openvibers/openvibe.contracts Commits
Add the Locker envelope contracts and the key directory API (#302)
Changes
@@@ -63,3 +63,9 @@ description = "Sample model_key in ai.model-list@1 fixture: a model name placehocondition = "AND"paths = ['''^fixtures/ai\.model-list/valid/two-models\.json$''']regexes = ['''^llama_3\.1_8b_instruct$''']++++[[allowlists]]++description = "Sample recipient key thumbprint in the locker fixtures: the base64url SHA-256 of made-up bytes, showing the shape of the field, not a secret"++condition = "AND"++paths = ['''^fixtures/locker\..*\.json$''', '''^fixtures/share/valid/locked\.json$''']++regexes = ['''^AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8$''']@@@ -1,5 +1,13 @@# Changelog++## 0.292.0 — 2026-11-06++++- Add `locker.envelope@1`: the header of a sealed item — the suite (AES-256-GCM), the chunk size (1 MiB), the padded size, the counter nonce base, the lock kind and one key slot per way in. The content key is never in the header; it is wrapped in a people slot (ECDH P-256 + HKDF-SHA-256, bound to the recipient's key by its RFC 7638 thumbprint), a password slot (PBKDF2-SHA-256, 600000 iterations, the parameters in the header so they can be raised, and bounded above at 10000000 so a hostile header cannot freeze a reader) or a link slot (empty: the key travels in the link's fragment).++- The padded size is padded with Padmé (PoPETs 2019): at most about twelve per cent over the real size, never below 256 bytes, and it leaks O(log log n) bits. Every chunk but the last is a whole chunk; the last holds the rest.++- Add the key directory contracts: `locker.public-key@1`, `locker.public-keys@1`, `locker.keys-put-request@1`, `locker.key-backup@1` and `locker.key-change@1`, with the eight-word fingerprint (sixty-four bits, in two groups of four) and the signature that proves a person owns their signing key.++- `share@1` and `share.update-request@1` gain `lock` (`none`, `people`, `password`, `link`), and a share member may carry that member's key slot, so a member and its slot are saved together. Additive: the fields are optional and old documents stay valid.++- Valid and invalid fixtures cover every new contract, and the new fields of the sharing contracts. The format is written down in [docs/locker.md](docs/locker.md).++## 0.291.0 — 2026-11-05- Add `share@1`: resource refs, audiences, members and member inputs, transfers, access requests, uniform API requests and responses. Transfers are recipient-bound, last seven days, and default to removing the former owner's membership.@@@ -2,7 +2,7 @@> Machine-readable contracts for the whole OpenVibe network.--**Status:** alpha (first released in Wave 1; the release is package.json's `version`, tagged). At v0.291.0: 1002 schemas in `contracts/catalog.json`, 60 service manifests, 452 capability manifests, 13 namespace manifests and the staff capability map. Service repositories run `openvibe-contracts-check` and the pin-drift check in CI, and deployed services verify service and app tokens with `serviceAuth` in production. Consumers pin release tags (each repository's `STATUS.json` names its pin). `node scripts/docs-currency.js <root>` checks every checkout's README and `STATUS.json` against its code: the pins and versions they name, a library's consumer list, the deployed flag against the manifest, README links, and the paths and migrations they name. `node scripts/estate.js` generates `docs/ESTATE.md` and `manifests/repositories/` from the estate checkouts, and `--check` fails on drift (plan T1 step 3).++**Status:** alpha (first released in Wave 1; the release is package.json's `version`, tagged). At v0.292.0: 1016 schemas in `contracts/catalog.json`, 60 service manifests, 452 capability manifests, 13 namespace manifests and the staff capability map. Service repositories run `openvibe-contracts-check` and the pin-drift check in CI, and deployed services verify service and app tokens with `serviceAuth` in production. Consumers pin release tags (each repository's `STATUS.json` names its pin). `node scripts/docs-currency.js <root>` checks every checkout's README and `STATUS.json` against its code: the pins and versions they name, a library's consumer list, the deployed flag against the manifest, README links, and the paths and migrations they name. `node scripts/estate.js` generates `docs/ESTATE.md` and `manifests/repositories/` from the estate checkouts, and `--check` fails on drift (plan T1 step 3).**Plan:** OpenVibe Development Roadmap, Wave 1 (implementation plan rev 3, §3.1 and §18.11).**License:** AGPL-3.0 (same as every OpenVibe service).@@@ -352,3 +352,5 @@ package reports version `0.28.0` and contains both changes (Codes: `codes.app-mastays for consumers that already pinned it and is identical.The network-wide [sharing contracts](docs/sharing.md) define the uniform access and ownership-transfer API (`share@1`).++++The [Locker contracts](docs/locker.md) define the sealed envelope (`locker.envelope@1`), its key slots and the key directory API: end-to-end encryption for anything on OpenVibe.@@@ -9124,7 +9124,7 @@},{"id": "share.member",-- "version": "1.0.0",++ "version": "1.1.0","owner": "network","schema": "share/member.v1.json","visibility": "public",@@@ -9133,7 +9133,7 @@},{"id": "share.member-input",-- "version": "1.0.0",++ "version": "1.1.0","owner": "network","schema": "share/member-input.v1.json","visibility": "public",@@@ -9160,7 +9160,7 @@},{"id": "share",-- "version": "1.0.0",++ "version": "1.1.0","owner": "network","schema": "share/share.v1.json","visibility": "public",@@@ -9214,7 +9214,7 @@},{"id": "share.update-request",-- "version": "1.0.0",++ "version": "1.1.0","owner": "network","schema": "share/update-request.v1.json","visibility": "public",@@@ -9301,6 +9301,87 @@"visibility": "first-party","compatibility": "backward","status": "active"++ },++ {++ "id": "locker.envelope",++ "version": "1.0.0",++ "owner": "network",++ "schema": "locker/envelope.v1.json",++ "visibility": "public",++ "compatibility": "backward",++ "status": "active"++ },++ {++ "id": "locker.people-slot",++ "version": "1.0.0",++ "owner": "network",++ "schema": "locker/people-slot.v1.json",++ "visibility": "public",++ "compatibility": "backward",++ "status": "active"++ },++ {++ "id": "locker.password-slot",++ "version": "1.0.0",++ "owner": "network",++ "schema": "locker/password-slot.v1.json",++ "visibility": "public",++ "compatibility": "backward",++ "status": "active"++ },++ {++ "id": "locker.link-slot",++ "version": "1.0.0",++ "owner": "network",++ "schema": "locker/link-slot.v1.json",++ "visibility": "public",++ "compatibility": "backward",++ "status": "active"++ },++ {++ "id": "locker.public-key",++ "version": "1.0.0",++ "owner": "network",++ "schema": "locker/public-key.v1.json",++ "visibility": "public",++ "compatibility": "backward",++ "status": "active"++ },++ {++ "id": "locker.public-keys",++ "version": "1.0.0",++ "owner": "network",++ "schema": "locker/public-keys.v1.json",++ "visibility": "public",++ "compatibility": "backward",++ "status": "active"++ },++ {++ "id": "locker.keys-put-request",++ "version": "1.0.0",++ "owner": "network",++ "schema": "locker/keys-put-request.v1.json",++ "visibility": "public",++ "compatibility": "backward",++ "status": "active"++ },++ {++ "id": "locker.key-backup",++ "version": "1.0.0",++ "owner": "network",++ "schema": "locker/key-backup.v1.json",++ "visibility": "public",++ "compatibility": "backward",++ "status": "active"++ },++ {++ "id": "locker.key-change",++ "version": "1.0.0",++ "owner": "network",++ "schema": "locker/key-change.v1.json",++ "visibility": "public",++ "compatibility": "backward",++ "status": "active"}]}nnew file mode 100644@@@ -0,0 +1,183 @@++{++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/envelope.v1.json",++ "title": "LockerEnvelope",++ "description": "locker.envelope@1: the header of a Locker envelope. It is the JSON that opens every chunk of the envelope bytes: the suite, the chunk size, the padded size, the counter nonce base and one key slot per way in. The content key is never in the header; it is wrapped inside a slot. Every chunk authenticates the header's core fields (version, suite, chunk_size, padded_size, nonce_base, lock) as associated data, so the framing, the size and the lock kind cannot be changed; the slots sit outside that core on purpose, because adding a member re-wraps the content key without re-encrypting the content, and each slot carries its own AES-GCM tag over the content key with its own parameters bound in.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "version",++ "suite",++ "chunk_size",++ "padded_size",++ "nonce_base",++ "lock",++ "slots"++ ],++ "properties": {++ "version": {++ "const": "locker.envelope.v1"++ },++ "suite": {++ "const": "AES-256-GCM"++ },++ "chunk_size": {++ "const": 1048576,++ "description": "The chunk size in bytes: 1 MiB. Fixed for this version."++ },++ "padded_size": {++ "type": "integer",++ "minimum": 256,++ "description": "The size of the padded plaintext in bytes. The true size lives inside the encrypted content, so the server cannot read it; this is the size it may store and show. The size is padded with Padmé (Nikitin et al., PoPETs 2019): it is the next size on a grid that gets finer as the content grows, at most twelve per cent over the real one, and never below 256 bytes. Every chunk but the last is a whole chunk; the last holds what is left of this size."++ },++ "nonce_base": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{11}=$",++ "description": "Eight random bytes, base64: the first half of every chunk nonce. The second half is the chunk counter, so no nonce repeats inside one envelope."++ },++ "lock": {++ "enum": [++ "people",++ "password",++ "link"++ ],++ "description": "Which way in the envelope has. Exactly one slot kind is present, and it matches this."++ },++ "slots": {++ "type": "object",++ "additionalProperties": false,++ "properties": {++ "people": {++ "type": "array",++ "minItems": 1,++ "maxItems": 100,++ "items": {++ "$ref": "people-slot.v1.json"++ }++ },++ "password": {++ "$ref": "password-slot.v1.json"++ },++ "link": {++ "$ref": "link-slot.v1.json"++ }++ }++ }++ },++ "allOf": [++ {++ "if": {++ "properties": {++ "lock": {++ "const": "people"++ }++ },++ "required": [++ "lock"++ ]++ },++ "then": {++ "properties": {++ "slots": {++ "type": "object",++ "required": [++ "people"++ ],++ "not": {++ "anyOf": [++ {++ "type": "object",++ "required": [++ "password"++ ]++ },++ {++ "type": "object",++ "required": [++ "link"++ ]++ }++ ]++ }++ }++ }++ }++ },++ {++ "if": {++ "properties": {++ "lock": {++ "const": "password"++ }++ },++ "required": [++ "lock"++ ]++ },++ "then": {++ "properties": {++ "slots": {++ "type": "object",++ "required": [++ "password"++ ],++ "not": {++ "anyOf": [++ {++ "type": "object",++ "required": [++ "people"++ ]++ },++ {++ "type": "object",++ "required": [++ "link"++ ]++ }++ ]++ }++ }++ }++ }++ },++ {++ "if": {++ "properties": {++ "lock": {++ "const": "link"++ }++ },++ "required": [++ "lock"++ ]++ },++ "then": {++ "properties": {++ "slots": {++ "type": "object",++ "required": [++ "link"++ ],++ "not": {++ "anyOf": [++ {++ "type": "object",++ "required": [++ "people"++ ]++ },++ {++ "type": "object",++ "required": [++ "password"++ ]++ }++ ]++ }++ }++ }++ }++ }++ ]++}nnew file mode 100644@@@ -0,0 +1,47 @@++{++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/key-backup.v1.json",++ "title": "LockerKeyBackup",++ "description": "locker.key-backup@1: the person's private keys, wrapped. The wrapping key comes from the locker passphrase with PBKDF2-SHA-256, so the server stores bytes it cannot open; a passkey (WebAuthn PRF) may wrap the same bytes later without changing this shape.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "method",++ "kdf",++ "iterations",++ "salt",++ "nonce",++ "wrapped_keys"++ ],++ "properties": {++ "method": {++ "enum": [++ "passphrase"++ ],++ "description": "How the private keys are wrapped. A passkey-only locker comes later."++ },++ "kdf": {++ "const": "PBKDF2-SHA-256"++ },++ "iterations": {++ "type": "integer",++ "minimum": 600000,++ "maximum": 10000000++ },++ "salt": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{22}==$",++ "description": "Sixteen random bytes, base64."++ },++ "nonce": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{16}$",++ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped keys."++ },++ "wrapped_keys": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]+={0,2}$",++ "description": "The two private keys as JWKs, sealed with AES-256-GCM under the derived key, base64."++ }++ }++}nnew file mode 100644@@@ -0,0 +1,40 @@++{++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/key-change.v1.json",++ "title": "LockerKeyChange",++ "description": "locker.key-change@1: a record that a person's locker keys changed, so the share sheet can warn before sharing with a key that is not the one people saw before.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "subject",++ "reason",++ "changed_at",++ "fingerprint"++ ],++ "properties": {++ "subject": {++ "$ref": "../identity/subject-ref.v1.json"++ },++ "reason": {++ "enum": [++ "created",++ "rotated",++ "restored"++ ]++ },++ "changed_at": {++ "type": "string",++ "format": "date-time"++ },++ "fingerprint": {++ "type": "string",++ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",++ "description": "The eight words of the new keys, in two groups of four joined by a middle dot."++ },++ "previous_fingerprint": {++ "type": "string",++ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",++ "description": "The eight words before the change, when there were any."++ }++ }++}nnew file mode 100644@@@ -0,0 +1,34 @@++{++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/keys-put-request.v1.json",++ "title": "LockerKeysPutRequest",++ "description": "locker.keys-put-request@1: what a person sends to set their locker keys. The public keys and the fingerprint are readable by anyone; the private keys go in the backup, wrapped by a key from the locker passphrase, so the server never holds an unwrapped key.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "ecdh",++ "signing",++ "fingerprint",++ "fingerprint_signature",++ "backup"++ ],++ "properties": {++ "ecdh": {++ "$ref": "public-key.v1.json"++ },++ "signing": {++ "$ref": "public-key.v1.json"++ },++ "fingerprint": {++ "type": "string",++ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$"++ },++ "fingerprint_signature": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{86}==$"++ },++ "backup": {++ "$ref": "key-backup.v1.json"++ }++ }++}nnew file mode 100644@@@ -0,0 +1,9 @@++{++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/link-slot.v1.json",++ "title": "LockerLinkSlot",++ "description": "locker.link-slot@1: a link lock stores no key. The content key travels in the part of the link after the #, which browsers never send to us, so this slot is empty on purpose and the envelope says only that the key is somewhere else.",++ "type": "object",++ "additionalProperties": false,++ "properties": {}++}nnew file mode 100644@@@ -0,0 +1,45 @@++{++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/password-slot.v1.json",++ "title": "LockerPasswordSlot",++ "description": "locker.password-slot@1: the content key wrapped with a password. The wrapping key comes from PBKDF2-SHA-256 with the salt and the iteration count in this slot, so both can be raised later without changing the format. The tag covers the parameters, so they cannot be weakened in transit.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "algorithm",++ "kdf",++ "iterations",++ "salt",++ "nonce",++ "wrapped_key"++ ],++ "properties": {++ "algorithm": {++ "const": "PBKDF2-SHA256/AES-256-GCM"++ },++ "kdf": {++ "const": "PBKDF2-SHA-256"++ },++ "iterations": {++ "type": "integer",++ "minimum": 600000,++ "maximum": 10000000,++ "description": "PBKDF2 iterations. 600000 is the floor for this version; the count may go up, never down."++ },++ "salt": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{22}==$",++ "description": "Sixteen random bytes, base64: the PBKDF2 salt."++ },++ "nonce": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{16}$",++ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key."++ },++ "wrapped_key": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{64}$",++ "description": "The 32-byte content key and its 16-byte tag, base64. Never the key itself."++ }++ }++}nnew file mode 100644@@@ -0,0 +1,48 @@++{++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/people-slot.v1.json",++ "title": "LockerPeopleSlot",++ "description": "locker.people-slot@1: the content key wrapped for one person. The wrapping key is ECDH P-256 (an ephemeral key pair per envelope) put through HKDF-SHA-256, and the content key is sealed with AES-256-GCM. The tag covers the subject, the recipient's key, the ephemeral public key and the salt, so a slot cannot be moved to another person or to another envelope.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "subject",++ "algorithm",++ "recipient_key",++ "ephemeral_public_key",++ "salt",++ "nonce",++ "wrapped_key"++ ],++ "properties": {++ "subject": {++ "$ref": "../identity/subject-ref.v1.json"++ },++ "algorithm": {++ "const": "ECDH-P256/HKDF-SHA256/AES-256-GCM"++ },++ "recipient_key": {++ "type": "string",++ "pattern": "^[A-Za-z0-9_-]{43}$",++ "description": "The RFC 7638 thumbprint of the recipient's ECDH public key: SHA-256 over the canonical JSON of the key's four members, base64url. The slot is bound to this key as well as to the subject, and the reader checks it before it derives anything."++ },++ "ephemeral_public_key": {++ "$ref": "public-key.v1.json"++ },++ "salt": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{22}==$",++ "description": "Sixteen random bytes, base64: the HKDF salt for this slot."++ },++ "nonce": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{16}$",++ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key."++ },++ "wrapped_key": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{64}$",++ "description": "The 32-byte content key and its 16-byte tag, base64. Never the key itself."++ }++ }++}nnew file mode 100644@@@ -0,0 +1,45 @@++{++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/public-key.v1.json",++ "title": "LockerPublicKey",++ "description": "locker.public-key@1: one P-256 public key as a JWK. The same shape is used for the ECDH key that receives content keys and for the ECDSA key that signs the fingerprint; what a key does is decided by where it is used, never by the key itself.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "kty",++ "crv",++ "x",++ "y"++ ],++ "properties": {++ "kty": {++ "const": "EC"++ },++ "crv": {++ "const": "P-256"++ },++ "x": {++ "type": "string",++ "pattern": "^[A-Za-z0-9_-]{43}$",++ "description": "The public x coordinate, base64url, as WebCrypto exports it."++ },++ "y": {++ "type": "string",++ "pattern": "^[A-Za-z0-9_-]{43}$",++ "description": "The public y coordinate, base64url, as WebCrypto exports it."++ },++ "ext": {++ "const": true++ },++ "key_ops": {++ "type": "array",++ "items": {++ "enum": [++ "deriveBits",++ "deriveKey",++ "verify"++ ]++ }++ }++ }++}nnew file mode 100644@@@ -0,0 +1,41 @@++{++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/public-keys.v1.json",++ "title": "LockerPublicKeys",++ "description": "locker.public-keys@1: what anyone may read about a person's locker: the two public keys and the eight-word fingerprint. The fingerprint is the first eight bytes of SHA-256 over both public keys, read as eight words in two groups of four, joined by a middle dot, and the signature proves the holder owns the signing key, so a person can compare the eight words out of band and a key change is visible.