ak.schema.invite.v1

Arkret Invite

ak.schema.invite.v1 · file: schemas/invite.schema.json

* $ · object

allOf · allOf[0] · ?

* id · string

pattern: ^ak:invite:[A-Za-z0-9_-]{44}$

* schema · const "ak.schema.invite.v1"

enum: "ak.schema.invite.v1"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* inviter_account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.

* principal_id · string · $ref #/$defs/did_core_id

Canonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* station_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

invitee_account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

* principal_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* station_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

introduction_evidence_digest · string · $ref #/$defs/digest

Digest of private invite delivery introduction_evidence. Raw locator tokens and receive-policy state MUST NOT appear in durable Realm events.

pattern: ^(sha256|blake3):[0-9a-f]{64}$

third_party_invite · object · $ref #/$defs/third_party_invite

Wire-level 3PID/OOB invite binding. No plaintext email/phone/SMS code is allowed here. `oob_code_kind` distinguishes offline high-entropy token validation from server-side lookup short-code validation.

allOf · allOf[0] · ?

allOf · allOf[1] · ?

display_name_hint · string

Non-identifying UI hint only; MUST NOT contain plaintext 3PID.

* token_commitment · string

SHA-256 of the private per-invite salt followed by the raw token UTF-8 bytes. Required in both modes; lookup uses a secret 256-bit salt in addition to its rate-limited pepper/HMAC index.

pattern: ^sha256:[0-9a-f]{64}$

token_salt_id · string

Opaque handle for the verification service's private salt record. The salt value itself MUST NOT appear on wire.

pattern: ^(?!ak:)

lookup_table_ref · string

Opaque verification-service lookup table reference for short-code mode. The raw short code MUST NOT appear on wire.

pepper_id · string

Server-private pepper generation identifier for lookup mode; the pepper value itself is never on wire.

pattern: ^(?!ak:)

* oob_code_kind · string (enum)

offline_token means the out-of-band code is itself >=128-bit entropy and validated against token_commitment. lookup means the human-readable code is only an index into a server-private lookup table protected by rate limits and pepper/HMAC storage.

enum: "offline_token" "lookup"

token_entropy_bits · integer

Required for offline_token mode. Entropy estimate excluding separators.

* verification_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* verification_public_key · string

Ephemeral public key or DID verification method used by the verification service to sign claim results.

max_claims · integer

example: 1

capability_grant_refs · array<string>

items · string

pattern: ^ak:grant:[A-Za-z0-9_-]{44}$

* state · string (enum)

enum: "pending" "accepted" "rejected" "revoked" "expired" "claimed" "send_failed" "revoked_by_capability_loss" "revoked_by_inviter_left" "invalidated_by_rate_limit"

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

updated_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

updated_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

(^x_[a-z][a-z0-9_]{0,63}$) · any

Source

registry row: spec/v1/artifacts/registry/schema-registry.json
schema document: spec/v1/artifacts/schemas/invite.schema.json