@storacha/clawracha 0.2.2 → 0.3.0

package/dist/plugin.js

@@ -7,15 +7,11 @@
  * - Agent tools for manual sync control
  */
 import { json as consumeJson } from "stream/consumers";
+import * as fs from "node:fs/promises";
 import { SyncEngine } from "./sync.js";
-import { createStorachaClient } from "./utils/client.js";
-import { decodeDelegation, encodeDelegation, } from "./utils/delegation.js";
 import { resolveAgentWorkspace, getAgentIds } from "./utils/workspace.js";
-import { Agent, Name } from "@storacha/ucn/pail";
-import { extract } from "@storacha/client/delegation";
 import * as z from "zod";
-import { spaceAccess } from "@storacha/client/capability/access";
-import { loadDeviceConfig, startWorkspaceSync, doInit, doSetup, doJoin, } from "./commands.js";
+import { loadDeviceConfig, startWorkspaceSync, doInit, doSetup, doJoin, doGrant, } from "./commands.js";
 const activeSyncers = new Map();
 // --- Config helpers ---
 const UpdateParams = z.object({
@@ -49,8 +45,6 @@ export default function plugin(api) {
         const updateParams = paramsResult.data;
         const sync = activeSyncers.get(updateParams.workspace);
         if (sync) {
-            // stop active sync engine if present
-            // waiting for any active syncs to flush.
             await sync.watcher.stop();
             await sync.watcher.forceFlush();
             await sync.engine.stop();
@@ -74,8 +68,7 @@ export default function plugin(api) {
             for (const agentId of agentIds) {
                 const workspace = resolveAgentWorkspace(ctx.config, agentId);
                 try {
-                    const sync = await startWorkspaceSync(workspace, agentId, pluginConfig, false, // Don't emit "add" events for existing files on startup (handled by initial scan)
-                    ctx.logger);
+                    const sync = await startWorkspaceSync(workspace, agentId, pluginConfig, false, ctx.logger);
                     if (sync) {
                         activeSyncers.set(workspace, sync);
                     }
@@ -101,7 +94,7 @@ export default function plugin(api) {
             activeSyncers.clear();
         },
     });
-    // --- Agent tools (keyed by workspace dir) ---
+    // --- Agent tools ---
     api.registerTool({
         name: "storacha_sync_status",
         label: "Storacha Sync Status",
@@ -167,7 +160,6 @@ export default function plugin(api) {
         const clawracha = program
             .command("clawracha")
             .description("Storacha workspace sync commands");
-        // Helper to resolve workspace from --agent
         function requireAgent(agentId) {
             if (!agentId) {
                 console.error("Error: --agent <id> is required. Specify which agent workspace to configure.");
@@ -195,16 +187,16 @@ export default function plugin(api) {
                     }
                     else {
                         console.log("\nNext step — choose one:");
-                        console.log(`  New workspace:  openclaw clawracha setup <delegation> --agent ${agentId}`);
-                        console.log(`  Join existing:  openclaw clawracha join <upload> <name> --agent ${agentId}`);
+                        console.log(`  New workspace:  openclaw clawracha setup --agent ${agentId}`);
+                        console.log(`  Join existing:  openclaw clawracha join <bundle> --agent ${agentId}`);
                     }
                     return;
                 }
                 console.log(`🔥 Agent initialized for ${agentId}!`);
                 console.log(`Agent DID: ${result.agentDID}`);
                 console.log("\nNext step — choose one:");
-                console.log(`  New workspace:  openclaw clawracha setup <delegation> --agent ${agentId}`);
-                console.log(`  Join existing:  openclaw clawracha join <upload> <name> --agent ${agentId}`);
+                console.log(`  New workspace:  openclaw clawracha setup --agent ${agentId}`);
+                console.log(`  Join existing:  openclaw clawracha join <bundle> --agent ${agentId}`);
             }
             catch (err) {
                 console.error(`Error: ${err.message}`);
@@ -213,12 +205,12 @@ export default function plugin(api) {
                 process.exit(1);
             }
         });
-        // --- setup ---
+        // --- setup (login-based only) ---
         clawracha
-            .command("setup <delegation>")
-            .description("Set up a NEW workspace (first device). <delegation> is a file path or base64 CID string.")
+            .command("setup")