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "subject",++ "ecdh",++ "signing",++ "fingerprint",++ "fingerprint_signature",++ "updated_at"++ ],++ "properties": {++ "subject": {++ "$ref": "../identity/subject-ref.v1.json"++ },++ "ecdh": {++ "$ref": "public-key.v1.json"++ },++ "signing": {++ "$ref": "public-key.v1.json"++ },++ "fingerprint": {++ "type": "string",++ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",++ "description": "Eight words, lower case, in two groups of four joined by a middle dot: sixty-four bits. Compare them out of band; a change means a changed key."++ },++ "fingerprint_signature": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{86}==$",++ "description": "The ECDSA signature over both public keys, base64. It proves the holder owns the signing key."++ },++ "updated_at": {++ "type": "string",++ "format": "date-time"++ }++ }++}@@@ -22,6 +22,9 @@"expires_at": {"type": "string","format": "date-time"++ },++ "key_slot": {++ "$ref": "../locker/people-slot.v1.json"}},"required": [@@@ -43,6 +43,9 @@"added_at": {"type": "string","format": "date-time"++ },++ "key_slot": {++ "$ref": "../locker/people-slot.v1.json"}},"required": [@@@ -33,6 +33,15 @@"transfer": {"$ref": "transfer-view.v1.json"},++ "lock": {++ "enum": [++ "none",++ "people",++ "password",++ "link"++ ],++ "description": "How the resource is sealed (Locker). none means it is stored as it is; people, password and link are the three Locker locks. The server stores the envelope and never opens it."++ },"you": {"$ref": "you.v1.json"},@@@ -2,7 +2,7 @@"$schema": "https://json-schema.org/draft/2020-12/schema","$id": "https://openvibe.network/contracts/share/update-request.v1.json","title": "ShareUpdateRequest",-- "description": "share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days.",++ "description": "share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days. `lock` sets how the resource itself is sealed (Locker).","type": "object","additionalProperties": false,"properties": {@@@ -24,6 +24,15 @@"notify": {"type": "boolean","default": true++ },++ "lock": {++ "enum": [++ "none",++ "people",++ "password",++ "link"++ ],++ "description": "How the resource is sealed (Locker)."}},"required": [],nnew file mode 100644@@@ -0,0 +1,183 @@++# Locker: end-to-end encryption for anything on OpenVibe++++`locker.envelope@1` (`contracts/locker/envelope.v1.json`) is the format. The library that reads and writes it is++`openvibe-sdk/locker` (Node and the browser); `openvibe-sdk/locker/server` checks an envelope's header without++decrypting it.++++Locker sits on top of sharing: sharing decides **who may fetch** a thing, Locker decides **who can read** it. With a++locked item, OpenVibe stores and serves only ciphertext, and the keys never reach our servers.++++## The three locks++++| Lock | Who can open it | What the header holds |++| --- | --- | --- |++| `people` | you and the people you shared with, each with their own key | one key slot per recipient |++| `password` | anyone you give the password to | one password slot (PBKDF2 parameters) |++| `link` | anyone with the full link | nothing: the key is in the part after `#` |++++`share@1` carries the same three names plus `none` in its `lock` field, so a service knows how an item is sealed++without opening it.++++## The envelope bytes++++```++0 4 8 8 + header length+++------+------+--------------------------+--------------------------+++| OVLK | len | header JSON (UTF-8) | chunk frames |+++------+------+--------------------------+--------------------------+++```++++* `OVLK` — four ASCII bytes. A service that does not know Locker can tell at once.++* `len` — the header length, unsigned 32-bit big endian.++* The header — the JSON object below, exactly `len` bytes, nothing else. The header is never encrypted: it holds no++ key material, only wrapped keys.++++Each chunk frame is:++++```++0 4 5 17+++------+------+--------------------------+--------------------------+++| len | flags| nonce (12 bytes) | ciphertext + 16-byte tag |+++------+------+--------------------------+--------------------------+++```++++* `len` — the ciphertext length, unsigned 32-bit big endian: the plaintext of the chunk plus the 16-byte GCM tag.++ Every chunk but the last holds a whole chunk (1 MiB) of plaintext; the last holds what is left of++ `padded_size`, which is more than zero bytes.++* `flags` — bit 0 (`0x01`) marks the **final chunk**. Every other bit is zero in this version.++* `nonce` — the 12-byte GCM nonce: the header's `nonce_base` (8 random bytes) followed by the chunk counter++ (unsigned 32-bit big endian). No nonce repeats inside one envelope.++++## The header++++```json++{++ "version": "locker.envelope.v1",++ "suite": "AES-256-GCM",++ "chunk_size": 1048576,++ "padded_size": 256,++ "nonce_base": "YmJiYmJiYmI=",++ "lock": "people",++ "slots": { "people": [ { "subject": {}, "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM", "recipient_key": "", "ephemeral_public_key": {}, "salt": "", "nonce": "", "wrapped_key": "" } ] }++}++```++++* `version` — `locker.envelope.v1`. A new format is a new file and a new catalog entry.++* `suite` — `AES-256-GCM`. The content key is 32 bytes.++* `chunk_size` — 1 MiB, fixed in this version.++* `padded_size` — the size of the padded plaintext, in bytes. **The true size lives inside the encrypted++ content**, so the server cannot read it; this is the size it may store and show. It is padded with Padmé++ (see below) and is never below 256 bytes.++* `nonce_base` — eight random bytes, base64: the first half of every chunk nonce.++* `lock` — `people`, `password` or `link`. Exactly one slot kind is present, and it matches.++* `slots` — the key slots. The content key itself is never in the header.++++### What is authenticated, and what is not++++Every chunk authenticates the header's **core** as associated data:++++```++AAD = UTF-8(canonical JSON of {version, suite, chunk_size, padded_size, nonce_base, lock})++ || counter (4 bytes, big endian)++ || flags (1 byte)++```++++The canonical JSON is that object with its keys in exactly that order and no whitespace, which both ends build the++same way. So the framing, the size, the nonce base and the lock kind cannot be changed: the chunks stop verifying.++++The **slots are deliberately outside that core**. Adding a member to a people-locked item wraps the content key for++the new member; it does not re-encrypt the content, so the header's core cannot change either. Each slot is++authenticated on its own instead: the slot's AES-GCM tag covers the content key *and* the slot's own parameters++(the subject, the ephemeral public key and the salt for a people slot; the iteration count and the salt for a++password slot). A slot therefore cannot be moved to another person, replayed from another envelope, or have its++parameters weakened in transit.++++### The padded plaintext++++The plaintext inside the chunks is:++++```++8 bytes the true length, unsigned 64-bit big endian++N bytes the content++rest zero padding, up to the next chunk boundary++```++++`padded_size` counts all of it, padding included, and is never below 256 bytes. The length prefix is why the++server cannot learn the size: the real length is inside the encrypted part.++++The padding is **Padmé** (Nikitin et al., "Reducing Metadata Leakage from Encrypted Files and Network Traffic",++PoPETs 2019): the length is rounded up to the next size on a grid that gets finer as the length grows. The++expansion is at most about twelve per cent (the worst case is 129 bytes padded to 144), the number of possible++padded lengths grows like the logarithm of the content size, so the padded size leaks O(log log n) bits about the++real one, and a short note costs 256 bytes rather than a whole megabyte. The chunk grid does not leak the size:++only the last chunk is shorter than a chunk, and its length is `padded_size` minus the whole chunks before it.++++### The slots++++**People slot** (`locker.people-slot@1`) — one per recipient:++++```json++{ "subject": { "type": "user", "id": "usr_..." }, "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",++ "ephemeral_public_key": { "kty": "EC", "crv": "P-256", "x": "...", "y": "..." },++ "salt": "<16 bytes, base64>", "nonce": "<12 bytes, base64>", "wrapped_key": "<48 bytes, base64>" }++```++++The envelope has one ephemeral ECDH P-256 key pair. For each recipient the shared secret with their public key goes++through HKDF-SHA-256 (salt: the slot's `salt`, info: `openvibe-locker people-slot v1|<subject id>`), and the result++wraps the content key with AES-256-GCM. The recipient derives the same secret with their private key and the++envelope's ephemeral public key.++++**Password slot** (`locker.password-slot@1`):++++```json++{ "algorithm": "PBKDF2-SHA256/AES-256-GCM", "kdf": "PBKDF2-SHA-256", "iterations": 600000,++ "salt": "<16 bytes, base64>", "nonce": "<12 bytes, base64>", "wrapped_key": "<48 bytes, base64>" }++```++++PBKDF2-SHA-256 with 600000 iterations and the slot's salt gives the wrapping key. The parameters live in the header++so they can be raised later: the reader takes the iteration count and the salt from the header, never from its own++defaults. The floor is 600000 and the ceiling is 10000000: the count may go up, never down, and a header outside++that range is refused before anything is derived, so a hostile header cannot make a reader work for hours.++++**Link slot** (`locker.link-slot@1`) — empty, on purpose. A link lock stores no key: the content key travels in the++part of the link after `#`, which browsers never send to us.++++## The key directory++++A person's keys live on Network, opaque. The contracts are:++++| API | Request contract | Response contract |++| --- | --- | --- |++| GET /api/v1/people/:subject/keys | none | locker.public-keys@1 |++| PUT /api/v1/me/keys | locker.keys-put-request@1 | locker.public-keys@1 |++| GET /api/v1/me/keys/backup | none | locker.key-backup@1 |++++A person has two key pairs: an **ECDH P-256** pair that receives content keys, and an **ECDSA P-256** pair that signs++the fingerprint. The **fingerprint** is the first eight bytes of SHA-256 over both public keys, read as eight words++(256 words, eight bits each) in two groups of four, joined by a middle dot: it is short enough to say out loud and compare once. Sixty-four++bits, not thirty-two: a server that swapped in its own key would need about 2^32 key generations to land on the same++four words, and 2^64 for the eight. The signature over both public keys proves the holder owns the signing key, so a++key pair is self-certifying; a change of keys changes the fingerprint, and `locker.key-change@1` records it so a share++sheet can warn before sharing with a key nobody saw before.++++The private keys are stored wrapped (`locker.key-backup@1`): PBKDF2-SHA-256 from the locker passphrase, then++AES-256-GCM. Network holds the protected copy and cannot open it. There is no reset: if the passphrase and the++recovery kit are both lost, nobody can open the locker, including OpenVibe.++++## What a service does with a locked item++++`openvibe-sdk/locker/server` gives a service the checks in one place: it reads the header and checks its shape and++its size, **without decrypting anything**. Then the service:++++* skips indexing, previews, thumbnails, transcoding and content AI;++* shows the lock badge;++* serves the bytes only to the people `canView` allows.++++A locked item is never public: everyone is disabled, and links are rate-limited. Locked storage has per-account++quotas. Normal abuse reports work by account and link; a recipient who reports may choose to disclose the content key++to moderators, which opens that one item only.++++## What we cannot do++++We cannot scan or moderate what is inside a locked item. That matters most for uploads. A recipient can always keep++what they opened, and the server still sees who owns what, how big it is (padded) and when.nnew file mode 100644@@@ -0,0 +1,11 @@++{++ "version": "locker.envelope.v1",++ "suite": "AES-256-GCM",++ "chunk_size": 1048576,++ "padded_size": 256,++ "nonce_base": "YmJiYmJiYmI=",++ "lock": "password",++ "slots": {++ "link": {}++ }++}nnew file mode 100644@@@ -0,0 +1,11 @@++{++ "version": "locker.envelope.v1",++ "suite": "AES-128-GCM",++ "chunk_size": 1048576,++ "padded_size": 256,++ "nonce_base": "YmJiYmJiYmI=",++ "lock": "link",++ "slots": {++ "link": {}++ }++}nnew file mode 100644@@@ -0,0 +1,11 @@++{++ "version": "locker.envelope.v1",++ "suite": "AES-256-GCM",++ "chunk_size": 1048576,++ "padded_size": 100,++ "nonce_base": "YmJiYmJiYmI=",++ "lock": "link",++ "slots": {++ "link": {}++ }++}nnew file mode 100644@@@ -0,0 +1,19 @@++{++ "version": "locker.envelope.v1",++ "suite": "AES-256-GCM",++ "chunk_size": 1048576,++ "padded_size": 256,++ "nonce_base": "YmJiYmJiYmI=",++ "lock": "link",++ "slots": {++ "link": {},++ "password": {++ "algorithm": "PBKDF2-SHA256/AES-256-GCM",++ "kdf": "PBKDF2-SHA-256",++ "iterations": 600000,++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++ }++ }++}nnew file mode 100644@@@ -0,0 +1,12 @@++{++ "version": "locker.envelope.v1",++ "suite": "AES-256-GCM",++ "chunk_size": 1048576,++ "padded_size": 256,++ "nonce_base": "YmJiYmJiYmI=",++ "lock": "link",++ "slots": {++ "link": {}++ },++ "secret": "the content key never goes in the header"++}nnew file mode 100644@@@ -0,0 +1,11 @@++{++ "version": "locker.envelope.v1",++ "suite": "AES-256-GCM",++ "chunk_size": 1048576,++ "padded_size": 256,++ "nonce_base": "YmJiYmJiYmI=",++ "lock": "link",++ "slots": {++ "link": {}++ }++}nnew file mode 100644@@@ -0,0 +1,18 @@++{++ "version": "locker.envelope.v1",++ "suite": "AES-256-GCM",++ "chunk_size": 1048576,++ "padded_size": 256,++ "nonce_base": "YmJiYmJiYmI=",++ "lock": "password",++ "slots": {++ "password": {++ "algorithm": "PBKDF2-SHA256/AES-256-GCM",++ "kdf": "PBKDF2-SHA-256",++ "iterations": 600000,++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++ }++ }++}nnew file mode 100644@@@ -0,0 +1,26 @@++{++ "version": "locker.envelope.v1",++ "suite": "AES-256-GCM",++ "chunk_size": 1048576,++ "padded_size": 256,++ "nonce_base": "YmJiYmJiYmI=",++ "lock": "people",++ "slots": {++ "people": [++{++ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR" },++ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",++ "recipient_key": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8",++ "ephemeral_public_key": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++ },++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}++ ]++ }++}nnew file mode 100644@@@ -0,0 +1,8 @@++{++ "method": "passphrase",++ "kdf": "PBKDF2-SHA-256",++ "iterations": 10000,++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}nnew file mode 100644@@@ -0,0 +1,8 @@++{++ "method": "passphrase",++ "kdf": "PBKDF2-SHA-256",++ "iterations": 600000,++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}nnew file mode 100644@@@ -0,0 +1,6 @@++{++ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },++ "reason": "stolen",++ "changed_at": "2026-11-06T00:00:00Z",++ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow"++}nnew file mode 100644@@@ -0,0 +1,7 @@++{++ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },++ "reason": "rotated",++ "changed_at": "2026-11-06T00:00:00Z",++ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow",++ "previous_fingerprint": "amber quiet harbor stone · lake fern moss reed"++}nnew file mode 100644@@@ -0,0 +1,16 @@++{++ "ecdh": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "signing": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow",++ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw=="++}nnew file mode 100644@@@ -0,0 +1,24 @@++{++ "ecdh": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "signing": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow",++ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==",++ "backup": {++ "method": "passphrase",++ "kdf": "PBKDF2-SHA-256",++ "iterations": 600000,++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++ }++}nnew file mode 100644@@@ -0,0 +1,3 @@++{++ "key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}nnew file mode 100644@@@ -0,0 +1 @@++{}nnew file mode 100644@@@ -0,0 +1,8 @@++{++ "algorithm": "PBKDF2-SHA256/AES-256-GCM",++ "kdf": "PBKDF2-SHA-256",++ "iterations": 1000,++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}nnew file mode 100644@@@ -0,0 +1,8 @@++{++ "algorithm": "PBKDF2-SHA256/AES-256-GCM",++ "kdf": "PBKDF2-SHA-256",++ "iterations": 600000,++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}nnew file mode 100644@@@ -0,0 +1,13 @@++{++ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR" },++ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",++ "ephemeral_public_key": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++ },++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}nnew file mode 100644@@@ -0,0 +1,13 @@++{++ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",++ "recipient_key": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8",++ "ephemeral_public_key": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++ },++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}nnew file mode 100644@@@ -0,0 +1,13 @@++{++ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR" },++ "algorithm": "RSA-OAEP/AES-256-GCM",++ "ephemeral_public_key": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++ },++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}nnew file mode 100644@@@ -0,0 +1,14 @@++{++ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR" },++ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",++ "recipient_key": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8",++ "ephemeral_public_key": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++ },++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++}nnew file mode 100644@@@ -0,0 +1,6 @@++{++ "kty": "EC",++ "crv": "P-384",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++}nnew file mode 100644@@@ -0,0 +1,6 @@++{++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++}nnew file mode 100644@@@ -0,0 +1,18 @@++{++ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },++ "ecdh": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "signing": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "fingerprint": "amber quiet harbor cedar-mist dawn ember willow",++ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==",++ "updated_at": "2026-11-06T00:00:00Z"++}nnew file mode 100644@@@ -0,0 +1,18 @@++{++ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },++ "ecdh": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "signing": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "fingerprint": "amber quiet harbor cedar",++ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==",++ "updated_at": "2026-11-06T00:00:00Z"++}nnew file mode 100644@@@ -0,0 +1,18 @@++{++ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },++ "ecdh": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "signing": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++},++ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow",++ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==",++ "updated_at": "2026-11-06T00:00:00Z"++}nnew file mode 100644@@@ -0,0 +1,3 @@++{++ "lock": "secret"++}nnew