sealbridge 0.4.2 → 0.5.0

package/dist/packages/core/dist/context-grant.js

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: Apache-2.0
+import { digest } from './crypto.js';
+import { validateSchema } from './schema.js';
+export const CONTEXT_GRANT_MAX_BYTES = 64 * 1024;
+export const CONTEXT_GRANT_MAX_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
+export const CONTEXT_GRANT_DEFAULT_LIFETIME_MS = 24 * 60 * 60 * 1000;
+/** Time-independent contract checks also apply when verifying historical evidence. */
+export function validateContextGrant(grant, createdAt) {
+    validateSchema('context-grant', grant);
+    const g = grant;
+    if (g.inputRetentionAllowed === true)
+        throw new Error('CONTEXT_GRANT_INPUT_RETENTION_UNAVAILABLE');
+    const start = Date.parse(createdAt), end = Date.parse(g.expiresAt);
+    if (!Number.isFinite(start) || end <= start || end - start > CONTEXT_GRANT_MAX_LIFETIME_MS)
+        throw new Error('CONTEXT_GRANT_EXPIRY_INVALID');
+    const denied = new Set(g.fieldsDenied);
+    if (g.fieldsAllowed?.some(field => denied.has(field)))
+        throw new Error('CONTEXT_GRANT_FIELDS_CONFLICT');
+}
+export function validateManifestContextGrant(manifest) {
+    const grant = manifest.contextGrant;
+    if (!grant)
+        return;
+    validateContextGrant(grant, manifest.createdAt);
+    if (manifest.protocolVersion !== '0.2.0')
+        throw new Error('CONTEXT_GRANT_PROTOCOL_UNSUPPORTED');
+    if (manifest.permissions.maxDelegationDepth !== (grant.deliveryMode === 'approval_redelegation' ? 1 : 0))
+        throw new Error('CONTEXT_GRANT_DEPTH_CONFLICT');
+    if (grant.deliveryMode !== 'hand_over' && manifest.sandboxPolicy.filesystemScope !== 'ephemeral_workspace_only')
+        throw new Error('CONTEXT_GRANT_FILESYSTEM_CONFLICT');
+}
+/** Check live use separately so expired grants remain verifiable in historical contracts. */
+export function validateContextGrantUse(manifest, input, now = Date.now()) {
+    validateManifestContextGrant(manifest);
+    const grant = manifest.contextGrant;
+    if (!grant)
+        return;
+    if (!Number.isFinite(now) || Date.parse(grant.expiresAt) <= now)
+        throw new Error('CONTEXT_GRANT_EXPIRED');
+    const bytes = JSON.stringify(input);
+    if (bytes === undefined || Buffer.byteLength(bytes, 'utf8') > grant.maxBytes)
+        throw new Error('CONTEXT_GRANT_MAX_BYTES_EXCEEDED');
+}
+/** Defaults are opt-in and never widen a supplied declaration. */
+export function buildContextGrant(options, createdAt = new Date().toISOString()) {
+    const mode = options.deliveryMode === undefined ? 'view_only' : options.deliveryMode;
+    const grant = structuredClone({
+        ...options,
+        deliveryMode: mode,
+        expiresAt: options.expiresAt === undefined
+            ? new Date(Date.parse(createdAt) + CONTEXT_GRANT_DEFAULT_LIFETIME_MS).toISOString() : options.expiresAt,
+        maxBytes: options.maxBytes === undefined ? CONTEXT_GRANT_MAX_BYTES : options.maxBytes,
+        retention: options.retention === undefined
+            ? mode === 'hand_over' ? 'keep_deliverable' : 'ephemeral_view' : options.retention,
+        inputRetentionAllowed: options.inputRetentionAllowed === undefined ? false : options.inputRetentionAllowed,
+    });
+    validateContextGrant(grant, createdAt);
+    return grant;
+}
+/** Only these two fields enter context lifecycle audit payloads. */
+export function contextGrantAuditPayload(grant) {
+    validateSchema('context-grant', grant);
+    return { grantDigest: digest(grant), deliveryMode: grant.deliveryMode };
+}
+//# sourceMappingURL=context-grant.js.map

package/dist/packages/core/dist/context-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-grant.js","sourceRoot":"","sources":["../src/context-grant.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrE,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErE,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,SAAiB;IACpE,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,KAAqB,CAAC;IAChC,IAAI,CAAC,CAAC,qBAAqB,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,GAAG,6BAA6B;QACxF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAAsB;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,eAAe,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,WAAW,CAAC,kBAAkB,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC1J,IAAI,KAAK,CAAC,YAAY,KAAK,WAAW,IAAI,QAAQ,CAAC,aAAa,CAAC,eAAe,KAAK,0BAA0B;QAC7G,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;AACzD,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CAAC,QAAsB,EAAE,KAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9F,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ;QAC1E,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACxD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,OAA4B,EAAE,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAClG,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACrF,MAAM,KAAK,GAAiB,eAAe,CAAC;QAC1C,GAAG,OAAO;QACV,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS;YACxC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,iCAAiC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS;QACzG,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ;QACrF,SAAS,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS;YACxC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS;QACpF,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB;KAC3G,CAAC,CAAC;IACH,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,wBAAwB,CAAC,KAAmB;IAC1D,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;AAC1E,CAAC"}

