# ai.newnal.illi.family.credentialEnvelope

> Published by [illi-service.newnal.id](https://lexicon.garden/identity/did:plc:uztm7bi2ce42dez3uu3qafro)

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.family.credentialEnvelope)
- [Documentation](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.family.credentialEnvelope/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.family.credentialEnvelope/examples)

## Definitions

### `ai.newnal.illi.family.credentialEnvelope`

**Type**: `record`

A parent's credentials (Newnal ID handle and password, scoped app passwords, parent 1's Private Phone key) sealed by the ILLI device to the root admin's custody public key (crypto_box_seal: ephemeral X25519 + HKDF + AES-256-GCM). Written by the device in the parent's repo; only the root admin can open it. Deleted by the device once a custodyReceipt is seen.

**Key**: `tid`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `ciphertext` | `bytes` | Yes |  |
| `createdAt` | `string` (datetime) | Yes |  |
| `keyId` | `string` | Yes | member.custodyPublicKey.keyId used to seal. |
| `recipient` | `string` (did) | Yes | The root admin whose custodyPublicKey sealed this envelope. |
| `slot` | `integer` | Yes |  |

## Raw Schema

```json
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "A parent's credentials (Newnal ID handle and password, scoped app passwords, parent 1's Private Phone key) sealed by the ILLI device to the root admin's custody public key (crypto_box_seal: ephemeral X25519 + HKDF + AES-256-GCM). Written by the device in the parent's repo; only the root admin can open it. Deleted by the device once a custodyReceipt is seen.",
      "key": "tid",
      "record": {
        "properties": {
          "ciphertext": {
            "maxLength": 16384,
            "type": "bytes"
          },
          "createdAt": {
            "format": "datetime",
            "type": "string"
          },
          "keyId": {
            "description": "member.custodyPublicKey.keyId used to seal.",
            "maxLength": 64,
            "type": "string"
          },
          "recipient": {
            "description": "The root admin whose custodyPublicKey sealed this envelope.",
            "format": "did",
            "type": "string"
          },
          "slot": {
            "maximum": 2,
            "minimum": 1,
            "type": "integer"
          }
        },
        "required": [
          "slot",
          "recipient",
          "keyId",
          "ciphertext",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "id": "ai.newnal.illi.family.credentialEnvelope",
  "lexicon": 1
}
```