file mode 100644@@@ -0,0 +1,3 @@++{++ "lock": "password"++}nnew file mode 100644@@@ -0,0 +1,72 @@++{++ "ref": {++ "service": "community",++ "kind": "paste",++ "id": "abc"++ },++ "owner_subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"++ },++ "owner": {++ "subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"++ },++ "username": "ursula",++ "display_name": "Ursula",++ "avatar_url": null++ },++ "audience": "people",++ "members": [++ {++ "subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR"++ },++ "username": "maticus",++ "display_name": "Maticus",++ "avatar_url": "https://cdn.openvibe.network/avatars/maticus.png",++ "role": "viewer",++ "added_by": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"++ },++ "added_at": "2026-11-06T00:00:00Z"++ }++ ],++ "you": {++ "subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"++ },++ "role": "owner"++ },++ "requests": [++ {++ "id": "00000000-0000-4000-8000-000000000001",++ "subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPS"++ },++ "username": "xenia",++ "display_name": "Xenia",++ "avatar_url": null,++ "requested_at": "2026-11-06T00:05:00Z"++ }++ ],++ "title": "LOOI bridge notes",++ "link": "https://community.openvibe.network/p/abc",++ "roles": [++ "viewer",++ "editor"++ ],++ "audiences": [++ "public",++ "link",++ "people",++ "private"++ ],++ "transferable": true,++ "lock": "everyone"++}nnew file mode 100644@@@ -0,0 +1,89 @@++{++ "ref": {++ "service": "community",++ "kind": "paste",++ "id": "abc"++ },++ "owner_subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"++ },++ "owner": {++ "subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"++ },++ "username": "ursula",++ "display_name": "Ursula",++ "avatar_url": null++ },++ "audience": "people",++ "members": [++ {++ "subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR"++ },++ "username": "maticus",++ "display_name": "Maticus",++ "avatar_url": "https://cdn.openvibe.network/avatars/maticus.png",++ "role": "viewer",++ "added_by": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"++ },++ "added_at": "2026-11-06T00:00:00Z",++ "key_slot": {++ "subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR"++ },++ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",++ "recipient_key": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8",++ "ephemeral_public_key": {++ "kty": "EC",++ "crv": "P-256",++ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",++ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"++ },++ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",++ "nonce": "bm5ubm5ubm5ubm5u",++ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"++ }++ }++ ],++ "you": {++ "subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"++ },++ "role": "owner"++ },++ "requests": [++ {++ "id": "00000000-0000-4000-8000-000000000001",++ "subject": {++ "type": "user",++ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPS"++ },++ "username": "xenia",++ "display_name": "Xenia",++ "avatar_url": null,++ "requested_at": "2026-11-06T00:05:00Z"++ }++ ],++ "title": "LOOI bridge notes",++ "link": "https://community.openvibe.network/p/abc",++ "roles": [++ "viewer",++ "editor"++ ],++ "audiences": [++ "public",++ "link",++ "people",++ "private"++ ],++ "transferable": true,++ "lock": "people"++}@@@ -101619,7 +101619,7 @@}},"share.member": {-- "version": "1.0.0",++ "version": "1.1.0","owner": "network","status": "active","schema": {@@@ -101667,6 +101667,9 @@"added_at": {"type": "string","format": "date-time"++ },++ "key_slot": {++ "$ref": "../locker/people-slot.v1.json"}},"required": [@@@ -101681,7 +101684,7 @@}},"share.member-input": {-- "version": "1.0.0",++ "version": "1.1.0","owner": "network","status": "active","schema": {@@@ -101708,6 +101711,9 @@"expires_at": {"type": "string","format": "date-time"++ },++ "key_slot": {++ "$ref": "../locker/people-slot.v1.json"}},"required": [@@@ -101832,7 +101838,7 @@}},"share": {-- "version": "1.0.0",++ "version": "1.1.0","owner": "network","status": "active","schema": {@@@ -101870,6 +101876,15 @@"transfer": {"$ref": "transfer-view.v1.json"},++ "lock": {++ "enum": [++ "none",++ "people",++ "password",++ "link"++ ],++ "description": "How the resource is sealed (Locker). none means it is stored as it is; people, password and link are the three Locker locks. The server stores the envelope and never opens it."++ },"you": {"$ref": "you.v1.json"},@@@ -102140,14 +102155,14 @@}},"share.update-request": {-- "version": "1.0.0",++ "version": "1.1.0","owner": "network","status": "active","schema": {"$schema": "https://json-schema.org/draft/2020-12/schema","$id": "https://openvibe.network/contracts/share/update-request.v1.json","title": "ShareUpdateRequest",-- "description": "share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days.",++ "description": "share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days. `lock` sets how the resource itself is sealed (Locker).","type": "object","additionalProperties": false,"properties": {@@@ -102169,6 +102184,15 @@"notify": {"type": "boolean","default": true++ },++ "lock": {++ "enum": [++ "none",++ "people",++ "password",++ "link"++ ],++ "description": "How the resource is sealed (Locker)."}},"required": [],@@@ -102634,6 +102658,543 @@"transfer"]}++ },++ "locker.envelope": {++ "version": "1.0.0",++ "owner": "network",++ "status": "active",++ "schema": {++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/envelope.v1.json",++ "title": "LockerEnvelope",++ "description": "locker.envelope@1: the header of a Locker envelope. It is the JSON that opens every chunk of the envelope bytes: the suite, the chunk size, the padded size, the counter nonce base and one key slot per way in. The content key is never in the header; it is wrapped inside a slot. Every chunk authenticates the header's core fields (version, suite, chunk_size, padded_size, nonce_base, lock) as associated data, so the framing, the size and the lock kind cannot be changed; the slots sit outside that core on purpose, because adding a member re-wraps the content key without re-encrypting the content, and each slot carries its own AES-GCM tag over the content key with its own parameters bound in.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "version",++ "suite",++ "chunk_size",++ "padded_size",++ "nonce_base",++ "lock",++ "slots"++ ],++ "properties": {++ "version": {++ "const": "locker.envelope.v1"++ },++ "suite": {++ "const": "AES-256-GCM"++ },++ "chunk_size": {++ "const": 1048576,++ "description": "The chunk size in bytes: 1 MiB. Fixed for this version."++ },++ "padded_size": {++ "type": "integer",++ "minimum": 256,++ "description": "The size of the padded plaintext in bytes. The true size lives inside the encrypted content, so the server cannot read it; this is the size it may store and show. The size is padded with Padmé (Nikitin et al., PoPETs 2019): it is the next size on a grid that gets finer as the content grows, at most twelve per cent over the real one, and never below 256 bytes. Every chunk but the last is a whole chunk; the last holds what is left of this size."++ },++ "nonce_base": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{11}=$",++ "description": "Eight random bytes, base64: the first half of every chunk nonce. The second half is the chunk counter, so no nonce repeats inside one envelope."++ },++ "lock": {++ "enum": [++ "people",++ "password",++ "link"++ ],++ "description": "Which way in the envelope has. Exactly one slot kind is present, and it matches this."++ },++ "slots": {++ "type": "object",++ "additionalProperties": false,++ "properties": {++ "people": {++ "type": "array",++ "minItems": 1,++ "maxItems": 100,++ "items": {++ "$ref": "people-slot.v1.json"++ }++ },++ "password": {++ "$ref": "password-slot.v1.json"++ },++ "link": {++ "$ref": "link-slot.v1.json"++ }++ }++ }++ },++ "allOf": [++ {++ "if": {++ "properties": {++ "lock": {++ "const": "people"++ }++ },++ "required": [++ "lock"++ ]++ },++ "then": {++ "properties": {++ "slots": {++ "type": "object",++ "required": [++ "people"++ ],++ "not": {++ "anyOf": [++ {++ "type": "object",++ "required": [++ "password"++ ]++ },++ {++ "type": "object",++ "required": [++ "link"++ ]++ }++ ]++ }++ }++ }++ }++ },++ {++ "if": {++ "properties": {++ "lock": {++ "const": "password"++ }++ },++ "required": [++ "lock"++ ]++ },++ "then": {++ "properties": {++ "slots": {++ "type": "object",++ "required": [++ "password"++ ],++ "not": {++ "anyOf": [++ {++ "type": "object",++ "required": [++ "people"++ ]++ },++ {++ "type": "object",++ "required": [++ "link"++ ]++ }++ ]++ }++ }++ }++ }++ },++ {++ "if": {++ "properties": {++ "lock": {++ "const": "link"++ }++ },++ "required": [++ "lock"++ ]++ },++ "then": {++ "properties": {++ "slots": {++ "type": "object",++ "required": [++ "link"++ ],++ "not": {++ "anyOf": [++ {++ "type": "object",++ "required": [++ "people"++ ]++ },++ {++ "type": "object",++ "required": [++ "password"++ ]++ }++ ]++ }++ }++ }++ }++ }++ ]++ }++ },++ "locker.people-slot": {++ "version": "1.0.0",++ "owner": "network",++ "status": "active",++ "schema": {++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/people-slot.v1.json",++ "title": "LockerPeopleSlot",++ "description": "locker.people-slot@1: the content key wrapped for one person. The wrapping key is ECDH P-256 (an ephemeral key pair per envelope) put through HKDF-SHA-256, and the content key is sealed with AES-256-GCM. The tag covers the subject, the recipient's key, the ephemeral public key and the salt, so a slot cannot be moved to another person or to another envelope.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "subject",++ "algorithm",++ "recipient_key",++ "ephemeral_public_key",++ "salt",++ "nonce",++ "wrapped_key"++ ],++ "properties": {++ "subject": {++ "$ref": "../identity/subject-ref.v1.json"++ },++ "algorithm": {++ "const": "ECDH-P256/HKDF-SHA256/AES-256-GCM"++ },++ "recipient_key": {++ "type": "string",++ "pattern": "^[A-Za-z0-9_-]{43}$",++ "description": "The RFC 7638 thumbprint of the recipient's ECDH public key: SHA-256 over the canonical JSON of the key's four members, base64url. The slot is bound to this key as well as to the subject, and the reader checks it before it derives anything."++ },++ "ephemeral_public_key": {++ "$ref": "public-key.v1.json"++ },++ "salt": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{22}==$",++ "description": "Sixteen random bytes, base64: the HKDF salt for this slot."++ },++ "nonce": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{16}$",++ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key."++ },++ "wrapped_key": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{64}$",++ "description": "The 32-byte content key and its 16-byte tag, base64. Never the key itself."++ }++ }++ }++ },++ "locker.password-slot": {++ "version": "1.0.0",++ "owner": "network",++ "status": "active",++ "schema": {++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/password-slot.v1.json",++ "title": "LockerPasswordSlot",++ "description": "locker.password-slot@1: the content key wrapped with a password. The wrapping key comes from PBKDF2-SHA-256 with the salt and the iteration count in this slot, so both can be raised later without changing the format. The tag covers the parameters, so they cannot be weakened in transit.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "algorithm",++ "kdf",++ "iterations",++ "salt",++ "nonce",++ "wrapped_key"++ ],++ "properties": {++ "algorithm": {++ "const": "PBKDF2-SHA256/AES-256-GCM"++ },++ "kdf": {++ "const": "PBKDF2-SHA-256"++ },++ "iterations": {++ "type": "integer",++ "minimum": 600000,++ "maximum": 10000000,++ "description": "PBKDF2 iterations. 600000 is the floor for this version; the count may go up, never down."++ },++ "salt": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{22}==$",++ "description": "Sixteen random bytes, base64: the PBKDF2 salt."++ },++ "nonce": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{16}$",++ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key."++ },++ "wrapped_key": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{64}$",++ "description": "The 32-byte content key and its 16-byte tag, base64. Never the key itself."++ }++ }++ }++ },++ "locker.link-slot": {++ "version": "1.0.0",++ "owner": "network",++ "status": "active",++ "schema": {++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/link-slot.v1.json",++ "title": "LockerLinkSlot",++ "description": "locker.link-slot@1: a link lock stores no key. The content key travels in the part of the link after the #, which browsers never send to us, so this slot is empty on purpose and the envelope says only that the key is somewhere else.",++ "type": "object",++ "additionalProperties": false,++ "properties": {}++ }++ },++ "locker.public-key": {++ "version": "1.0.0",++ "owner": "network",++ "status": "active",++ "schema": {++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/public-key.v1.json",++ "title": "LockerPublicKey",++ "description": "locker.public-key@1: one P-256 public key as a JWK. The same shape is used for the ECDH key that receives content keys and for the ECDSA key that signs the fingerprint; what a key does is decided by where it is used, never by the key itself.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "kty",++ "crv",++ "x",++ "y"++ ],++ "properties": {++ "kty": {++ "const": "EC"++ },++ "crv": {++ "const": "P-256"++ },++ "x": {++ "type": "string",++ "pattern": "^[A-Za-z0-9_-]{43}$",++ "description": "The public x coordinate, base64url, as WebCrypto exports it."++ },++ "y": {++ "type": "string",++ "pattern": "^[A-Za-z0-9_-]{43}$",++ "description": "The public y coordinate, base64url, as WebCrypto exports it."++ },++ "ext": {++ "const": true++ },++ "key_ops": {++ "type": "array",++ "items": {++ "enum": [++ "deriveBits",++ "deriveKey",++ "verify"++ ]++ }++ }++ }++ }++ },++ "locker.public-keys": {++ "version": "1.0.0",++ "owner": "network",++ "status": "active",++ "schema": {++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/public-keys.v1.json",++ "title": "LockerPublicKeys",++ "description": "locker.public-keys@1: what anyone may read about a person's locker: the two public keys and the eight-word fingerprint. The fingerprint is the first eight bytes of SHA-256 over both public keys, read as eight words in two groups of four, joined by a middle dot, and the signature proves the holder owns the signing key, so a person can compare the eight words out of band and a key change is visible.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "subject",++ "ecdh",++ "signing",++ "fingerprint",++ "fingerprint_signature",++ "updated_at"++ ],++ "properties": {++ "subject": {++ "$ref": "../identity/subject-ref.v1.json"++ },++ "ecdh": {++ "$ref": "public-key.v1.json"++ },++ "signing": {++ "$ref": "public-key.v1.json"++ },++ "fingerprint": {++ "type": "string",++ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",++ "description": "Eight words, lower case, in two groups of four joined by a middle dot: sixty-four bits. Compare them out of band; a change means a changed key."++ },++ "fingerprint_signature": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{86}==$",++ "description": "The ECDSA signature over both public keys, base64. It proves the holder owns the signing key."++ },++ "updated_at": {++ "type": "string",++ "format": "date-time"++ }++ }++ }++ },++ "locker.keys-put-request": {++ "version": "1.0.0",++ "owner": "network",++ "status": "active",++ "schema": {++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/keys-put-request.v1.json",++ "title": "LockerKeysPutRequest",++ "description": "locker.keys-put-request@1: what a person sends to set their locker keys. The public keys and the fingerprint are readable by anyone; the private keys go in the backup, wrapped by a key from the locker passphrase, so the server never holds an unwrapped key.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "ecdh",++ "signing",++ "fingerprint",++ "fingerprint_signature",++ "backup"++ ],++ "properties": {++ "ecdh": {++ "$ref": "public-key.v1.json"++ },++ "signing": {++ "$ref": "public-key.v1.json"++ },++ "fingerprint": {++ "type": "string",++ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$"++ },++ "fingerprint_signature": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{86}==$"++ },++ "backup": {++ "$ref": "key-backup.v1.json"++ }++ }++ }++ },++ "locker.key-backup": {++ "version": "1.0.0",++ "owner": "network",++ "status": "active",++ "schema": {++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/key-backup.v1.json",++ "title": "LockerKeyBackup",++ "description": "locker.key-backup@1: the person's private keys, wrapped. The wrapping key comes from the locker passphrase with PBKDF2-SHA-256, so the server stores bytes it cannot open; a passkey (WebAuthn PRF) may wrap the same bytes later without changing this shape.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "method",++ "kdf",++ "iterations",++ "salt",++ "nonce",++ "wrapped_keys"++ ],++ "properties": {++ "method": {++ "enum": [++ "passphrase"++ ],++ "description": "How the private keys are wrapped. A passkey-only locker comes later."++ },++ "kdf": {++ "const": "PBKDF2-SHA-256"++ },++ "iterations": {++ "type": "integer",++ "minimum": 600000,++ "maximum": 10000000++ },++ "salt": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{22}==$",++ "description": "Sixteen random bytes, base64."++ },++ "nonce": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]{16}$",++ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped keys."++ },++ "wrapped_keys": {++ "type": "string",++ "pattern": "^[A-Za-z0-9+/]+={0,2}$",++ "description": "The two private keys as JWKs, sealed with AES-256-GCM under the derived key, base64."++ }++ }++ }++ },++ "locker.key-change": {++ "version": "1.0.0",++ "owner": "network",++ "status": "active",++ "schema": {++ "$schema": "https://json-schema.org/draft/2020-12/schema",++ "$id": "https://openvibe.network/contracts/locker/key-change.v1.json",++ "title": "LockerKeyChange",++ "description": "locker.key-change@1: a record that a person's locker keys changed, so the share sheet can warn before sharing with a key that is not the one people saw before.",++ "type": "object",++ "additionalProperties": false,++ "required": [++ "subject",++ "reason",++ "changed_at",++ "fingerprint"++ ],++ "properties": {++ "subject": {++ "$ref": "../identity/subject-ref.v1.json"++ },++ "reason": {++ "enum": [++ "created",++ "rotated",++ "restored"++ ]++ },++ "changed_at": {++ "type": "string",++ "format": "date-time"++ },++ "fingerprint": {++ "type": "string",++ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",++ "description": "The eight words of the new keys, in two groups of four joined by a middle dot."++ },++ "previous_fingerprint": {++ "type": "string",++ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",++ "description": "The eight words before the change, when there were any."