@tinycloud/courier 0.6.0-beta.18 → 0.6.0-beta.20

package/dist/invite-approval.js

@@ -0,0 +1,271 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { ulid } from 'ulid';
+import { activateValidatedRuntimeDelegation } from '@tinycloud/node-sdk';
+import { assertApprovalRequestBinding, assertInvitationApprovalGrant, parseApprovalSiwe } from './authority.js';
+import { CourierError } from './errors.js';
+import { mkdirOwnerOnly, profileDir, writeSecure } from './profile.js';
+const DAY_MS = 86_400_000;
+const pendingDir = (home = profileDir()) => path.join(home, 'pending-invites');
+const grantDir = (home = profileDir()) => path.join(home, 'invite-grants');
+const ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw new CourierError('bad-profile', `Invalid ${path.basename(file)}: ${error.message}`);
+    }
+}
+function secureWrite(dir, id, value) {
+    mkdirOwnerOnly(dir);
+    writeSecure(path.join(dir, `${id}.json`), value);
+}
+export function loadPendingInvite(invitationId, home = profileDir()) {
+    if (!ULID.test(invitationId))
+        return undefined;
+    return readJson(path.join(pendingDir(home), `${invitationId}.json`));
+}
+export function savePendingInvite(pending) {
+    secureWrite(pendingDir(), pending.invitationId, pending);
+}
+export function loadInviteGrant(invitationId, home = profileDir()) {
+    if (!ULID.test(invitationId))
+        return undefined;
+    return readJson(path.join(grantDir(home), `${invitationId}.json`));
+}
+/** The open (not closed, not sent, not yet expired) pending approval for this exact session and recipient, if any. */
+export function findPendingInvite(profile, sessionId, recipient, now, home = profileDir()) {
+    let names;
+    try {
+        names = fs.readdirSync(pendingDir(home));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    for (const name of names.filter((value) => value.endsWith('.json')).sort()) {
+        const pending = readJson(path.join(pendingDir(home), name));
+        if (pending?.status === 'awaiting' && pending.sessionId === sessionId && pending.recipient === recipient && pending.courierDid === profile.courierDid
+            && pending.ownerDid === profile.ownerDid && Date.parse(pending.acceptanceExpiresAt) > now)
+            return pending;
+    }
+    return undefined;
+}
+/** A new pending invitation: fresh id, expiry at most 24 hours out and never past the main grant. */
+export function newPendingInvite(profile, input, now) {
+    if (!profile.ownerDid || !profile.grantExpiresAt)
+        throw new CourierError('no-grant', 'No owner grant is installed.');
+    const expires = new Date(Math.floor(Math.min(now + DAY_MS, Date.parse(profile.grantExpiresAt)) / 1000) * 1000);
+    if (expires.getTime() - now < 60_000)
+        throw new CourierError('grant-expired', 'The Courier grant ends too soon to send an invitation.');
+    return {
+        v: 1, invitationId: ulid(now), recipient: input.recipient, sessionId: input.sessionId, subjectName: input.subjectName,
+        courierDid: profile.courierDid, ownerDid: profile.ownerDid, createdAt: new Date(now).toISOString(),
+        acceptanceExpiresAt: expires.toISOString(), accessExpiresAt: expires.toISOString(), status: 'awaiting',
+    };
+}
+export function invitationContext(pending) {
+    return {
+        kind: 'share-invitation', version: 1, invitationId: pending.invitationId, recipientEmail: pending.recipient,
+        subjectKind: 'session', subjectName: pending.subjectName,
+        acceptanceExpiresAt: pending.acceptanceExpiresAt, accessExpiresAt: pending.accessExpiresAt,
+    };
+}
+/** A host that could not be reached (or a registry that did not answer): says nothing about the approval, so it is retried, never refused. */
+const TRANSIENT_ACTIVATION_CODES = new Set(['NODE_NOT_RESPONDING', 'registry_unavailable', 'ACTIVATION_TRANSPORT_FAILED']);
+function activationUnavailable(error) {
+    const { reason, code } = (error ?? {});
+    return reason === 'activation_unavailable' || (typeof code === 'string' && TRANSIENT_ACTIVATION_CODES.has(code));
+}
+/** A share key id belongs to exactly one invitation, so a stored approval is never reusable for a second one. */
+function keyIdUsedElsewhere(shareId, invitationId) {
+    let names;
+    try {
+        names = fs.readdirSync(grantDir());
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+    return names.filter((name) => name.endsWith('.json') && name !== `${invitationId}.json`)
+        .some((name) => readJson(path.join(grantDir(), name))?.shareId === shareId);
+}
+/**
+ * Verify the owner-signed grant for THIS pending request and install it as a runtime delegation on the Courier node. The
+ * grant's ReCap is a raw encryption network resource (no space), so it is a grant, not a session: the node-sdk verifies it
+ * (SIWE signature, signer, audience = this node's session key, expiry) and activates it. Order: the request binding, then
+ * the signed authority (exactly one key pair), then the install. Returns the key id from the signed grant.
