Module invite 

The invite payload: a self-verifying {address, pubkey, petname?, sig?} blob for QR codes and links.

This is the permanent path to first contact, and the primary one. Username discovery (see crate::discovery) is additive: it is a non-authoritative directory whose only trust anchor is a human confirming a name out of band, which is exactly what scanning a QR code is. Deleting the invite path would therefore delete the discovery layer’s security model, not merely one of two ways to reach someone.

What verification proves, and what it does not

parse_invite enforces derive_address(pubkey) == address and, when a signature is present, that the signature verifies under pubkey. That makes the blob self-certifying: no directory, no server and no prior contact is consulted, which is why the helpers are namespace-level and callable before create().

It does not defend against substitution. An attacker who hands you their own invite, correctly signed by their own key, is indistinguishable from a legitimate stranger — no payload format can fix that, only the out-of-band context in which the code was shown to you.

What the optional signature defends is relabeling. Without it, anyone can mint an invite pairing a victim’s real, public {address, pubkey} with an attacker-chosen petname, so an invite forwarded through a third party can save Alice’s key under the name “Bob”. With it, the petname is bound to the key by the key’s owner.

Include a signature when the invite may travel without its issuer. A QR code shown phone-to-phone is already authenticated by the physical channel, and an app that prompts the user to confirm or edit the name has made the user the authority over it, which is what a petname properly is.

What an invite deliberately does not carry

No key package. An MLS key package’s init key is consumed by the first peer who uses it, and a QR code is static, so pairing them guarantees a collision as soon as two people scan the same code. Session establishment runs over whatever transport connects, by the ordinary exchange.

No expiry. A printed QR code that stops working is a bug. Apps that need revocable invites have the server-mediated group-invite-link mechanism.

Container

The SDK specifies the blob; apps own their URI scheme. The recommended form is <app-scheme>://connect?c=<blob> — one opaque parameter, so it composes with any existing scheme and route.

Structs

Invite

A decoded and verified invite.

Constants

INVITE_SIGN_DOMAIN

Signature domain for invite payloads.

INVITE_VERSION

The only invite format version this build produces or accepts.

MAX_PETNAME_BYTES

Maximum petname length in bytes.

Functions

encode_invite

Encodes an invite blob, optionally signed.

invite_signing_payload

Builds the payload an invite signature is taken over.

parse_invite

Decodes and verifies an invite blob.