package/dist/packages/core/dist/delegation.d.ts

@@ -0,0 +1,17 @@
+import type { TaskContract } from './contract.js';
+import type { DelegationLink, DelegationProof, KeyPair, TaskManifest } from './types.js';
+/** Literal declaration comparison only; it does not interpret selectors or inspect provenance. */
+export declare function assertDelegationAttenuation(parent: TaskManifest, child: TaskManifest): void;
+/** Historical verification has no implicit current clock. Siblings are separate one-edge chains. */
+export declare function verifyDelegationChain(input: {
+    rootContract: TaskContract;
+    chain: readonly DelegationProof[];
+}): {
+    depthRemaining: number;
+    delegateeOwnerDids: string[];
+};
+export declare function createDelegationLink(input: {
+    parentContract: TaskContract;
+    childContract: TaskContract;
+    issuedAt?: string;
+}, delegator: KeyPair): DelegationLink;

package/dist/packages/core/dist/delegation.js

@@ -0,0 +1,126 @@
+// SPDX-License-Identifier: Apache-2.0
+import { digest, signPayload, verifySigned } from './crypto.js';
+import { verifyContract } from './contract.js';
+import { validateManifest, validateSchema } from './schema.js';
+const maxima = ['maxInputTokens', 'maxOutputTokens', 'maxToolInvocations', 'maxWallClockSeconds'];
+const equal = (a, b) => digest(a) === digest(b);
+function fail(code = 'DELEGATION_INVALID') { throw new Error(code); }
+function time(value) {
+    const n = Date.parse(value);
+    if (!Number.isFinite(n))
+        fail();
+    return n;
+}
+function root(manifest) {
+    if (manifest.protocolVersion !== '0.2.0' || manifest.contextGrant?.deliveryMode !== 'approval_redelegation')
+        fail('DELEGATION_INVALID');
+    if (manifest.permissions.maxDelegationDepth !== 1)
+        fail('DELEGATION_INVALID');
+}
+/** Literal declaration comparison only; it does not interpret selectors or inspect provenance. */
+export function assertDelegationAttenuation(parent, child) {
+    root(parent);
+    try {
+        validateManifest(parent);
+        validateManifest(child);
+    }
+    catch {
+        fail();
+    }
+    const p = parent.contextGrant, c = child.contextGrant;
+    if (!c || c.deliveryMode !== 'view_only' || c.retention !== 'ephemeral_view' || c.inputRetentionAllowed === true)
+        fail('DELEGATION_INVALID');
+    if (child.permissions.maxDelegationDepth !== 0)
+        fail('DELEGATION_INVALID');
+    if (child.permissions.grantedCapabilities.length)
+        fail('DELEGATION_INVALID');
+    if (time(child.createdAt) < time(parent.createdAt) || time(child.deadline) <= time(child.createdAt) ||
+        time(parent.deadline) <= time(parent.createdAt))
+        fail();
+    if (time(child.deadline) > time(parent.deadline) || time(c.expiresAt) > time(p.expiresAt) || c.maxBytes > p.maxBytes)
+        fail('DELEGATION_INVALID');
+    for (const name of maxima)
+        if (child.budget[name] > parent.budget[name])
+            fail('DELEGATION_INVALID');
+    const withoutMaxima = (m) => Object.fromEntries(Object.entries(m.budget).filter(([k]) => !maxima.includes(k)));
+    if (!equal(withoutMaxima(parent), withoutMaxima(child)) || !equal(parent.sandboxPolicy, child.sandboxPolicy) ||
+        !equal(parent.verification, child.verification))
+        fail('DELEGATION_INVALID');
+    if (!c.selectors.length || c.selectors.some(s => !p.selectors.includes(s)) ||
+        p.fieldsAllowed && (!c.fieldsAllowed?.length || c.fieldsAllowed.some(f => !p.fieldsAllowed.includes(f))) ||
+        c.fieldsAllowed && !c.fieldsAllowed.length ||
+        p.fieldsDenied?.some(f => !c.fieldsDenied?.includes(f)) ||
+        p.outputSchema !== undefined && (c.outputSchema === undefined || !equal(p.outputSchema, c.outputSchema)))
+        fail('DELEGATION_INVALID');
+    const narrower = c.selectors.length < p.selectors.length ||
+        (p.fieldsAllowed ? !!c.fieldsAllowed && c.fieldsAllowed.length < p.fieldsAllowed.length : !!c.fieldsAllowed?.length);
+    if (!narrower)
+        fail('DELEGATION_INVALID');
+}
+function actualLimits(child) {
+    return structuredClone({ deadline: child.deadline, expiresAt: child.contextGrant.expiresAt,
+        budget: child.budget, sandboxPolicy: child.sandboxPolicy, verification: child.verification,
+        depthRemaining: child.permissions.maxDelegationDepth });
+}
+/** Historical verification has no implicit current clock. Siblings are separate one-edge chains. */
