "The JWT in the Poppy-Session header, as its decoded header and payload (spec 5.2). The Personal Agent signs one for each request with a delegated key: kid is the delegated key's JWK thumbprint, and poppy_dlg is the delegation that vouches for it (delegation.schema.json). The Company verifies it as spec 5.3 describes. agent_id is optional, and ath is present only when the request carries an access token. The header and payload are also available on their own as session-jwt.schema.json#/$defs/header and #/$defs/payload.",
  "type": "object",
  "required": [
    "header",
    "payload"
  ],
  "properties": {
    "header": {
      "$ref": "#/$defs/header"
    },
    "payload": {
      "$ref": "#/$defs/payload"
    }
  },
  "$defs": {
    "header": {
      "type": "object",
      "required": [
        "typ",
        "alg",
        "kid",
        "poppy_dlg"
      ],
      "properties": {
        "typ": {
          "const": "poppy-session+jwt"
        },
        "alg": {
          "const": "ES256"
        },
        "kid": {
          "type": "string",
          "pattern": "^[A-Za-z0-9_-]{43}$"
        },
        "poppy_dlg": {
          "type": "string",
          "minLength": 1,
          "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$"
        }
      }
    },
    "payload": {
      "type": "object",
      "required": [
        "iss",
        "aud",
        "sid",
        "sub",
        "htm",
        "htu",
        "iat",
        "jti"
      ],
      "properties": {
        "iss": {
          "type": "string",
          "pattern": "^[Hh][Tt][Tt][Pp][Ss]://[^/?#@\\\\\\s]+(?:[/?#][^\\\\\\s]*)?$",
          "format": "uri"
        },
        "aud": {
          "type": "string",
          "pattern": "^[Hh][Tt][Tt][Pp][Ss]://[^/?#@\\\\\\s]+(?:[/?#][^\\\\\\s]*)?$",
          "format": "uri"
        },
        "sid": {
          "type": "string",
          "pattern": "^[A-Za-z0-9_-]{1,256}$"
        },
        "sub": {
          "type": "string",
          "minLength": 1
        },
        "agent_id": {
          "type": "string",
          "minLength": 1
        },
        "htm": {
          "type": "string",
          "pattern": "^[A-Z]+$"
        },
        "htu": {
          "type": "string",
          "format": "uri",
          "pattern": "^[Hh][Tt][Tt][Pp][Ss]://[^/?#@\\\\\\s]+(?:/[^?#\\\\\\s]*)?$"
        },
        "iat": {
          "type": "number",
          "minimum": 0
        },
        "jti": {
          "type": "string",
          "minLength": 1
        },
        "ath": {
          "type": "string",
          "pattern": "^[A-Za-z0-9_-]{43}$"
        }
      }
    }
  },
  "$comment": "Adapted from personal-agent-protocol at 6fb46d381ac1b94265795132af13848ec442b6f6 (Apache-2.0); unmodified independent fixtures and hashes in tests/upstream/poppy/published-0.3. JSON Schema does not verify cryptography or runtime requirements."
}