+ */
+async function activateInviteGrant(node, profile, pending, payload, now) {
+    const state = pending.transport;
+    if (typeof state?.requestId !== 'string' || typeof state.bodyCid !== 'string')
+        throw new CourierError('bad-grant', 'No approval request exists for this invitation.');
+    // One strict parse: the binding and the lifetime are read from it, and the signature is verified over its exact text.
+    const parsed = parseApprovalSiwe(payload.siwe);
+    assertApprovalRequestBinding(parsed, { requestId: state.requestId, bodyCid: state.bodyCid });
+    const times = { ...(parsed.issuedAt ? { issuedAt: parsed.issuedAt } : {}), ...(parsed.expiresAt ? { expiresAt: parsed.expiresAt } : {}) };
+    if (!times.expiresAt || times.expiresAt.getTime() <= now)
+        throw new CourierError('grant-expired', 'The invitation approval has expired.');
+    if (pending.courierDid !== profile.courierDid)
+        throw new CourierError('bad-grant', 'The invitation approval was not requested by this Courier key.');
+    const owner = `did:pkh:eip155:${payload.chainId}:${payload.address}`;
+    if (!profile.ownerDid || owner.toLowerCase() !== profile.ownerDid.toLowerCase() || owner.toLowerCase() !== pending.ownerDid.toLowerCase()) {
+        throw new CourierError('bad-grant', 'The invitation approval was given by a different account than the Courier owner.');
+    }
+    let verified;
+    try {
+        verified = node.verifySessionGrant({
+            delegationHeader: { Authorization: payload.delegationHeader.Authorization }, delegationCid: payload.delegationCid, spaceId: payload.spaceId,
+            address: payload.address, chainId: payload.chainId, siwe: parsed.raw, signature: payload.signature,
+        });
+    }
+    catch {
+        throw new CourierError('bad-grant', 'The invitation approval could not be verified for this Courier key.');
+    }
+    const signed = verified.recap.map((entry) => {
+        const service = entry.service.startsWith('tinycloud.') ? entry.service : `tinycloud.${entry.service}`;
+        return { service, space: entry.space, path: entry.path, actions: entry.actions.map((action) => (action.includes('/') ? action : `${service}/${action}`)), ...(entry.caveats?.length ? { caveats: [...entry.caveats] } : {}) };
+    });
+    const bounds = { ownerDid: owner, acceptanceExpiresAt: new Date(pending.acceptanceExpiresAt), now };
+    const shareId = assertInvitationApprovalGrant(signed, times, bounds);
+    const entry = signed[0];
+    const delegation = {
+        cid: payload.delegationCid, delegationHeader: { Authorization: payload.delegationHeader.Authorization }, spaceId: payload.spaceId,
+        path: entry.path, actions: [...entry.actions], resources: [{ service: 'encryption', space: 'encryption', path: entry.path, actions: [...entry.actions] }],
+        expiry: verified.expiresAt, delegateDID: payload.verificationMethod, ownerAddress: payload.address, chainId: payload.chainId, host: profile.host,
+        siweProof: { siwe: payload.siwe, signature: payload.signature },
+    };
+    try {
+        await activateValidatedRuntimeDelegation(node, delegation, {
+            host: profile.host,
+            // What the node ends up holding must be exactly the one pair, again from the signed bytes it parsed itself.
+            authorize: (effective) => { try {
+                return assertInvitationApprovalGrant(effective, times, bounds) === shareId;
+            }
+            catch {
+                return false;
+            } },
+        });
+    }
+    catch (error) {
+        // The host could not be reached (or answered with a transient status): the approval is fine and is kept; the next run installs it.
