{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://tune.toys/schemas/platform/signed-envelope.schema.json",
  "title": "SignedEnvelope",
  "description": "Ed25519 envelope for update manifests and license certificates. The signature covers a purpose-specific domain prefix followed by the exact payload bytes; verifiers check it before parsing and never re-canonicalize.",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "payload": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1398104,
      "pattern": "^[A-Za-z0-9_-]+$",
      "description": "base64url of the exact canonical payload bytes (at most 1 MiB decoded)."
    },
    "alg": {
      "const": "ed25519"
    },
    "keyId": {
      "$ref": "common.schema.json#/$defs/EntityId"
    },
    "sig": {
      "type": "string",
      "minLength": 86,
      "maxLength": 86,
      "pattern": "^[A-Za-z0-9_-]{86}$",
      "description": "base64url Ed25519 signature without padding."
    }
  },
  "required": ["payload", "alg", "keyId", "sig"]
}