Epoch seconds after which the server refuses this token. 0 means no timed expiry, which is only
appropriate when the signing process also owns the verifying server and randomizes the secret at
startup — the token then dies with the process. Every minted token that leaves the machine sets it.
Absolute URL the browser loaded, ikon-* query params stripped; copied into Context.InitialUrl.
Empty for every non-browser client. Client-supplied like InitialPath — never authoritative.
True when the user is anonymous (guest login or no login): a device-scoped identity rather than
a real account. Filled by the backend from the user's role; copied into Context.IsAnonymous.
AuthSessionId cannot express this — cloud logins (including anonymous ones) always carry a
session id, so "has a session" does not mean "has an account".
True when the anonymous user is the space's GLOBAL communal identity (the "global" login
method) — every global visitor shares one UserId. Always false for device-scoped guests and
signed-in users; implies IsAnonymous. Filled by the backend from the minted flavor; copied
into Context.IsGlobal.
True for the build-time snapshot-capture client; copied into Context.IsSnapshot. Identifies the
client whose initial UI is baked into boot-snapshot.json. Inert beyond identification in v1.
Launch parameters. Signed, and NOT part of the removable block below, because Studio mints the
preview inspector by putting ikon-inspect here — a client that could assert its own parameters
would hand itself the inspector.
Boot-snapshot variant id the capture client asks the app to render (a skeleton keyed by the
BootSnapshot seed rules); empty for route captures and all live clients. Copied into
Context.SnapshotVariant. Client-controlled like IsSnapshot — must never gate anything
security-relevant.