@logicsrc/schemas 0.1.0 → 0.1.1

package/fixtures/openwall/direct.json

@@ -0,0 +1,17 @@
+{
+  "openwall": "0.1-draft",
+  "id": "urn:uuid:07b2b83e-27f6-4d59-bdfa-cdcd42548678",
+  "sender": "did:web:ops.example",
+  "createdAt": "2026-09-13T12:00:00Z",
+  "expiresAt": "2026-09-13T12:10:00Z",
+  "visibility": "private",
+  "topic": "maintenance",
+  "audience": {
+    "kind": "direct",
+    "recipient": "did:web:ada.example"
+  },
+  "content": {
+    "mediaType": "text/plain",
+    "text": "Ready when you are."
+  }
+}

package/fixtures/openwall/receipt-accepted.json

@@ -0,0 +1,13 @@
+{
+  "openwall": "0.1-draft",
+  "id": "urn:uuid:963f9109-803f-4f0c-8506-10c70ec47ee6",
+  "messageId": "urn:uuid:94d908df-2876-48f1-bec8-c931f5c847d4",
+  "recipient": "did:web:ada.example",
+  "sequence": 3,
+  "state": "accepted",
+  "at": "2026-09-13T12:00:03Z",
+  "attempt": 1,
+  "route": "https://chat.example",
+  "providerMessageId": "provider-msg-123",
+  "deliveryId": "urn:uuid:db925d64-4e1a-4e5a-83c1-e37b68aa5eef"
+}

package/fixtures/openwall/receipt-retrying.json

@@ -0,0 +1,14 @@
+{
+  "openwall": "0.1-draft",
+  "id": "urn:uuid:211bb615-90e1-4773-b7c0-49d59d7cd6bc",
+  "messageId": "urn:uuid:94d908df-2876-48f1-bec8-c931f5c847d4",
+  "recipient": "did:web:ada.example",
+  "sequence": 3,
+  "state": "retrying",
+  "at": "2026-09-13T12:00:03Z",
+  "attempt": 1,
+  "route": "https://chat.example",
+  "reason": "rate-limited",
+  "nextAttemptAt": "2026-09-13T12:01:00Z",
+  "deliveryId": "urn:uuid:db925d64-4e1a-4e5a-83c1-e37b68aa5eef"
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@logicsrc/schemas",
-  "version": "0.1.0",
-  "description": "LogicSRC JSON schemas for tasks, agents, runs, events, plugins, the AgentAd ad standard, the OpenOntology knowledge contracts, and the OpenContext context plane.",
+  "version": "0.1.1",
+  "description": "LogicSRC JSON schemas for tasks, agents, runs, events, plugins, the AgentAd ad standard, the OpenOntology knowledge contracts, the OpenContext context plane, the OpenCreds credential vault, OpenFleet membership and rental offers, and the OpenWall messaging proposal.",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -21,8 +21,12 @@
     "logicsrc",
     "ontology",
     "opencontext",
+    "opencreds",
+    "openfleet",
     "openontology",
-    "standards"
+    "password-manager",
+    "standards",
+    "vault"
   ],
   "publishConfig": {
     "access": "public"
@@ -55,6 +59,13 @@
     "./opencontext-object": "./schemas/logicsrc-opencontext-object.schema.json",
     "./opencontext-provenance": "./schemas/logicsrc-opencontext-provenance.schema.json",
     "./opencontext-role": "./schemas/logicsrc-opencontext-role.schema.json",
+    "./opencreds-audit-event": "./schemas/logicsrc-opencreds-audit-event.schema.json",
+    "./opencreds-database": "./schemas/logicsrc-opencreds-database.schema.json",
+    "./opencreds-envelope": "./schemas/logicsrc-opencreds-envelope.schema.json",
+    "./opencreds-item": "./schemas/logicsrc-opencreds-item.schema.json",
+    "./opencreds-manifest": "./schemas/logicsrc-opencreds-manifest.schema.json",
+    "./opencreds-vault-meta": "./schemas/logicsrc-opencreds-vault-meta.schema.json",
+    "./openfleet": "./schemas/logicsrc-openfleet.schema.json",
     "./openontology-action": "./schemas/logicsrc-openontology-action.schema.json",
     "./openontology-approval": "./schemas/logicsrc-openontology-approval.schema.json",
     "./openontology-changeset": "./schemas/logicsrc-openontology-changeset.schema.json",
@@ -74,6 +85,8 @@
     "./openontology-review": "./schemas/logicsrc-openontology-review.schema.json",
     "./openontology-source": "./schemas/logicsrc-openontology-source.schema.json",
     "./openprd-prd": "./schemas/openprd-prd.schema.json",
+    "./openwall-message": "./schemas/logicsrc-openwall-message.schema.json",
+    "./openwall-receipt": "./schemas/logicsrc-openwall-receipt.schema.json",
     "./plugin": "./schemas/logicsrc-plugin.schema.json",
     "./pull-request": "./schemas/logicsrc-pull-request.schema.json",
     "./repo": "./schemas/logicsrc-repo.schema.json",

