id: 872a50fc87074c50a99c36bb0324fd57
parent_id: 
item_type: 1
item_id: 1fbaa70f2fb94ffcaabbeca7b39482da
item_updated_time: 1782887655947
title_diff: "[{\"diffs\":[[1,\"Keyfob Station — PlantUML Diagram Sources\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":41}]"
body_diff: "[{\"diffs\":[[1,\"# Keyfob Station — PlantUML Diagram Sources\\\n\\\n> Master copy of every PlantUML diagram for the key-fob provisioning architecture.  \\\n> Files live in the repo at `docs/diagrams/*.puml`. Rendered PNG/SVG go alongside  \\\n> them. Companions: **\\\"Keyfob Flow 1\\\"**, **\\\"Keyfob Flow 2\\\"**, **\\\"Keyfob Flow 2b —  \\\n> KLMS ↔ NetHSM AES Orchestration\\\"**.\\\n\\\n## Diagrams\\\n\\\n| File | Shows |\\\n| --- | --- |\\\n| `kdf-overview.puml` | KDF phase overview (A→B→C→D) |\\\n| `kdf-phase-a.puml` | Phase A — KDF3 (master+UID → static keys) |\\\n| `kdf-phase-b.puml` | Phase B — session keys (static → SES-\\\\*) |\\\n| `kdf-phase-c.puml` | Phase C — cryptograms (card verify gate + host cg) |\\\n| `kdf-phase-d.puml` | Phase D — A003 AES-CBC + handle cleanup |\\\n| `flow-2b-kdf-nethsm.puml` | Combined KLMS↔NetHSM KDF (all phases, one diagram) |\\\n| `flow-2-provisioning.puml` | Key Fob ↔ Station ↔ KLMS (↔ NetHSM) end-to-end |\\\n\\\n## Rendering\\\n\\\n```sh\\\n# local (needs java + plantuml.jar)\\\nplantuml -tpng -tsvg docs/diagrams/*.puml\\\n\\\n# headless, no java — public server via the deflate/base64 encoder\\\npython3 ~/render_puml.py docs/diagrams\\\n```\\\n\\\nFor PPT/Word, embed the **SVG** (scalable) or **PNG**. Server base URL:  \\\n`https://www.plantuml.com/plantuml/{png,svg}/<encoded>`.\\\n\\\n* * *\\\n\\\n## kdf-overview.puml — Phase overview\\\n\\\n```plantuml\\\n@startuml kdf-overview\\\n' KLMS <-> NetHSM KDF: phase overview (per fob). For PPT/Word embedding.\\\n\\\nskinparam monochrome false\\\nskinparam defaultFontName \\\"DejaVu Sans\\\"\\\nskinparam ArrowColor #444444\\\nskinparam rectangle {\\\n  BackgroundColor #F4F8FF\\\n  BorderColor #3B6FB6\\\n}\\\nskinparam card {\\\n  BackgroundColor #FFFFFF\\\n  BorderColor #3B6FB6\\\n}\\\n\\\ntitle KLMS <-> NetHSM KDF — Phase Overview (per fob transaction)\\\n\\\nrectangle \\\"**Inputs from station**\\\\\nUID - host_challenge - card_challenge\\\\\n- card_cryptogram (from fob)\\\" as In #E8F5E9\\\n\\\ncard \\\"**Phase A — KDF3**\\\\\nkey = master **M**\\\\\n7 x AES-ECB\\\" as A\\\ncard \\\"**Phase B — Session keys**\\\\\nkey = **SE / SM**\\\\\n8 x AES-ECB\\\" as B\\\ncard \\\"**Phase C — Cryptograms**\\\\\nkey = **SESMAC**\\\\\n5 x AES-ECB\\\" as C\\\ncard \\\"**Phase D — A003 CBC + cleanup**\\\\\nkey = **SD**\\\\\n3 x AES-ECB\\\" as D\\\n\\\nnote right of A\\\n  master + UID -> S-ENC / S-MAC / S-DEK\\\n  imported as handles SE / SM / SD\\\nend note\\\n\\\nnote right of B\\\n  -> SES-ENC / SES-MAC / SES-RMAC\\\n  SES-MAC imported as handle SESMAC\\\nend note\\\n\\\nnote right of C\\\n  VERIFY