++ }++ }++ }}}}@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Actor API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.AI API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Bench API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Bench as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Bench as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Billing API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Blog API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Bot API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Chat API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Codes API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Community API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Coupons API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Deals API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Domains API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Domains as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Domains as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Events API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Food API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Games API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Host API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Inventory API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Live API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.MediaHub API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Media API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Network API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.News API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenRestream API",-- "version": "0.291.0",-- "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Play API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Quest API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Report API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Report as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Report as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Reviews API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Run API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Search API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Services API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Sources API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Space API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Tips API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Today API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Today as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Today as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Tools API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Trade API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.VIP API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Vision API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Vision as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Vision as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Watch API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Wiki API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Work API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -3,8 +3,8 @@"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema","info": {"title": "OpenVibe.Zone API",-- "version": "0.291.0",-- "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",++ "version": "0.292.0",++ "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.","license": {"name": "MIT","identifier": "MIT"@@@ -291661,7 +291661,7 @@ export interface ShareResourceRef {id: string;}--/** [email protected] (owner: network) */++/** [email protected] (owner: network) *//*** share.member@1: a member with their Network identity fields. username, display_name and avatar_url are null when Network does not know the subject (or reports it banned or deleted).*/@@@ -291674,9 +291674,10 @@ export interface ShareMember {expires_at?: string;added_by: SubjectRef;added_at: string;++ key_slot?: LockerPeopleSlot;}--/** [email protected] (owner: network) */++/** [email protected] (owner: network) *//*** share.member-input@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days.*/@@@ -291685,6 +291686,7 @@ export type ShareMemberInput = {subject?: SubjectRef;role: "viewer" | "editor";expires_at?: string;++ key_slot?: LockerPeopleSlot;} & {[k: string]: unknown | undefined;};@@@ -291714,7 +291716,7 @@ export interface ShareAccessRequest {state: "pending" | "granted" | "dismissed";}--/** [email protected] (owner: network) */++/** [email protected] (owner: network) *//*** share@1: the uniform GET/PUT body. People, not bare subjects; ids only, never a resource title or content except the service's own describe() (title and link). Members apply to people audience; pending recipients may preview for seven days.*/@@@ -291728,6 +291730,10 @@ export interface Share {*/members: ShareMember[];transfer?: ShareTransferView;++ /**++ * How the resource is sealed (Locker). none means it is stored as it is; people, password and link are the three Locker locks. The server stores the envelope and never opens it.++ */++ lock?: "none" | "people" | "password" | "link";you: ShareYou;requests: ShareAccessRequestView[];title: string | null;@@@ -291798,9 +291804,9 @@ export interface SharePeopleLookup {person: SharePerson | null;}--/** [email protected] (owner: network) */++/** [email protected] (owner: network) *//**-- * share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days.++ * share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days. `lock` sets how the resource itself is sealed (Locker).*/export interface ShareUpdateRequest {audience?: "public" | "link" | "people" | "private";@@@ -291809,6 +291815,10 @@ export interface ShareUpdateRequest {*/members?: ShareMemberInput[];notify?: boolean;++ /**++ * How the resource is sealed (Locker).++ */++ lock?: "none" | "people" | "password" | "link";}/** [email protected] (owner: network) */@@@ -291947,3 +291957,189 @@ export interface ShareTransferDeclinedPayload {occurred_at: string;transfer: ShareTransfer;}++++/** [email protected] (owner: network) */++/**++ * locker.envelope@1: the header of a Locker envelope. It is the JSON that opens every chunk of the envelope bytes: the suite, the chunk size, the padded size, the counter nonce base and one key slot per way in. The content key is never in the header; it is wrapped inside a slot. Every chunk authenticates the header's core fields (version, suite, chunk_size, padded_size, nonce_base, lock) as associated data, so the framing, the size and the lock kind cannot be changed; the slots sit outside that core on purpose, because adding a member re-wraps the content key without re-encrypting the content, and each slot carries its own AES-GCM tag over the content key with its own parameters bound in.++ */++export type LockerEnvelope = {++ [k: string]: unknown | undefined;++} & {++ version: "locker.envelope.v1";++ suite: "AES-256-GCM";++ /**++ * The chunk size in bytes: 1 MiB. Fixed for this version.++ */++ chunk_size: 1048576;++ /**++ * The size of the padded plaintext in bytes. The true size lives inside the encrypted content, so the server cannot read it; this is the size it may store and show. The size is padded with Padmé (Nikitin et al., PoPETs 2019): it is the next size on a grid that gets finer as the content grows, at most twelve per cent over the real one, and never below 256 bytes. Every chunk but the last is a whole chunk; the last holds what is left of this size.++ */++ padded_size: number;++ /**++ * Eight random bytes, base64: the first half of every chunk nonce. The second half is the chunk counter, so no nonce repeats inside one envelope.++ */++ nonce_base: string;++ /**++ * Which way in the envelope has. Exactly one slot kind is present, and it matches this.++ */++ lock: "people" | "password" | "link";++ slots: {++ /**++ * @minItems 1++ * @maxItems 100++ */++ people?: [LockerPeopleSlot, ...LockerPeopleSlot[]];++ password?: LockerPasswordSlot;++ link?: LockerLinkSlot;++ };++};++++/** [email protected] (owner: network) */++/**++ * locker.people-slot@1: the content key wrapped for one person. The wrapping key is ECDH P-256 (an ephemeral key pair per envelope) put through HKDF-SHA-256, and the content key is sealed with AES-256-GCM. The tag covers the subject, the recipient's key, the ephemeral public key and the salt, so a slot cannot be moved to another person or to another envelope.++ */++export interface LockerPeopleSlot {++ subject: SubjectRef;++ algorithm: "ECDH-P256/HKDF-SHA256/AES-256-GCM";++ /**++ * The RFC 7638 thumbprint of the recipient's ECDH public key: SHA-256 over the canonical JSON of the key's four members, base64url. The slot is bound to this key as well as to the subject, and the reader checks it before it derives anything.++ */++ recipient_key: string;++ ephemeral_public_key: LockerPublicKey;++ /**++ * Sixteen random bytes, base64: the HKDF salt for this slot.++ */++ salt: string;++ /**++ * Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key.++ */++ nonce: string;++ /**++ * The 32-byte content key and its 16-byte tag, base64. Never the key itself.++ */++ wrapped_key: string;++}++++/** [email protected] (owner: network) */++/**++ * locker.password-slot@1: the content key wrapped with a password. The wrapping key comes from PBKDF2-SHA-256 with the salt and the iteration count in this slot, so both can be raised later without changing the format. The tag covers the parameters, so they cannot be weakened in transit.++ */++export interface LockerPasswordSlot {++ algorithm: "PBKDF2-SHA256/AES-256-GCM";++ kdf: "PBKDF2-SHA-256";++ /**++ * PBKDF2 iterations. 600000 is the floor for this version; the count may go up, never down.++ */++ iterations: number;++ /**++ * Sixteen random bytes, base64: the PBKDF2 salt.++ */++ salt: string;++ /**++ * Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key.++ */++ nonce: string;++ /**++ * The 32-byte content key and its 16-byte tag, base64. Never the key itself.++ */++ wrapped_key: string;++}++++/** [email protected] (owner: network) */++/**++ * locker.link-slot@1: a link lock stores no key. The content key travels in the part of the link after the #, which browsers never send to us, so this slot is empty on purpose and the envelope says only that the key is somewhere else.++ */++export interface LockerLinkSlot {}++++/** [email protected] (owner: network) */++/**++ * locker.public-key@1: one P-256 public key as a JWK. The same shape is used for the ECDH key that receives content keys and for the ECDSA key that signs the fingerprint; what a key does is decided by where it is used, never by the key itself.++ */++export interface LockerPublicKey {++ kty: "EC";++ crv: "P-256";++ /**++ * The public x coordinate, base64url, as WebCrypto exports it.++ */++ x: string;++ /**++ * The public y coordinate, base64url, as WebCrypto exports it.++ */++ y: string;++ ext?: true;++ key_ops?: ("deriveBits" | "deriveKey" | "verify")[];++}++++/** [email protected] (owner: network) */++/**++ * locker.public-keys@1: what anyone may read about a person's locker: the two public keys and the eight-word fingerprint. The fingerprint is the first eight bytes of SHA-256 over both public keys, read as eight words in two groups of four, joined by a middle dot, and the signature proves the holder owns the signing key, so a person can compare the eight words out of band and a key change is visible.++ */++export interface LockerPublicKeys {++ subject: SubjectRef;++ ecdh: LockerPublicKey;++ signing: LockerPublicKey;++ /**++ * Eight words, lower case, in two groups of four joined by a middle dot: sixty-four bits. Compare them out of band; a change means a changed key.++ */++ fingerprint: string;++ /**++ * The ECDSA signature over both public keys, base64. It proves the holder owns the signing key.++ */++ fingerprint_signature: string;++ updated_at: string;++}++++/** [email protected] (owner: network) */++/**++ * locker.keys-put-request@1: what a person sends to set their locker keys. The public keys and the fingerprint are readable by anyone; the private keys go in the backup, wrapped by a key from the locker passphrase, so the server never holds an unwrapped key.++ */++export interface LockerKeysPutRequest {++ ecdh: LockerPublicKey;++ signing: LockerPublicKey;++ fingerprint: string;++ fingerprint_signature: string;++ backup: LockerKeyBackup;++}++++/** [email protected] (owner: network) */++/**++ * locker.key-backup@1: the person's private keys, wrapped. The wrapping key comes from the locker passphrase with PBKDF2-SHA-256, so the server stores bytes it cannot open; a passkey (WebAuthn PRF) may wrap the same bytes later without changing this shape.++ */++export interface LockerKeyBackup {++ /**++ * How the private keys are wrapped. A passkey-only locker comes later.++ */++ method: "passphrase";++ kdf: "PBKDF2-SHA-256";++ iterations: number;++ /**++ * Sixteen random bytes, base64.++ */++ salt: string;++ /**++ * Twelve random bytes, base64: the AES-GCM nonce of the wrapped keys.++ */++ nonce: string;++ /**++ * The two private keys as JWKs, sealed with AES-256-GCM under the derived key, base64.++ */++ wrapped_keys: string;++}++++/** [email protected] (owner: network) */++/**++ * locker.key-change@1: a record that a person's locker keys changed, so the share sheet can warn before sharing with a key that is not the one people saw before.++ */++export interface LockerKeyChange {++ subject: SubjectRef;++ reason: "created" | "rotated" | "restored";++ changed_at: string;++ /**++ * The eight words of the new keys, in two groups of four joined by a middle dot.++ */++ fingerprint: string;++ /**++ * The eight words before the change, when there were any.++ */++ previous_fingerprint?: string;++}@@@ -1,6 +1,6 @@{"name": "openvibe-contracts",-- "version": "0.291.0",++ "version": "0.292.0","description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.","main": "index.js","types": "generated/typescript/index.d.ts",
@@ -63,3 +63,9 @@ description = "Sample model_key in ai.model-list@1 fixture: a model name placeho
@@ -63,3 +63,9 @@ description = "Sample model_key in ai.model-list@1 fixture: a model name placeho
condition = "AND"
condition = "AND"
paths = ['''^fixtures/ai\.model-list/valid/two-models\.json$''']
paths = ['''^fixtures/ai\.model-list/valid/two-models\.json$''']
regexes = ['''^llama_3\.1_8b_instruct$''']
regexes = ['''^llama_3\.1_8b_instruct$''']
+
+[[allowlists]]
+description = "Sample recipient key thumbprint in the locker fixtures: the base64url SHA-256 of made-up bytes, showing the shape of the field, not a secret"
+condition = "AND"
+paths = ['''^fixtures/locker\..*\.json$''', '''^fixtures/share/valid/locked\.json$''']
+regexes = ['''^AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8$''']
@@ -1,5 +1,13 @@
@@ -1,5 +1,13 @@
# Changelog
# Changelog
+## 0.292.0 — 2026-11-06
+
+- Add `locker.envelope@1`: the header of a sealed item — the suite (AES-256-GCM), the chunk size (1 MiB), the padded size, the counter nonce base, the lock kind and one key slot per way in. The content key is never in the header; it is wrapped in a people slot (ECDH P-256 + HKDF-SHA-256, bound to the recipient's key by its RFC 7638 thumbprint), a password slot (PBKDF2-SHA-256, 600000 iterations, the parameters in the header so they can be raised, and bounded above at 10000000 so a hostile header cannot freeze a reader) or a link slot (empty: the key travels in the link's fragment).
+- The padded size is padded with Padmé (PoPETs 2019): at most about twelve per cent over the real size, never below 256 bytes, and it leaks O(log log n) bits. Every chunk but the last is a whole chunk; the last holds the rest.
+- Add the key directory contracts: `locker.public-key@1`, `locker.public-keys@1`, `locker.keys-put-request@1`, `locker.key-backup@1` and `locker.key-change@1`, with the eight-word fingerprint (sixty-four bits, in two groups of four) and the signature that proves a person owns their signing key.
+- `share@1` and `share.update-request@1` gain `lock` (`none`, `people`, `password`, `link`), and a share member may carry that member's key slot, so a member and its slot are saved together. Additive: the fields are optional and old documents stay valid.
+- Valid and invalid fixtures cover every new contract, and the new fields of the sharing contracts. The format is written down in [docs/locker.md](docs/locker.md).
+
## 0.291.0 — 2026-11-05
## 0.291.0 — 2026-11-05
- Add `share@1`: resource refs, audiences, members and member inputs, transfers, access requests, uniform API requests and responses. Transfers are recipient-bound, last seven days, and default to removing the former owner's membership.
- Add `share@1`: resource refs, audiences, members and member inputs, transfers, access requests, uniform API requests and responses. Transfers are recipient-bound, last seven days, and default to removing the former owner's membership.
@@ -2,7 +2,7 @@
@@ -2,7 +2,7 @@
> Machine-readable contracts for the whole OpenVibe network.
> Machine-readable contracts for the whole OpenVibe network.
-**Status:** alpha (first released in Wave 1; the release is package.json's `version`, tagged). At v0.291.0: 1002 schemas in `contracts/catalog.json`, 60 service manifests, 452 capability manifests, 13 namespace manifests and the staff capability map. Service repositories run `openvibe-contracts-check` and the pin-drift check in CI, and deployed services verify service and app tokens with `serviceAuth` in production. Consumers pin release tags (each repository's `STATUS.json` names its pin). `node scripts/docs-currency.js <root>` checks every checkout's README and `STATUS.json` against its code: the pins and versions they name, a library's consumer list, the deployed flag against the manifest, README links, and the paths and migrations they name. `node scripts/estate.js` generates `docs/ESTATE.md` and `manifests/repositories/` from the estate checkouts, and `--check` fails on drift (plan T1 step 3).
+**Status:** alpha (first released in Wave 1; the release is package.json's `version`, tagged). At v0.292.0: 1016 schemas in `contracts/catalog.json`, 60 service manifests, 452 capability manifests, 13 namespace manifests and the staff capability map. Service repositories run `openvibe-contracts-check` and the pin-drift check in CI, and deployed services verify service and app tokens with `serviceAuth` in production. Consumers pin release tags (each repository's `STATUS.json` names its pin). `node scripts/docs-currency.js <root>` checks every checkout's README and `STATUS.json` against its code: the pins and versions they name, a library's consumer list, the deployed flag against the manifest, README links, and the paths and migrations they name. `node scripts/estate.js` generates `docs/ESTATE.md` and `manifests/repositories/` from the estate checkouts, and `--check` fails on drift (plan T1 step 3).
**Plan:** OpenVibe Development Roadmap, Wave 1 (implementation plan rev 3, §3.1 and §18.11).
**Plan:** OpenVibe Development Roadmap, Wave 1 (implementation plan rev 3, §3.1 and §18.11).
**License:** AGPL-3.0 (same as every OpenVibe service).
**License:** AGPL-3.0 (same as every OpenVibe service).
@@ -352,3 +352,5 @@ package reports version `0.28.0` and contains both changes (Codes: `codes.app-ma
@@ -352,3 +352,5 @@ package reports version `0.28.0` and contains both changes (Codes: `codes.app-ma
stays for consumers that already pinned it and is identical.
stays for consumers that already pinned it and is identical.
The network-wide [sharing contracts](docs/sharing.md) define the uniform access and ownership-transfer API (`share@1`).
The network-wide [sharing contracts](docs/sharing.md) define the uniform access and ownership-transfer API (`share@1`).
+
+The [Locker contracts](docs/locker.md) define the sealed envelope (`locker.envelope@1`), its key slots and the key directory API: end-to-end encryption for anything on OpenVibe.
