@econ-v1/domain 7.4.3 → 7.4.5

package/dist/services/invite-redemption-service.d.ts

@@ -1,43 +1,38 @@
 /** @typedef {import('@econ-v1/ports').HomeNodeClient} HomeNodeClient */
+/** @typedef {import('@econ-v1/ports').OwnerClaimCryptoPort} OwnerClaimCryptoPort */
+/** Claim-key proof for invitation admission; raw codes live only during the request. */
 export class InviteRedemptionService {
-    /**
-     * @param {InviteRedemptionServiceOptions} options
-     */
+    /** @param {InviteRedemptionServiceOptions} options */
     constructor(options: InviteRedemptionServiceOptions);
-    /**
-     * @param {string} code
-     * @returns {Promise<InviteRedemptionOutcome>}
-     */
-    redeem(code: string): Promise<InviteRedemptionOutcome>;
+    /** @param {string} code @param {string} [confirmation] @returns {Promise<InviteRedemptionOutcome>} */
+    redeem(code: string, confirmation?: string): Promise<InviteRedemptionOutcome>;
+    /** @returns {Promise<InviteRedemptionOutcome>} */
+    resume(): Promise<InviteRedemptionOutcome>;
     #private;
 }
 export type HomeNodeClient = import("@econ-v1/ports").HomeNodeClient;
-/**
- * Step 11's real action: redeem an invitation code against the node's PUBLIC
- * `POST /api/v2/invite/redeem` (`core/adapters-network/src/http/server/invite.rs`), which
- * takes `{ code }` or `{ token }` and needs no authentication — deliberately, because at step
- * 11 the browser has no session at all.
- *
- * The response's `receiver_name` is the name the INVITER registered for this person. Prefilling
- * step 12's display name with it (and locking it, see `OnboardingFlowService`) is what makes
- * the invitation meaningful rather than decorative: the person who was invited as "Ada
- * Lovelace" shows up on the inviter's node as Ada Lovelace. It is null for legacy
- * token-shaped invites, which is a normal, non-error case.
- *
- * Outcomes are closed and text-free. `"rejected"` covers expired, already-used, unknown and
- * malformed codes alike — the node's own message would tell an attacker which of those it was.
- */
+export type OwnerClaimCryptoPort = import("@econ-v1/ports").OwnerClaimCryptoPort;
 export type InviteRedemptionOutcome = {
     readonly kind: "redeemed";
-    readonly receiverName: string | undefined;
+    readonly receiverName: string;
 } | {
     readonly kind: "rejected";
+} | {
+    readonly kind: "unavailable";
+} | {
+    readonly kind: "confirmation-required";
+} | {
+    readonly kind: "recovery";
 };
 export type InviteRedemptionServiceOptions = {
     node: Pick<HomeNodeClient, "invoke">;
-};
-export type InviteRedeemWire = {
-    ok?: unknown;
-    receiver_name?: unknown;
+    /**
+     * Same persisted identity used for owner completion.
+     */
+    keys: OwnerClaimCryptoPort;
+    /**
+     * SHA256 lowercase hex of the supplied UTF-8 string.
+     */
+    hashCode: (code: string) => Promise<string>;
 };
 //# sourceMappingURL=invite-redemption-service.d.ts.map

package/dist/services/invite-redemption-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invite-redemption-service.d.ts","sourceRoot":"","sources":["../../src/services/invite-redemption-service.js"],"names":[],"mappings":"AACA,wEAAwE;AACxE;IAKE;;OAEG;IACH,qBAFW,8BAA8B,EAIxC;IACD;;;OAGG;IACH,aAHW,MAAM,GACJ,OAAO,CAAC,uBAAuB,CAAC,CAoB5C;;CACF;6BAnCa,OAAO,gBAAgB,EAAE,cAAc;;;;;;;;;;;;;;;;sCAkDtC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAChF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;;UAItB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;;;SAI9B,OAAO;oBACP,OAAO"}
+{"version":3,"file":"invite-redemption-service.d.ts","sourceRoot":"","sources":["../../src/services/invite-redemption-service.js"],"names":[],"mappings":"AAEA,wEAAwE;AACxE,oFAAoF;AAEpF,wFAAwF;AACxF;IAIE,sDAAsD;IACtD,qBADY,8BAA8B,EAKzC;IACD,sGAAsG;IACtG,aADY,MAAM,iBAAe,MAAM,GAA2B,OAAO,CAAC,uBAAuB,CAAC,CAKjG;IACD,kDAAkD;IAClD,UADc,OAAO,CAAC,uBAAuB,CAAC,CAG7C;;CA+BF;6BAtDa,OAAO,gBAAgB,EAAE,cAAc;mCACvC,OAAO,gBAAgB,EAAE,oBAAoB;sCAsD7C;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;;UAG5M,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;;;;UAC9B,oBAAoB;;;;cACpB,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC"}