package/schemas/logicsrc-opencreds-audit-event.schema.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://logicsrc.com/schemas/opencreds/audit-event.schema.json",
+  "title": "OpenCreds Audit Event",
+  "description": "One recorded vault operation. An audit event MUST NOT contain a secret value. Where a value must be referenced it is referenced by salted, truncated SHA-256 fingerprint — an equality and integrity marker, not secret storage. Item names are also secret-adjacent (a folder list is a good description of someone's life), so an event carries the item id and type rather than its name.",
+  "type": "object",
+  "required": ["type", "id", "action", "createdAt"],
+  "additionalProperties": false,
+  "properties": {
+    "type": { "type": "string", "const": "opencreds.audit_event" },
+    "id": { "type": "string" },
+    "action": {
+      "type": "string",
+      "enum": [
+        "vault.create",
+        "vault.unlock",
+        "vault.unlock_failed",
+        "vault.rekey",
+        "vault.recovery_reset",
+        "item.create",
+        "item.update",
+        "item.delete",
+        "item.restore",
+        "item.purge",
+        "database.export",
+        "database.export_plaintext",
+        "database.import"
+      ]
+    },
+    "itemId": { "type": "string" },
+    "itemType": { "type": "string", "enum": ["login", "card", "identity", "note", "key", "account"] },
+    "namespace": { "type": "string", "pattern": "^[a-z][a-z0-9-]{1,31}$" },
+    "profile": { "type": "string", "enum": ["user", "team"] },
+    "principal": {
+      "type": "object",
+      "description": "Who acted. Shape borrowed from LogicSRC account-core so an OpenCreds event sits alongside the credential-sharing audit trail.",
+      "additionalProperties": true,
+      "properties": {
+        "kind": { "type": "string", "enum": ["user", "agent", "service"] },
+        "id": { "type": "string" },
+        "label": { "type": "string" }
+      }
+    },
+    "fingerprint": {
+      "type": "string",
+      "description": "Salted, truncated SHA-256 of the value observed or written. Never the value."
+    },
+    "itemCount": { "type": "integer", "minimum": 0, "description": "For database.* actions." },
+    "dryRun": { "type": "boolean", "default": false },
+    "outcome": { "type": "string", "enum": ["succeeded", "failed", "refused"] },
+    "reason": { "type": "string", "description": "Why a failed or refused action did not proceed. Never contains a value." },
+    "createdAt": { "type": "string", "format": "date-time" }
+  }
+}