+            .description("Set up a NEW workspace via Storacha login (creates space, generates delegations)")
             .requiredOption("--agent <id>", "Agent ID")
-            .action(async (delegationArg, opts) => {
+            .action(async (opts) => {
             try {
                 const { agentId, workspace } = requireAgent(opts.agent);
                 const deviceConfig = await loadDeviceConfig(workspace);
@@ -226,12 +218,16 @@ export default function plugin(api) {
                     console.error(`Run \`openclaw clawracha init --agent ${agentId}\` first.`);
                     process.exit(1);
                 }
-                const result = await doSetup(workspace, agentId, delegationArg, pluginConfig, config.gateway);
-                console.log(`🔥 Storacha workspace ready for ${agentId}!`);
+                const { prompt } = await import("./prompts.js");
+                const email = await prompt("Storacha email: ");
+                const spaceName = await prompt("Space name: ");
+                console.log("\n⏳ Setting up workspace...");
+                const result = await doSetup(workspace, agentId, email, spaceName, pluginConfig, config.gateway);
+                console.log(`\n🔥 Storacha workspace ready for ${agentId}!`);
                 console.log(`Agent DID: ${result.agentDID}`);
                 console.log(`Space: ${result.spaceDID ?? "unknown"}`);
                 console.log(`\nTo add another device, run \`openclaw clawracha grant <their-DID> --agent ${agentId}\` here,`);
-                console.log(`then \`openclaw clawracha join <upload> <name> --agent <id>\` on the other device.`);
+                console.log(`then \`openclaw clawracha join <bundle> --agent <id>\` on the other device.`);
                 console.log("\nSync is now active (no gateway restart needed).");
             }
             catch (err) {
@@ -243,12 +239,12 @@ export default function plugin(api) {
                 process.exit(1);
             }
         });
-        // --- join ---
+        // --- join (single bundle arg) ---
         clawracha
-            .command("join <upload-delegation> <name-delegation>")
-            .description("Join an existing workspace from another device. Arguments are file paths or base64 CID strings.")
+            .command("join <bundle>")
+            .description("Join an existing workspace from another device. Bundle is a file path or base64 string from `grant`.")
             .requiredOption("--agent <id>", "Agent ID")
-            .action(async (uploadArg, nameArg, opts) => {
+            .action(async (bundleArg, opts) => {
             try {
                 const { agentId, workspace } = requireAgent(opts.agent);
                 const deviceConfig = await loadDeviceConfig(workspace);
@@ -256,8 +252,9 @@ export default function plugin(api) {
                     console.error(`Run \`openclaw clawracha init --agent ${agentId}\` first.`);
                     process.exit(1);
                 }
-                const result = await doJoin(workspace, agentId, uploadArg, nameArg, pluginConfig, config.gateway);
-                console.log(`🔥 Joined existing Storacha workspace for ${agentId}!`);
+                console.log("⏳ Joining workspace...");
+                const result = await doJoin(workspace, agentId, bundleArg, pluginConfig, config.gateway);
+                console.log(`\n🔥 Joined Storacha workspace for ${agentId}!`);
                 console.log(`Agent DID: ${result.agentDID}`);
                 console.log(`Space: ${result.spaceDID ?? "unknown"}`);
                 console.log(`Pulled ${result.pullCount} files from remote.`);
@@ -272,11 +269,12 @@ export default function plugin(api) {
                 process.exit(1);
             }
         });
-        // --- grant ---
+        // --- grant (produces bundle) ---
         clawracha
             .command("grant <target-DID>")
-            .description("Grant another device access to this workspace")
+            .description("Grant another device access to this workspace (outputs a delegation bundle)")
             .requiredOption("--agent <id>", "Agent ID")
+            .option("-o, --output <file>", "Write bundle to file instead of base64 stdout")
             .action(async (targetDID, opts) => {
             try {
                 const { agentId, workspace } = requireAgent(opts.agent);
@@ -284,60 +282,19 @@ export default function plugin(api) {
                     console.error("Error: target must be a DID (did:key:z...)");
                     process.exit(1);
                 }