@@ -9124,7 +9124,7 @@
@@ -9124,7 +9124,7 @@
},
},
{
{
"id": "share.member",
"id": "share.member",
- "version": "1.0.0",
+ "version": "1.1.0",
"owner": "network",
"owner": "network",
"schema": "share/member.v1.json",
"schema": "share/member.v1.json",
"visibility": "public",
"visibility": "public",
@@ -9133,7 +9133,7 @@
@@ -9133,7 +9133,7 @@
},
},
{
{
"id": "share.member-input",
"id": "share.member-input",
- "version": "1.0.0",
+ "version": "1.1.0",
"owner": "network",
"owner": "network",
"schema": "share/member-input.v1.json",
"schema": "share/member-input.v1.json",
"visibility": "public",
"visibility": "public",
@@ -9160,7 +9160,7 @@
@@ -9160,7 +9160,7 @@
},
},
{
{
"id": "share",
"id": "share",
- "version": "1.0.0",
+ "version": "1.1.0",
"owner": "network",
"owner": "network",
"schema": "share/share.v1.json",
"schema": "share/share.v1.json",
"visibility": "public",
"visibility": "public",
@@ -9214,7 +9214,7 @@
@@ -9214,7 +9214,7 @@
},
},
{
{
"id": "share.update-request",
"id": "share.update-request",
- "version": "1.0.0",
+ "version": "1.1.0",
"owner": "network",
"owner": "network",
"schema": "share/update-request.v1.json",
"schema": "share/update-request.v1.json",
"visibility": "public",
"visibility": "public",
@@ -9301,6 +9301,87 @@
@@ -9301,6 +9301,87 @@
"visibility": "first-party",
"visibility": "first-party",
"compatibility": "backward",
"compatibility": "backward",
"status": "active"
"status": "active"
+ },
+ {
+ "id": "locker.envelope",
+ "version": "1.0.0",
+ "owner": "network",
+ "schema": "locker/envelope.v1.json",
+ "visibility": "public",
+ "compatibility": "backward",
+ "status": "active"
+ },
+ {
+ "id": "locker.people-slot",
+ "version": "1.0.0",
+ "owner": "network",
+ "schema": "locker/people-slot.v1.json",
+ "visibility": "public",
+ "compatibility": "backward",
+ "status": "active"
+ },
+ {
+ "id": "locker.password-slot",
+ "version": "1.0.0",
+ "owner": "network",
+ "schema": "locker/password-slot.v1.json",
+ "visibility": "public",
+ "compatibility": "backward",
+ "status": "active"
+ },
+ {
+ "id": "locker.link-slot",
+ "version": "1.0.0",
+ "owner": "network",
+ "schema": "locker/link-slot.v1.json",
+ "visibility": "public",
+ "compatibility": "backward",
+ "status": "active"
+ },
+ {
+ "id": "locker.public-key",
+ "version": "1.0.0",
+ "owner": "network",
+ "schema": "locker/public-key.v1.json",
+ "visibility": "public",
+ "compatibility": "backward",
+ "status": "active"
+ },
+ {
+ "id": "locker.public-keys",
+ "version": "1.0.0",
+ "owner": "network",
+ "schema": "locker/public-keys.v1.json",
+ "visibility": "public",
+ "compatibility": "backward",
+ "status": "active"
+ },
+ {
+ "id": "locker.keys-put-request",
+ "version": "1.0.0",
+ "owner": "network",
+ "schema": "locker/keys-put-request.v1.json",
+ "visibility": "public",
+ "compatibility": "backward",
+ "status": "active"
+ },
+ {
+ "id": "locker.key-backup",
+ "version": "1.0.0",
+ "owner": "network",
+ "schema": "locker/key-backup.v1.json",
+ "visibility": "public",
+ "compatibility": "backward",
+ "status": "active"
+ },
+ {
+ "id": "locker.key-change",
+ "version": "1.0.0",
+ "owner": "network",
+ "schema": "locker/key-change.v1.json",
+ "visibility": "public",
+ "compatibility": "backward",
+ "status": "active"
}
}
]
]
}
}
new file mode 100644
new file mode 100644
@@ -0,0 +1,183 @@
@@ -0,0 +1,183 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/envelope.v1.json",
+ "title": "LockerEnvelope",
+ "description": "locker.envelope@1: the header of a Locker envelope. It is the JSON that opens every chunk of the envelope bytes: the suite, the chunk size, the padded size, the counter nonce base and one key slot per way in. The content key is never in the header; it is wrapped inside a slot. Every chunk authenticates the header's core fields (version, suite, chunk_size, padded_size, nonce_base, lock) as associated data, so the framing, the size and the lock kind cannot be changed; the slots sit outside that core on purpose, because adding a member re-wraps the content key without re-encrypting the content, and each slot carries its own AES-GCM tag over the content key with its own parameters bound in.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "version",
+ "suite",
+ "chunk_size",
+ "padded_size",
+ "nonce_base",
+ "lock",
+ "slots"
+ ],
+ "properties": {
+ "version": {
+ "const": "locker.envelope.v1"
+ },
+ "suite": {
+ "const": "AES-256-GCM"
+ },
+ "chunk_size": {
+ "const": 1048576,
+ "description": "The chunk size in bytes: 1 MiB. Fixed for this version."
+ },
+ "padded_size": {
+ "type": "integer",
+ "minimum": 256,
+ "description": "The size of the padded plaintext in bytes. The true size lives inside the encrypted content, so the server cannot read it; this is the size it may store and show. The size is padded with Padmé (Nikitin et al., PoPETs 2019): it is the next size on a grid that gets finer as the content grows, at most twelve per cent over the real one, and never below 256 bytes. Every chunk but the last is a whole chunk; the last holds what is left of this size."
+ },
+ "nonce_base": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{11}=$",
+ "description": "Eight random bytes, base64: the first half of every chunk nonce. The second half is the chunk counter, so no nonce repeats inside one envelope."
+ },
+ "lock": {
+ "enum": [
+ "people",
+ "password",
+ "link"
+ ],
+ "description": "Which way in the envelope has. Exactly one slot kind is present, and it matches this."
+ },
+ "slots": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "people": {
+ "type": "array",
+ "minItems": 1,
+ "maxItems": 100,
+ "items": {
+ "$ref": "people-slot.v1.json"
+ }
+ },
+ "password": {
+ "$ref": "password-slot.v1.json"
+ },
+ "link": {
+ "$ref": "link-slot.v1.json"
+ }
+ }
+ }
+ },
+ "allOf": [
+ {
+ "if": {
+ "properties": {
+ "lock": {
+ "const": "people"
+ }
+ },
+ "required": [
+ "lock"
+ ]
+ },
+ "then": {
+ "properties": {
+ "slots": {
+ "type": "object",
+ "required": [
+ "people"
+ ],
+ "not": {
+ "anyOf": [
+ {
+ "type": "object",
+ "required": [
+ "password"
+ ]
+ },
+ {
+ "type": "object",
+ "required": [
+ "link"
+ ]
+ }
+ ]
+ }
+ }
+ }
+ }
+ },
+ {
+ "if": {
+ "properties": {
+ "lock": {
+ "const": "password"
+ }
+ },
+ "required": [
+ "lock"
+ ]
+ },
+ "then": {
+ "properties": {
+ "slots": {
+ "type": "object",
+ "required": [
+ "password"
+ ],
+ "not": {
+ "anyOf": [
+ {
+ "type": "object",
+ "required": [
+ "people"
+ ]
+ },
+ {
+ "type": "object",
+ "required": [
+ "link"
+ ]
+ }
+ ]
+ }
+ }
+ }
+ }
+ },
+ {
+ "if": {
+ "properties": {
+ "lock": {
+ "const": "link"
+ }
+ },
+ "required": [
+ "lock"
+ ]
+ },
+ "then": {
+ "properties": {
+ "slots": {
+ "type": "object",
+ "required": [
+ "link"
+ ],
+ "not": {
+ "anyOf": [
+ {
+ "type": "object",
+ "required": [
+ "people"
+ ]
+ },
+ {
+ "type": "object",
+ "required": [
+ "password"
+ ]
+ }
+ ]
+ }
+ }
+ }
+ }
+ }
+ ]
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,47 @@
@@ -0,0 +1,47 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/key-backup.v1.json",
+ "title": "LockerKeyBackup",
+ "description": "locker.key-backup@1: the person's private keys, wrapped. The wrapping key comes from the locker passphrase with PBKDF2-SHA-256, so the server stores bytes it cannot open; a passkey (WebAuthn PRF) may wrap the same bytes later without changing this shape.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "method",
+ "kdf",
+ "iterations",
+ "salt",
+ "nonce",
+ "wrapped_keys"
+ ],
+ "properties": {
+ "method": {
+ "enum": [
+ "passphrase"
+ ],
+ "description": "How the private keys are wrapped. A passkey-only locker comes later."
+ },
+ "kdf": {
+ "const": "PBKDF2-SHA-256"
+ },
+ "iterations": {
+ "type": "integer",
+ "minimum": 600000,
+ "maximum": 10000000
+ },
+ "salt": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{22}==$",
+ "description": "Sixteen random bytes, base64."
+ },
+ "nonce": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{16}$",
+ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped keys."
+ },
+ "wrapped_keys": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]+={0,2}$",
+ "description": "The two private keys as JWKs, sealed with AES-256-GCM under the derived key, base64."
+ }
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,40 @@
@@ -0,0 +1,40 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/key-change.v1.json",
+ "title": "LockerKeyChange",
+ "description": "locker.key-change@1: a record that a person's locker keys changed, so the share sheet can warn before sharing with a key that is not the one people saw before.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "subject",
+ "reason",
+ "changed_at",
+ "fingerprint"
+ ],
+ "properties": {
+ "subject": {
+ "$ref": "../identity/subject-ref.v1.json"
+ },
+ "reason": {
+ "enum": [
+ "created",
+ "rotated",
+ "restored"
+ ]
+ },
+ "changed_at": {
+ "type": "string",
+ "format": "date-time"
+ },
+ "fingerprint": {
+ "type": "string",
+ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",
+ "description": "The eight words of the new keys, in two groups of four joined by a middle dot."
+ },
+ "previous_fingerprint": {
+ "type": "string",
+ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",
+ "description": "The eight words before the change, when there were any."
+ }
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,34 @@
@@ -0,0 +1,34 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/keys-put-request.v1.json",
+ "title": "LockerKeysPutRequest",
+ "description": "locker.keys-put-request@1: what a person sends to set their locker keys. The public keys and the fingerprint are readable by anyone; the private keys go in the backup, wrapped by a key from the locker passphrase, so the server never holds an unwrapped key.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "ecdh",
+ "signing",
+ "fingerprint",
+ "fingerprint_signature",
+ "backup"
+ ],
+ "properties": {
+ "ecdh": {
+ "$ref": "public-key.v1.json"
+ },
+ "signing": {
+ "$ref": "public-key.v1.json"
+ },
+ "fingerprint": {
+ "type": "string",
+ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$"
+ },
+ "fingerprint_signature": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{86}==$"
+ },
+ "backup": {
+ "$ref": "key-backup.v1.json"
+ }
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,9 @@
@@ -0,0 +1,9 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/link-slot.v1.json",
+ "title": "LockerLinkSlot",
+ "description": "locker.link-slot@1: a link lock stores no key. The content key travels in the part of the link after the #, which browsers never send to us, so this slot is empty on purpose and the envelope says only that the key is somewhere else.",
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {}
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,45 @@
@@ -0,0 +1,45 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/password-slot.v1.json",
+ "title": "LockerPasswordSlot",
+ "description": "locker.password-slot@1: the content key wrapped with a password. The wrapping key comes from PBKDF2-SHA-256 with the salt and the iteration count in this slot, so both can be raised later without changing the format. The tag covers the parameters, so they cannot be weakened in transit.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "algorithm",
+ "kdf",
+ "iterations",
+ "salt",
+ "nonce",
+ "wrapped_key"
+ ],
+ "properties": {
+ "algorithm": {
+ "const": "PBKDF2-SHA256/AES-256-GCM"
+ },
+ "kdf": {
+ "const": "PBKDF2-SHA-256"
+ },
+ "iterations": {
+ "type": "integer",
+ "minimum": 600000,
+ "maximum": 10000000,
+ "description": "PBKDF2 iterations. 600000 is the floor for this version; the count may go up, never down."
+ },
+ "salt": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{22}==$",
+ "description": "Sixteen random bytes, base64: the PBKDF2 salt."
+ },
+ "nonce": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{16}$",
+ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key."
+ },
+ "wrapped_key": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{64}$",
+ "description": "The 32-byte content key and its 16-byte tag, base64. Never the key itself."
+ }
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,48 @@
@@ -0,0 +1,48 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/people-slot.v1.json",
+ "title": "LockerPeopleSlot",
+ "description": "locker.people-slot@1: the content key wrapped for one person. The wrapping key is ECDH P-256 (an ephemeral key pair per envelope) put through HKDF-SHA-256, and the content key is sealed with AES-256-GCM. The tag covers the subject, the recipient's key, the ephemeral public key and the salt, so a slot cannot be moved to another person or to another envelope.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "subject",
+ "algorithm",
+ "recipient_key",
+ "ephemeral_public_key",
+ "salt",
+ "nonce",
+ "wrapped_key"
+ ],
+ "properties": {
+ "subject": {
+ "$ref": "../identity/subject-ref.v1.json"
+ },
+ "algorithm": {
+ "const": "ECDH-P256/HKDF-SHA256/AES-256-GCM"
+ },
+ "recipient_key": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9_-]{43}$",
+ "description": "The RFC 7638 thumbprint of the recipient's ECDH public key: SHA-256 over the canonical JSON of the key's four members, base64url. The slot is bound to this key as well as to the subject, and the reader checks it before it derives anything."
+ },
+ "ephemeral_public_key": {
+ "$ref": "public-key.v1.json"
+ },
+ "salt": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{22}==$",
+ "description": "Sixteen random bytes, base64: the HKDF salt for this slot."
+ },
+ "nonce": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{16}$",
+ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key."
+ },
+ "wrapped_key": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{64}$",
+ "description": "The 32-byte content key and its 16-byte tag, base64. Never the key itself."
+ }
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,45 @@
@@ -0,0 +1,45 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/public-key.v1.json",
+ "title": "LockerPublicKey",
+ "description": "locker.public-key@1: one P-256 public key as a JWK. The same shape is used for the ECDH key that receives content keys and for the ECDSA key that signs the fingerprint; what a key does is decided by where it is used, never by the key itself.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "kty",
+ "crv",
+ "x",
+ "y"
+ ],
+ "properties": {
+ "kty": {
+ "const": "EC"
+ },
+ "crv": {
+ "const": "P-256"
+ },
+ "x": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9_-]{43}$",
+ "description": "The public x coordinate, base64url, as WebCrypto exports it."
+ },
+ "y": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9_-]{43}$",
+ "description": "The public y coordinate, base64url, as WebCrypto exports it."
+ },
+ "ext": {
+ "const": true
+ },
+ "key_ops": {
+ "type": "array",
+ "items": {
+ "enum": [
+ "deriveBits",
+ "deriveKey",
+ "verify"
+ ]
+ }
+ }
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,41 @@
@@ -0,0 +1,41 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/public-keys.v1.json",
+ "title": "LockerPublicKeys",
+ "description": "locker.public-keys@1: what anyone may read about a person's locker: the two public keys and the eight-word fingerprint. The fingerprint is the first eight bytes of SHA-256 over both public keys, read as eight words in two groups of four, joined by a middle dot, and the signature proves the holder owns the signing key, so a person can compare the eight words out of band and a key change is visible.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "subject",
+ "ecdh",
+ "signing",
+ "fingerprint",
+ "fingerprint_signature",
+ "updated_at"
+ ],
+ "properties": {
+ "subject": {
+ "$ref": "../identity/subject-ref.v1.json"
+ },
+ "ecdh": {
+ "$ref": "public-key.v1.json"
+ },
+ "signing": {
+ "$ref": "public-key.v1.json"
+ },
+ "fingerprint": {
+ "type": "string",
+ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",
+ "description": "Eight words, lower case, in two groups of four joined by a middle dot: sixty-four bits. Compare them out of band; a change means a changed key."
+ },
+ "fingerprint_signature": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{86}==$",
+ "description": "The ECDSA signature over both public keys, base64. It proves the holder owns the signing key."
+ },
+ "updated_at": {
+ "type": "string",
+ "format": "date-time"
+ }
+ }
+}
@@ -22,6 +22,9 @@
@@ -22,6 +22,9 @@
"expires_at": {
"expires_at": {
"type": "string",
"type": "string",
"format": "date-time"
"format": "date-time"
+ },
+ "key_slot": {
+ "$ref": "../locker/people-slot.v1.json"
}
}
},
},
"required": [
"required": [
@@ -43,6 +43,9 @@
@@ -43,6 +43,9 @@
"added_at": {
"added_at": {
"type": "string",
"type": "string",
"format": "date-time"
"format": "date-time"
+ },
+ "key_slot": {
+ "$ref": "../locker/people-slot.v1.json"
}
}
},
},
"required": [
"required": [
@@ -33,6 +33,15 @@
@@ -33,6 +33,15 @@
"transfer": {
"transfer": {
"$ref": "transfer-view.v1.json"
"$ref": "transfer-view.v1.json"
},
},
+ "lock": {
+ "enum": [
+ "none",
+ "people",
+ "password",
+ "link"
+ ],
+ "description": "How the resource is sealed (Locker). none means it is stored as it is; people, password and link are the three Locker locks. The server stores the envelope and never opens it."