+        if (activationUnavailable(error)) {
+            throw new CourierError('activation-unavailable', 'The TinyCloud host could not be reached to install the invitation approval; nothing was sent. Run the command again to continue with the same approval.');
+        }
+        throw new CourierError('bad-grant', `The invitation approval could not be installed for this Courier key (${error.reason ?? error.code ?? 'refused'}).`);
+    }
+    return { shareId, expiresAt: verified.expiresAt };
+}
+/** A pending invitation whose approval cannot be used any more is closed, so the next run asks afresh. A stored approved grant is never removed. */
+function closePending(pending) {
+    pending.status = 'closed';
+    savePendingInvite(pending);
+}
+/**
+ * Create (once) and await this invitation's approval, then keep the approved per-invite grant. Nothing the caller does
+ * after this - relay delegation, state, Share key, link or email - happens unless the result is `approved`.
+ */
+export async function obtainInviteKey(options) {
+    const { node, profile, key, transport, pending } = options;
+    const clock = options.now ?? Date.now;
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const stored = loadInviteGrant(pending.invitationId);
+    if (stored) {
+        if (stored.invitationId !== pending.invitationId)
+            throw new CourierError('bad-grant', 'This approval belongs to another invitation.');
+        const activated = await activateInviteGrant(node, profile, pending, stored.payload, clock());
+        if (activated.shareId !== stored.shareId)
+            throw new CourierError('bad-grant', 'The stored approval no longer matches its key.');
+        return { status: 'approved', shareId: stored.shareId };
+    }
+    if (Date.parse(pending.acceptanceExpiresAt) <= clock()) {
+        closePending(pending);
+        throw new CourierError('invite-expired', 'The approval for this invitation was not given in time; nothing was created.');
+    }
+    if (pending.transport === undefined) {
+        const created = await transport.create({ context: invitationContext(pending), key, host: profile.host });
+        pending.approvalUrl = created.approvalUrl;
+        pending.transport = created.transport;
+        savePendingInvite(pending);
+    }
+    options.onApprovalUrl?.(pending.approvalUrl, pending);
+    const deadline = clock() + options.waitMs;
+    for (;;) {
+        let result;
+        try {
+            result = await transport.poll(pending, key);
+        }
+        catch (error) {
+            // The approver says it does not know this request (or its result): nothing more can come of it.
+            if (error instanceof CourierError && error.code === 'approval-unavailable')
+                closePending(pending);
+            throw error;
+        }
+        savePendingInvite(pending);
+        if (result.status === 'approved') {
+            let activated;
+            try {
+                activated = await activateInviteGrant(node, profile, pending, result.payload, clock());
+            }
+            catch (error) {
+                // A result that is not this request's valid approval is never retried against the same request. A host that could not be reached
+                // says nothing about the approval, so the pending invitation stays and the result is fetched again on the next run.
+                if (error instanceof CourierError && error.code !== 'activation-unavailable')
+                    closePending(pending);
+                throw error;
+            }
+            if (keyIdUsedElsewhere(activated.shareId, pending.invitationId)) {
+                closePending(pending);
+                throw new CourierError('bad-grant', 'This approval was already used for another invitation; each invitation needs its own approval.');
+            }
+            secureWrite(grantDir(), pending.invitationId, {
+                v: 1, invitationId: pending.invitationId, shareId: activated.shareId, payload: result.payload,
+                expiresAt: activated.expiresAt.toISOString(), receivedAt: new Date(clock()).toISOString(),
+            });
+            await transport.acknowledge?.(pending, key);
+            return { status: 'approved', shareId: activated.shareId };
+        }
+        if (result.status === 'denied' || result.status === 'expired') {
+            closePending(pending);
+            throw new CourierError('invite-approval-refused', result.status === 'denied' ? 'The owner declined this invitation; nothing was created.' : 'The approval request expired before it was given; nothing was created.');
+        }
+        if (clock() >= deadline)
+            return { status: 'awaiting', approvalUrl: pending.approvalUrl };
+        await sleep(Math.min(2000, Math.max(0, deadline - clock())));
+    }
+}
+export function closeInvite(pending) {
+    closePending(pending);
+}
+export function markInviteSent(pending) {
+    pending.status = 'sent';
+    savePendingInvite(pending);
+}
+/**
+ * Exactly one run may go on to create the relay, the Share key, the link and the email for an approved invitation:
+ * the marker is created exclusively and never removed. A run that finds it refuses, so a rerun or a concurrent run can
+ * never send a second email for the same approval. It also closes the pending invitation (the marker and any stored approved
+ * grant stay), so an attempt interrupted after the claim does not leave the invitation waiting forever: the next run asks the
+ * owner afresh, and the old approval is never used again.