-                const deviceConfig = await loadDeviceConfig(workspace);
-                if (!deviceConfig) {
-                    console.error(`Not initialized. Run \`openclaw clawracha init --agent ${agentId}\` first.`);
-                    process.exit(1);
-                }
-                const results = [];
-                // Re-delegate upload capability
-                if (deviceConfig.uploadDelegation) {
-                    const storachaClient = await createStorachaClient(deviceConfig);
-                    const audience = {
-                        did: () => targetDID,
-                    };
-                    const uploadDel = await storachaClient.createDelegation(audience, 
-                    // @ts-expect-error createDelegation should validate abilities
-                    Object.keys(spaceAccess), { expiration: Infinity });
-                    const { ok: archiveBytes } = await uploadDel.archive();
-                    if (archiveBytes) {
-                        results.push(`Upload delegation:\n${encodeDelegation(archiveBytes)}`);
-                    }
-                }
-                else {
-                    results.push("⚠️ No upload delegation to re-delegate.");
-                }
-                // Re-delegate name capability
-                const agent = Agent.parse(deviceConfig.agentKey);
-                let name;
-                if (deviceConfig.nameArchive) {
-                    const archiveBytes = decodeDelegation(deviceConfig.nameArchive);
-                    name = await Name.extract(agent, archiveBytes);
-                }
-                else if (deviceConfig.nameDelegation) {
-                    const nameBytes = decodeDelegation(deviceConfig.nameDelegation);
-                    const { ok: nameDel } = await extract(nameBytes);
-                    if (nameDel) {
-                        name = Name.from(agent, [nameDel]);
-                    }
-                }
-                if (name) {
-                    const nameDel = await name.grant(targetDID);
-                    const { ok: archiveBytes } = await nameDel.archive();
-                    if (archiveBytes) {
-                        results.push(`Name delegation:\n${encodeDelegation(archiveBytes)}`);
-                    }
+                console.log("⏳ Creating delegation bundle...");
+                const bundleBytes = await doGrant(workspace, targetDID);
+                if (opts.output) {
+                    await fs.writeFile(opts.output, bundleBytes);
+                    console.log(`\n🔥 Delegation bundle written to ${opts.output}`);
                 }
                 else {
-                    results.push("⚠️ No name state available to grant from.");
-                }
-                console.log(`🔥 Delegations for ${targetDID}:\n`);
-                for (const r of results) {
-                    console.log(r);
-                    console.log();
+                    const base64 = Buffer.from(bundleBytes).toString("base64");
+                    console.log(`\n🔥 Delegation bundle for ${targetDID}:\n`);
+                    console.log(base64);
                 }
-                console.log("The target device should run:");
-                console.log(`  openclaw clawracha join <upload-delegation> <name-delegation> --agent <id>`);
+                console.log("\nThe target device should run:");
+                console.log(`  openclaw clawracha join <bundle> --agent <id>`);
             }
             catch (err) {
                 console.error(`Error: ${err.message}`);
@@ -363,7 +320,9 @@ export default function plugin(api) {
                 console.log(`Workspace: ${workspace}`);
                 console.log(`Upload delegation: ${deviceConfig.uploadDelegation ? "✅" : "❌ not set"}`);
                 console.log(`Name delegation: ${deviceConfig.nameDelegation ? "✅" : "❌ not set"}`);
+                console.log(`Plan delegation: ${deviceConfig.planDelegation ? "✅" : "❌ not set"}`);
                 console.log(`Space DID: ${deviceConfig.spaceDID ?? "unknown"}`);
+                console.log(`Access: ${deviceConfig.access?.type ?? "unknown"}`);
                 console.log(`Name Archive: ${deviceConfig.nameArchive ? "saved" : "not created"}`);
                 console.log(`Setup complete: ${deviceConfig.setupComplete ? "✅" : "❌"}`);
                 const sync = activeSyncers.get(workspace);
@@ -398,7 +357,6 @@ export default function plugin(api) {
                     console.log(`Not set up. Run \`openclaw clawracha init --agent ${agentId}\` first.`);
                     return;