package/dist/services/onboarding-flow-service.d.ts

@@ -98,7 +98,7 @@ export type OnboardingFlowApprovalState = "waiting" | "approved" | "rejected" |
  * node's outright refusal of this device's claim — the code is already bound to a different
  * device, or the supplied/missing code did not match.
  */
-export type OnboardingFlowReasonCode = "approval-expired" | "approval-rejected" | "wifi-credentials-rejected" | "wifi-scan-failed" | "wifi-unreachable" | "invitation-invalid" | "claim-failed" | "code-already-bound" | "access-code-invalid";
+export type OnboardingFlowReasonCode = "approval-expired" | "approval-rejected" | "wifi-credentials-rejected" | "wifi-scan-failed" | "wifi-unreachable" | "invitation-invalid" | "invitation-unavailable" | "claim-failed" | "code-already-bound" | "access-code-invalid";
 export type OnboardingFlowRow = OnboardingFlowRowBase & ({
     readonly networks: readonly OnboardingFlowNetwork[];
     readonly probing: boolean;
@@ -131,7 +131,7 @@ export type OnboardingFlowRow = OnboardingFlowRowBase & ({
     readonly stepId: Exclude<OnboardingFlowStepId, "choose-network" | "handoff" | "identity" | "invitation" | "match-code" | "network-password" | "trusted">;
 });
 export type OnboardingFlowClaimPort = Pick<OwnerClaimService, "awaitConfirmation" | "cancel" | "completeClaim" | "prepareClaim">;
-export type OnboardingFlowInvitePort = Pick<InviteRedemptionService, "redeem">;
+export type OnboardingFlowInvitePort = Pick<InviteRedemptionService, "redeem" | "resume">;
 export type OnboardingFlowWifiPort = Pick<WifiProvisioningService, "awaitHandoff" | "awaitReconnect" | "configure" | "scan" | "status">;
 export type OnboardingFlowLcdPort = Pick<LcdDecisionService, "confirm" | "reject">;
 export type OnboardingFlowNetwork = {

