47 lines
1.1 KiB
Markdown
47 lines
1.1 KiB
Markdown
# ADR-0009: Invite capability format `fj1.`
|
|
|
|
- **Status:** Accepted
|
|
- **Date:** 2026-07-30
|
|
|
|
## Context
|
|
|
|
Users need a single copy-pasteable secret to join private worlds, similar to peardock `pd1.` invites, without accounts or central invite servers.
|
|
|
|
## Decision
|
|
|
|
Invite envelope:
|
|
|
|
```text
|
|
fj1.<encoded-payload>
|
|
```
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
JSON["JSON payload<br/>worldKey cap meta"] --> UTF[UTF-8]
|
|
UTF --> Z32[z32 encode]
|
|
Z32 --> Str["fj1. string"]
|
|
```
|
|
|
|
Payload (logical) includes protocol version, type (`private-world` | `mesh`), `worldKey`, shared `cap`, optional name/mcVersion/expires.
|
|
|
|
Phase 2 encoding: JSON → z32 (debug-friendly). May migrate to compact-encoding later (Q13).
|
|
|
|
Bearer capability model: possession grants join attempt; host enforces proof and may rotate keys.
|
|
|
|
## Consequences
|
|
|
|
### Positive
|
|
|
|
- Offline-friendly, self-contained
|
|
- Familiar UX (paste string / QR later)
|
|
|
|
### Negative / tradeoffs
|
|
|
|
- Leak = unauthorized join until rotation
|
|
- Long strings if JSON grows
|
|
|
|
### Follow-ups
|
|
|
|
- [ ] Phase 2 mint/parse library
|
|
- [ ] Phase 5 TTL/revoke/roles
|