card_cryptogram  ->  GATE\\\n  then host_cryptogram\\\nend note\\\n\\\nnote right of D\\\n  AES-CBC(S-DEK) -> A003 ciphertext\\\n  Destroy SE / SM / SD / SESMAC; zeroize RAM\\\nend note\\\n\\\nIn -down-> A\\\nA -down-> B : static keys (SE/SM/SD)\\\nB -down-> C : SES-MAC (SESMAC)\\\nC -down-> D : authenticated + host_cryptogram\\\n\\\nrectangle \\\"**Outputs to station**\\\\\nSES-* keys - host_cryptogram\\\\\n- A003 ciphertext (pre-encrypted)\\\" as Out #FFF8E1\\\nD -down-> Out\\\n\\\nnote as N1 #FFEEEE\\\n  NetHSM exposes only single-block AES-ECB.\\\n  Master key **M** never returned (0 bytes).\\\n  ~= 23 AES-ECB calls per transaction.\\\nend note\\\nA .. N1\\\n@enduml\\\n```\\\n\\\n* * *\\\n\\\n## kdf-phase-a.puml — Phase A: KDF3\\\n\\\n```plantuml\\\n@startuml kdf-phase-a\\\n' Phase A - KDF3: master + UID -> S-ENC/S-MAC/S-DEK via AES-ECB (RFC 4493 CMAC).\\\n\\\nautonumber\\\ntitle Phase A — KDF3 (key = master M) -> static keys\\\n\\\nparticipant KLMS\\\nparticipant \\\"NetHSM\\\\\n(master M sealed)\\\" as HSM\\\n\\\n== master subkeys (RFC 4493) ==\\\nKLMS -> HSM : ECB(M, 0^16)\\\nHSM --> KLMS : L_M\\\nnote right of KLMS : host: K1_M = dbl(L_M),  K2_M = dbl(K1_M)\\\n\\\n== S-ENC (purpose 0x40, 26-B deriv data) ==\\\nKLMS -> HSM : ECB(M, block1)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(M, pad(block2) ^ K2_M)\\\nHSM --> KLMS : C2 = **S-ENC**\\\nKLMS -> HSM : ImportKey(S-ENC)\\\nHSM --> KLMS : handle **SE**\\\n\\\n== S-MAC (purpose 0x60) ==\\\nKLMS -> HSM : ECB(M, block1)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(M, pad(block2) ^ K2_M)\\\nHSM --> KLMS : C2 = **S-MAC**\\\nKLMS -> HSM : ImportKey(S-MAC)\\\nHSM --> KLMS : handle **SM**\\\n\\\n== S-DEK (purpose 0x70) ==\\\nKLMS -> HSM : ECB(M, block1)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(M, pad(block2) ^ K2_M)\\\nHSM --> KLMS : C2 = **S-DEK**\\\nKLMS -> HSM : ImportKey(S-DEK)\\\nHSM --> KLMS : handle **SD**\\\n\\\nnote over HSM #FFEEEE : master M never returned (7 AES-ECB calls)\\\nnote over KLMS : block1 = 16-B header; block2 = raw 10-B UID (partial -> padded)\\\\\nlayouts: crates/kf-scp03/src/derive.rs (build_static_derivation_data)\\\n@enduml\\\n```\\\n\\\n* * *\\\n\\\n## kdf-phase-b.puml — Phase B: session keys\\\n\\\n```plantuml\\\n@startuml kdf-phase-b\\\n' Phase B - session keys: S-ENC/S-MAC -> SES-ENC/MAC/RMAC via AES-ECB CMAC.\\\n\\\nautonumber\\\ntitle Phase B — Session keys (key = SE / SM) -> SES-*\\\n\\\nparticipant KLMS\\\nparticipant \\\"NetHSM\\\" as HSM\\\n\\\n== session subkeys (RFC 4493) ==\\\nKLMS -> HSM : ECB(SE, 0^16)\\\nHSM --> KLMS : L_SE\\\nnote right of KLMS : host: K1_SE, K2_SE\\\nKLMS -> HSM : ECB(SM, 0^16)\\\nHSM --> KLMS : L_SM\\\nnote right of KLMS : host: K1_SM, K2_SM\\\n\\\n== SES-ENC (const 0x04, 32-B deriv data) ==\\\nKLMS -> HSM : ECB(SE, block1)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(SE, block2 ^ K1_SE)\\\nHSM --> KLMS : C2 = **SES-ENC**  (-> station)\\\n\\\n== SES-MAC (const 0x06) ==\\\nKLMS -> HSM : ECB(SM, block1)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(SM, block2 ^ K1_SM)\\\nHSM --> KLMS : C2 = **SES-MAC**  (-> station)\\\nKLMS -> HSM : ImportKey(SES-MAC)\\\nHSM --> KLMS : handle **SESMAC**\\\n\\\n== SES-RMAC (const 0x07, reuse K1_SM) ==\\\nKLMS -> HSM : ECB(SM, block1)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(SM, block2 ^ K1_SM)\\\nHSM --> KLMS : C2 = **SES-RMAC**  (-> station)\\\n\\\nnote over HSM #FFEEEE : 8 AES-ECB calls; block2 is full -> XOR K1\\\nnote over KLMS : 32-B deriv data = 16-B header || host_challenge || card_challenge\\\\\n(crates/kf-scp03/src/derive.rs :: build_derivation_data)\\\n@enduml\\\n```\\\n\\\n* * *\\\n\\\n## kdf-phase-c.puml — Phase C: cryptograms\\\n\\\n```plantuml\\\n@startuml kdf-phase-c\\\n' Phase C - cryptograms (key = SESMAC): verify card_cryptogram (gate) + host_cryptogram.\\\n\\\nautonumber\\\ntitle Phase C — Cryptograms (key = SESMAC)\\\n\\\nparticipant KLMS\\\nparticipant \\\"NetHSM\\\" as HSM\\\n\\\n== cryptogram subkeys (RFC 4493) ==\\\nKLMS -> HSM : ECB(SESMAC, 0^16)\\\nHSM --> KLMS : L\\\nnote right of KLMS : host: K1, K2\\\n\\\n== card cryptogram verify (const 0x00) — GATE ==\\\nKLMS -> HSM : ECB(SESMAC, block1)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(SESMAC, block2 ^ K1)\\\nHSM --> KLMS : C2 -> truncate 8 B\\\nKLMS -> KLMS : compare == fob **card_cryptogram**\\\n\\\nalt match\\\n  note right of KLMS #DFFFD6 : authenticated = true -> proceed\\\nelse mismatch\\\n  KLMS --> Station : auth error\\\\\n(no keys / container issued)\\\n  stop\\\nend\\\n\\\n== host cryptogram (const 0x01, reuse K1/K2) ==\\\nKLMS -> HSM : ECB(SESMAC, block1)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(SESMAC, block2 ^ K1)\\\nHSM --> KLMS : C2 -> truncate 8 B = **host_cryptogram**  (-> station)\\\n\\\nnote over HSM #FFEEEE : 5 AES-ECB calls\\\nnote over KLMS : card/host cryptograms keyed by SES-MAC (crates/kf-scp03/src/derive.rs)\\\n@enduml\\\n```\\\n\\\n* * *\\\n\\\n## kdf-phase-d.puml — Phase D: A003 CBC + cleanup\\\n\\\n```plantuml\\\n@startuml kdf-phase-d\\\n' Phase D - A003 AES-CBC (key = SD, IV=0, ISO 9797-1 M2 pad) + handle cleanup.\\\n\\\nautonumber\\\ntitle Phase D — A003 AES-CBC (key = SD) + cleanup\\\n\\\nparticipant KLMS\\\nparticipant \\\"NetHSM\\\" as HSM\\\n\\\n== A003 encryption (AES-CBC, IV = 0) ==\\\nKLMS -> KLMS : pad 32-B scalar -> 48 B (ISO 9797-1 Method 2)\\\nKLMS -> HSM : ECB(SD, P1 ^ IV)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(SD, P2 ^ C1)\\\nHSM --> KLMS : C2\\\nKLMS -> HSM : ECB(SD, P3 ^ C2)\\\nHSM --> KLMS : C3\\\nnote right of KLMS : A003 = C1 || C2 || C3  (-> station, pre-encrypted)\\\n\\\n== Cleanup — destroy ephemeral handles ==\\\nKLMS -> HSM : Destroy(SE)\\\nKLMS -> HSM : Destroy(SM)\\\nKLMS -> HSM : Destroy(SD)\\\nKLMS -> HSM : Destroy(SESMAC)\\\nKLMS -> KLMS : zeroize all derived keys (RAM)\\\n\\\nnote over HSM #FFEEEE : 3 AES-ECB calls; master M untouched\\\nnote over KLMS : CBC chained by host from single-block ECB; S-DEK never sent to station\\\n@enduml\\\n```\\\n\\\n* * *\\\n\\\n## flow-2b-kdf-nethsm.puml — combined KDF (all phases)\\\n\\\n```plantuml\\\n@startuml flow-2b-kdf-nethsm\\\n' Flow 2b - KLMS <-> NetHSM KDF orchestration (AES-ECB only).