package/dist/services/onboarding-flow-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding-flow-service.d.ts","sourceRoot":"","sources":["../../src/services/onboarding-flow-service.js"],"names":[],"mappings":"AAaA,8KAA8K;AAC9K,uCADW,SAAS,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAaxK;AA0DF;IA0FE;;OAEG;IACH,qBAFW,4BAA4B,EActC;IACD;;OAEG;IACH,QAFa,iBAAiB,CAkE7B;IACD;;OAEG;IACH,SAFa,IAAI,CAoFhB;IACD;;OAEG;IACH,WAFa,OAAO,CAAC,IAAI,CAAC,CAoBzB;IACD;;;OAGG;IACH,0BAHW,qBAAqB,GAAG,WAAW,GACjC,OAAO,CAAC,IAAI,CAAC,CAMzB;IACD;;OAEG;IACH,aAFa,uBAAuB,CAUnC;IACD;;;OAGG;IACH,oBAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAsBzB;IACD;;OAEG;IACH,kBAFa,OAAO,CAAC,IAAI,CAAC,CAKzB;IACD;;;OAGG;IACH,uBAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CA4BzB;IACD;;;;OAIG;IACH,oBAJW,MAAM,YACN,0BAA0B,GACxB,OAAO,CAAC,IAAI,CAAC,CAUzB;IACD;;OAEG;IACH,mBAFa,OAAO,CAAC,IAAI,CAAC,CAKzB;IACD;;OAEG;IACH,kBAFa,OAAO,CAAC,IAAI,CAAC,CAYzB;IACD;;;OAGG;IACH,yBAHW,kBAAkB,GAChB,OAAO,CAAC,IAAI,CAAC,CAiDzB;IACD;;;OAGG;IACH,8BAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAgCzB;IACD;;OAEG;IACH,iBAFa,OAAO,CAAC,IAAI,CAAC,CAOzB;IACD;;OAEG;IACH,UAFa,IAAI,CA8BhB;IACD;;OAEG;IACH,QAFa,IAAI,CAiBhB;;CAiXF;wCAv+Ba,OAAO,gBAAgB,EAAE,yBAAyB;sCAClD,OAAO,gBAAgB,EAAE,uBAAuB;qCAChD,OAAO,gBAAgB,EAAE,sBAAsB;sCAC/C,OAAO,gCAAgC,EAAE,uBAAuB;iCAChE,OAAO,2BAA2B,EAAE,kBAAkB;wCACtD,OAAO,kCAAkC,EAAE,yBAAyB;iCACpE,OAAO,0BAA0B,EAAE,kBAAkB;gCACrD,OAAO,0BAA0B,EAAE,iBAAiB;sCACpD,OAAO,gCAAgC,EAAE,uBAAuB;gCAChE,OAAO,gCAAgC,EAAE,iBAAiB;mCAm/B1D,CAAC,OAAO,wBAAwB,EAAE,MAAM,CAAC;kCACzC,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO;wCAEtD,YAAY,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,oBAAoB,GACpB,qBAAqB,GACrB,iBAAiB,GACjB,cAAc,GACd,iBAAiB,GACjB,kBAAkB;yCAEX,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM;0CAE/B,SAAS,GACjB,UAAU,GACV,UAAU,GACV,SAAS,GACT,WAAW;;;;;;uCAMH,kBAAkB,GAC1B,mBAAmB,GACnB,2BAA2B,GAC3B,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,cAAc,GACd,oBAAoB,GACpB,qBAAqB;gCAGf,qBAAqB,GAAG,CAAC;IACrC,QAAc,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC1D,QAAc,CAAC,OAAO,EAAE,OAAO,CAAC;IAChC,QAAc,CAAC,QAAQ,EAAE,OAAO,CAAC;IACjC,QAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GACC;IACN,QAAc,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IACpD,QAAc,CAAC,IAAI,EAAE,MAAM,CAAC;IAC5B,QAAc,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC,GACC;IACN,QAAc,CAAC,aAAa,EAAE,2BAA2B,CAAC;IAC1D,QAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC;IACxC,QAAc,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B,GACC;IACN,QAAc,CAAC,cAAc,EAAE,OAAO,CAAC;IACvC,QAAc,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B,GACC;IACN,QAAc,CAAC,WAAW,EAAE,MAAM,CAAC;IACnC,QAAc,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC1C,QAAc,CAAC,MAAM,EAAE,UAAU,CAAC;IAClC,QAAc,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,GACC;IACN,QAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAC3C,QAAc,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B,GACC;IACN,QAAc,CAAC,IAAI,EAAE,MAAM,CAAC;IAC5B,QAAc,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B,GACC;IACN,QAAc,CAAC,MAAM,EAAE,OAAO,CACtB,oBAAoB,EAClB,gBAAgB,GAChB,SAAS,GACT,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,SAAS,CACZ,CAAC;CACH,CAAC;sCAGM,IAAI,CACZ,iBAAiB,EACrB,mBAAuB,GAAG,QAAQ,GAAG,eAAe,GAAG,cAAc,CAClE;uCAEU,IAAI,CAAC,uBAAuB,EAAE,QAAQ,CAAC;qCAExC,IAAI,CACZ,uBAAuB,EAC3B,cAAkB,GAAG,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,CACpE;oCAEU,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,QAAQ,CAAC;;cAG9C,0BAA0B;YAC1B,MAAM;UACN,MAAM;;;iBAIN,yBAAyB;WACzB,mBAAmB;iBACnB,wBAAwB;eACxB,MAAM;gBACN,MAAM;;;kBAIN,OAAO;qBACP,OAAO;cACP,yBAAyB;WACzB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;;;;;;;;;;;iBAIzC,yBAAyB;iBAMzB,IAAI,CAAC,yBAAyB,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;WAC3D,uBAAuB;yBACvB,MAAM,OAAO;wBACb,MAAM,OAAO;aACb,wBAAwB;UACxB,qBAAqB;SACrB,MAAM,MAAM;eACZ,sBAAsB;aACtB,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI;UACtC,sBAAsB;;;WAItB,aAAa;QACb,oBAAoB;iBACpB,yBAAyB;WACzB,mBAAmB"}
+{"version":3,"file":"onboarding-flow-service.d.ts","sourceRoot":"","sources":["../../src/services/onboarding-flow-service.js"],"names":[],"mappings":"AAaA,8KAA8K;AAC9K,uCADW,SAAS,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAaxK;AA0DF;IA4FE;;OAEG;IACH,qBAFW,4BAA4B,EActC;IACD;;OAEG;IACH,QAFa,iBAAiB,CAkE7B;IACD;;OAEG;IACH,SAFa,IAAI,CAyFhB;IACD;;OAEG;IACH,WAFa,OAAO,CAAC,IAAI,CAAC,CAoBzB;IACD;;;OAGG;IACH,0BAHW,qBAAqB,GAAG,WAAW,GACjC,OAAO,CAAC,IAAI,CAAC,CAMzB;IACD;;OAEG;IACH,aAFa,uBAAuB,CAUnC;IACD;;;OAGG;IACH,oBAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAsBzB;IACD;;OAEG;IACH,kBAFa,OAAO,CAAC,IAAI,CAAC,CAKzB;IACD;;;OAGG;IACH,uBAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CA+CzB;IAqCD;;;;OAIG;IACH,oBAJW,MAAM,YACN,0BAA0B,GACxB,OAAO,CAAC,IAAI,CAAC,CAUzB;IACD;;OAEG;IACH,mBAFa,OAAO,CAAC,IAAI,CAAC,CAKzB;IACD;;OAEG;IACH,kBAFa,OAAO,CAAC,IAAI,CAAC,CAYzB;IACD;;;OAGG;IACH,yBAHW,kBAAkB,GAChB,OAAO,CAAC,IAAI,CAAC,CAwDzB;IACD;;;OAGG;IACH,8BAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAgCzB;IACD;;OAEG;IACH,iBAFa,OAAO,CAAC,IAAI,CAAC,CAOzB;IACD;;OAEG;IACH,UAFa,IAAI,CAiChB;IACD;;OAEG;IACH,QAFa,IAAI,CAiBhB;;CAiXF;wCA/iCa,OAAO,gBAAgB,EAAE,yBAAyB;sCAClD,OAAO,gBAAgB,EAAE,uBAAuB;qCAChD,OAAO,gBAAgB,EAAE,sBAAsB;sCAC/C,OAAO,gCAAgC,EAAE,uBAAuB;iCAChE,OAAO,2BAA2B,EAAE,kBAAkB;wCACtD,OAAO,kCAAkC,EAAE,yBAAyB;iCACpE,OAAO,0BAA0B,EAAE,kBAAkB;gCACrD,OAAO,0BAA0B,EAAE,iBAAiB;sCACpD,OAAO,gCAAgC,EAAE,uBAAuB;gCAChE,OAAO,gCAAgC,EAAE,iBAAiB;mCA2jC1D,CAAC,OAAO,wBAAwB,EAAE,MAAM,CAAC;kCACzC,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO;wCAEtD,YAAY,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,oBAAoB,GACpB,qBAAqB,GACrB,iBAAiB,GACjB,cAAc,GACd,iBAAiB,GACjB,kBAAkB;yCAEX,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM;0CAE/B,SAAS,GACjB,UAAU,GACV,UAAU,GACV,SAAS,GACT,WAAW;;;;;;uCAMH,kBAAkB,GAC1B,mBAAmB,GACnB,2BAA2B,GAC3B,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,cAAc,GACd,oBAAoB,GACpB,qBAAqB;gCAGf,qBAAqB,GAAG,CAAC;IACrC,QAAc,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC1D,QAAc,CAAC,OAAO,EAAE,OAAO,CAAC;IAChC,QAAc,CAAC,QAAQ,EAAE,OAAO,CAAC;IACjC,QAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GACC;IACN,QAAc,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IACpD,QAAc,CAAC,IAAI,EAAE,MAAM,CAAC;IAC5B,QAAc,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC,GACC;IACN,QAAc,CAAC,aAAa,EAAE,2BAA2B,CAAC;IAC1D,QAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC;IACxC,QAAc,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B,GACC;IACN,QAAc,CAAC,cAAc,EAAE,OAAO,CAAC;IACvC,QAAc,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B,GACC;IACN,QAAc,CAAC,WAAW,EAAE,MAAM,CAAC;IACnC,QAAc,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC1C,QAAc,CAAC,MAAM,EAAE,UAAU,CAAC;IAClC,QAAc,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,GACC;IACN,QAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAC3C,QAAc,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B,GACC;IACN,QAAc,CAAC,IAAI,EAAE,MAAM,CAAC;IAC5B,QAAc,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B,GACC;IACN,QAAc,CAAC,MAAM,EAAE,OAAO,CACtB,oBAAoB,EAClB,gBAAgB,GAChB,SAAS,GACT,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,kBAAkB,GAClB,SAAS,CACZ,CAAC;CACH,CAAC;sCAGM,IAAI,CACZ,iBAAiB,EACrB,mBAAuB,GAAG,QAAQ,GAAG,eAAe,GAAG,cAAc,CAClE;uCAEU,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,QAAQ,CAAC;qCAEnD,IAAI,CACZ,uBAAuB,EAC3B,cAAkB,GAAG,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,CACpE;oCAEU,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,QAAQ,CAAC;;cAG9C,0BAA0B;YAC1B,MAAM;UACN,MAAM;;;iBAIN,yBAAyB;WACzB,mBAAmB;iBACnB,wBAAwB;eACxB,MAAM;gBACN,MAAM;;;kBAIN,OAAO;qBACP,OAAO;cACP,yBAAyB;WACzB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;;;;;;;;;;;iBAIzC,yBAAyB;iBAMzB,IAAI,CAAC,yBAAyB,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;WAC3D,uBAAuB;yBACvB,MAAM,OAAO;wBACb,MAAM,OAAO;aACb,wBAAwB;UACxB,qBAAqB;SACrB,MAAM,MAAM;eACZ,sBAAsB;aACtB,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI;UACtC,sBAAsB;;;WAItB,aAAa;QACb,oBAAoB;iBACpB,yBAAyB;WACzB,mBAAmB"}