package/schemas/logicsrc-opencreds-database.schema.json

@@ -0,0 +1,94 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://logicsrc.com/schemas/opencreds/database.schema.json",
+  "title": "OpenCreds Portable Database",
+  "description": "A vault as one file: what you hand to another product, keep as a backup, and read to import. Encrypted by default. The plaintext form exists because the products people move to frequently read nothing else, and an export format that cannot express that gets worked around with a script that is worse — no warning, no file mode, no label. So it is specified and made loud: an explicit opt-in, and protected:false in the header so tooling can identify the file without parsing the rest of it. Media type application/vnd.logicsrc.opencreds+json; conventional extension .opencreds.",
+  "type": "object",
+  "required": ["opencreds", "type", "protected", "namespace", "exportedAt", "manifest"],
+  "additionalProperties": false,
+  "properties": {
+    "opencreds": { "type": "string", "const": "0.1" },
+    "type": { "type": "string", "const": "opencreds.database" },
+    "protected": { "type": "boolean" },
+    "namespace": { "type": "string", "pattern": "^[a-z][a-z0-9-]{1,31}$" },
+    "exportedAt": { "type": "string", "format": "date-time" },
+    "generator": {
+      "type": "object",
+      "required": ["name", "version"],
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "version": { "type": "string" }
+      }
+    },
+    "kdf": {
+      "type": "object",
+      "required": ["kdf", "iterations", "salt"],
+      "additionalProperties": false,
+      "description": "Parameters for the export key, which is derived from an export passphrase and is NOT the vault's user key — a file encrypted under the user key would only open inside the vault it came from, which is the opposite of portable. Omitted when a raw 32-byte key was supplied instead.",
+      "properties": {
+        "kdf": { "type": "string", "enum": ["pbkdf2-sha256", "argon2id"] },
+        "iterations": { "type": "integer", "minimum": 100000 },
+        "salt": { "type": "string", "pattern": "^[A-Za-z0-9+/]*={0,2}$" }
+      }
+    },
+    "manifest": { "$ref": "https://logicsrc.com/schemas/opencreds/manifest.schema.json" },
+    "iv": { "type": "string", "pattern": "^[A-Za-z0-9+/]*={0,2}$" },
+    "ciphertext": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9+/]*={0,2}$",
+      "description": "AES-256-GCM over the UTF-8 JSON of {folders, items}, with the header (opencreds, type, protected, namespace, exportedAt, generator, kdf, manifest, in that key order) bound as additional authenticated data. An attacker cannot restate the item count, swap the generator, or downgrade protected without the decryption failing."
+    },
+    "folders": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/folder" },
+      "description": "Plaintext form only."
+    },
+    "items": {
+      "type": "array",
+      "items": { "$ref": "https://logicsrc.com/schemas/opencreds/item.schema.json" },
+      "description": "Plaintext form only. Every secret in the vault, in the clear."
+    }
+  },
+  "allOf": [
+    {
+      "$comment": "The two forms are mutually exclusive: an encrypted database carries a payload it cannot also state in the clear. A false subschema is how JSON Schema says 'this property must be absent'.",
+      "if": { "properties": { "protected": { "const": true } }, "required": ["protected"] },
+      "then": {
+        "required": ["iv", "ciphertext"],
+        "properties": {
+          "iv": { "type": "string" },
+          "ciphertext": { "type": "string" },
+          "items": false,
+          "folders": false
+        }
+      }
+    },
+    {
+      "if": { "properties": { "protected": { "const": false } }, "required": ["protected"] },
+      "then": {
+        "required": ["items"],
+        "properties": {
+          "items": { "type": "array" },
+          "iv": false,
+          "ciphertext": false,
+          "kdf": false
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "folder": {
+      "type": "object",
+      "required": ["id", "name"],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+        },
+        "name": { "type": "string" }
+      }
+    }
+  }
+}

package/schemas/logicsrc-opencreds-envelope.schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://logicsrc.com/schemas/opencreds/envelope.schema.json",
+  "title": "OpenCreds Item Envelope",
+  "description": "One encrypted item as it is stored. AES-256-GCM over the item's UTF-8 JSON, with UTF8(\"<namespace>:vault:item:<v>:<id>\") bound as additional authenticated data. Binding the id means a ciphertext cannot be moved between rows: without it, anyone with write access to the storage could copy a low-value login's ciphertext into a high-value one's row and watch what the user does next. Only id and type are plaintext, and that is the metadata this design accepts leaking — the server learns you hold forty logins and two cards, never which sites or what values.",
+  "type": "object",
+  "required": ["id", "type", "ciphertext", "iv"],
+  "additionalProperties": false,
+  "properties": {
+    "id": {
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+      "description": "Matches the id inside the ciphertext. A decrypting implementation MUST verify the two agree; the AAD already makes a mismatch unreachable, and the check costs nothing."
+    },
+    "type": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 6,
+      "description": "1 login, 2 card, 3 identity, 4 note, 5 key, 6 account. Plaintext on purpose, so a server can filter and paginate without decrypting."
+    },
+    "ciphertext": { "type": "string", "pattern": "^[A-Za-z0-9+/]*={0,2}$" },
+    "iv": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9+/]*={0,2}$",
+      "description": "96 bits, fresh per encryption. With GCM a repeated IV under one key is not a weakness but a break, leaking the XOR of two plaintexts along with the authentication subkey."
+    },
+    "v": { "type": "integer", "minimum": 1, "description": "Item schema version, when the storage carries it outside the ciphertext. Defaults to 1." },
+    "revision": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Optimistic concurrency. Two devices editing two different passwords at the same moment must not cost anyone a credential; a client that writes with a stale revision is rejected rather than overwriting."
+    },
+    "deletedAt": { "type": ["string", "null"], "description": "Trash bin, not erasure." },
+    "purgeAfter": { "type": ["string", "null"] },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "updatedAt": { "type": "string", "format": "date-time" }
+  }
+}

