Language: English | 中文

ZeroLink Documentation Index

Quick Lookup

I want to learn about...

Project Concepts

• What is this project? → README.md
• How to get started quickly? → QUICK_START.md
• How to deploy to Cloudflare? → DEPLOYMENT.md
• How to self-host locally? → SELF_HOSTED_DEPLOYMENT.md
• Core value proposition → PRD.md § 1. Product Overview
• User flows → PRD.md § 5. User Flows

Technical Architecture

• Overall architecture → ARCHITECTURE.md
• Tech stack → TECH_STACK.md
• Three-party role model → ARCHITECTURE.md § Three-Party Role Model
• State machine → ARCHITECTURE.md § State Machine

Security Design

• Threat model → SECURITY.md § Threat Model
• Security objectives → PRD.md § 2.1 Security Objectives
• Attack scenario analysis → SECURITY.md § Attack Scenario Analysis
• Security tiers → PRD.md § 4. Product Modes and Security Tiers

Core Mechanisms

• Lock Secret (Anti-TOFU) → ARCHITECTURE.md § TOFU Preemptive Lock Protection
• Padding (Anti-Length Leakage) → ARCHITECTURE.md § Ciphertext Length Leakage Mitigation
• Admin Authority (WebAuthn / ECDSA) → ARCHITECTURE.md § Product Modes
• Intent Binding → ARCHITECTURE.md § Intent Binding

Cryptography

• Encryption scheme → PRD.md § 7. Cryptography and Data Formats
• Cryptographic specification → SECURITY.md § Cryptographic Specification
• Protocol constants → PRD.md § Appendix A

API Protocol

• Full API definition → PRD.md § 10. API
• Self-hosted backend contract → SELF_HOSTED_CONTRACT.md
• Lock API → PRD.md § Appendix D
• Protocol diagrams (Mermaid) → PRD.md § 15. Protocol Diagrams

Implementation Details

• Canonical specification → PRD.md § Appendix B
• Lock precise definition → PRD.md § Appendix C
• Padding format → PRD.md § Appendix E
• WebAuthn verification → PRD.md § Appendix H

UX Design

• Safety Code specification → PRD.md § Appendix K
• WebAuthn unavailable guidance → PRD.md § 13.3

Testing

• Test vectors → PRD.md § 14. Test Vectors and Acceptance
• Cross-runtime self-host fixtures → SELF_HOSTED_CONTRACT.md § Fixture Consumption Rules
• Security invariants → SECURITY.md § Security Invariants

Build Integrity

• Verified release process → VERIFY.md
• Manifest signing → DEPLOYMENT.md § Manifest Signing

---

Reading by Role

Frontend Developer

1. QUICK_START.md - Set up the project
2. TECH_STACK.md - Tech stack overview
3. ARCHITECTURE.md § Data Flow Diagrams - Frontend responsibilities
4. PRD.md § 7 - Cryptography implementation
5. PRD.md § Appendix C - Lock Secret implementation
6. PRD.md § Appendix E - Padding implementation

Backend Developer

1. QUICK_START.md - Set up the project
2. ARCHITECTURE.md - System architecture
3. SELF_HOSTED_CONTRACT.md - Self-hosted backend contract
4. PRD.md § 10 - Full API
5. PRD.md § Appendix D - Lock API Schema
6. PRD.md § Appendix H - WebAuthn verification

Security Auditor

1. SECURITY.md - Full security model
2. SECURITY.md § Attack Scenario Analysis - Threat analysis
3. SECURITY.md § Security Invariants - Audit checkpoints
4. SECURITY.md § Cryptographic Specification - Encryption parameters
5. PRD.md § 14 - Test vectors

DevOps / Deployment

1. DEPLOYMENT.md - Full deployment guide
2. SELF_HOSTED_DEPLOYMENT.md - Docker Compose self-hosting
3. VERIFY.md - Build integrity verification

---

FAQ

Q: Why use URL Fragment to store lock_secret?

→ SECURITY.md § TOFU Preemptive Lock

Q: How does Padding prevent length leakage?

→ ARCHITECTURE.md § Ciphertext Length Leakage Mitigation

Q: Can WebAuthn private keys be exported?

→ SECURITY.md § Admin Private Key Non-Exportable

Q: Can the server see plaintext?

→ SECURITY.md § Server Zero-Knowledge

Q: How to prevent man-in-the-middle attacks?

→ SECURITY.md § Man-in-the-Middle Attack

Q: What's the difference between Quick Share and Secure Share?

→ PRD.md § 4. Product Modes and Security Tiers

Q: How to verify frontend code hasn't been tampered with?

→ VERIFY.md