package/dist/services/onboarding-status-service.d.ts

@@ -4,6 +4,8 @@ export class OnboardingStatusService {
     /** Synchronous read of the last flag the node reported. Injected into
      * `OnboardingFlowService` as a getter so a value arriving after boot still takes effect. */
     /** @returns {boolean} */
+    /** @returns {boolean} */
+    invitationRequired(): boolean;
     invitationsEnabled(): boolean;
     /** @returns {Promise<OnboardingLifecycleStatusRow>} */
     status(): Promise<OnboardingLifecycleStatusRow>;
@@ -19,6 +21,7 @@ export type OnboardingLifecycleStatusRow = {
 export type OnboardingStatusWire = {
     readonly claimed?: unknown;
     readonly invitations_enabled?: unknown;
+    readonly admission_policy?: unknown;
 };
 export type OnboardingStatusServiceOptions = {
     readonly hasActiveSession: () => boolean;

package/dist/services/onboarding-status-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding-status-service.d.ts","sourceRoot":"","sources":["../../src/services/onboarding-status-service.js"],"names":[],"mappings":"AAOA;IAQI,sDAAsD;IACtD,qBADY,8BAA8B,EAKzC;IACD;gGAC4F;IAC5F,yBAAyB;IACzB,sBADc,OAAO,CAGpB;IACD,uDAAuD;IACvD,UADc,OAAO,CAAC,4BAA4B,CAAC,CAmClD;;CACJ;uCA7DgB,oBAAoB,GAAG,kBAAkB,GAAG,eAAe,GAAG,OAAO;2CACvE;IAAE,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAAE;mCAChJ;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAAE;6CACvE;IAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;CAAE;oCAJ3H,gBAAgB"}
+{"version":3,"file":"onboarding-status-service.d.ts","sourceRoot":"","sources":["../../src/services/onboarding-status-service.js"],"names":[],"mappings":"AAOA;IASI,sDAAsD;IACtD,qBADY,8BAA8B,EAKzC;IACD;gGAC4F;IAC5F,yBAAyB;IACzB,yBAAyB;IACzB,sBADc,OAAO,CACoC;IACzD,8BAEC;IACD,uDAAuD;IACvD,UADc,OAAO,CAAC,4BAA4B,CAAC,CAoClD;;CACJ;uCAjEgB,oBAAoB,GAAG,kBAAkB,GAAG,eAAe,GAAG,OAAO;2CACvE;IAAE,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAAE;mCAChJ;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAAE;6CAC5G;IAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;CAAE;oCAJ3H,gBAAgB"}