+ },
"you": {
"you": {
"$ref": "you.v1.json"
"$ref": "you.v1.json"
},
},
@@ -2,7 +2,7 @@
@@ -2,7 +2,7 @@
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://openvibe.network/contracts/share/update-request.v1.json",
"$id": "https://openvibe.network/contracts/share/update-request.v1.json",
"title": "ShareUpdateRequest",
"title": "ShareUpdateRequest",
- "description": "share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days.",
+ "description": "share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days. `lock` sets how the resource itself is sealed (Locker).",
"type": "object",
"type": "object",
"additionalProperties": false,
"additionalProperties": false,
"properties": {
"properties": {
@@ -24,6 +24,15 @@
@@ -24,6 +24,15 @@
"notify": {
"notify": {
"type": "boolean",
"type": "boolean",
"default": true
"default": true
+ },
+ "lock": {
+ "enum": [
+ "none",
+ "people",
+ "password",
+ "link"
+ ],
+ "description": "How the resource is sealed (Locker)."
}
}
},
},
"required": [],
"required": [],
new file mode 100644
new file mode 100644
@@ -0,0 +1,183 @@
@@ -0,0 +1,183 @@
+# Locker: end-to-end encryption for anything on OpenVibe
+
+`locker.envelope@1` (`contracts/locker/envelope.v1.json`) is the format. The library that reads and writes it is
+`openvibe-sdk/locker` (Node and the browser); `openvibe-sdk/locker/server` checks an envelope's header without
+decrypting it.
+
+Locker sits on top of sharing: sharing decides **who may fetch** a thing, Locker decides **who can read** it. With a
+locked item, OpenVibe stores and serves only ciphertext, and the keys never reach our servers.
+
+## The three locks
+
+| Lock | Who can open it | What the header holds |
+| --- | --- | --- |
+| `people` | you and the people you shared with, each with their own key | one key slot per recipient |
+| `password` | anyone you give the password to | one password slot (PBKDF2 parameters) |
+| `link` | anyone with the full link | nothing: the key is in the part after `#` |
+
+`share@1` carries the same three names plus `none` in its `lock` field, so a service knows how an item is sealed
+without opening it.
+
+## The envelope bytes
+
+```
+0 4 8 8 + header length
++------+------+--------------------------+--------------------------+
+| OVLK | len | header JSON (UTF-8) | chunk frames |
++------+------+--------------------------+--------------------------+
+```
+
+* `OVLK` — four ASCII bytes. A service that does not know Locker can tell at once.
+* `len` — the header length, unsigned 32-bit big endian.
+* The header — the JSON object below, exactly `len` bytes, nothing else. The header is never encrypted: it holds no
+ key material, only wrapped keys.
+
+Each chunk frame is:
+
+```
+0 4 5 17
++------+------+--------------------------+--------------------------+
+| len | flags| nonce (12 bytes) | ciphertext + 16-byte tag |
++------+------+--------------------------+--------------------------+
+```
+
+* `len` — the ciphertext length, unsigned 32-bit big endian: the plaintext of the chunk plus the 16-byte GCM tag.
+ Every chunk but the last holds a whole chunk (1 MiB) of plaintext; the last holds what is left of
+ `padded_size`, which is more than zero bytes.
+* `flags` — bit 0 (`0x01`) marks the **final chunk**. Every other bit is zero in this version.
+* `nonce` — the 12-byte GCM nonce: the header's `nonce_base` (8 random bytes) followed by the chunk counter
+ (unsigned 32-bit big endian). No nonce repeats inside one envelope.
+
+## The header
+
+```json
+{
+ "version": "locker.envelope.v1",
+ "suite": "AES-256-GCM",
+ "chunk_size": 1048576,
+ "padded_size": 256,
+ "nonce_base": "YmJiYmJiYmI=",
+ "lock": "people",
+ "slots": { "people": [ { "subject": {}, "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM", "recipient_key": "", "ephemeral_public_key": {}, "salt": "", "nonce": "", "wrapped_key": "" } ] }
+}
+```
+
+* `version` — `locker.envelope.v1`. A new format is a new file and a new catalog entry.
+* `suite` — `AES-256-GCM`. The content key is 32 bytes.
+* `chunk_size` — 1 MiB, fixed in this version.
+* `padded_size` — the size of the padded plaintext, in bytes. **The true size lives inside the encrypted
+ content**, so the server cannot read it; this is the size it may store and show. It is padded with Padmé
+ (see below) and is never below 256 bytes.
+* `nonce_base` — eight random bytes, base64: the first half of every chunk nonce.
+* `lock` — `people`, `password` or `link`. Exactly one slot kind is present, and it matches.
+* `slots` — the key slots. The content key itself is never in the header.
+
+### What is authenticated, and what is not
+
+Every chunk authenticates the header's **core** as associated data:
+
+```
+AAD = UTF-8(canonical JSON of {version, suite, chunk_size, padded_size, nonce_base, lock})
+ || counter (4 bytes, big endian)
+ || flags (1 byte)
+```
+
+The canonical JSON is that object with its keys in exactly that order and no whitespace, which both ends build the
+same way. So the framing, the size, the nonce base and the lock kind cannot be changed: the chunks stop verifying.
+
+The **slots are deliberately outside that core**. Adding a member to a people-locked item wraps the content key for
+the new member; it does not re-encrypt the content, so the header's core cannot change either. Each slot is
+authenticated on its own instead: the slot's AES-GCM tag covers the content key *and* the slot's own parameters
+(the subject, the ephemeral public key and the salt for a people slot; the iteration count and the salt for a
+password slot). A slot therefore cannot be moved to another person, replayed from another envelope, or have its
+parameters weakened in transit.
+
+### The padded plaintext
+
+The plaintext inside the chunks is:
+
+```
+8 bytes the true length, unsigned 64-bit big endian
+N bytes the content
+rest zero padding, up to the next chunk boundary
+```
+
+`padded_size` counts all of it, padding included, and is never below 256 bytes. The length prefix is why the
+server cannot learn the size: the real length is inside the encrypted part.
+
+The padding is **Padmé** (Nikitin et al., "Reducing Metadata Leakage from Encrypted Files and Network Traffic",
+PoPETs 2019): the length is rounded up to the next size on a grid that gets finer as the length grows. The
+expansion is at most about twelve per cent (the worst case is 129 bytes padded to 144), the number of possible
+padded lengths grows like the logarithm of the content size, so the padded size leaks O(log log n) bits about the
+real one, and a short note costs 256 bytes rather than a whole megabyte. The chunk grid does not leak the size:
+only the last chunk is shorter than a chunk, and its length is `padded_size` minus the whole chunks before it.
+
+### The slots
+
+**People slot** (`locker.people-slot@1`) — one per recipient:
+
+```json
+{ "subject": { "type": "user", "id": "usr_..." }, "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",
+ "ephemeral_public_key": { "kty": "EC", "crv": "P-256", "x": "...", "y": "..." },
+ "salt": "<16 bytes, base64>", "nonce": "<12 bytes, base64>", "wrapped_key": "<48 bytes, base64>" }
+```
+
+The envelope has one ephemeral ECDH P-256 key pair. For each recipient the shared secret with their public key goes
+through HKDF-SHA-256 (salt: the slot's `salt`, info: `openvibe-locker people-slot v1|<subject id>`), and the result
+wraps the content key with AES-256-GCM. The recipient derives the same secret with their private key and the
+envelope's ephemeral public key.
+
+**Password slot** (`locker.password-slot@1`):
+
+```json
+{ "algorithm": "PBKDF2-SHA256/AES-256-GCM", "kdf": "PBKDF2-SHA-256", "iterations": 600000,
+ "salt": "<16 bytes, base64>", "nonce": "<12 bytes, base64>", "wrapped_key": "<48 bytes, base64>" }
+```
+
+PBKDF2-SHA-256 with 600000 iterations and the slot's salt gives the wrapping key. The parameters live in the header
+so they can be raised later: the reader takes the iteration count and the salt from the header, never from its own
+defaults. The floor is 600000 and the ceiling is 10000000: the count may go up, never down, and a header outside
+that range is refused before anything is derived, so a hostile header cannot make a reader work for hours.
+
+**Link slot** (`locker.link-slot@1`) — empty, on purpose. A link lock stores no key: the content key travels in the
+part of the link after `#`, which browsers never send to us.
+
+## The key directory
+
+A person's keys live on Network, opaque. The contracts are:
+
+| API | Request contract | Response contract |
+| --- | --- | --- |
+| GET /api/v1/people/:subject/keys | none | locker.public-keys@1 |
+| PUT /api/v1/me/keys | locker.keys-put-request@1 | locker.public-keys@1 |
+| GET /api/v1/me/keys/backup | none | locker.key-backup@1 |
+
+A person has two key pairs: an **ECDH P-256** pair that receives content keys, and an **ECDSA P-256** pair that signs
+the fingerprint. The **fingerprint** is the first eight bytes of SHA-256 over both public keys, read as eight words
+(256 words, eight bits each) in two groups of four, joined by a middle dot: it is short enough to say out loud and compare once. Sixty-four
+bits, not thirty-two: a server that swapped in its own key would need about 2^32 key generations to land on the same
+four words, and 2^64 for the eight. The signature over both public keys proves the holder owns the signing key, so a
+key pair is self-certifying; a change of keys changes the fingerprint, and `locker.key-change@1` records it so a share
+sheet can warn before sharing with a key nobody saw before.
+
+The private keys are stored wrapped (`locker.key-backup@1`): PBKDF2-SHA-256 from the locker passphrase, then
+AES-256-GCM. Network holds the protected copy and cannot open it. There is no reset: if the passphrase and the
+recovery kit are both lost, nobody can open the locker, including OpenVibe.
+
+## What a service does with a locked item
+
+`openvibe-sdk/locker/server` gives a service the checks in one place: it reads the header and checks its shape and
+its size, **without decrypting anything**. Then the service:
+
+* skips indexing, previews, thumbnails, transcoding and content AI;
+* shows the lock badge;
+* serves the bytes only to the people `canView` allows.
+
+A locked item is never public: everyone is disabled, and links are rate-limited. Locked storage has per-account
+quotas. Normal abuse reports work by account and link; a recipient who reports may choose to disclose the content key
+to moderators, which opens that one item only.
+
+## What we cannot do
+
+We cannot scan or moderate what is inside a locked item. That matters most for uploads. A recipient can always keep
+what they opened, and the server still sees who owns what, how big it is (padded) and when.
new file mode 100644
new file mode 100644
@@ -0,0 +1,11 @@
@@ -0,0 +1,11 @@
+{
+ "version": "locker.envelope.v1",
+ "suite": "AES-256-GCM",
+ "chunk_size": 1048576,
+ "padded_size": 256,
+ "nonce_base": "YmJiYmJiYmI=",
+ "lock": "password",
+ "slots": {
+ "link": {}
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,11 @@
@@ -0,0 +1,11 @@
+{
+ "version": "locker.envelope.v1",
+ "suite": "AES-128-GCM",
+ "chunk_size": 1048576,
+ "padded_size": 256,
+ "nonce_base": "YmJiYmJiYmI=",
+ "lock": "link",
+ "slots": {
+ "link": {}
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,11 @@
@@ -0,0 +1,11 @@
+{
+ "version": "locker.envelope.v1",
+ "suite": "AES-256-GCM",
+ "chunk_size": 1048576,
+ "padded_size": 100,
+ "nonce_base": "YmJiYmJiYmI=",
+ "lock": "link",
+ "slots": {
+ "link": {}
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,19 @@
@@ -0,0 +1,19 @@
+{
+ "version": "locker.envelope.v1",
+ "suite": "AES-256-GCM",
+ "chunk_size": 1048576,
+ "padded_size": 256,
+ "nonce_base": "YmJiYmJiYmI=",
+ "lock": "link",
+ "slots": {
+ "link": {},
+ "password": {
+ "algorithm": "PBKDF2-SHA256/AES-256-GCM",
+ "kdf": "PBKDF2-SHA-256",
+ "iterations": 600000,
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+ }
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,12 @@
@@ -0,0 +1,12 @@
+{
+ "version": "locker.envelope.v1",
+ "suite": "AES-256-GCM",
+ "chunk_size": 1048576,
+ "padded_size": 256,
+ "nonce_base": "YmJiYmJiYmI=",
+ "lock": "link",
+ "slots": {
+ "link": {}
+ },
+ "secret": "the content key never goes in the header"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,11 @@
@@ -0,0 +1,11 @@
+{
+ "version": "locker.envelope.v1",
+ "suite": "AES-256-GCM",
+ "chunk_size": 1048576,
+ "padded_size": 256,
+ "nonce_base": "YmJiYmJiYmI=",
+ "lock": "link",
+ "slots": {
+ "link": {}
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,18 @@
@@ -0,0 +1,18 @@
+{
+ "version": "locker.envelope.v1",
+ "suite": "AES-256-GCM",
+ "chunk_size": 1048576,
+ "padded_size": 256,
+ "nonce_base": "YmJiYmJiYmI=",
+ "lock": "password",
+ "slots": {
+ "password": {
+ "algorithm": "PBKDF2-SHA256/AES-256-GCM",
+ "kdf": "PBKDF2-SHA-256",
+ "iterations": 600000,
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+ }
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,26 @@
@@ -0,0 +1,26 @@
+{
+ "version": "locker.envelope.v1",
+ "suite": "AES-256-GCM",
+ "chunk_size": 1048576,
+ "padded_size": 256,
+ "nonce_base": "YmJiYmJiYmI=",
+ "lock": "people",
+ "slots": {
+ "people": [
+{
+ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR" },
+ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",
+ "recipient_key": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8",
+ "ephemeral_public_key": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+ },
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
+ ]
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,8 @@
@@ -0,0 +1,8 @@
+{
+ "method": "passphrase",
+ "kdf": "PBKDF2-SHA-256",
+ "iterations": 10000,
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,8 @@
@@ -0,0 +1,8 @@
+{
+ "method": "passphrase",
+ "kdf": "PBKDF2-SHA-256",
+ "iterations": 600000,
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,6 @@
@@ -0,0 +1,6 @@
+{
+ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },
+ "reason": "stolen",
+ "changed_at": "2026-11-06T00:00:00Z",
+ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,7 @@
@@ -0,0 +1,7 @@
+{
+ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },
+ "reason": "rotated",
+ "changed_at": "2026-11-06T00:00:00Z",
+ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow",
+ "previous_fingerprint": "amber quiet harbor stone · lake fern moss reed"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,16 @@
@@ -0,0 +1,16 @@
+{
+ "ecdh": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "signing": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow",
+ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw=="
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,24 @@
@@ -0,0 +1,24 @@
+{
+ "ecdh": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "signing": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow",
+ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==",
+ "backup": {
+ "method": "passphrase",
+ "kdf": "PBKDF2-SHA-256",
+ "iterations": 600000,
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_keys": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+ }
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,3 @@
@@ -0,0 +1,3 @@
+{
+ "key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1 @@
@@ -0,0 +1 @@
+{}
new file mode 100644
new file mode 100644
@@ -0,0 +1,8 @@
@@ -0,0 +1,8 @@
+{
+ "algorithm": "PBKDF2-SHA256/AES-256-GCM",
+ "kdf": "PBKDF2-SHA-256",
+ "iterations": 1000,
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,8 @@
@@ -0,0 +1,8 @@
+{
+ "algorithm": "PBKDF2-SHA256/AES-256-GCM",
+ "kdf": "PBKDF2-SHA-256",
+ "iterations": 600000,
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,13 @@
@@ -0,0 +1,13 @@
+{
+ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR" },
+ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",
+ "ephemeral_public_key": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+ },
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,13 @@
@@ -0,0 +1,13 @@
+{
+ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",
+ "recipient_key": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8",
+ "ephemeral_public_key": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+ },
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,13 @@
@@ -0,0 +1,13 @@
+{
+ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR" },
+ "algorithm": "RSA-OAEP/AES-256-GCM",
+ "ephemeral_public_key": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+ },
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,14 @@
@@ -0,0 +1,14 @@
+{
+ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR" },
+ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",
+ "recipient_key": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8",
+ "ephemeral_public_key": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+ },
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,6 @@
@@ -0,0 +1,6 @@
+{
+ "kty": "EC",
+ "crv": "P-384",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,6 @@
@@ -0,0 +1,6 @@
+{
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,18 @@
@@ -0,0 +1,18 @@
+{
+ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },
+ "ecdh": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "signing": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "fingerprint": "amber quiet harbor cedar-mist dawn ember willow",
+ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==",
+ "updated_at": "2026-11-06T00:00:00Z"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,18 @@
@@ -0,0 +1,18 @@
+{
+ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },
+ "ecdh": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "signing": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "fingerprint": "amber quiet harbor cedar",
+ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==",
+ "updated_at": "2026-11-06T00:00:00Z"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,18 @@
@@ -0,0 +1,18 @@
+{
+ "subject": { "type": "user", "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ" },
+ "ecdh": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "signing": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+},
+ "fingerprint": "amber quiet harbor cedar · mist dawn ember willow",
+ "fingerprint_signature": "Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==",
+ "updated_at": "2026-11-06T00:00:00Z"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,3 @@
@@ -0,0 +1,3 @@
+{
+ "lock": "secret"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,3 @@
@@ -0,0 +1,3 @@
+{
+ "lock": "password"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,72 @@
@@ -0,0 +1,72 @@
+{
+ "ref": {
+ "service": "community",
+ "kind": "paste",
+ "id": "abc"
+ },
+ "owner_subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
+ },
+ "owner": {
+ "subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
+ },
+ "username": "ursula",
+ "display_name": "Ursula",
+ "avatar_url": null
+ },
+ "audience": "people",
+ "members": [
+ {
+ "subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR"
+ },
+ "username": "maticus",
+ "display_name": "Maticus",
+ "avatar_url": "https://cdn.openvibe.network/avatars/maticus.png",
+ "role": "viewer",
+ "added_by": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
+ },
+ "added_at": "2026-11-06T00:00:00Z"
+ }
+ ],
+ "you": {
+ "subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
+ },
+ "role": "owner"
+ },
+ "requests": [
+ {
+ "id": "00000000-0000-4000-8000-000000000001",
+ "subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPS"
+ },
+ "username": "xenia",
+ "display_name": "Xenia",
+ "avatar_url": null,
+ "requested_at": "2026-11-06T00:05:00Z"
+ }
+ ],
+ "title": "LOOI bridge notes",
+ "link": "https://community.openvibe.network/p/abc",
+ "roles": [
+ "viewer",
+ "editor"
+ ],
+ "audiences": [
+ "public",
+ "link",
+ "people",
+ "private"
+ ],
+ "transferable": true,
+ "lock": "everyone"
+}
new file mode 100644
new file mode 100644
@@ -0,0 +1,89 @@
@@ -0,0 +1,89 @@
+{
+ "ref": {
+ "service": "community",
+ "kind": "paste",
+ "id": "abc"
+ },
+ "owner_subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
+ },
+ "owner": {
+ "subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
+ },
+ "username": "ursula",
+ "display_name": "Ursula",
+ "avatar_url": null
+ },
+ "audience": "people",
+ "members": [
+ {
+ "subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR"
+ },
+ "username": "maticus",
+ "display_name": "Maticus",
+ "avatar_url": "https://cdn.openvibe.network/avatars/maticus.png",
+ "role": "viewer",
+ "added_by": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
+ },
+ "added_at": "2026-11-06T00:00:00Z",
+ "key_slot": {
+ "subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPR"
+ },
+ "algorithm": "ECDH-P256/HKDF-SHA256/AES-256-GCM",
+ "recipient_key": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8",
+ "ephemeral_public_key": {
+ "kty": "EC",
+ "crv": "P-256",
+ "x": "eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg",
+ "y": "eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXk"
+ },
+ "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
+ "nonce": "bm5ubm5ubm5ubm5u",
+ "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
+ }
+ }
+ ],
+ "you": {
+ "subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ"
+ },
+ "role": "owner"
+ },
+ "requests": [
+ {
+ "id": "00000000-0000-4000-8000-000000000001",
+ "subject": {
+ "type": "user",
+ "id": "usr_01JAB2C3D4E5F6G7H8J9K0MNPS"
+ },
+ "username": "xenia",
+ "display_name": "Xenia",
+ "avatar_url": null,
+ "requested_at": "2026-11-06T00:05:00Z"
+ }
+ ],
+ "title": "LOOI bridge notes",
+ "link": "https://community.openvibe.network/p/abc",
+ "roles": [
+ "viewer",
+ "editor"
+ ],
+ "audiences": [
+ "public",
+ "link",
+ "people",
+ "private"
+ ],
+ "transferable": true,
+ "lock": "people"
+}
@@ -101619,7 +101619,7 @@
@@ -101619,7 +101619,7 @@
}
}
},
},
"share.member": {
"share.member": {
- "version": "1.0.0",
+ "version": "1.1.0",
"owner": "network",
"owner": "network",
"status": "active",
"status": "active",
"schema": {
"schema": {
@@ -101667,6 +101667,9 @@
@@ -101667,6 +101667,9 @@
"added_at": {
"added_at": {
"type": "string",
"type": "string",
"format": "date-time"
"format": "date-time"
+ },
+ "key_slot": {
+ "$ref": "../locker/people-slot.v1.json"
}
}
},
},
"required": [
"required": [
@@ -101681,7 +101684,7 @@
@@ -101681,7 +101684,7 @@
}
}
},
},
"share.member-input": {
"share.member-input": {
- "version": "1.0.0",
+ "version": "1.1.0",
"owner": "network",
"owner": "network",
"status": "active",
"status": "active",
"schema": {
"schema": {
@@ -101708,6 +101711,9 @@
@@ -101708,6 +101711,9 @@
"expires_at": {
"expires_at": {
"type": "string",
"type": "string",
"format": "date-time"
"format": "date-time"
+ },
+ "key_slot": {
+ "$ref": "../locker/people-slot.v1.json"
}
}
},
},
"required": [
"required": [
@@ -101832,7 +101838,7 @@
@@ -101832,7 +101838,7 @@
}
}
},
},
"share": {
"share": {
- "version": "1.0.0",
+ "version": "1.1.0",
"owner": "network",
"owner": "network",
"status": "active",
"status": "active",
"schema": {
"schema": {
@@ -101870,6 +101876,15 @@
@@ -101870,6 +101876,15 @@
"transfer": {
"transfer": {
"$ref": "transfer-view.v1.json"
"$ref": "transfer-view.v1.json"
},
},
+ "lock": {
+ "enum": [
+ "none",
+ "people",
+ "password",
+ "link"
+ ],
+ "description": "How the resource is sealed (Locker). none means it is stored as it is; people, password and link are the three Locker locks. The server stores the envelope and never opens it."