\\\n' Byte layouts: crates/kf-scp03/src/derive.rs\\\n\\\nautonumber\\\ntitle Flow 2b — KLMS <-> NetHSM KDF Orchestration (AES-ECB only, per transaction)\\\n\\\nparticipant KLMS\\\nparticipant \\\"NetHSM\\\\\n(master key sealed)\\\" as HSM\\\n\\\nnote over HSM\\\n  Handles:  M       = master key (permanent)\\\n            SE/SM/SD = static S-ENC/MAC/DEK (ephemeral, imported)\\\n            SESMAC  = session S-MAC (ephemeral, imported)\\\n  \\\"host:\\\" steps are pure KLMS logic (no HSM call)\\\nend note\\\n\\\n== Phase A — KDF3 (key = M, master key) ==\\\nKLMS -> HSM : ECB(M, 0^16)\\\nHSM --> KLMS : L_M\\\nnote right of KLMS : host: K1_M = dbl(L_M),  K2_M = dbl(K1_M)\\\n\\\ngroup S-ENC  (purpose 0x40, 26-B derivation data)\\\n  KLMS -> HSM : ECB(M, block1)\\\n  HSM --> KLMS : C1\\\n  KLMS -> HSM : ECB(M, pad(block2) ^ K2_M)\\\n  HSM --> KLMS : C2 = S-ENC\\\n  KLMS -> HSM : ImportKey(S-ENC)\\\n  HSM --> KLMS : handle SE\\\nend\\\n\\\ngroup S-MAC  (purpose 0x60)\\\n  KLMS -> HSM : ECB(M, block1)\\\n  HSM --> KLMS : C1\\\n  KLMS -> HSM : ECB(M, pad(block2) ^ K2_M)\\\n  HSM --> KLMS : C2 = S-MAC\\\n  KLMS -> HSM : ImportKey(S-MAC)\\\n  HSM --> KLMS : handle SM\\\nend\\\n\\\ngroup S-DEK  (purpose 0x70)\\\n  KLMS -> HSM : ECB(M, block1)\\\n  HSM --> KLMS : C1\\\n  KLMS -> HSM : ECB(M, pad(block2) ^ K2_M)\\\n  HSM --> KLMS : C2 = S-DEK\\\n  KLMS -> HSM : ImportKey(S-DEK)\\\n  HSM --> KLMS : handle SD\\\nend\\\n\\\n== Phase B — session keys (key = SE / SM) ==\\\nKLMS -> HSM : ECB(SE, 0^16)\\\nHSM --> KLMS : L_SE\\\nnote right of KLMS : host: K1_SE, K2_SE\\\nKLMS -> HSM : ECB(SM, 0^16)\\\nHSM --> KLMS : L_SM\\\nnote right of KLMS : host: K1_SM, K2_SM\\\n\\\ngroup SES-ENC  (const 0x04, 32-B derivation data)\\\n  KLMS -> HSM : ECB(SE, block1)\\\n  HSM --> KLMS : C1\\\n  KLMS -> HSM : ECB(SE, block2 ^ K1_SE)\\\n  HSM --> KLMS : C2 = SES-ENC   (-> station)\\\nend\\\n\\\ngroup SES-MAC  (const 0x06)\\\n  KLMS -> HSM : ECB(SM, block1)\\\n  HSM --> KLMS : C1\\\n  KLMS -> HSM : ECB(SM, block2 ^ K1_SM)\\\n  HSM --> KLMS : C2 = SES-MAC   (-> station)\\\n  KLMS -> HSM : ImportKey(SES-MAC)\\\n  HSM --> KLMS : handle SESMAC\\\nend\\\n\\\ngroup SES-RMAC  (const 0x07, reuses K1_SM)\\\n  KLMS -> HSM : ECB(SM, block1)\\\n  HSM --> KLMS : C1\\\n  KLMS -> HSM : ECB(SM, block2 ^ K1_SM)\\\n  HSM --> KLMS : C2 = SES-RMAC  (-> station)\\\nend\\\n\\\n== Phase C — cryptograms (key = SESMAC) ==\\\nKLMS -> HSM : ECB(SESMAC, 0^16)\\\nHSM --> KLMS : L\\\nnote right of KLMS : host: K1, K2\\\n\\\ngroup