package/dist/services/owner-claim-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-claim-service.d.ts","sourceRoot":"","sources":["../../src/services/owner-claim-service.js"],"names":[],"mappings":"AAQA;IAmBE;;OAEG;IACH,qBAFW,wBAAwB,EAOlC;IACD;;;;;;;;;;;;OAYG;IACH,0BAHW,MAAM,GACJ,OAAO,CAAC,wBAAwB,CAAC,CAyB7C;IACD;;;;;;;;;OASG;IACH,iCAHW,MAAM,GACJ,OAAO,CAAC,sBAAsB,CAAC,CAsB3C;IACD;;;;;;;;;;;;;;OAcG;IACH,wBAHW,kBAAkB,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAsEtC;IACD;;;OAGG;IACH,UAFa,IAAI,CAKhB;;CACF;wBAnMa,OAAO,gBAAgB,EAAE,SAAS;6BAClC,OAAO,gBAAgB,EAAE,cAAc;mCACvC,OAAO,gBAAgB,EAAE,oBAAoB;oCAC7C,OAAO,gBAAgB,EAAE,qBAAqB;sCAC9C,OAAO,gBAAgB,EAAE,uBAAuB;qCA2NhD,WAAW,GAAG,UAAU,GAAG,WAAW;;;;;;;gCAMrC,SAAS,GACjB,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6DJ,MAAM;cACN,MAAM;;;;;;;;;eAIN,OAAO;iBAIP,OAAO;eACP,MAAM;;;;;mBACN,MAAM,GAAG,SAAS;0BAElB,OAAO;;;;;;;;UAIP,oBAAoB;WAGpB,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;UACvB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;;;;;aAC9B,qBAAqB;;;;;;;gBAKrB,OAAO;mBAEP,OAAO;qBACP,MAAM;iBACN,MAAM;kBACN,OAAO;;;eAIP,OAAO;aACP,MAAM;;;eAIN,MAAM;kBACN,MAAM;;;oBAIN,OAAO;aACP,OAAO;YACP,OAAO;uBACP,OAAO"}
+{"version":3,"file":"owner-claim-service.d.ts","sourceRoot":"","sources":["../../src/services/owner-claim-service.js"],"names":[],"mappings":"AAQA;IAmBE;;OAEG;IACH,qBAFW,wBAAwB,EAOlC;IACD;;;;;;;;;;;;OAYG;IACH,0BAHW,MAAM,GACJ,OAAO,CAAC,wBAAwB,CAAC,CAyB7C;IACD;;;;;;;;;OASG;IACH,iCAHW,MAAM,GACJ,OAAO,CAAC,sBAAsB,CAAC,CAsB3C;IACD;;;;;;;;;;;;;;OAcG;IACH,wBAHW,kBAAkB,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAsEtC;IACD;;;OAGG;IACH,UAFa,IAAI,CAMhB;;CACF;wBApMa,OAAO,gBAAgB,EAAE,SAAS;6BAClC,OAAO,gBAAgB,EAAE,cAAc;mCACvC,OAAO,gBAAgB,EAAE,oBAAoB;oCAC7C,OAAO,gBAAgB,EAAE,qBAAqB;sCAC9C,OAAO,gBAAgB,EAAE,uBAAuB;qCA4NhD,WAAW,GAAG,UAAU,GAAG,WAAW;;;;;;;gCAMrC,SAAS,GACjB,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6DJ,MAAM;cACN,MAAM;;;;;;;;;eAIN,OAAO;iBAIP,OAAO;eACP,MAAM;;;;;mBACN,MAAM,GAAG,SAAS;0BAElB,OAAO;;;;;;;;UAIP,oBAAoB;WAGpB,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;UACvB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;;;;;aAC9B,qBAAqB;;;;;;;gBAKrB,OAAO;mBAEP,OAAO;qBACP,MAAM;iBACN,MAAM;kBACN,OAAO;;;eAIP,OAAO;aACP,MAAM;;;eAIN,MAAM;kBACN,MAAM;;;oBAIN,OAAO;aACP,OAAO;YACP,OAAO;uBACP,OAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@econ-v1/domain",
-  "version": "7.4.3",
+  "version": "7.4.5",
   "description": "Platform-neutral domain contracts and errors for Node clients",
   "license": "MIT OR Apache-2.0",
   "author": "Node contributors",
@@ -57,6 +57,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@econ-v1/ports": "7.4.3"
+    "@econ-v1/ports": "7.4.5"
   }
 }