+ */
+export function claimInviteSend(pending) {
+    mkdirOwnerOnly(pendingDir());
+    try {
+        fs.closeSync(fs.openSync(path.join(pendingDir(), `${pending.invitationId}.sending`), 'wx', 0o600));
+    }
+    catch (error) {
+        if (error.code === 'EEXIST') {
+            // A concurrent run that already finished the send has recorded it as sent: that is never overwritten with closed.
+            if (loadPendingInvite(pending.invitationId)?.status !== 'sent')
+                closePending(pending);
+            throw new CourierError('invite-in-progress', 'This invitation was already sent or an earlier attempt did not finish; nothing more was sent. Run the command again to start a new invitation (a new owner approval).');
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=invite-approval.js.map

package/dist/invite-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-approval.js","sourceRoot":"","sources":["../src/invite-approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,kCAAkC,EAAE,MAAM,qBAAqB,CAAC;AAGzE,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAChH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIvE,MAAM,MAAM,GAAG,UAAU,CAAC;AA2C1B,MAAM,UAAU,GAAG,CAAC,IAAI,GAAG,UAAU,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;AAC/E,MAAM,QAAQ,GAAG,CAAC,IAAI,GAAG,UAAU,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AAC3E,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,SAAS,QAAQ,CAAI,IAAY;IAC/B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAC5E,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,EAAU,EAAE,KAAc;IAC1D,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,IAAI,GAAG,UAAU,EAAE;IACzE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,QAAQ,CAAgB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,WAAW,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,IAAI,GAAG,UAAU,EAAE;IACvE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,QAAQ,CAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,SAAiB,EAAE,SAAiB,EAAE,GAAW,EAAE,IAAI,GAAG,UAAU,EAAE;IACxH,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAC/D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,QAAQ,CAAgB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;eAChJ,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,GAAG;YAAE,OAAO,OAAO,CAAC;IAC9G,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,KAAoE,EAAE,GAAW;IAClI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,cAAc;QAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;IACrH,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;IACxI,OAAO;QACL,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QACrH,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QAClG,mBAAmB,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU;KACvG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,OAAO;QACL,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,OAAO,CAAC,SAAS;QAC3G,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;QACxD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;KAC3F,CAAC;AACJ,CAAC;AAED,8IAA8I;AAC9I,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAC3H,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAyC,CAAC;IAC/E,OAAO,MAAM,KAAK,wBAAwB,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,iHAAiH;AACjH,SAAS,kBAAkB,CAAC,OAAe,EAAE,YAAoB;IAC/D,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACzD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,GAAG,YAAY,OAAO,CAAC;SACrF,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAmB,EAAE,OAAgB,EAAE,OAAsB,EAAE,OAAqB,EAAE,GAAW;IAClI,MAAM,KAAK,GAAG,OAAO,CAAC,SAAmE,CAAC;IAC1F,IAAI,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,iDAAiD,CAAC,CAAC;IACtK,sHAAsH;IACtH,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,4BAA4B,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1I,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IAC1I,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,gEAAgE,CAAC,CAAC;IACrJ,MAAM,KAAK,GAAG,kBAAkB,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1I,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,kFAAkF,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,QAAyD,CAAC;IAC9D,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;YACjC,gBAAgB,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;YAC3I,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;SACnG,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,qEAAqE,CAAC,CAAC;IAAC,CAAC;IACvH,MAAM,MAAM,GAAsB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChO,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC;IACpG,MAAM,OAAO,GAAG,6BAA6B,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IACzB,MAAM,UAAU,GAAuB;QACrC,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,gBAAgB,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;QACjI,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzJ,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,kBAAkB,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;QAChJ,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;KAChE,CAAC;IACF,IAAI,CAAC;QACH,MAAM,kCAAkC,CAAC,IAAI,EAAE,UAAU,EAAE;YACzD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,4GAA4G;YAC5G,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,6BAA6B,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC,CAAC,CAAC;SAC1I,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mIAAmI;QACnI,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,yJAAyJ,CAAC,CAAC;QAC9M,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