IDOP: a file format for documents that do things.

The first entry of every package, stored uncompressed. Its content puts the media type at byte offset 38, so software can recognise an IDOP file without unpacking it.

Executable

No

Written by

Producer

application/vnd.idop+zip

What the document is and what it may ask for: the application, the document’s identity and revision lineage, the entry point, and every network capability with the origins, methods and purpose it declares. It never contains a secret.

Executable

No

Written by

Producer; the reader updates the revision on Save

{
  "format": "https://idoplabs.com/ns/idop/package",
  "formatVersion": "1.0",
  "entryPoint": "code/index.html",
  "application": { "id": "com.example.budget",
                   "title": "Project budget" },
  "requiredCapabilities": []
}

HTML, CSS, JavaScript and JSON — the only part of a package that can run. It runs inside the reader’s sandbox, with no network and no access to the reader. Inline scripts, remote URLs and dynamic evaluation are refused before anything runs.

Executable

Yes — in the sandbox only

Written by

Producer

code/
├── index.html   <script type="module" src="app.js">
├── app.js       await idop.storage.write(…)
└── style.css

Images, fonts and data files the interface displays. The reader serves them to the document by path; nothing under resources/ is ever executed, and a script placed there causes the package to be refused.

Executable

No

Written by

Producer

resources/
├── icon.svg
├── fonts/inter.woff2
└── data/rates.csv

The document’s data, saved in the file. The document reads and writes it only through the Runtime API; changes stay in a working copy until the user saves, and every Save produces a new revision.

Executable

No

Written by

The reader, on Save

// inside the document
const { text } = await idop.storage.read('model.json');
await idop.storage.write('model.json', next);

Names the specification keeps for itself. IDOP 1.1 defines an optional thumbnail here; publisher signatures and encryption metadata are reserved for future versions. A 1.0 reader ignores this root.

Executable

No

Written by

Defined by later versions

_idop/
├── thumbnail.png    1.1 draft
├── signatures/      reserved
└── encryption/      reserved

Data for named extensions, each under its own reverse-domain namespace, so extensions cannot collide with each other or with the format.

Executable

No

Written by

Producers of an extension

extensions/
└── com.example.review/
    └── comments.json