package/src/services/invite-redemption-service.js

@@ -1,64 +1,64 @@
 // @ts-check
+import { DomainError } from "../errors/index.js";
 /** @typedef {import('@econ-v1/ports').HomeNodeClient} HomeNodeClient */
+/** @typedef {import('@econ-v1/ports').OwnerClaimCryptoPort} OwnerClaimCryptoPort */
+
+/** Claim-key proof for invitation admission; raw codes live only during the request. */
 export class InviteRedemptionService {
-  /**
-   * @readonly
-   */
   #node;
-  /**
-   * @param {InviteRedemptionServiceOptions} options
-   */
+  #keys;
+  #hashCode;
+  /** @param {InviteRedemptionServiceOptions} options */
   constructor(options) {
     this.#node = options.node;
+    this.#keys = options.keys;
+    this.#hashCode = options.hashCode;
   }
-  /**
-   * @param {string} code
-   * @returns {Promise<InviteRedemptionOutcome>}
-   */
-  async redeem(code) {
+  /** @param {string} code @param {string} [confirmation] @returns {Promise<InviteRedemptionOutcome>} */
+  async redeem(code, confirmation) {
     const trimmed = code.trim();
-    if (trimmed.length === 0) return { kind: "rejected" };
+    if (trimmed.length === 0 || trimmed.length > 2900) return { kind: "rejected" };
+    return await this.#prove("redeem", trimmed, confirmation);
+  }
+  /** @returns {Promise<InviteRedemptionOutcome>} */
+  async resume() {
+    return await this.#prove("resume", "");
+  }
+  /** @param {"redeem" | "resume"} purpose @param {string} code @param {string} [confirmation] @returns {Promise<InviteRedemptionOutcome>} */
+  async #prove(purpose, code, confirmation) {
     try {
+      const publicKey = await this.#keys.publicKey();
+      const codeHash = purpose === "redeem" ? await this.#hashCode(code) : "";
+      const challenge = await this.#node.invoke({
+        operation: "POST /api/v2/invite/challenge",
+        payload: { public_key: publicKey, purpose, code_hash: codeHash, ...(purpose === "redeem" && confirmation !== undefined ? { onboarding_confirmation: confirmation } : {}) },
+      });
+      if (typeof challenge.challenge_id !== "string" || typeof challenge.challenge !== "string")
+        return { kind: "unavailable" };
+      const signature = await this.#keys.sign(challenge.challenge);
       const wire = await this.#node.invoke({
-        operation: "POST /api/v2/invite/redeem",
-        payload: { code: trimmed },
+        operation: `POST /api/v2/invite/${purpose}`,
+        payload: { public_key: publicKey, challenge_id: challenge.challenge_id, signature,
+          ...(purpose === "redeem" ? { code, ...(confirmation !== undefined ? { onboarding_confirmation: confirmation } : {}) } : {}) },
       });
-      if (wire.ok !== true) return { kind: "rejected" };
-      const receiverName =
-        typeof wire.receiver_name === "string" &&
-        wire.receiver_name.trim().length > 0
-          ? wire.receiver_name.trim()
-          : undefined;
-      return { kind: "redeemed", receiverName };
-    } catch {
-      return { kind: "rejected" };
+      if (purpose === "resume" && wire.ok === true && ["legacy_recovery", "genesis"].includes(wire.source)) return { kind: "recovery" };
+      if (wire.ok === false) return { kind: "rejected" };
+      if (wire.ok !== true || typeof wire.receiver_name !== "string" || !wire.receiver_name.trim())
+        return { kind: "unavailable" };
+      return { kind: "redeemed", receiverName: wire.receiver_name.trim() };
+    } catch (error) {
+      if (purpose === "redeem" && error instanceof DomainError && error.code === "forbidden") return { kind: "confirmation-required" };
+      // Only explicit refusals mean invalid admission. Network/provider/store failures can retry.
+      if (error instanceof DomainError && ["invalid_request", "invalid_payload", "validation_failed", "not_found", "conflict", "unauthorized", "forbidden"].includes(error.code))
+        return { kind: "rejected" };
+      return { kind: "unavailable" };
     }
   }
 }
-/**
- * Step 11's real action: redeem an invitation code against the node's PUBLIC
- * `POST /api/v2/invite/redeem` (`core/adapters-network/src/http/server/invite.rs`), which
- * takes `{ code }` or `{ token }` and needs no authentication — deliberately, because at step
- * 11 the browser has no session at all.
- *
- * The response's `receiver_name` is the name the INVITER registered for this person. Prefilling
- * step 12's display name with it (and locking it, see `OnboardingFlowService`) is what makes
- * the invitation meaningful rather than decorative: the person who was invited as "Ada
- * Lovelace" shows up on the inviter's node as Ada Lovelace. It is null for legacy
- * token-shaped invites, which is a normal, non-error case.
- *
- * Outcomes are closed and text-free. `"rejected"` covers expired, already-used, unknown and
- * malformed codes alike — the node's own message would tell an attacker which of those it was.
- * @typedef {| { readonly kind: "redeemed"; readonly receiverName: string | undefined }
- *   | { readonly kind: "rejected" }} InviteRedemptionOutcome
- */
+/** @typedef {{ readonly kind: "redeemed"; readonly receiverName: string } | { readonly kind: "rejected" } | { readonly kind: "unavailable" } | { readonly kind: "confirmation-required" } | { readonly kind: "recovery" }} InviteRedemptionOutcome */
 /**
  * @typedef {object} InviteRedemptionServiceOptions
  * @property {Pick<HomeNodeClient, "invoke">} node
+ * @property {OwnerClaimCryptoPort} keys Same persisted identity used for owner completion.
+ * @property {(code: string) => Promise<string>} hashCode SHA256 lowercase hex of the supplied UTF-8 string.
  */
-/**
- * @typedef {object} InviteRedeemWire
- * @property {unknown} [ok]
- * @property {unknown} [receiver_name]
- */
-// @ts-check