,wEAAyE,KAA4C,CAAC,MAAM,IAAK,KAA2B,CAAC,IAAI,IAAI,SAAS,IAAI,CAAC,CAAC;IAC1N,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC;AAkBD,oJAAoJ;AACpJ,SAAS,YAAY,CAAC,OAAsB;IAC1C,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;IAC1B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAsB;IAC1D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;YAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,8CAA8C,CAAC,CAAC;QACtI,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,gDAAgD,CAAC,CAAC;QAChI,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACvD,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,8EAA8E,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACzG,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAC1C,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACtC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAY,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1C,SAAS,CAAC;QACR,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gGAAgG;YAChG,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB;gBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YAClG,MAAM,KAAK,CAAC;QACd,CAAC;QACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iIAAiI;gBACjI,oHAAoH;gBACpH,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB;oBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;gBACpG,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,kBAAkB,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChE,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,gGAAgG,CAAC,CAAC;YACxI,CAAC;YACD,WAAW,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE;gBAC5C,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;gBAC7F,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;aACpE,CAAC,CAAC;YACzB,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9D,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,0DAA0D,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC;QACxN,CAAC;QACD,IAAI,KAAK,EAAE,IAAI,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,WAAY,EAAE,CAAC;QAC1F,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAsB;IAChD,YAAY,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAsB;IACnD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACxB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAsB;IACpD,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,kHAAkH;YAClH,IAAI,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,MAAM;gBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YACtF,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,uKAAuK,CAAC,CAAC;QACxN,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/invite-openkey.d.ts

@@ -0,0 +1,14 @@
+import type { InviteApprovalTransport, PendingInvite } from './invite-approval.js';
+import type { AgentKey } from './profile.js';
+export interface OpenKeyInviteDeps {
+    fetch?: typeof fetch;
+    now?: () => number;
+}
+/**
+ * The OpenKey side of one invitation approval: a signed intent request, then repeatable requester-authenticated reads of
+ * its encrypted result. Result verification beyond the binding to this request (holder, owner, key, expiry) is done by
+ * the caller from the signed SIWE, never from anything the transport reports.
+ */
+export declare function openKeyInviteTransport(deps?: OpenKeyInviteDeps): InviteApprovalTransport & {
+    acknowledge(pending: PendingInvite, key: AgentKey): Promise<void>;
+};

package/dist/invite-openkey.js

@@ -0,0 +1,184 @@
+import { createDecipheriv, createECDH, createHash, createHmac, createPrivateKey, randomBytes, randomUUID, sign } from 'node:crypto';
+import { buildShareInvitationApprovalSpec, createApprovalRequest, signerFromJwk } from '@tinycloud/share-envelope/links';
+import { CourierError } from './errors.js';
+import { resolveOpenKeyApiHost } from './grant.js';
+import { loadProfile } from './profile.js';
+const DEFAULT_LINKS_API = 'https://api.tinycloud.xyz';
+const unavailable = (message) => new CourierError('approval-unavailable', message);
+function origin(value, label) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw unavailable(`${label} is not an origin.`);
+    }
+    const loopback = ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname);
+    if (url.pathname !== '/' || url.search || url.hash || (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)))
+        throw unavailable(`${label} must be an HTTPS origin.`);
+    return url.origin;
+}
+function sessionProof(state, key, action, resultRef, ackId) {
+    const jwk = key.jwk;
+    const jkt = createHash('sha256').update(JSON.stringify({ crv: 'Ed25519', kty: 'OKP', x: jwk.x })).digest('base64url');
+    const path = action === 'discover' ? `/api/approval-requests/${state.requestId}/result` : `/api/approval-results/${resultRef}/${action}`;
+    const header = Buffer.from(JSON.stringify({ alg: 'EdDSA', kid: jkt, typ: 'openkey-session-proof+jwt' })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({
+        client_id: 'openkey-approval-result-v1',
+        cred_hash: createHash('sha256').update(JSON.stringify([action, state.requestId, state.bodyCid, resultRef, ackId])).digest('base64url'),
+        htm: 'POST', htu: state.apiOrigin + path, iat: Math.floor(Date.now() / 1000), jti: randomBytes(24).toString('base64url'),
+    })).toString('base64url');
+    const input = `${header}.${payload}`;
+    const signature = sign(null, Buffer.from(input), createPrivateKey({ key: { kty: jwk.kty, crv: jwk.crv, x: jwk.x, d: jwk.d }, format: 'jwk' }));
