How the user signed in, as the session token's provider claim names it; copied into
Context.AuthProvider. Empty for a session minted before the claim existed.
Epoch seconds after which the server refuses this token. 0 means no timed expiry, which is only
appropriate when the signing process also owns the verifying server and randomizes the secret at
startup — the token then dies with the process. Every minted token that leaves the machine sets it.
Absolute URL the browser loaded, ikon-* query params stripped; copied into Context.InitialUrl.
Empty for every non-browser client. Client-supplied like InitialPath — never authoritative.
True when the user is anonymous (guest login or no login): a device-scoped identity rather than
a real account. Filled by the backend from the user's role; copied into Context.IsAnonymous.
AuthSessionId cannot express this — cloud logins (including anonymous ones) always carry a
session id, so "has a session" does not mean "has an account".
True when the anonymous user is the space's GLOBAL communal identity (the "global" login
method) — every global visitor shares one UserId. Always false for device-scoped guests and
signed-in users; implies IsAnonymous. Filled by the backend from the minted flavor; copied
into Context.IsGlobal.
True for the build-time snapshot-capture client; copied into Context.IsSnapshot. Identifies the
client whose initial UI is baked into boot-snapshot.json. Inert beyond identification in v1.
Launch parameters. Signed, and NOT part of the removable block below, because the reserved
ikon- names here are the minter's to grant: the server reads ikon-shared-session
(Context.SharedSessionParameter). The cloud backend signs the app's own parameters as the client
sends them, drops every reserved name, and puts ikon-shared-session back only for a developer
of the space on their own platform login. A local run's /connect-token signs what it is posted.
Retired ledger values captured on read: keys the schema no longer names, kept so
code upgrading from an older peer can still reach them. Null when the source carried none.
Boot-snapshot variant id the capture client asks the app to render (a skeleton keyed by the
BootSnapshot seed rules); empty for route captures and all live clients. Copied into
Context.SnapshotVariant. Client-controlled like IsSnapshot — must never gate anything
security-relevant.
The SSO connection the user signed in through, from the session token's ssoConnection claim;
copied into Context.SsoConnectionId. Empty unless AuthProvider is sso.
Set when the session was admitted through a test link the app's makers minted: the link's id and
its name. A test-link session is a guest that is also a tester — the feedback button is offered
whatever the app's audience setting, and a report it files is tagged with the link. Filled by the
backend from the validated link; copied into Context. Empty for every other session.
