this repo has no description
Split data model ER diagram into three focused diagrams
Identity/keys, records/sharing, and workspaces/proposals as separate
mermaid blocks — easier to read than one monolithic graph.
+28
-14
+28
-14
docs/ARCHITECTURE.md
+28
-14
docs/ARCHITECTURE.md
···
117
117
118
118
All records live under the `app.opake.*` NSID namespace. See [lexicons/README.md](../lexicons/README.md) for the schema reference and [lexicons/EXAMPLES.md](../lexicons/EXAMPLES.md) for annotated example records.
119
119
120
+
### Identity and Key Material
121
+
120
122
```mermaid
121
123
erDiagram
122
124
ACCOUNT ||--|| PUBLICKEY : "publishes"
123
125
ACCOUNT ||--|| IDENTITY : "derived from seed phrase"
126
+
127
+
IDENTITY {
128
+
bytes x25519_private "decrypts wrapped keys"
129
+
bytes ed25519_signing "Indexer auth"
130
+
string seed_phrase "24-word BIP-39 (not stored)"
131
+
}
132
+
133
+
PUBLICKEY {
134
+
bytes public_key "X25519 (published on PDS)"
135
+
bytes signing_key "Ed25519 (published on PDS)"
136
+
}
137
+
```
138
+
139
+
### Records and Sharing
140
+
141
+
```mermaid
142
+
erDiagram
124
143
DOCUMENT ||--o{ GRANT : "shared via"
125
144
DOCUMENT }o--o{ KEYRING : "optionally encrypted under"
126
-
DOCUMENT ||--o{ DOCUMENT_UPDATE : "updated via"
127
-
KEYRING ||--o{ KEYRING_UPDATE : "member proposals via"
128
-
DIRECTORY ||--o{ DIRECTORY_UPDATE : "structure proposals via"
129
145
130
146
DOCUMENT {
131
147
blob encrypted_content
···
147
163
int rotation
148
164
keyHistoryEntry[] keyHistory "previous rotation snapshots"
149
165
}
166
+
```
167
+
168
+
### Workspaces and Proposals
169
+
170
+
```mermaid
171
+
erDiagram
172
+
DOCUMENT ||--o{ DOCUMENT_UPDATE : "updated via"
173
+
KEYRING ||--o{ KEYRING_UPDATE : "member proposals via"
174
+
DIRECTORY ||--o{ DIRECTORY_UPDATE : "structure proposals via"
150
175
151
176
DOCUMENT_UPDATE {
152
177
at-uri document "target document"
···
165
190
at-uri keyring "target workspace"
166
191
at-uri directory "target directory"
167
192
string actionType "addEntry|removeEntry|moveEntry|createDirectory|deleteDirectory|renameDirectory"
168
-
}
169
-
170
-
IDENTITY {
171
-
bytes x25519_private "decrypts wrapped keys"
172
-
bytes ed25519_signing "Indexer auth"
173
-
string seed_phrase "24-word BIP-39 (not stored)"
174
-
}
175
-
176
-
PUBLICKEY {
177
-
bytes public_key "X25519 (published on PDS)"
178
-
bytes signing_key "Ed25519 (published on PDS)"
179
193
}
180
194
```
181
195