+    return `${input}.${signature.toString('base64url')}`;
+}
+function canonicalB64(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]+$/.test(value))
+        throw unavailable('OpenKey returned an invalid result.');
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.toString('base64url') !== value)
+        throw unavailable('OpenKey returned an invalid result.');
+    return decoded;
+}
+/** The result is AES-GCM under an ECDH-P-256 key only this request's relay key can derive. Node's ECDH refuses off-curve points. */
+function decryptResult(envelope, requestId, relay) {
+    const value = envelope;
+    if (!value || value.version !== 1 || value.algorithm !== 'ECDH-P256-A256GCM')
+        throw unavailable('OpenKey returned an unsupported result.');
+    const x = canonicalB64(value.ephemeralPublicJwk?.x);
+    const y = canonicalB64(value.ephemeralPublicJwk?.y);
+    const nonce = canonicalB64(value.nonce);
+    const ciphertext = canonicalB64(value.ciphertext);
+    if (x.length !== 32 || y.length !== 32 || nonce.length !== 12 || ciphertext.length <= 16)
+        throw unavailable('OpenKey returned an invalid result.');
+    let secret;
+    try {
+        secret = relay.computeSecret(Buffer.concat([Buffer.from([4]), x, y]));
+    }
+    catch {
+        throw unavailable('OpenKey returned an invalid result key.');
+    }
+    const extracted = createHmac('sha256', Buffer.from(requestId)).update(secret).digest();
+    const aesKey = createHmac('sha256', extracted).update(Buffer.from('openkey-device-relay-v1')).update(Buffer.from([1])).digest();
+    const decipher = createDecipheriv('aes-256-gcm', aesKey, nonce);
+    decipher.setAAD(Buffer.from(requestId));
+    decipher.setAuthTag(ciphertext.subarray(ciphertext.length - 16));
+    try {
+        const opened = JSON.parse(Buffer.concat([decipher.update(ciphertext.subarray(0, -16)), decipher.final()]).toString('utf8'));
+        if (opened && typeof opened === 'object' && !Array.isArray(opened))
+            return opened;
+    }
+    catch { /* falls through */ }
+    throw unavailable('OpenKey returned an unreadable result.');
+}
+/**
+ * The OpenKey side of one invitation approval: a signed intent request, then repeatable requester-authenticated reads of
+ * its encrypted result. Result verification beyond the binding to this request (holder, owner, key, expiry) is done by
+ * the caller from the signed SIWE, never from anything the transport reports.
+ */
+export function openKeyInviteTransport(deps = {}) {
+    const fetchFn = deps.fetch ?? fetch;
+    const now = deps.now ?? Date.now;
+    const post = async (state, key, action) => {
+        const resultRef = action === 'discover' ? '' : state.resultRef ?? '';
+        const path = action === 'discover' ? `/api/approval-requests/${state.requestId}/result` : `/api/approval-results/${resultRef}/${action}`;
+        const body = action === 'discover'
+            ? { bodyCid: state.bodyCid, header: state.record.header, signature: state.record.signature }
+            : { requestId: state.requestId, bodyCid: state.bodyCid, ...(action === 'ack' ? { ackId: state.ackId } : {}) };
+        return fetchFn(state.apiOrigin + path, {
+            method: 'POST', credentials: 'omit', redirect: 'error', referrerPolicy: 'no-referrer',
+            headers: { 'content-type': 'application/json', 'OpenKey-Session-Proof': sessionProof(state, key, action, resultRef, action === 'ack' ? state.ackId : '') },
+            body: JSON.stringify(body), signal: AbortSignal.timeout(10_000),
+        });
+    };
+    return {
+        async create({ context, key, host }) {
+            const profile = loadProfile();
+            const openkeyOrigin = origin(profile.openkeyHost, 'OpenKey');
+            const apiOrigin = origin(resolveOpenKeyApiHost({ env: process.env.COURIER_OPENKEY_API_HOST, openkeyHost: openkeyOrigin }), 'OpenKey API');
+            const jwk = key.jwk;
+            const signer = signerFromJwk(jwk);
+            const spec = buildShareInvitationApprovalSpec({ targetDid: signer.did, targetPublicJwk: { kty: jwk.kty, crv: jwk.crv, x: jwk.x }, nodeOrigin: host, context, now: now() });
+            const relay = createECDH('prime256v1');
+            relay.generateKeys();
+            const point = relay.getPublicKey();
+            const request = { ...spec, resultEncryptionPublicJwk: { kty: 'EC', crv: 'P-256', x: point.subarray(1, 33).toString('base64url'), y: point.subarray(33).toString('base64url') } };
+            let created;
+            try {
+                created = await createApprovalRequest({ request, issuerKey: signer, apiOrigin: origin(process.env.COURIER_LINKS_API_ORIGIN ?? DEFAULT_LINKS_API, 'Links API'),
+                    openkeyOrigin, expiresAt: new Date(context.acceptanceExpiresAt), now: now(), fetch: fetchFn });
+            }
+            catch {
+                throw unavailable('The approval request could not be created.');
+            }
+            const state = { requestId: created.id, bodyCid: created.bodyCid, record: created.record, request, apiOrigin,
+                relayPrivateKey: relay.getPrivateKey().toString('base64url'), ackId: randomUUID() };
+            return { approvalUrl: created.link, transport: state };
+        },
+        async poll(pending, key) {
+            const state = pending.transport;
+            if (!state)
+                throw unavailable('No approval request exists for this invitation.');