                 }
-                // Use active syncer if available, otherwise spin up temporary engine
                 let engine;
                 const activeSync = activeSyncers.get(workspace);
                 if (activeSync) {
@@ -439,7 +397,7 @@ export default function plugin(api) {
             .description("Interactive guided setup for Storacha workspace sync")
             .requiredOption("--agent <id>", "Agent ID")
             .action(async (opts) => {
-            const { promptMultiline, choose } = await import("./prompts.js");
+            const { prompt, promptMultiline, choose } = await import("./prompts.js");
             try {
                 const { agentId, workspace } = requireAgent(opts.agent);
                 console.log("🔥 Welcome to Clawracha — Storacha workspace sync!\n");
@@ -460,18 +418,12 @@ export default function plugin(api) {
                 // Step 2: Path choice
                 const choice = await choose("Are you setting up a NEW workspace or JOINING an existing one?", ["NEW workspace", "JOIN existing"]);
                 if (choice === "NEW workspace") {
-                    // --- Setup path ---
+                    // --- Setup path (login only) ---
                     console.log("\n📦 New Workspace Setup\n");
-                    console.log("You need a Storacha upload delegation for this agent.");
-                    console.log("On a machine with the Storacha CLI, run:\n");
-                    console.log(`  storacha delegation create ${initResult.agentDID} --base64\n`);
-                    const delegationInput = await promptMultiline("Paste your upload delegation here:");
-                    if (!delegationInput) {
-                        console.error("No delegation provided. Aborting.");
-                        process.exit(1);
-                    }
+                    const email = await prompt("Storacha email: ");
+                    const spaceName = await prompt("Space name: ");
                     console.log("\n⏳ Setting up workspace...");
-                    const result = await doSetup(workspace, agentId, delegationInput, pluginConfig, config.gateway);
+                    const result = await doSetup(workspace, agentId, email, spaceName, pluginConfig, config.gateway);
                     console.log(`\n🔥 Storacha workspace ready for ${agentId}!`);
                     console.log(`  Agent DID: ${result.agentDID}`);
                     console.log(`  Space: ${result.spaceDID ?? "unknown"}`);
@@ -480,24 +432,18 @@ export default function plugin(api) {
                     console.log("\nSync is now active! 🎉");
                 }
                 else {
-                    // --- Join path ---
+                    // --- Join path (single bundle) ---
                     console.log("\n🤝 Join Existing Workspace\n");
-                    console.log("You need someone with access to grant you delegations.");
+                    console.log("You need a delegation bundle from someone with access.");
                     console.log("Ask them to run:\n");
                     console.log(`  openclaw clawracha grant ${initResult.agentDID} --agent <their-agent-id>\n`);
-                    console.log("They'll get two delegations to share with you.\n");
-                    const uploadInput = await promptMultiline("Paste the upload delegation here:");
-                    if (!uploadInput) {
-                        console.error("No upload delegation provided. Aborting.");
-                        process.exit(1);
-                    }
-                    const nameInput = await promptMultiline("Paste the name delegation here:");
-                    if (!nameInput) {
-                        console.error("No name delegation provided. Aborting.");
+                    const bundleInput = await promptMultiline("Paste the delegation bundle here:");
+                    if (!bundleInput) {
+                        console.error("No bundle provided. Aborting.");
                         process.exit(1);
                     }
                     console.log("\n⏳ Joining workspace...");
-                    const result = await doJoin(workspace, agentId, uploadInput, nameInput, pluginConfig, config.gateway);
+                    const result = await doJoin(workspace, agentId, bundleInput, pluginConfig, config.gateway);
                     console.log(`\n🔥 Joined Storacha workspace for ${agentId}!`);
                     console.log(`  Agent DID: ${result.agentDID}`);
                     console.log(`  Space: ${result.spaceDID ?? "unknown"}`);