+ },
"you": {
"you": {
"$ref": "you.v1.json"
"$ref": "you.v1.json"
},
},
@@ -102140,14 +102155,14 @@
@@ -102140,14 +102155,14 @@
}
}
},
},
"share.update-request": {
"share.update-request": {
- "version": "1.0.0",
+ "version": "1.1.0",
"owner": "network",
"owner": "network",
"status": "active",
"status": "active",
"schema": {
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://openvibe.network/contracts/share/update-request.v1.json",
"$id": "https://openvibe.network/contracts/share/update-request.v1.json",
"title": "ShareUpdateRequest",
"title": "ShareUpdateRequest",
- "description": "share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days.",
+ "description": "share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days. `lock` sets how the resource itself is sealed (Locker).",
"type": "object",
"type": "object",
"additionalProperties": false,
"additionalProperties": false,
"properties": {
"properties": {
@@ -102169,6 +102184,15 @@
@@ -102169,6 +102184,15 @@
"notify": {
"notify": {
"type": "boolean",
"type": "boolean",
"default": true
"default": true
+ },
+ "lock": {
+ "enum": [
+ "none",
+ "people",
+ "password",
+ "link"
+ ],
+ "description": "How the resource is sealed (Locker)."
}
}
},
},
"required": [],
"required": [],
@@ -102634,6 +102658,543 @@
@@ -102634,6 +102658,543 @@
"transfer"
"transfer"
]
]
}
}
+ },
+ "locker.envelope": {
+ "version": "1.0.0",
+ "owner": "network",
+ "status": "active",
+ "schema": {
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/envelope.v1.json",
+ "title": "LockerEnvelope",
+ "description": "locker.envelope@1: the header of a Locker envelope. It is the JSON that opens every chunk of the envelope bytes: the suite, the chunk size, the padded size, the counter nonce base and one key slot per way in. The content key is never in the header; it is wrapped inside a slot. Every chunk authenticates the header's core fields (version, suite, chunk_size, padded_size, nonce_base, lock) as associated data, so the framing, the size and the lock kind cannot be changed; the slots sit outside that core on purpose, because adding a member re-wraps the content key without re-encrypting the content, and each slot carries its own AES-GCM tag over the content key with its own parameters bound in.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "version",
+ "suite",
+ "chunk_size",
+ "padded_size",
+ "nonce_base",
+ "lock",
+ "slots"
+ ],
+ "properties": {
+ "version": {
+ "const": "locker.envelope.v1"
+ },
+ "suite": {
+ "const": "AES-256-GCM"
+ },
+ "chunk_size": {
+ "const": 1048576,
+ "description": "The chunk size in bytes: 1 MiB. Fixed for this version."
+ },
+ "padded_size": {
+ "type": "integer",
+ "minimum": 256,
+ "description": "The size of the padded plaintext in bytes. The true size lives inside the encrypted content, so the server cannot read it; this is the size it may store and show. The size is padded with Padmé (Nikitin et al., PoPETs 2019): it is the next size on a grid that gets finer as the content grows, at most twelve per cent over the real one, and never below 256 bytes. Every chunk but the last is a whole chunk; the last holds what is left of this size."
+ },
+ "nonce_base": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{11}=$",
+ "description": "Eight random bytes, base64: the first half of every chunk nonce. The second half is the chunk counter, so no nonce repeats inside one envelope."
+ },
+ "lock": {
+ "enum": [
+ "people",
+ "password",
+ "link"
+ ],
+ "description": "Which way in the envelope has. Exactly one slot kind is present, and it matches this."
+ },
+ "slots": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "people": {
+ "type": "array",
+ "minItems": 1,
+ "maxItems": 100,
+ "items": {
+ "$ref": "people-slot.v1.json"
+ }
+ },
+ "password": {
+ "$ref": "password-slot.v1.json"
+ },
+ "link": {
+ "$ref": "link-slot.v1.json"
+ }
+ }
+ }
+ },
+ "allOf": [
+ {
+ "if": {
+ "properties": {
+ "lock": {
+ "const": "people"
+ }
+ },
+ "required": [
+ "lock"
+ ]
+ },
+ "then": {
+ "properties": {
+ "slots": {
+ "type": "object",
+ "required": [
+ "people"
+ ],
+ "not": {
+ "anyOf": [
+ {
+ "type": "object",
+ "required": [
+ "password"
+ ]
+ },
+ {
+ "type": "object",
+ "required": [
+ "link"
+ ]
+ }
+ ]
+ }
+ }
+ }
+ }
+ },
+ {
+ "if": {
+ "properties": {
+ "lock": {
+ "const": "password"
+ }
+ },
+ "required": [
+ "lock"
+ ]
+ },
+ "then": {
+ "properties": {
+ "slots": {
+ "type": "object",
+ "required": [
+ "password"
+ ],
+ "not": {
+ "anyOf": [
+ {
+ "type": "object",
+ "required": [
+ "people"
+ ]
+ },
+ {
+ "type": "object",
+ "required": [
+ "link"
+ ]
+ }
+ ]
+ }
+ }
+ }
+ }
+ },
+ {
+ "if": {
+ "properties": {
+ "lock": {
+ "const": "link"
+ }
+ },
+ "required": [
+ "lock"
+ ]
+ },
+ "then": {
+ "properties": {
+ "slots": {
+ "type": "object",
+ "required": [
+ "link"
+ ],
+ "not": {
+ "anyOf": [
+ {
+ "type": "object",
+ "required": [
+ "people"
+ ]
+ },
+ {
+ "type": "object",
+ "required": [
+ "password"
+ ]
+ }
+ ]
+ }
+ }
+ }
+ }
+ }
+ ]
+ }
+ },
+ "locker.people-slot": {
+ "version": "1.0.0",
+ "owner": "network",
+ "status": "active",
+ "schema": {
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/people-slot.v1.json",
+ "title": "LockerPeopleSlot",
+ "description": "locker.people-slot@1: the content key wrapped for one person. The wrapping key is ECDH P-256 (an ephemeral key pair per envelope) put through HKDF-SHA-256, and the content key is sealed with AES-256-GCM. The tag covers the subject, the recipient's key, the ephemeral public key and the salt, so a slot cannot be moved to another person or to another envelope.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "subject",
+ "algorithm",
+ "recipient_key",
+ "ephemeral_public_key",
+ "salt",
+ "nonce",
+ "wrapped_key"
+ ],
+ "properties": {
+ "subject": {
+ "$ref": "../identity/subject-ref.v1.json"
+ },
+ "algorithm": {
+ "const": "ECDH-P256/HKDF-SHA256/AES-256-GCM"
+ },
+ "recipient_key": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9_-]{43}$",
+ "description": "The RFC 7638 thumbprint of the recipient's ECDH public key: SHA-256 over the canonical JSON of the key's four members, base64url. The slot is bound to this key as well as to the subject, and the reader checks it before it derives anything."
+ },
+ "ephemeral_public_key": {
+ "$ref": "public-key.v1.json"
+ },
+ "salt": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{22}==$",
+ "description": "Sixteen random bytes, base64: the HKDF salt for this slot."
+ },
+ "nonce": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{16}$",
+ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key."
+ },
+ "wrapped_key": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{64}$",
+ "description": "The 32-byte content key and its 16-byte tag, base64. Never the key itself."
+ }
+ }
+ }
+ },
+ "locker.password-slot": {
+ "version": "1.0.0",
+ "owner": "network",
+ "status": "active",
+ "schema": {
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/password-slot.v1.json",
+ "title": "LockerPasswordSlot",
+ "description": "locker.password-slot@1: the content key wrapped with a password. The wrapping key comes from PBKDF2-SHA-256 with the salt and the iteration count in this slot, so both can be raised later without changing the format. The tag covers the parameters, so they cannot be weakened in transit.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "algorithm",
+ "kdf",
+ "iterations",
+ "salt",
+ "nonce",
+ "wrapped_key"
+ ],
+ "properties": {
+ "algorithm": {
+ "const": "PBKDF2-SHA256/AES-256-GCM"
+ },
+ "kdf": {
+ "const": "PBKDF2-SHA-256"
+ },
+ "iterations": {
+ "type": "integer",
+ "minimum": 600000,
+ "maximum": 10000000,
+ "description": "PBKDF2 iterations. 600000 is the floor for this version; the count may go up, never down."
+ },
+ "salt": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{22}==$",
+ "description": "Sixteen random bytes, base64: the PBKDF2 salt."
+ },
+ "nonce": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{16}$",
+ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key."
+ },
+ "wrapped_key": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{64}$",
+ "description": "The 32-byte content key and its 16-byte tag, base64. Never the key itself."
+ }
+ }
+ }
+ },
+ "locker.link-slot": {
+ "version": "1.0.0",
+ "owner": "network",
+ "status": "active",
+ "schema": {
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/link-slot.v1.json",
+ "title": "LockerLinkSlot",
+ "description": "locker.link-slot@1: a link lock stores no key. The content key travels in the part of the link after the #, which browsers never send to us, so this slot is empty on purpose and the envelope says only that the key is somewhere else.",
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {}
+ }
+ },
+ "locker.public-key": {
+ "version": "1.0.0",
+ "owner": "network",
+ "status": "active",
+ "schema": {
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/public-key.v1.json",
+ "title": "LockerPublicKey",
+ "description": "locker.public-key@1: one P-256 public key as a JWK. The same shape is used for the ECDH key that receives content keys and for the ECDSA key that signs the fingerprint; what a key does is decided by where it is used, never by the key itself.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "kty",
+ "crv",
+ "x",
+ "y"
+ ],
+ "properties": {
+ "kty": {
+ "const": "EC"
+ },
+ "crv": {
+ "const": "P-256"
+ },
+ "x": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9_-]{43}$",
+ "description": "The public x coordinate, base64url, as WebCrypto exports it."
+ },
+ "y": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9_-]{43}$",
+ "description": "The public y coordinate, base64url, as WebCrypto exports it."
+ },
+ "ext": {
+ "const": true
+ },
+ "key_ops": {
+ "type": "array",
+ "items": {
+ "enum": [
+ "deriveBits",
+ "deriveKey",
+ "verify"
+ ]
+ }
+ }
+ }
+ }
+ },
+ "locker.public-keys": {
+ "version": "1.0.0",
+ "owner": "network",
+ "status": "active",
+ "schema": {
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/public-keys.v1.json",
+ "title": "LockerPublicKeys",
+ "description": "locker.public-keys@1: what anyone may read about a person's locker: the two public keys and the eight-word fingerprint. The fingerprint is the first eight bytes of SHA-256 over both public keys, read as eight words in two groups of four, joined by a middle dot, and the signature proves the holder owns the signing key, so a person can compare the eight words out of band and a key change is visible.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "subject",
+ "ecdh",
+ "signing",
+ "fingerprint",
+ "fingerprint_signature",
+ "updated_at"
+ ],
+ "properties": {
+ "subject": {
+ "$ref": "../identity/subject-ref.v1.json"
+ },
+ "ecdh": {
+ "$ref": "public-key.v1.json"
+ },
+ "signing": {
+ "$ref": "public-key.v1.json"
+ },
+ "fingerprint": {
+ "type": "string",
+ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",
+ "description": "Eight words, lower case, in two groups of four joined by a middle dot: sixty-four bits. Compare them out of band; a change means a changed key."
+ },
+ "fingerprint_signature": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{86}==$",
+ "description": "The ECDSA signature over both public keys, base64. It proves the holder owns the signing key."
+ },
+ "updated_at": {
+ "type": "string",
+ "format": "date-time"
+ }
+ }
+ }
+ },
+ "locker.keys-put-request": {
+ "version": "1.0.0",
+ "owner": "network",
+ "status": "active",
+ "schema": {
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/keys-put-request.v1.json",
+ "title": "LockerKeysPutRequest",
+ "description": "locker.keys-put-request@1: what a person sends to set their locker keys. The public keys and the fingerprint are readable by anyone; the private keys go in the backup, wrapped by a key from the locker passphrase, so the server never holds an unwrapped key.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "ecdh",
+ "signing",
+ "fingerprint",
+ "fingerprint_signature",
+ "backup"
+ ],
+ "properties": {
+ "ecdh": {
+ "$ref": "public-key.v1.json"
+ },
+ "signing": {
+ "$ref": "public-key.v1.json"
+ },
+ "fingerprint": {
+ "type": "string",
+ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$"
+ },
+ "fingerprint_signature": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{86}==$"
+ },
+ "backup": {
+ "$ref": "key-backup.v1.json"
+ }
+ }
+ }
+ },
+ "locker.key-backup": {
+ "version": "1.0.0",
+ "owner": "network",
+ "status": "active",
+ "schema": {
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/key-backup.v1.json",
+ "title": "LockerKeyBackup",
+ "description": "locker.key-backup@1: the person's private keys, wrapped. The wrapping key comes from the locker passphrase with PBKDF2-SHA-256, so the server stores bytes it cannot open; a passkey (WebAuthn PRF) may wrap the same bytes later without changing this shape.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "method",
+ "kdf",
+ "iterations",
+ "salt",
+ "nonce",
+ "wrapped_keys"
+ ],
+ "properties": {
+ "method": {
+ "enum": [
+ "passphrase"
+ ],
+ "description": "How the private keys are wrapped. A passkey-only locker comes later."