package/schemas/logicsrc-opencreds-item.schema.json

@@ -0,0 +1,240 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://logicsrc.com/schemas/opencreds/item.schema.json",
+  "title": "OpenCreds Item",
+  "description": "One credential record: a login, a card, an identity, a note, a key, or an account. These are not six features but one record with a type and a named field group, so that everything the user typed lives inside a single encrypted blob. That is what makes password history free — it is an array in that blob, encrypted by construction, rather than a second table someone can forget to protect. Every field in every group is optional and defaults to an empty string, because a real vault holds half-filled records and a model that requires fields produces importers that invent them.",
+  "type": "object",
+  "required": ["v", "id", "type", "name", "createdAt", "updatedAt"],
+  "additionalProperties": true,
+  "properties": {
+    "v": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Item schema version, stamped into every record from the first write. A record you cannot identify is a record you cannot migrate. 1 for OpenCreds 0.1."
+    },
+    "id": {
+      "$ref": "#/$defs/uuid",
+      "description": "Generated on the client, because it is bound into the ciphertext as additional authenticated data. A ciphertext moved to another row fails to decrypt rather than silently showing the wrong credential."
+    },
+    "type": {
+      "$ref": "#/$defs/itemType",
+      "description": "Selects the field group. An item MUST NOT carry a group other than the one named here."
+    },
+    "name": {
+      "type": "string",
+      "description": "Display name. MAY be empty; importers fall back to the URL host when an export had none."
+    },
+    "favorite": { "type": "boolean", "default": false },
+    "folderId": {
+      "oneOf": [{ "$ref": "#/$defs/uuid" }, { "type": "null" }],
+      "description": "A folder declared in the same vault, or null. Folders are flat: a name may contain a slash and a client may render that as a hierarchy, but the model does not nest, because every product that nests disagrees about what a move does."
+    },
+    "notes": {
+      "type": "string",
+      "description": "Free text. For a note item this is the content."
+    },
+    "fields": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/customField" },
+      "description": "Custom fields. A hidden field is displayed masked; it is not encrypted differently, because everything in the item is already inside one ciphertext."
+    },
+    "attachments": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/attachment" },
+      "description": "Attachment references, never bytes. An implementation that does not store blobs MUST still round-trip these."
+    },
+    "history": {
+      "type": "array",
+      "maxItems": 20,
+      "items": { "$ref": "#/$defs/historyEntry" },
+      "description": "Password history, newest first, defined only for login items. Capped at 20: the item blob is rewritten on every save, so an uncapped array grows the ciphertext without bound and the growth is invisible until sync starts timing out."
+    },
+    "createdAt": { "$ref": "#/$defs/timestamp" },
+    "updatedAt": {
+      "$ref": "#/$defs/timestamp",
+      "description": "Belongs to the item, not to a transfer. An importer that restamps this destroys the only evidence of when a password was last rotated."
+    },
+    "login": { "$ref": "#/$defs/loginGroup" },
+    "card": { "$ref": "#/$defs/cardGroup" },
+    "identity": { "$ref": "#/$defs/identityGroup" },
+    "key": { "$ref": "#/$defs/keyGroup" },
+    "account": { "$ref": "#/$defs/accountGroup" }
+  },
+  "allOf": [
+    {
+      "$comment": "An item MUST NOT carry a field group other than the one named by its type. A card group on a login item is either a broken importer or an attempt to smuggle a field past a type-based permission check; neither should be stored. A false subschema is how JSON Schema says 'this property must be absent'.",
+      "if": { "properties": { "type": { "const": "login" } }, "required": ["type"] },
+      "then": { "properties": { "card": false, "identity": false, "key": false, "account": false } }
+    },
+    {
+      "if": { "properties": { "type": { "const": "card" } }, "required": ["type"] },
+      "then": { "properties": { "login": false, "identity": false, "key": false, "account": false } }
+    },
+    {
+      "if": { "properties": { "type": { "const": "identity" } }, "required": ["type"] },
+      "then": { "properties": { "login": false, "card": false, "key": false, "account": false } }
+    },
+    {
+      "if": { "properties": { "type": { "const": "note" } }, "required": ["type"] },
+      "then": { "properties": { "login": false, "card": false, "identity": false, "key": false, "account": false } }
+    },
+    {
+      "if": { "properties": { "type": { "const": "key" } }, "required": ["type"] },
+      "then": { "properties": { "login": false, "card": false, "identity": false, "account": false } }
+    },
+    {
+      "if": { "properties": { "type": { "const": "account" } }, "required": ["type"] },
+      "then": { "properties": { "login": false, "card": false, "identity": false, "key": false } }
+    },
+    {
+      "$comment": "Password history is defined only for logins.",
+      "if": { "not": { "properties": { "type": { "const": "login" } }, "required": ["type"] } },
+      "then": { "properties": { "history": { "type": "array", "maxItems": 0 } } }
+    }
+  ],
+  "$defs": {
+    "uuid": {
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+    },
+    "timestamp": { "type": "string", "format": "date-time" },
+    "itemType": {
+      "type": "string",
+      "enum": ["login", "card", "identity", "note", "key", "account"],
+      "description": "Type codes 1 login, 2 card, 3 identity, 4 note, 5 key, 6 account. Codes 1-4 are fixed by a deployed vault and MUST NOT be renumbered; 5 and 6 are introduced by OpenCreds; 7+ are reserved."