+            if (!state.resultEnvelope) {
+                let response;
+                try {
+                    response = await post(state, key, 'discover');
+                }
+                catch {
+                    return { status: 'pending' };
+                }
+                if (response.status === 202)
+                    return { status: 'pending' };
+                if (!response.ok) {
+                    const failed = (await response.clone().json().catch(() => null));
+                    const code = failed?.code;
+                    if (failed?.status === 'denied')
+                        return { status: 'denied' };
+                    if (code === 'expired_request' || code === 'expired_result')
+                        return { status: 'expired' };
+                    if (code === 'not_found' || code === 'request_binding' || code === 'invalid_proof')
+                        throw unavailable('OpenKey does not recognise this approval request.');
+                    return { status: 'pending' };
+                }
+                const found = await response.json();
+                if (typeof found.resultRef !== 'string' || !/^[A-Za-z0-9_-]{20,128}$/.test(found.resultRef) || typeof found.expiresAt !== 'string')
+                    throw unavailable('OpenKey returned an invalid result reference.');
+                state.resultRef = found.resultRef;
+                state.resultExpiresAt = found.expiresAt;
+                let fetched;
+                try {
+                    fetched = await post(state, key, 'fetch');
+                }
+                catch {
+                    return { status: 'pending' };
+                }
+                if (!fetched.ok)
+                    return { status: 'pending' };
+                const result = await fetched.json();
+                if (result.requestId !== state.requestId || result.bodyCid !== state.bodyCid || result.resultRef !== state.resultRef || result.expiresAt !== state.resultExpiresAt || !result.relay) {
+                    throw unavailable('The approval result does not match this request.');
+                }
+                state.resultEnvelope = result.relay;
+            }
+            const relay = createECDH('prime256v1');
+            relay.setPrivateKey(Buffer.from(state.relayPrivateKey, 'base64url'));
+            const opened = decryptResult(state.resultEnvelope, state.requestId, relay);
+            const delegation = opened.delegation;
+            if (opened.resultVersion !== 1 || opened.requestId !== state.requestId || opened.requestDigest !== state.bodyCid
+                || opened.requesterDid !== state.request.issuer || opened.targetDid !== state.request.targetDid || !delegation || typeof delegation !== 'object') {
+                throw new CourierError('bad-grant', 'The approval result does not belong to this request.');
+            }
+            return { status: 'approved', payload: delegation };
+        },
+        async acknowledge(pending, key) {
+            const state = pending.transport;
+            if (!state?.resultRef)
+                return;
+            try {
+                await post(state, key, 'ack');
+            }
+            catch { /* the stored approval is already committed; OpenKey may be told on the next run */ }
+        },
+    };
+}
+//# sourceMappingURL=invite-openkey.js.map

package/dist/invite-openkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-openkey.js","sourceRoot":"","sources":["../src/invite-openkey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACpI,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEzH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAInD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AAkBtD,MAAM,WAAW,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,IAAI,YAAY,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAEzG,SAAS,MAAM,CAAC,KAAa,EAAE,KAAa;IAC1C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,WAAW,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;QAAE,MAAM,WAAW,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACrL,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB,EAAE,GAAa,EAAE,MAAc,EAAE,SAAiB,EAAE,KAAa;IACxG,MAAM,GAAG,GAAG,GAAG,CAAC,GAAmC,CAAC;IACpD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,yBAAyB,SAAS,IAAI,MAAM,EAAE,CAAC;IACzI,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/H,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACzC,SAAS,EAAE,4BAA4B;QACvC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QACtI,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACzH,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/I,OAAO,GAAG,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACtG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oIAAoI;AACpI,SAAS,aAAa,CAAC,QAAiB,EAAE,SAAiB,EAAE,KAAoC;IAC/F,MAAM,KAAK,GAAG,QAAuJ,CAAC;IACtK,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,mBAAmB;QAAE,MAAM,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAC3I,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE;QAAE,MAAM,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACnJ,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAAC,CAAC;IACtJ,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChI,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAChE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrI,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAiC,CAAC