+ },
+ "kdf": {
+ "const": "PBKDF2-SHA-256"
+ },
+ "iterations": {
+ "type": "integer",
+ "minimum": 600000,
+ "maximum": 10000000
+ },
+ "salt": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{22}==$",
+ "description": "Sixteen random bytes, base64."
+ },
+ "nonce": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]{16}$",
+ "description": "Twelve random bytes, base64: the AES-GCM nonce of the wrapped keys."
+ },
+ "wrapped_keys": {
+ "type": "string",
+ "pattern": "^[A-Za-z0-9+/]+={0,2}$",
+ "description": "The two private keys as JWKs, sealed with AES-256-GCM under the derived key, base64."
+ }
+ }
+ }
+ },
+ "locker.key-change": {
+ "version": "1.0.0",
+ "owner": "network",
+ "status": "active",
+ "schema": {
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://openvibe.network/contracts/locker/key-change.v1.json",
+ "title": "LockerKeyChange",
+ "description": "locker.key-change@1: a record that a person's locker keys changed, so the share sheet can warn before sharing with a key that is not the one people saw before.",
+ "type": "object",
+ "additionalProperties": false,
+ "required": [
+ "subject",
+ "reason",
+ "changed_at",
+ "fingerprint"
+ ],
+ "properties": {
+ "subject": {
+ "$ref": "../identity/subject-ref.v1.json"
+ },
+ "reason": {
+ "enum": [
+ "created",
+ "rotated",
+ "restored"
+ ]
+ },
+ "changed_at": {
+ "type": "string",
+ "format": "date-time"
+ },
+ "fingerprint": {
+ "type": "string",
+ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",
+ "description": "The eight words of the new keys, in two groups of four joined by a middle dot."
+ },
+ "previous_fingerprint": {
+ "type": "string",
+ "pattern": "^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$",
+ "description": "The eight words before the change, when there were any."
+ }
+ }
+ }
}
}
}
}
}
}
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Actor API",
"title": "OpenVibe.Actor API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.AI API",
"title": "OpenVibe.AI API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Bench API",
"title": "OpenVibe.Bench API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Bench as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Bench as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Billing API",
"title": "OpenVibe.Billing API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Blog API",
"title": "OpenVibe.Blog API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Bot API",
"title": "OpenVibe.Bot API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Chat API",
"title": "OpenVibe.Chat API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Codes API",
"title": "OpenVibe.Codes API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Community API",
"title": "OpenVibe.Community API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Coupons API",
"title": "OpenVibe.Coupons API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Deals API",
"title": "OpenVibe.Deals API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Domains API",
"title": "OpenVibe.Domains API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Domains as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Domains as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Events API",
"title": "OpenVibe.Events API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Food API",
"title": "OpenVibe.Food API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Games API",
"title": "OpenVibe.Games API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Host API",
"title": "OpenVibe.Host API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Inventory API",
"title": "OpenVibe.Inventory API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Live API",
"title": "OpenVibe.Live API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.MediaHub API",
"title": "OpenVibe.MediaHub API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Media API",
"title": "OpenVibe.Media API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Network API",
"title": "OpenVibe.Network API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.News API",
"title": "OpenVibe.News API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenRestream API",
"title": "OpenRestream API",
- "version": "0.291.0",
- "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Play API",
"title": "OpenVibe.Play API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Quest API",
"title": "OpenVibe.Quest API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Quest as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Report API",
"title": "OpenVibe.Report API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Report as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Report as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Reviews API",
"title": "OpenVibe.Reviews API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Run API",
"title": "OpenVibe.Run API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Search API",
"title": "OpenVibe.Search API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Services API",
"title": "OpenVibe.Services API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Sources API",
"title": "OpenVibe.Sources API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Space API",
"title": "OpenVibe.Space API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Tips API",
"title": "OpenVibe.Tips API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Today API",
"title": "OpenVibe.Today API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Today as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Today as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Tools API",
"title": "OpenVibe.Tools API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Trade API",
"title": "OpenVibe.Trade API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.VIP API",
"title": "OpenVibe.VIP API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Vision API",
"title": "OpenVibe.Vision API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Vision as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Vision as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Watch API",
"title": "OpenVibe.Watch API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Wiki API",
"title": "OpenVibe.Wiki API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Work API",
"title": "OpenVibe.Work API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -3,8 +3,8 @@
@@ -3,8 +3,8 @@
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
"info": {
"info": {
"title": "OpenVibe.Zone API",
"title": "OpenVibe.Zone API",
- "version": "0.291.0",
- "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.291.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
+ "version": "0.292.0",
+ "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.292.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
"license": {
"license": {
"name": "MIT",
"name": "MIT",
"identifier": "MIT"
"identifier": "MIT"
@@ -291661,7 +291661,7 @@ export interface ShareResourceRef {
@@ -291661,7 +291661,7 @@ export interface ShareResourceRef {
id: string;
id: string;
}
}
-/** [email protected] (owner: network) */
+/** [email protected] (owner: network) */
/**
/**
* share.member@1: a member with their Network identity fields. username, display_name and avatar_url are null when Network does not know the subject (or reports it banned or deleted).
* share.member@1: a member with their Network identity fields. username, display_name and avatar_url are null when Network does not know the subject (or reports it banned or deleted).
*/
*/
@@ -291674,9 +291674,10 @@ export interface ShareMember {
@@ -291674,9 +291674,10 @@ export interface ShareMember {
expires_at?: string;
expires_at?: string;
added_by: SubjectRef;
added_by: SubjectRef;
added_at: string;
added_at: string;
+ key_slot?: LockerPeopleSlot;
}
}
-/** [email protected] (owner: network) */
+/** [email protected] (owner: network) */
/**
/**
* share.member-input@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days.
* share.member-input@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days.
*/
*/
@@ -291685,6 +291686,7 @@ export type ShareMemberInput = {
@@ -291685,6 +291686,7 @@ export type ShareMemberInput = {
subject?: SubjectRef;
subject?: SubjectRef;
role: "viewer" | "editor";
role: "viewer" | "editor";
expires_at?: string;
expires_at?: string;
+ key_slot?: LockerPeopleSlot;
} & {
} & {
[k: string]: unknown | undefined;
[k: string]: unknown | undefined;
};
};
@@ -291714,7 +291716,7 @@ export interface ShareAccessRequest {
@@ -291714,7 +291716,7 @@ export interface ShareAccessRequest {
state: "pending" | "granted" | "dismissed";
state: "pending" | "granted" | "dismissed";
}
}
-/** [email protected] (owner: network) */
+/** [email protected] (owner: network) */
/**
/**
* share@1: the uniform GET/PUT body. People, not bare subjects; ids only, never a resource title or content except the service's own describe() (title and link). Members apply to people audience; pending recipients may preview for seven days.
* share@1: the uniform GET/PUT body. People, not bare subjects; ids only, never a resource title or content except the service's own describe() (title and link). Members apply to people audience; pending recipients may preview for seven days.
*/
*/
@@ -291728,6 +291730,10 @@ export interface Share {
@@ -291728,6 +291730,10 @@ export interface Share {
*/
*/
members: ShareMember[];
members: ShareMember[];
transfer?: ShareTransferView;
transfer?: ShareTransferView;
+ /**
+ * How the resource is sealed (Locker). none means it is stored as it is; people, password and link are the three Locker locks. The server stores the envelope and never opens it.
+ */
+ lock?: "none" | "people" | "password" | "link";
you: ShareYou;
you: ShareYou;
requests: ShareAccessRequestView[];
requests: ShareAccessRequestView[];
title: string | null;
title: string | null;
@@ -291798,9 +291804,9 @@ export interface SharePeopleLookup {
@@ -291798,9 +291804,9 @@ export interface SharePeopleLookup {
person: SharePerson | null;
person: SharePerson | null;
}
}
-/** [email protected] (owner: network) */
+/** [email protected] (owner: network) */
/**
/**
- * share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days.
+ * share.update-request@1: network-wide sharing. Ids only; no resource title or content. Members apply to people audience; pending recipients may preview for seven days. `lock` sets how the resource itself is sealed (Locker).
*/
*/
export interface ShareUpdateRequest {
export interface ShareUpdateRequest {
audience?: "public" | "link" | "people" | "private";
audience?: "public" | "link" | "people" | "private";
@@ -291809,6 +291815,10 @@ export interface ShareUpdateRequest {
@@ -291809,6 +291815,10 @@ export interface ShareUpdateRequest {
*/
*/
members?: ShareMemberInput[];
members?: ShareMemberInput[];
notify?: boolean;
notify?: boolean;
+ /**
+ * How the resource is sealed (Locker).
+ */
+ lock?: "none" | "people" | "password" | "link";
}
}
/** [email protected] (owner: network) */
/** [email protected] (owner: network) */
@@ -291947,3 +291957,189 @@ export interface ShareTransferDeclinedPayload {
@@ -291947,3 +291957,189 @@ export interface ShareTransferDeclinedPayload {
occurred_at: string;
occurred_at: string;
transfer: ShareTransfer;
transfer: ShareTransfer;
}
}
+
+/** [email protected] (owner: network) */
+/**
+ * locker.envelope@1: the header of a Locker envelope. It is the JSON that opens every chunk of the envelope bytes: the suite, the chunk size, the padded size, the counter nonce base and one key slot per way in. The content key is never in the header; it is wrapped inside a slot. Every chunk authenticates the header's core fields (version, suite, chunk_size, padded_size, nonce_base, lock) as associated data, so the framing, the size and the lock kind cannot be changed; the slots sit outside that core on purpose, because adding a member re-wraps the content key without re-encrypting the content, and each slot carries its own AES-GCM tag over the content key with its own parameters bound in.
+ */
+export type LockerEnvelope = {
+ [k: string]: unknown | undefined;
+} & {
+ version: "locker.envelope.v1";
+ suite: "AES-256-GCM";
+ /**
+ * The chunk size in bytes: 1 MiB. Fixed for this version.
+ */
+ chunk_size: 1048576;
+ /**
+ * The size of the padded plaintext in bytes. The true size lives inside the encrypted content, so the server cannot read it; this is the size it may store and show. The size is padded with Padmé (Nikitin et al., PoPETs 2019): it is the next size on a grid that gets finer as the content grows, at most twelve per cent over the real one, and never below 256 bytes. Every chunk but the last is a whole chunk; the last holds what is left of this size.
+ */
+ padded_size: number;
+ /**
+ * Eight random bytes, base64: the first half of every chunk nonce. The second half is the chunk counter, so no nonce repeats inside one envelope.
+ */
+ nonce_base: string;
+ /**
+ * Which way in the envelope has. Exactly one slot kind is present, and it matches this.
+ */
+ lock: "people" | "password" | "link";
+ slots: {
+ /**
+ * @minItems 1
+ * @maxItems 100
+ */
+ people?: [LockerPeopleSlot, ...LockerPeopleSlot[]];
+ password?: LockerPasswordSlot;
+ link?: LockerLinkSlot;
+ };
+};
+
+/** [email protected] (owner: network) */
+/**
+ * locker.people-slot@1: the content key wrapped for one person. The wrapping key is ECDH P-256 (an ephemeral key pair per envelope) put through HKDF-SHA-256, and the content key is sealed with AES-256-GCM. The tag covers the subject, the recipient's key, the ephemeral public key and the salt, so a slot cannot be moved to another person or to another envelope.
+ */
+export interface LockerPeopleSlot {
+ subject: SubjectRef;
+ algorithm: "ECDH-P256/HKDF-SHA256/AES-256-GCM";
+ /**
+ * The RFC 7638 thumbprint of the recipient's ECDH public key: SHA-256 over the canonical JSON of the key's four members, base64url. The slot is bound to this key as well as to the subject, and the reader checks it before it derives anything.
+ */
+ recipient_key: string;
+ ephemeral_public_key: LockerPublicKey;
+ /**
+ * Sixteen random bytes, base64: the HKDF salt for this slot.
+ */
+ salt: string;
+ /**
+ * Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key.
+ */
+ nonce: string;
+ /**
+ * The 32-byte content key and its 16-byte tag, base64. Never the key itself.
+ */
+ wrapped_key: string;
+}
+
+/** [email protected] (owner: network) */
+/**
+ * locker.password-slot@1: the content key wrapped with a password. The wrapping key comes from PBKDF2-SHA-256 with the salt and the iteration count in this slot, so both can be raised later without changing the format. The tag covers the parameters, so they cannot be weakened in transit.
+ */
+export interface LockerPasswordSlot {
+ algorithm: "PBKDF2-SHA256/AES-256-GCM";
+ kdf: "PBKDF2-SHA-256";
+ /**
+ * PBKDF2 iterations. 600000 is the floor for this version; the count may go up, never down.
+ */
+ iterations: number;
+ /**
+ * Sixteen random bytes, base64: the PBKDF2 salt.
+ */
+ salt: string;
+ /**
+ * Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key.
+ */
+ nonce: string;
+ /**
+ * The 32-byte content key and its 16-byte tag, base64. Never the key itself.
+ */
+ wrapped_key: string;
+}
+
+/** [email protected] (owner: network) */
+/**
+ * locker.link-slot@1: a link lock stores no key. The content key travels in the part of the link after the #, which browsers never send to us, so this slot is empty on purpose and the envelope says only that the key is somewhere else.
+ */
+export interface LockerLinkSlot {}
+
+/** [email protected] (owner: network) */
+/**
+ * locker.public-key@1: one P-256 public key as a JWK. The same shape is used for the ECDH key that receives content keys and for the ECDSA key that signs the fingerprint; what a key does is decided by where it is used, never by the key itself.
+ */
+export interface LockerPublicKey {
+ kty: "EC";
+ crv: "P-256";
+ /**
+ * The public x coordinate, base64url, as WebCrypto exports it.
+ */
+ x: string;
+ /**
+ * The public y coordinate, base64url, as WebCrypto exports it.
+ */
+ y: string;
+ ext?: true;
+ key_ops?: ("deriveBits" | "deriveKey" | "verify")[];
+}
+
+/** [email protected] (owner: network) */
+/**
+ * locker.public-keys@1: what anyone may read about a person's locker: the two public keys and the eight-word fingerprint. The fingerprint is the first eight bytes of SHA-256 over both public keys, read as eight words in two groups of four, joined by a middle dot, and the signature proves the holder owns the signing key, so a person can compare the eight words out of band and a key change is visible.
+ */
+export interface LockerPublicKeys {
+ subject: SubjectRef;
+ ecdh: LockerPublicKey;
+ signing: LockerPublicKey;
+ /**
+ * Eight words, lower case, in two groups of four joined by a middle dot: sixty-four bits. Compare them out of band; a change means a changed key.
+ */
+ fingerprint: string;
+ /**
+ * The ECDSA signature over both public keys, base64. It proves the holder owns the signing key.
+ */
+ fingerprint_signature: string;
+ updated_at: string;
+}
+
+/** [email protected] (owner: network) */
+/**
+ * locker.keys-put-request@1: what a person sends to set their locker keys. The public keys and the fingerprint are readable by anyone; the private keys go in the backup, wrapped by a key from the locker passphrase, so the server never holds an unwrapped key.
+ */
+export interface LockerKeysPutRequest {
+ ecdh: LockerPublicKey;
+ signing: LockerPublicKey;
+ fingerprint: string;
+ fingerprint_signature: string;
+ backup: LockerKeyBackup;
+}
+
+/** [email protected] (owner: network) */
+/**
+ * locker.key-backup@1: the person's private keys, wrapped. The wrapping key comes from the locker passphrase with PBKDF2-SHA-256, so the server stores bytes it cannot open; a passkey (WebAuthn PRF) may wrap the same bytes later without changing this shape.
+ */
+export interface LockerKeyBackup {
+ /**
+ * How the private keys are wrapped. A passkey-only locker comes later.
+ */
+ method: "passphrase";
+ kdf: "PBKDF2-SHA-256";
+ iterations: number;
+ /**
+ * Sixteen random bytes, base64.
+ */
+ salt: string;
+ /**
+ * Twelve random bytes, base64: the AES-GCM nonce of the wrapped keys.
+ */
+ nonce: string;
+ /**
+ * The two private keys as JWKs, sealed with AES-256-GCM under the derived key, base64.
+ */
+ wrapped_keys: string;
+}
+
+/** [email protected] (owner: network) */
+/**
+ * locker.key-change@1: a record that a person's locker keys changed, so the share sheet can warn before sharing with a key that is not the one people saw before.
+ */
+export interface LockerKeyChange {
+ subject: SubjectRef;
+ reason: "created" | "rotated" | "restored";
+ changed_at: string;
+ /**
+ * The eight words of the new keys, in two groups of four joined by a middle dot.
+ */
+ fingerprint: string;
+ /**
+ * The eight words before the change, when there were any.
+ */
+ previous_fingerprint?: string;
+}
@@ -1,6 +1,6 @@
@@ -1,6 +1,6 @@
{
{
"name": "openvibe-contracts",
"name": "openvibe-contracts",
- "version": "0.291.0",
+ "version": "0.292.0",
"description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
"description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
"main": "index.js",
"main": "index.js",
"types": "generated/typescript/index.d.ts",
"types": "generated/typescript/index.d.ts",