+    },
+    "customField": {
+      "type": "object",
+      "required": ["name", "value", "type"],
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "value": { "type": "string" },
+        "type": { "type": "string", "enum": ["text", "hidden", "boolean", "linked"] },
+        "hidden": { "type": "boolean", "default": false }
+      }
+    },
+    "attachment": {
+      "type": "object",
+      "required": ["id", "name"],
+      "additionalProperties": false,
+      "properties": {
+        "id": { "type": "string" },
+        "name": { "type": "string" },
+        "size": { "type": "integer", "minimum": 0 },
+        "contentType": { "type": "string" },
+        "digest": { "type": "string", "description": "sha256-<base64> over the plaintext blob." },
+        "key": {
+          "type": "string",
+          "description": "Base64 AES-256 key the blob was encrypted under, held inside the item ciphertext so the blob store never sees it."
+        }
+      }
+    },
+    "historyEntry": {
+      "type": "object",
+      "required": ["password", "changedAt"],
+      "additionalProperties": false,
+      "properties": {
+        "password": { "type": "string" },
+        "changedAt": { "$ref": "#/$defs/timestamp" }
+      }
+    },
+    "uri": {
+      "type": "object",
+      "required": ["uri"],
+      "additionalProperties": false,
+      "properties": {
+        "uri": { "type": "string" },
+        "match": {
+          "type": "string",
+          "enum": ["domain", "host", "startsWith", "exact", "regex", "never"],
+          "default": "domain",
+          "description": "Carried so that a move does not silently widen where a credential will be offered. An implementation that does not autofill still round-trips it."
+        }
+      }
+    },
+    "loginGroup": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "username": { "type": "string" },
+        "password": { "type": "string" },
+        "totp": {
+          "type": "string",
+          "description": "An otpauth:// URI, or a bare base32 seed. Store the URI where you have it: it carries the algorithm, digits and period, and a bare seed loses them."
+        },
+        "uris": { "type": "array", "items": { "$ref": "#/$defs/uri" } }
+      }
+    },
+    "cardGroup": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "cardholderName": { "type": "string" },
+        "brand": { "type": "string", "description": "Free text; issuers add brands." },
+        "number": { "type": "string" },
+        "expMonth": { "type": "string", "description": "1-12, no leading zero required." },
+        "expYear": { "type": "string", "description": "Four digits. Two-digit years from an import are expanded to 20xx." },
+        "code": { "type": "string" }
+      }
+    },
+    "identityGroup": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "title": { "type": "string" },
+        "firstName": { "type": "string" },
+        "middleName": { "type": "string" },
+        "lastName": { "type": "string" },
+        "username": { "type": "string" },
+        "company": { "type": "string" },
+        "email": { "type": "string" },
+        "phone": { "type": "string" },
+        "address1": { "type": "string" },
+        "address2": { "type": "string" },
+        "address3": { "type": "string" },
+        "city": { "type": "string" },
+        "state": { "type": "string" },
+        "postalCode": { "type": "string" },
+        "country": { "type": "string" },
+        "ssn": { "type": "string", "description": "National identity number. Named ssn for import compatibility; it is not US-specific." },
+        "passportNumber": { "type": "string" },
+        "licenseNumber": { "type": "string" }
+      }
+    },
+    "keyGroup": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "SSH and PGP keys, API tokens, certificates, and the .env secrets that Credential Sharing synchronizes. path and mode exist so a restore is total: a private key written back with the wrong mode is a key ssh will refuse to use, and one written to the wrong path is a key nothing finds.",
+      "properties": {
+        "keyType": { "type": "string", "enum": ["ssh", "pgp", "api", "symmetric", "certificate", "env"] },
+        "algorithm": { "type": "string" },
+        "publicKey": { "type": "string" },
+        "privateKey": { "type": "string" },
+        "passphrase": { "type": "string" },
+        "fingerprint": { "type": "string", "description": "SHA256:… — a public, non-secret identifier." },
+        "value": { "type": "string", "description": "The secret for key types that are one opaque string (api, env, symmetric)." },
+        "path": { "type": "string" },
+        "mode": { "type": "string", "pattern": "^0?[0-7]{3}$" },
+        "expiresAt": { "type": "string" }
+      }
+    },
+    "accountGroup": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "A provider account and the tokens that authorize acting as it. Deliberately not a login: a login is what a person types at a sign-in form, an account is what a machine presents to an API. They expire differently and are revoked differently, and conflating them is how a rotated refresh token ends up in a password history array.",
+      "properties": {
+        "provider": { "type": "string", "description": "google, github, x, stripe, … An OpenOntology entity id where one is in use." },
+        "accountId": { "type": "string" },
+        "handle": { "type": "string" },
+        "email": { "type": "string" },
+        "accessToken": { "type": "string" },
+        "refreshToken": { "type": "string" },
+        "tokenType": { "type": "string" },
+        "scopes": { "type": "array", "items": { "type": "string" } },
+        "expiresAt": { "type": "string" },
+        "environment": { "type": "string", "description": "production, sandbox, … A test key and a live key look identical and are not." }
+      }
+    }
+  }
+}