;IAC/G,CAAC;IAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAC/B,MAAM,WAAW,CAAC,wCAAwC,CAAC,CAAC;AAC9D,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA0B,EAAE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,EAAE,KAAmB,EAAE,GAAa,EAAE,MAAc,EAAqB,EAAE;QAC3F,MAAM,SAAS,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,yBAAyB,SAAS,IAAI,MAAM,EAAE,CAAC;QACzI,MAAM,IAAI,GAAG,MAAM,KAAK,UAAU;YAChC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;YAC5F,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChH,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,EAAE;YACrC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa;YACrF,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC1J,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SAChE,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE;YACjC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;YAC1I,MAAM,GAAG,GAAG,GAAG,CAAC,GAAmC,CAAC;YACpD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,gCAAgC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3K,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;YACvC,KAAK,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,yBAAyB,EAAE,EAAE,GAAG,EAAE,IAAa,EAAE,GAAG,EAAE,OAAgB,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACnM,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,iBAAiB,EAAE,WAAW,CAAC;oBAC3J,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACnG,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,WAAW,CAAC,4CAA4C,CAAC,CAAC;YAAC,CAAC;YAC5E,MAAM,KAAK,GAAiB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS;gBACvH,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;YACtF,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,KAA2C,EAAE,CAAC;QAC/F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG;YACrB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAgD,CAAC;YACvE,IAAI,CAAC,KAAK;gBAAE,MAAM,WAAW,CAAC,iDAAiD,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC1B,IAAI,QAAkB,CAAC;gBACvB,IAAI,CAAC;oBAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAAC,CAAC;gBAC9F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAgD,CAAC;oBAChH,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;oBAC1B,IAAI,MAAM,EAAE,MAAM,KAAK,QAAQ;wBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;oBAC7D,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,gBAAgB;wBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBAC1F,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,eAAe;wBAAE,MAAM,WAAW,CAAC,mDAAmD,CAAC,CAAC;oBAC3J,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAkD,CAAC;gBACpF,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;oBAAE,MAAM,WAAW,CAAC,+CAA+C,CAAC,CAAC;gBACvM,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;gBAClC,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,SAAS,CAAC;gBACxC,IAAI,OAAiB,CAAC;gBACtB,IAAI,CAAC;oBAAC,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAAC,CAAC;gBAC1F,IAAI,CAAC,OAAO,CAAC,EAAE;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAA6B,CAAC;gBAC/D,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACpL,MAAM,WAAW,CAAC,kDAAkD,CAAC,CAAC;gBACxE,CAAC;gBACD,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC;YACtC,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;YACvC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAiD,CAAC;YAC5E,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,OAAO;mBAC3G,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACnJ,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,sDAAsD,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAqC,EAAE,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG;YAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAgD,CAAC;YACvE,IAAI,CAAC,KAAK,EAAE,SAAS;gBAAE,OAAO;YAC9B,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,mFAAmF,CAAC,CAAC;QACtI,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/main.js

@@ -52,7 +52,7 @@ Setup & pairing (humans run these):
                                    Accept artifact A, B or C; prints B or C to pass on
   pair renew [peer] [--force]      Renew both directions; humans or watcher only
   pair renew <peer> --renew-artifact [--force]  Emit renewed C artifact for handoff; receiver runs pair accept
-  revoke <peer>                    Stop renewing + drop the peer (access lapses at delegation expiry)
+  revoke <peer>                    Stop renewing and remove the peer; their access ends when the current grant expires. Files you already shared stay available until each share expires or you revoke it (\`tinycloud share revoke <id>\`).
 
 Threads (agents run these):
   send <peer> (--new <subject> | --thread <id>) [--text t | --file f | stdin]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/courier",
-  "version": "0.6.0-beta.18",
+  "version": "0.6.0-beta.20",
   "description": "Courier: agent-to-agent threads over TinyCloud (CLI, library and agent skill)",
   "author": "TinyCloud, Inc.",
   "type": "module",
@@ -30,10 +30,10 @@
     "test:live": "tsc -p tsconfig.json && node scripts/happy-path.mjs"
   },
   "dependencies": {
-    "@tinycloud/node-sdk": "3.12.0-beta.16",
-    "@tinycloud/sdk-core": "3.12.0-beta.16",
-    "@tinycloud/share-envelope": "1.5.0",
-    "@tinycloud/share-sdk": "1.5.0-beta.0",
+    "@tinycloud/node-sdk": "3.12.0-beta.18",
+    "@tinycloud/sdk-core": "3.12.0-beta.18",
+    "@tinycloud/share-envelope": "1.6.0-beta.0",
+    "@tinycloud/share-sdk": "1.5.0-beta.2",
     "ulid": "^3.0.2"
   },
   "devDependencies": {