#UniCAS Glossary
Canonical storage, identity, and access terms extracted from the repository-wide glossary.
#Data model and storage
| Term | 中文定义 | Usage and boundary |
|---|---|---|
| CAS | Content-addressed storage；按内容摘要寻址不可变数据的存储模型。 | Generic architecture term. In this repository, UniCAS is the standalone CAS middleware implementation. |
| SValue | UniDocs 的结构化值与文档内容模型。 | Application-layer model owned by @unidocs/protocol and @unidocs/svalue-codec. UniCAS treats SValue content as opaque bytes. |
| SBlob | 在 SValue 中表示原子二进制内容的值类型。 | Described by the SValue schema dialect. Do not confuse it with arbitrary object-store blobs or client-side blob-index manifests. |
| TDoc | Doc service 在内存中应用操作的不可变文档表示。 | Format-specific implementations derive and snapshot TDoc state through SValue roots. |
| Merkle DAG | 节点以摘要互相引用形成的有向无环图。 | Enables structural sharing and content verification. Ordered duplicate child references are significant in CAS node identity and accounting. |
| node | 由规范逻辑字节的 SHA-256 摘要标识的不可变 CAS 节点。 | Contains immutable metadata, ordered child refs, and own content; lease and reference counts are mutable state outside node identity. |
| digest | 对规范逻辑节点字节计算的完整 256-bit SHA-256 值。 | Raw form is 32 bytes. The external CAS key is its 64-character lowercase hexadecimal encoding; use hash only where an API or type already does. |
| own content | 直接属于某个 CAS node 的内容字节。 | Excludes child node content. UniCAS stores it separately from immutable metadata. |
| child ref | node 不可变元数据中的一个有序子节点摘要引用。 | Each occurrence contributes to childRefCount; duplicates are meaningful. |
| ready node | 不可变元数据与已验证 own content 都存在的 node。 | Only ready nodes may be read, receive a Root Ref, or be referenced by a newly inserted node. |
| lease | 在指定截止时间前保护 node 不被 GC 删除的临时声明。 | A lease does not imply readiness or durable business ownership. |
| Root Ref | 由文档 delta、snapshot 或其他业务根持有的持久 CAS 根引用。 | Contributes to rootRefCount and protects a root independently of a lease. Preserve this capitalization in UniCAS documentation. |
| GC | Garbage collection；回收租约已过期且 child/root 引用计数均为零的节点。 | Space-scoped operation. Expiry makes a node eligible; it does not promise immediate deletion. |
See CAS Architecture, CAS Binary Format, and UniCAS package boundaries for normative storage semantics.
#Identity and access
| Term | 中文定义 | Usage and boundary |
|---|---|---|
| App | 顶层应用、信任、管理、issuer、审计与存储命名空间。 | Identified by appId. A trusted issuer resolves to one stable App authority. |
| Space | App 内的数据所有权、隔离、授权与用量核算边界。 | Identified by spaceId. Storage, usage, leases, Root Refs, and GC are scoped by App and Space. It is not a user or capacity measurement. |
| Principal | 由 (issuer, subject) 唯一标识的已认证人或服务身份。 |
Immutable authorization identity. A Principal may administer Apps or receive Space capabilities. |
| Profile | display name 与 display email 等非权威展示元数据。 | Profile changes never alter Principal identity, App membership, or Space authorization. |
| Member | 获得某个 App 同等管理员权限的 Principal。 | Membership depends on Principal, not mutable Profile fields. |
| Platform Access | Principal 在管理员平面的持久准入状态与独立权限集合。 | Active authority or App membership admits; blocked overrides both. |
| Platform Admin | 持有 platform.admin 权限、可管理平台准入与平台邀请的 Principal。 |
Does not imply apps.create. |
| App Creator | 持有 apps.create 权限、可创建 App 的 Principal。 |
App membership does not imply this authority. |
| control plane | 管理 App、成员、邀请、issuer 与审计的管理面。 | Served through UniCAS Admin APIs and clients. Do not call Space content operations “admin APIs”. |
| data plane | Space 内容寻址存储的读写与生命周期操作面。 | HTTP v2 routes are scoped by both App and Space. Node, Root Ref, usage, and GC permissions are independent data-plane authorities. |
| capability | 对 Principal、Space、权限和可选 Root Ref domain 进行约束的已签名授权声明。 | The HTTP v2 API uses capability ver: 3, one signed spaceId, and exact cas:{resource}:{action} permissions. A capability authorizes an operation; it is not a public document identifier. |
| issuer | 签发并可被验证信任令牌的身份提供方。 | A registered issuer establishes App authority; verified Space claims and permissions must agree with the request path. |
| Root Ref revision | App 内跨 Space 的追加审计序号。 | Replay identity remains App + Space + request ID; audit never determines GC retention. |
| retired Stack/Tenant identifiers | 已退役原型合同中的 stackId、tenantId 与 tenants: 权限。 |
Retained only in historical records, the frozen unicas.shazhou.work environment, negative guards, and isolated physical/audit adapters. Never reinterpret them as App/Space claims. |
See UniCAS OAuth Discovery and Issuer Migration for key and issuer operations.