package/src/services/onboarding-flow-service.js

@@ -95,6 +95,7 @@ export class OnboardingFlowService {
   #invitationsEnabled;
   /** @readonly @type {OnboardingFlowInvitePort} */
   #invites;
+  #admissionGeneration = 0;
   /** @readonly @type {OnboardingFlowLcdPort | undefined} */
   #lcd;
   /** @readonly @type {() => string} */
@@ -133,6 +134,7 @@ export class OnboardingFlowService {
   #networks = [];
   /** @type {string | undefined} */
   #operationHash;
+  #admissionRestored = false;
   /** @type {OnboardingFlowReasonCode | undefined} */
   #reasonCode;
   /** @default 0 */
@@ -260,6 +262,8 @@ export class OnboardingFlowService {
    * @returns {void}
    */
   start() {
+    this.#admissionGeneration += 1;
+    this.#submittingIdentity = false;
     // Latched HERE, before anything else — including the checkpoint restore right below, which
     // consults `#activeSteps()` (and therefore `#accessCodeMode`) to validate a resumed step id.
     // See `#accessCodeMode`'s own doc comment for why this is the only place it is ever set.
@@ -275,6 +279,7 @@ export class OnboardingFlowService {
     // Neither the invitation's name nor the session flag is checkpointed: both are facts about
     // an in-memory attempt, and a resumed flow must re-earn them rather than assert them.
     this.#lockedDisplayName = undefined;
+    this.#admissionRestored = false;
     // Deliberately not restored from the checkpoint: it is an answer about THIS claim attempt,
     // and a resumed flow re-earns it at the next prepare. Until then the pane offers a real
     // confirm, which a node with a display simply refuses — the safe direction.
@@ -288,6 +293,7 @@ export class OnboardingFlowService {
     this.#scanning = false;
     this.#sessionEstablished = false;
     this.#stepId = restored ?? FIRST_PWA_STEP;
+    if (this.#stepId === "trusted" && this.#invitationRequired()) this.#stepId = "identity";
     this.#probing = this.#stepId === "choose-network";
     // The security of the checkpointed SSID is deliberately NOT persisted: the password is not
     // resumable either, so step 5 is re-shown rather than replayed, and WPA2 is the demanding
@@ -307,6 +313,7 @@ export class OnboardingFlowService {
     // access" moment — independent of which step a resumed checkpoint or the Wi-Fi skip-check
     // below lands on, rather than waiting for a click through the now-absent match-code step.
     if (this.#accessCodeMode) void this.#prepareCode();
+    if ((this.#stepId === "identity" || this.#stepId === "invitation") && this.#invitationRequired()) void this.#restoreAdmission();
     // A node whose Wi-Fi was configured on its own captive portal (or any earlier attempt)
     // needs no credentials from this flow: asking again is the double-prompt this probe
     // exists to kill, and RESUBMITTING working credentials is worse than redundant — the node
@@ -422,12 +429,28 @@ export class OnboardingFlowService {
    * @returns {Promise<void>}
    */
   async redeemInvitation(code) {
-    if (this.#stepId !== "invitation") return;
+    if (this.#stepId !== "invitation" || this.#submittingIdentity) return;
+    // The restore action sends no token; whitespace input still follows ordinary validation.
+    if (code === "") { await this.#restoreAdmission(); return; }
+    const generation = ++this.#admissionGeneration;
+    this.#submittingIdentity = true;
+    this.#publish(this.#stepId);
     /** @type {Awaited<ReturnType<OnboardingFlowInvitePort["redeem"]>>} */
-    const outcome = await this.#invites.redeem(code);
+    const outcome = await this.#invites.redeem(code, this.#operationHash);
+    if (generation !== this.#admissionGeneration) return;
+    this.#submittingIdentity = false;
     if (this.#stepId !== "invitation") return;
-    if (outcome.kind === "rejected") {
-      this.#reasonCode = "invitation-invalid";
+    if (outcome.kind === "confirmation-required") {
+      this.#submittingIdentity = true;
+      const prepared = await this.#prepareCode();
+      if (generation !== this.#admissionGeneration) return;
+      this.#submittingIdentity = false;
+      if (prepared) this.#enterMatchCode();
+      else this.#publish(this.#stepId);
+      return;
+    }
+    if (outcome.kind !== "redeemed") {
+      this.#reasonCode = outcome.kind === "unavailable" ? "invitation-unavailable" : "invitation-invalid";
       this.#publish(this.#stepId);
       return;
     }
@@ -443,11 +466,50 @@ export class OnboardingFlowService {
       // runs (reason code set + published) but is immediately superseded by the `#moveTo` below,
       // which always resets the reason code; the completion-failure belt in `submitIdentity()`
       // remains the backstop if the operation is ALSO stale by the time identity is submitted.
+      this.#submittingIdentity = true;
       await this.#prepareCode();
+      if (generation !== this.#admissionGeneration) return;
+      this.#submittingIdentity = false;
       if (this.#stepId !== "invitation") return;
     }
     this.#moveTo(this.#nextStepAfter("invitation"));
   }
+  /** Restore only host-authorized identity; a checkpoint never grants admission.
+   * @returns {Promise<boolean>} */
+  async #restoreAdmission() {
+    const generation = ++this.#admissionGeneration;
+    this.#submittingIdentity = true;
+    this.#publish(this.#stepId);
+    const outcome = await this.#invites.resume();
+    if (generation !== this.#admissionGeneration) return false;
+    this.#submittingIdentity = false;
+    if (this.#stepId !== "identity" && this.#stepId !== "invitation") return false;
+    if (outcome.kind === "rejected" || outcome.kind === "confirmation-required") {
+      this.#moveTo("invitation");
+      return false;
+    }
+    if (outcome.kind === "unavailable") {
+      this.#reasonCode = "invitation-unavailable";
+      this.#publish(this.#stepId);
+      return false;
+    }
+    this.#admissionRestored = true;
+    this.#lockedDisplayName = outcome.kind === "redeemed" ? outcome.receiverName : undefined;
+    // The owner service's prepared operation is memory-only. A reload must re-prepare the
+    // same persistent key; admission never substitutes for the physical-presence gate.
+    if (!this.#accessCodeMode) {
+      this.#submittingIdentity = true;
+      const prepared = await this.#prepareCode();
+      if (generation !== this.#admissionGeneration) return false;
+      this.#submittingIdentity = false;
+      if (!prepared) { this.#publish(this.#stepId); return false; }
+      if (this.#requiresConfirmation) { this.#enterMatchCode(); return false; }
+    }
+    if (this.#stepId === "invitation") this.#moveTo("identity");
+    this.#reasonCode = undefined;
+    this.#publish(this.#stepId);
+    return true;
+  }
   /**
    * @param {string} ssid
    * @param {OnboardingFlowWifiSecurity} security
@@ -494,6 +556,9 @@ export class OnboardingFlowService {
     // disabled "Setting up your node…" button instead of a dead one, and a second submit while
     // one is in flight is refused rather than racing two owner creations.
     if (this.#submittingIdentity) return;
+    if (this.#invitationRequired() && !this.#admissionRestored && this.#lockedDisplayName === undefined) {
+      if (!await this.#restoreAdmission()) return;
+    }
     this.#submittingIdentity = true;
     this.#reasonCode = undefined;
     this.#publish(this.#stepId);
@@ -512,6 +577,10 @@ export class OnboardingFlowService {
     this.#submittingIdentity = false;
     if (this.#stepId !== "identity") return;
     if (outcome !== "claimed" && outcome !== "claimed-unpaired") {
+      if (outcome === "not-prepared" && !this.#accessCodeMode) {
+        if (await this.#prepareCode() && this.#requiresConfirmation) this.#enterMatchCode();
+        if (this.#stepId !== "identity") return;
+      }
       if (this.#accessCodeMode) {
         // Belt for the op-expiry case (design §5.4): the node's confirmed_at freshness window
         // may have lapsed while the person filled in their identity, so re-fire the idempotent
@@ -583,6 +652,8 @@ export class OnboardingFlowService {
    * @returns {void}
    */
   cancel() {
+    this.#admissionGeneration += 1;
+    this.#submittingIdentity = false;
     this.#claimGeneration += 1;
     this.#claim.cancel();
     this.#accessCodes.clear();
@@ -595,6 +666,7 @@ export class OnboardingFlowService {
     this.#lcdTapPending = false;
     this.#networks = [];
     this.#operationHash = undefined;
+    this.#admissionRestored = false;
     this.#probeGeneration += 1;
     this.#probing = false;
     this.#reasonCode = undefined;
@@ -813,7 +885,7 @@ export class OnboardingFlowService {
       // The node's confirmation gate is disabled (no screen): there is nothing to wait for and
       // nothing to compare, so the flow must not stall on a confirmation that never arrives.
       this.#approvalState = "approved";
-      this.#moveTo(this.#nextStepAfter("match-code"));
+      this.#moveTo((this.#admissionRestored || this.#lockedDisplayName !== undefined) ? "identity" : this.#nextStepAfter("match-code"));
       return;
     }
     this.#moveTo("match-code");
@@ -960,7 +1032,7 @@ export class OnboardingFlowService {
         if (generation !== this.#claimGeneration) return;
         if (confirmation === "confirmed") {
           this.#approvalState = "approved";
-          this.#moveTo(this.#nextStepAfter("match-code"));
+          this.#moveTo((this.#admissionRestored || this.#lockedDisplayName !== undefined) ? "identity" : this.#nextStepAfter("match-code"));
           return;
         }
         this.#approvalState =
@@ -1050,6 +1122,7 @@ function accessCodeReasonCode(error) {
  *   | "wifi-scan-failed"
  *   | "wifi-unreachable"
  *   | "invitation-invalid"
+ *   | "invitation-unavailable"
  *   | "claim-failed"
  *   | "code-already-bound"
  *   | "access-code-invalid"} OnboardingFlowReasonCode
@@ -1109,7 +1182,7 @@ function accessCodeReasonCode(error) {
  *   "awaitConfirmation" | "cancel" | "completeClaim" | "prepareClaim"
  * >} OnboardingFlowClaimPort
  */
-/** @typedef {Pick<InviteRedemptionService, "redeem">} OnboardingFlowInvitePort */
+/** @typedef {Pick<InviteRedemptionService, "redeem" | "resume">} OnboardingFlowInvitePort */
 /**
  * @typedef {Pick<
  *   WifiProvisioningService,

