# description
The `/.well-known/dfos-app.json` application description document for Sign In With DFOS — served over https from the application's own origin, where the domain vouches for itself. STRUCTURAL VALIDATION ONLY: this schema checks shape, not truth. It cannot verify that `identity_chain` folds into a valid identity chain, that `client_did` equals the DID derived from the chain's genesis operation, or that each carried operation respects the protocol's per-operation size cap — those are consumption-time checks defined by the SIWD specification (https://protocol.dfos.com/siwd), which remains normative. A document this schema accepts can still be invalid at consumption. The member set is closed (`additionalProperties: false`), making the spec's closed-registry rule mechanically checkable: a consumer MAY treat a document carrying unrecognized members as invalid.

# properties.name.description
Display name — the application's own claim about itself, and optional: nothing in the spec vouches for it, the serving domain remains the phishing-relevant binding, and a consumer with no name to render leads with the domain it already verified. Present-but-empty is malformed, not absent.

# properties.redirect_uris.description
Exact-match allowlist of the redirect targets this origin will accept callbacks at. Exact means exact: scheme, host, path, trailing slash included.

# properties.client_did.description
The application's own DFOS DID. Optional at scope=identity; required whenever a credential-returning scope would name this application as audience. When `identity_chain` is present, this MUST equal the DID derived from the chain's genesis operation — a cryptographic check this schema cannot perform.

# properties.identity_chain.description
The application identity's full ordered operation log, genesis first, carried as bare identity-operation JWS strings — never a fragment or a suffix. Capped at 100 operations (the SIWD carriage cap). Whether the strings fold into a valid chain deriving `client_did` is a consumption-time cryptographic check, not a structural one.