# ADR-0009: Invite capability format `fj1.`

- **Status:** Accepted
- **Date:** 2026-07-30

## Context

Users need a single copy-pasteable secret to join private worlds, similar to peardock `pd1.` invites, without accounts or central invite servers.

## Decision

Invite envelope:

```text
fj1.<encoded-payload>
```

Payload (logical) includes protocol version, type (`private-world` | `mesh`), `worldKey`, shared `cap`, optional name/mcVersion/expires.

Phase 2 encoding: JSON → z32 (debug-friendly). May migrate to compact-encoding later (Q13).

Bearer capability model: possession grants join attempt; host enforces proof and may rotate keys.

## Consequences

### Positive

- Offline-friendly, self-contained
- Familiar UX (paste string / QR later)

### Negative / tradeoffs

- Leak = unauthorized join until rotation
- Long strings if JSON grows

### Follow-ups

- [ ] Phase 2 mint/parse library
- [ ] Phase 5 TTL/revoke/roles