package/schemas/logicsrc-opencreds-manifest.schema.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://logicsrc.com/schemas/opencreds/manifest.schema.json",
+  "title": "OpenCreds Database Manifest",
+  "description": "The authenticated inventory of a portable database. In an encrypted database the manifest sits in the header, which is bound as additional authenticated data over the payload — so the counts can be shown in a preview before anyone types a passphrase, and they cannot be lied about. After decrypting, an implementation MUST recompute all four fields and MUST refuse the import if any disagrees. This is the difference between an import you can trust and a CSV: a CSV truncated at 3,000 rows imports 3,000 rows and reports success.",
+  "type": "object",
+  "required": ["itemCount", "types", "folderCount", "digest"],
+  "additionalProperties": false,
+  "properties": {
+    "itemCount": { "type": "integer", "minimum": 0 },
+    "types": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Item count per type name. Types with zero items are omitted.",
+      "properties": {
+        "login": { "type": "integer", "minimum": 1 },
+        "card": { "type": "integer", "minimum": 1 },
+        "identity": { "type": "integer", "minimum": 1 },
+        "note": { "type": "integer", "minimum": 1 },
+        "key": { "type": "integer", "minimum": 1 },
+        "account": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "folderCount": { "type": "integer", "minimum": 0 },
+    "digest": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9+/]*={0,2}$",
+      "description": "Base64 SHA-256 over the item ids, sorted lexicographically and joined by a newline. Detects a dropped item and a re-ordered payload alike."
+    }
+  }
+}