package/dist/sync.d.ts

@@ -19,6 +19,9 @@ export declare class SyncEngine {
     private carFile;
     private lastSync;
     private syncLock;
+    private encryptionConfig?;
+    private decryptionConfig?;
+    private encryptedClient?;
     constructor(workspace: string);
     /**
      * Initialize sync engine with device config.

package/dist/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EAEV,YAAY,EACb,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAgBxE,qBAAa,UAAU;IACrB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,KAAK,CAAiD;IAC9D,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAoC;gBAExC,SAAS,EAAE,MAAM;IAK7B;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAoC/C;;OAEG;IACH,OAAO,CAAC,cAAc;IAOtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;OAGG;IACG,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAe1D;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAMb,UAAU;IAwDxB;;OAEG;YACW,iBAAiB;IAe/B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAc5C;;OAEG;YACW,kBAAkB;IAUhC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3B;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;YAMrB,gBAAgB;IA0B9B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC;QACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5D,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IAkBI,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;IAW5B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;YAM5B,WAAW;CAK1B"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EAEV,YAAY,EACb,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmBxE,qBAAa,UAAU;IACrB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,KAAK,CAAiD;IAC9D,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,eAAe,CAAC,CAAkB;gBAE9B,SAAS,EAAE,MAAM;IAK7B;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IA6D/C;;OAEG;IACH,OAAO,CAAC,cAAc;IAOtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;OAGG;IACG,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB1D;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAMb,UAAU;IAwDxB;;OAEG;YACW,iBAAiB;IAe/B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAc5C;;OAEG;YACW,kBAAkB;IAYhC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3B;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;YAMrB,gBAAgB;IA4B9B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC;QACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC5D,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IAkBI,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;IAW5B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;YAM5B,WAAW;CAK1B"}

package/dist/sync.js

@@ -18,6 +18,8 @@ import { diffRemoteChanges } from "./utils/differ.js";
 import { makeTempCar } from "./utils/tempcar.js";
 import { createStorachaClient } from "./utils/client.js";
 import { decodeDelegation, encodeDelegation } from "./utils/delegation.js";
+import { extract } from "@storacha/client/delegation";
+import { makeEncryptionConfig, makeDecryptionConfig, getEncryptedClient } from "./utils/crypto.js";
 export class SyncEngine {
     workspace;
     blocks;
@@ -27,6 +29,9 @@ export class SyncEngine {
     carFile = null;
     lastSync = null;
     syncLock = Promise.resolve();
+    encryptionConfig;
+    decryptionConfig;
+    encryptedClient;
     constructor(workspace) {
         this.workspace = workspace;
         this.blocks = createWorkspaceBlockstore(workspace);
@@ -46,7 +51,6 @@ export class SyncEngine {
         }
         else if (config.nameDelegation) {
             // Reconstruct from delegation (granted by another device)
-            const { extract } = await import("@storacha/client/delegation");
             const nameBytes = decodeDelegation(config.nameDelegation);
             const { ok: delegation } = await extract(nameBytes);
             if (!delegation)
@@ -58,6 +62,24 @@ export class SyncEngine {
             name = await Name.create(agent);
         }
         this.state = { initialized: true, running: true, name, storachaClient };
+        // Set up encryption for private spaces
+        if (config.access?.type === "private") {
+            if (!config.planDelegation) {
+                throw new Error("Private space requires a plan delegation for KMS access");
+            }
+            const planBytes = decodeDelegation(config.planDelegation);
+            const { ok: planDel } = await extract(planBytes);
+            if (!planDel)
+                throw new Error("Failed to extract plan delegation");
+            this.encryptionConfig = makeEncryptionConfig(agent, config.spaceDID, [planDel]);
+            // For decrypt, uploadDelegation covers space/content/decrypt
+            const uploadBytes = decodeDelegation(config.uploadDelegation);
+            const { ok: uploadDel } = await extract(uploadBytes);
+            if (!uploadDel)
+                throw new Error("Failed to extract upload delegation");
+            this.decryptionConfig = makeDecryptionConfig(config.spaceDID, uploadDel);
+            this.encryptedClient = await getEncryptedClient(storachaClient);
+        }
         try {
             const result = await Revision.resolve(this.blocks, name);
             this.current = result.value;
@@ -98,7 +120,7 @@ export class SyncEngine {
         if (!this.carFile) {
             this.carFile = await makeTempCar();
         }
-        const pendingOps = await processChanges(changes, this.workspace, this.current, this.blocks, (block) => this.carFile.put(block), (block) => this.blocks.put(block));
+        const pendingOps = await processChanges(changes, this.workspace, this.current, this.blocks, (block) => this.carFile.put(block), (block) => this.blocks.put(block), this.encryptionConfig);
         this.pendingOps.push(...pendingOps);
     }
     /**
@@ -203,6 +225,8 @@ export class SyncEngine {
         await applyRemoteChanges(changedPaths, entries, this.workspace, {
             blocks: this.blocks,
             current: this.current ?? undefined,
+            encryptedClient: this.encryptedClient,
+            decryptionConfig: this.decryptionConfig,
         });
     }
     /**
@@ -249,6 +273,8 @@ export class SyncEngine {
             await applyRemoteChanges(allPaths, entries, this.workspace, {
                 blocks: this.blocks,
                 current: this.current ?? undefined,
+                encryptedClient: this.encryptedClient,
+                decryptionConfig: this.decryptionConfig,
             });
         }
         this.lastSync = Date.now();