package/src/services/onboarding-status-service.js

@@ -2,7 +2,7 @@
 /** @import { HomeNodeClient } from "@econ-v1/ports" */
 /**  @typedef {| "bootstrap-required" | "needs-onboarding" | "needs-pairing" | "ready"} OnboardingLifecycleState */
 /**  @typedef {{ readonly id: "onboarding-status"; readonly invitationsEnabled: boolean; readonly scenario?: "new"; readonly state: OnboardingLifecycleState; }} OnboardingLifecycleStatusRow */
-/**  @typedef {{ readonly claimed?: unknown; readonly invitations_enabled?: unknown; }} OnboardingStatusWire */
+/**  @typedef {{ readonly claimed?: unknown; readonly invitations_enabled?: unknown; readonly admission_policy?: unknown; }} OnboardingStatusWire */
 /**  @typedef {{ readonly hasActiveSession: () => boolean; readonly locallyOnboarded?: () => Promise<boolean>; readonly node: Pick<HomeNodeClient, "invoke">; }} OnboardingStatusServiceOptions */
 import { TransportError } from "../errors/index.js";
 export class OnboardingStatusService {
@@ -13,6 +13,7 @@ export class OnboardingStatusService {
     /** @type {Pick<HomeNodeClient, "invoke">} */
     #node;
     #invitationsEnabled = false;
+    #invitationRequired = true;
     /** @param {OnboardingStatusServiceOptions} options */
     constructor(options) {
         this.#hasActiveSession = options.hasActiveSession;
@@ -22,6 +23,8 @@ export class OnboardingStatusService {
     /** Synchronous read of the last flag the node reported. Injected into
      * `OnboardingFlowService` as a getter so a value arriving after boot still takes effect. */
     /** @returns {boolean} */
+    /** @returns {boolean} */
+    invitationRequired() { return this.#invitationRequired; }
     invitationsEnabled() {
         return this.#invitationsEnabled;
     }
@@ -47,6 +50,7 @@ export class OnboardingStatusService {
             });
             claimed = typeof response.claimed === "boolean" ? response.claimed : undefined;
             this.#invitationsEnabled = response.invitations_enabled === true;
+            this.#invitationRequired = response.admission_policy !== "genesis";
         }
         catch (error) {
             if (error instanceof TransportError) {

package/src/services/owner-claim-service.js

@@ -172,7 +172,7 @@ export class OwnerClaimService {
     // `adopt` inside that block would have been swallowed into `"rejected"` and told a person
     // their setup failed after it had already succeeded.
     //
-    // This is also the ONLY point (besides `cancel()`) where the pending claim is dropped and
+    // This is also the ONLY point where the pending claim is dropped and
     // the ephemeral key is reset — the claim it belonged to is now settled, one way or another.
     this.#pending = undefined;
     this.#crypto.reset();
@@ -192,7 +192,8 @@ export class OwnerClaimService {
    */
   cancel() {
     this.#pending = undefined;
-    this.#crypto.reset();
+    // Admission may already be bound to this key, even if its response was lost.
+    // UI cancellation must preserve the identity needed to resume that admission.
   }
 }
 /**