package/schemas/logicsrc-opencreds-vault-meta.schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://logicsrc.com/schemas/opencreds/vault-meta.schema.json",
+  "title": "OpenCreds Vault Metadata",
+  "description": "Per-vault key material and parameters. Every value here is encrypted or derived on the client; nothing in this document can be decrypted with anything a server, its backups, or an operator with full access can see. Key material is base64 text rather than binary because this travels as JSON over HTTP, where binary round-trips as an escaped hex string and invites encoding mistakes on exactly the values that must not be corrupted.",
+  "type": "object",
+  "required": ["opencreds", "namespace", "profile", "kdf", "kdfIterations", "kdfSalt", "protectedUserKey", "protectedUserKeyIv"],
+  "additionalProperties": false,
+  "properties": {
+    "opencreds": { "type": "string", "const": "0.1" },
+    "namespace": {
+      "$ref": "#/$defs/namespace",
+      "description": "Domain-separation label prefix. Carried as data because labels are compiled into the additional authenticated data of every ciphertext a vault has written: editing one does not migrate a vault, it makes it undecryptable. Registered: opencreds, marksyncr."
+    },
+    "profile": {
+      "type": "string",
+      "enum": ["user", "team"],
+      "description": "How the user key is managed. user: wrapped by a key derived from a master password. team: sealed to each member's X25519 public key. The item envelope is identical under both. An implementation MUST refuse a profile it does not implement rather than attempting to open the vault."
+    },
+    "kdf": {
+      "type": "string",
+      "enum": ["pbkdf2-sha256", "argon2id"],
+      "description": "argon2id is registered and not yet specified. A client that does not implement it MUST refuse the vault rather than fall back."
+    },
+    "kdfIterations": {
+      "type": "integer",
+      "minimum": 100000,
+      "default": 600000,
+      "description": "Floor enforced in the client before deriving anything. These parameters arrive from a server, which makes them attacker-controlled if the server is compromised: serving 1 would turn every captured auth hash into an offline guessing exercise with no work factor."
+    },
+    "kdfMemoryKib": { "type": "integer", "minimum": 1, "description": "Reserved for argon2id." },
+    "kdfParallelism": { "type": "integer", "minimum": 1, "description": "Reserved for argon2id." },
+    "kdfSalt": { "$ref": "#/$defs/base64", "description": "Per vault, random, at least 16 bytes." },
+    "protectedUserKey": {
+      "$ref": "#/$defs/base64",
+      "description": "The 32-byte random user key, encrypted under the wrap key. Random rather than derived, so a master password change re-wraps 32 bytes instead of re-encrypting every item."
+    },
+    "protectedUserKeyIv": { "$ref": "#/$defs/base64" },
+    "recoveryKeyBlob": {
+      "$ref": "#/$defs/base64",
+      "description": "A second copy of the same user key under the recovery key, so a forgotten master password is survivable without the server learning anything."
+    },
+    "recoveryKeyIv": { "$ref": "#/$defs/base64" },
+    "authHash": {
+      "$ref": "#/$defs/base64",
+      "description": "The only password-derived value that may leave the device. It comes out of a different HKDF label than the wrap key, so holding every auth hash ever sent does not help derive a wrapping key. A server storing it MUST hash it again."
+    },
+    "wrappedKeys": {
+      "type": "array",
+      "description": "team profile only: one sealed copy of the vault key per member. The server holds these and never the key.",
+      "items": {
+        "type": "object",
+        "required": ["memberId", "publicKey", "wrappedKey"],
+        "additionalProperties": false,
+        "properties": {
+          "memberId": { "type": "string" },
+          "publicKey": { "$ref": "#/$defs/base64" },
+          "wrappedKey": { "$ref": "#/$defs/base64" },
+          "grantedAt": { "type": "string", "format": "date-time" }
+        }
+      }
+    },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "updatedAt": { "type": "string", "format": "date-time" }
+  },
+  "$defs": {
+    "base64": { "type": "string", "pattern": "^[A-Za-z0-9+/]*={0,2}$" },
+    "namespace": { "type": "string", "pattern": "^[a-z][a-z0-9-]{1,31}$" }
+  }
+}