package/dist/types/index.d.ts

@@ -10,6 +10,17 @@ export interface SyncPluginConfig {
     watchPatterns: string[];
     ignorePatterns: string[];
 }
+export interface PublicAccess {
+    type: "public";
+}
+export interface PrivateAccess {
+    type: "private";
+    encryption: {
+        provider: string;
+        algorithm: string;
+    };
+}
+export type SpaceAccess = PublicAccess | PrivateAccess;
 /** Stored in .storacha/config.json — device-specific, not synced */
 export interface DeviceConfig {
     /** Ed25519 agent private key (base64) */
@@ -20,8 +31,12 @@ export interface DeviceConfig {
     uploadDelegation?: string;
     /** Name → agent delegation for pail sync (base64 archive) */
     nameDelegation?: string;
+    /** Plan/get delegation for KMS access in private spaces (base64 archive) */
+    planDelegation?: string;
     /** Space DID extracted from upload delegation */
     spaceDID?: string;
+    /** Space access type — determines if content is encrypted */
+    access?: SpaceAccess;
     /** Whether setup is complete (watcher won't start without this) */
     setupComplete?: boolean;
 }

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAE5C,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,yBAAyB;AACzB,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,4BAA4B;IAC5B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qCAAqC;AACrC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8BAA8B;AAC9B,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,GAAG,CAAC;CACb"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAE5C,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,aAAa,CAAC;AAEvD,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mEAAmE;IACnE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,yBAAyB;AACzB,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,4BAA4B;IAC5B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qCAAqC;AACrC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8BAA8B;AAC9B,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,GAAG,CAAC;CACb"}

package/dist/utils/bundle.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Delegation bundle — packs upload, name, and plan delegations
+ * into a single CAR file for the `join` workflow.
+ */
+export interface DelegationBundle {
+    upload: Uint8Array;
+    name: Uint8Array;
+    plan: Uint8Array;
+}
+/**
+ * Pack three delegation archives into a single CAR file.
+ * Root block is DAG-CBOR: { upload, name, plan } as byte arrays.
+ */
+export declare function createDelegationBundle(bundle: DelegationBundle): Promise<Uint8Array>;
+/**
+ * Extract three delegation archives from a bundle CAR file.
+ */
+export declare function extractDelegationBundle(carBytes: Uint8Array): Promise<DelegationBundle>;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/utils/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/utils/bundle.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,UAAU,CAAC,CA2BrB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAwB3B"}