card cryptogram verify (const 0x00) — GATE\\\n  KLMS -> HSM : ECB(SESMAC, block1)\\\n  HSM --> KLMS : C1\\\n  KLMS -> HSM : ECB(SESMAC, block2 ^ K1)\\\n  HSM --> KLMS : C2 -> truncate 8 B\\\n  KLMS -> KLMS : compare == fob card_cryptogram\\\nend\\\nnote right of KLMS #FFD0D0\\\n  mismatch => ABORT:\\\n  no session keys / container issued to the station\\\nend note\\\n\\\ngroup host cryptogram (const 0x01, reuses K1/K2)\\\n  KLMS -> HSM : ECB(SESMAC, block1)\\\n  HSM --> KLMS : C1\\\n  KLMS -> HSM : ECB(SESMAC, block2 ^ K1)\\\n  HSM --> KLMS : C2 -> truncate 8 B = host_cryptogram  (-> station)\\\nend\\\n\\\n== Phase D — A003 AES-CBC (key = SD, IV = 0) ==\\\nKLMS -> KLMS : pad 32-B scalar -> 48 B (ISO 9797-1 Method 2)\\\nKLMS -> HSM : ECB(SD, P1 ^ IV)\\\nHSM --> KLMS : C1\\\nKLMS -> HSM : ECB(SD, P2 ^ C1)\\\nHSM --> KLMS : C2\\\nKLMS -> HSM : ECB(SD, P3 ^ C2)\\\nHSM --> KLMS : C3\\\nnote right of KLMS : A003 = C1 || C2 || C3   (-> station)\\\n\\\n== Cleanup ==\\\nKLMS -> HSM : Destroy(SE)\\\nKLMS -> HSM : Destroy(SM)\\\nKLMS -> HSM : Destroy(SD)\\\nKLMS -> HSM : Destroy(SESMAC)\\\nKLMS -> KLMS : zeroize all derived keys (RAM)\\\n\\\nnote over HSM #FFEEEE\\\n  Master key M: 0 bytes ever returned.\\\n  Totals: 23 ECB + 4 ImportKey + 4 Destroy per transaction\\\n  (master subkeys cacheable across transactions).\\\nend note\\\n\\\n@enduml\\\n```\\\n\\\n* * *\\\n\\\n## flow-2-provisioning.puml — Key Fob ↔ Station ↔ KLMS\\\n\\\n```plantuml\\\n@startuml flow-2-provisioning\\\n' Flow 2 - Provisioning: Key Fob <-> Station <-> KLMS (-> NetHSM)\\\n' Station knows only the UID; FESN/SPID come back in the response.\\\n' KDF detail: flow-2b-kdf-nethsm.puml\\\n\\\ntitle Flow 2 — Provisioning: Key Fob <-> Station <-> KLMS\\\n\\\nactor       \\\"Key Fob\\\\\n(NCJ37x)\\\"   as Fob\\\nparticipant Station               as Station\\\nparticipant KLMS                  as KLMS\\\nparticipant \\\"NetHSM\\\\\n(master key)\\\" as HSM\\\n\\\n== 1. SCP03 initial handshake (station <-> fob) ==\\\nStation -> Fob : INITIALIZE UPDATE\\\\\n80 50 <KVN> 00 08 || host_challenge[8]\\\nFob --> Station : UID[10] || key_info || seq_counter[3]\\\\\n|| card_challenge[8] || card_cryptogram[8]\\\n\\\n== 2. Forward handshake to Clypeum (DLL over mTLS) ==\\\nStation -> KLMS : establish session\\\\\n{ transaction_id, station_id,\\\\\n  fob{uid, key_version},\\\\\n  scp03{host_challenge, card_challenge,\\\\\n        sequence_counter, card_cryptogram} }\\\n\\\nKLMS -> KLMS : cache lookup **by UID**\\\\\n-> content + FESN + SPID (from Flow 1)\\\n\\\nalt no package for UID\\\n  KLMS --> Station : NoPackage  (watchdog priority-fetches the UID)\\\nend\\\n\\\n== 3. Clypeum derives keys via NetHSM (detail: flow-2b-kdf-nethsm.puml) ==\\\ngroup KDF orchestration — 23 AES-ECB calls (keyed AES-ECB only)\\\n  KLMS -> HSM : KDF3 (master + UID) -> S-ENC/MAC/DEK\\\n  HSM --> KLMS : static keys\\\n  KLMS -> HSM : session KDF -> SES-ENC/MAC/RMAC\\\n  KLMS -> HSM : verify card_cryptogram (SES-MAC)\\\n  HSM --> KLMS : authenticated = true\\\n  KLMS -> HSM : host cryptogram\\\n  HSM --> KLMS : host_cryptogram\\\n  KLMS -> HSM : AES-CBC(S-DEK) -> A003 ciphertext\\\n  HSM --> KLMS : A003 ciphertext\\\nend\\\n\\\n== 4. Container back to station ==\\\nKLMS --> Station : container\\\\\n{ fob{fesn, spid}, authenticated,\\\\\n  scp03{ses_enc, ses_mac, ses_rmac, host_cryptogram,\\\\\n       security_level},\\\\\n  content{A001..A006 (A003 pre-encrypted), post_perso},\\\\\n  expires_at (~5 s) }\\\nStation -> Station : Scp03Channel::establish_from_session_keys()\\\n\\\n== 5. Open secure channel (C-MAC) ==\\\nStation -> Fob : EXTERNAL AUTHENTICATE\\\\\n84 82 <level> 00 || host_cryptogram || MAC[8]\\\nFob --> Station : 9000   (channel open)\\\n\\\n== 6. Personalize — STORE DATA loop ==\\\nloop over DGI blocks (<= 245 B each, each C-MAC'd)\\\n  Station -> Fob : STORE DATA\\\\\n84 E2 <P1> <P2> || DGI payload || MAC[8]\\\n  Fob --> Station : 9000\\\nend\\\n\\\n== 7. Lifecycle transition ==\\\nStation -> Fob : STORE DATA (last)\\\\\n84 E2 80 <P2> 00 || MAC[8]\\\nnote over Fob : UNPERSONALIZED -> FACTORY\\\nFob --> Station : 9000\\\n\\\n== 8. Post-personalization (raw, no secure messaging) ==\\\nStation -> Fob : 00 DB 00 00 03 0A 01 01   (enable UICC)\\\nStation -> Fob : 00 DB 00 00 03 0B 01 01   (enable BLE)\\\nFob --> Station : 9000\\\n\\\n== 9. Result + audit ==\\\nStation -> KLMS : provision result\\\\\n{ transaction_id, fesn, result,\\\\\n  stage_reached, apdu_count, timestamp }\\\nKLMS -> KLMS : audit + retire cached package\\\nStation -> Station : zeroize session keys\\\n\\\nnote over Station #E8FFE8\\\n  Station holds ONLY: ephemeral session keys\\\n  + pre-encrypted A003 (both zeroized after the transaction).\\\n  Never: master key, static keys, S-DEK.\\\nend note\\\nnote over HSM #FFEEEE : master key never leaves the NetHSM\\\n\\\n@enduml\\\n```\\\n\\\n* * *\\\n\\\n> **ASCII note:** the Joplin copies use ASCII (`^`, `||`, `->`, `0^16`) so they paste  \\\n> cleanly anywhere; the repo `.puml` files use the unicode glyphs (`⊕ ‖ ¹ →`) for  \\\n> nicer rendering. Either set renders identically in PlantUML.\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":14609}]"
metadata_diff: {"new":{"id":"1fbaa70f2fb94ffcaabbeca7b39482da","parent_id":"283dd54f183a4ce69366648f091336d1","latitude":"0.00000000","longitude":"0.00000000","altitude":"0.0000","author":"","source_url":"","is_todo":0,"todo_due":0,"todo_completed":0,"source":"joplin-desktop","source_application":"net.cozic.joplin-desktop","application_data":"","order":1782819569304,"markup_language":1,"is_shared":0,"share_id":"","conflict_original_id":"","master_key_id":"","user_data":"","deleted_time":0},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-07-01T06:39:23.447Z
created_time: 2026-07-01T06:39:23.447Z
type_: 13