package/dist/utils/bundle.js

@@ -0,0 +1,67 @@
+/**
+ * Delegation bundle — packs upload, name, and plan delegations
+ * into a single CAR file for the `join` workflow.
+ */
+import * as cbor from "@ipld/dag-cbor";
+import { encode, decode } from "multiformats/block";
+import { sha256 } from "multiformats/hashes/sha2";
+import { CarWriter } from "@ipld/car/writer";
+import { CarReader } from "@ipld/car/reader";
+/**
+ * Pack three delegation archives into a single CAR file.
+ * Root block is DAG-CBOR: { upload, name, plan } as byte arrays.
+ */
+export async function createDelegationBundle(bundle) {
+    const rootBlock = await encode({
+        value: bundle,
+        codec: cbor,
+        hasher: sha256,
+    });
+    const { writer, out } = CarWriter.create([rootBlock.cid]);
+    const chunks = [];
+    const drain = (async () => {
+        for await (const chunk of out) {
+            chunks.push(chunk);
+        }
+    })();
+    await writer.put(rootBlock);
+    await writer.close();
+    await drain;
+    // Concatenate chunks
+    const totalLength = chunks.reduce((sum, c) => sum + c.length, 0);
+    const result = new Uint8Array(totalLength);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return result;
+}
+/**
+ * Extract three delegation archives from a bundle CAR file.
+ */
+export async function extractDelegationBundle(carBytes) {
+    const reader = await CarReader.fromBytes(carBytes);
+    const roots = await reader.getRoots();
+    if (roots.length !== 1) {
+        throw new Error(`Expected 1 root in delegation bundle, got ${roots.length}`);
+    }
+    const rootBlock = await reader.get(roots[0]);
+    if (!rootBlock) {
+        throw new Error("Could not read root block from delegation bundle");
+    }
+    const decoded = await decode({
+        bytes: rootBlock.bytes,
+        codec: cbor,
+        hasher: sha256,
+    });
+    const value = decoded.value;
+    if (!value.upload || !value.name || !value.plan) {
+        throw new Error("Delegation bundle missing required keys (upload, name, plan)");
+    }
+    return {
+        upload: value.upload,
+        name: value.name,
+        plan: value.plan,
+    };
+}

package/dist/utils/crypto.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Encryption helpers for private spaces.
+ * Uses @storacha/encrypt-upload-client with KMS-based key management.
+ */
+import type { Block } from "multiformats";
+import type { CID } from "multiformats/cid";
+import type { Client } from "@storacha/client";
+import type { Proof } from "@ucanto/interface";
+type SpaceDID = `did:key:${string}`;
+import type { CryptoAdapter, EncryptionConfig, DecryptionConfig, BlobLike, EncryptedClient } from "@storacha/encrypt-upload-client/types";
+export declare function getKMSCryptoAdapter(): CryptoAdapter;
+export declare function getEncryptedClient(storachaClient: Client): Promise<EncryptedClient>;
+export declare function makeEncryptionConfig(issuer: {
+    did: () => `did:key:${string}`;
+}, spaceDID: SpaceDID, proofs: Proof[]): EncryptionConfig;
+export declare function makeDecryptionConfig(spaceDID: SpaceDID, decryptDelegation: Proof, proofs?: Proof[]): DecryptionConfig;
+/**
+ * Encrypt a BlobLike and return a block stream
+ * (UnixFS-encoded encrypted content + metadata block appended).
+ */
+export declare function encryptToBlockStream(file: BlobLike, encryptionConfig: EncryptionConfig): Promise<ReadableStream<Block>>;
+/**
+ * Wrap raw bytes as a BlobLike for encryption.
+ */
+export declare function bytesToBlobLike(bytes: Uint8Array): BlobLike;
+/**
+ * Create a decrypt function for mdsync resolveValue.
+ * Fetches encrypted content by CID via EncryptedClient and returns decrypted bytes.
+ */
+export declare function makeDecryptFn(encryptedClient: EncryptedClient, decryptionConfig: DecryptionConfig): (cid: CID) => Promise<Uint8Array>;
+export {};
+//# sourceMappingURL=crypto.d.ts.map

package/dist/utils/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,KAAK,QAAQ,GAAG,WAAW,MAAM,EAAE,CAAC;AACpC,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,EACR,eAAe,EAChB,MAAM,uCAAuC,CAAC;AAU/C,wBAAgB,mBAAmB,IAAI,aAAa,CAInD;AAED,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,WAAW,MAAM,EAAE,CAAA;CAAE,EAC1C,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,KAAK,EAAE,GACd,gBAAgB,CAMlB;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,QAAQ,EAClB,iBAAiB,EAAE,KAAK,EACxB,MAAM,CAAC,EAAE,KAAK,EAAE,GACf,gBAAgB,CAMlB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,QAAQ,EACd,gBAAgB,EAAE,gBAAgB,GACjC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAIhC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,CAU3D;AAwBD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,eAAe,EAAE,eAAe,EAChC,gBAAgB,EAAE,gBAAgB,GACjC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,CAQnC"}