+export function verifyDelegationChain(input) {
+    const { rootContract: parent, chain } = input;
+    if (!verifyContract(parent))
+        fail();
+    root(parent.manifest);
+    if (!Array.isArray(chain) || !chain.length)
+        fail('DELEGATION_PROOF_REQUIRED');
+    if (chain.length > 1 || chain.length > parent.manifest.permissions.maxDelegationDepth)
+        fail('DELEGATION_INVALID');
+    const proof = chain[0];
+    try {
+        validateSchema('delegation-attachment', { parentContract: parent, children: [proof] });
+    }
+    catch {
+        fail();
+    }
+    const child = proof.childContract, link = proof.link, l = link.payload;
+    if (!verifyContract(child))
+        fail();
+    const a = parent.manifest.requester.ownerDid, b = parent.manifest.worker.ownerDid, c = child.manifest.worker.ownerDid;
+    if (new Set([a, b, c]).size !== 3 || b !== child.manifest.requester.ownerDid ||
+        parent.manifest.taskId === child.manifest.taskId || !verifySigned(link, b) ||
+        l.delegatorOwnerDid !== b || l.delegateeOwnerDid !== c || l.parentTaskId !== parent.manifest.taskId ||
+        l.childTaskId !== child.manifest.taskId || l.parentContractDigest !== parent.contractDigest ||
+        l.childContractDigest !== child.contractDigest || l.prevLinkDigest !== null)
+        fail();
+    const remaining = parent.manifest.permissions.maxDelegationDepth - 1;
+    if (l.depthRemaining !== remaining || l.limits.depthRemaining !== remaining || child.manifest.permissions.maxDelegationDepth !== remaining)
+        fail('DELEGATION_INVALID');
+    assertDelegationAttenuation(parent.manifest, child.manifest);
+    if (!equal(l.limits, actualLimits(child.manifest)))
+        fail('DELEGATION_INVALID');
+    const issued = time(l.issuedAt);
+    if (l.issuedAt !== link.signature.signedAt || time(child.acceptance.signature.signedAt) > issued ||
+        time(child.manifest.createdAt) > time(child.acceptance.signature.signedAt) ||
+        [parent.manifest, child.manifest].some(m => issued >= time(m.deadline) || issued >= time(m.contextGrant.expiresAt)))
+        fail();
+    return { depthRemaining: remaining, delegateeOwnerDids: [c] };
+}
+export function createDelegationLink(input, delegator) {
+    const { parentContract: parent, childContract: child } = input;
+    if (!verifyContract(parent) || !verifyContract(child))
+        fail();
+    assertDelegationAttenuation(parent.manifest, child.manifest);
+    const issuedAt = input.issuedAt ?? new Date().toISOString();
+    time(issuedAt);
+    let link;
+    try {
+        link = signPayload({ type: 'DelegationLink', parentTaskId: parent.manifest.taskId,
+            parentContractDigest: parent.contractDigest, childTaskId: child.manifest.taskId,
+            childContractDigest: child.contractDigest, delegatorOwnerDid: delegator.did,
+            delegateeOwnerDid: child.manifest.worker.ownerDid, depthRemaining: 0, limits: actualLimits(child.manifest),
+            issuedAt, prevLinkDigest: null }, delegator, issuedAt);
+    }
+    catch {
+        fail();
+    }
+    verifyDelegationChain({ rootContract: parent, chain: [{ link, childContract: child }] });
+    return link;
+}
+//# sourceMappingURL=delegation.js.map

package/dist/packages/core/dist/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../src/delegation.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG/D,MAAM,MAAM,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,qBAAqB,CAAU,CAAC;AAC3G,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;AAClE,SAAS,IAAI,CAAC,IAAI,GAAG,oBAAoB,IAAW,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5E,SAAS,IAAI,CAAC,KAAa;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,IAAI,EAAE,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,IAAI,CAAC,QAAsB;IAClC,IAAI,QAAQ,CAAC,eAAe,KAAK,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE,YAAY,KAAK,uBAAuB;QACzG,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7B,IAAI,QAAQ,CAAC,WAAW,CAAC,kBAAkB,KAAK,CAAC;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAChF,CAAC;AACD,kGAAkG;AAClG,MAAM,UAAU,2BAA2B,CAAC,MAAoB,EAAE,KAAmB;IACnF,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,IAAI,CAAC;QAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,MAAM,CAAC,YAAa,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IACvD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,gBAAgB,IAAI,CAAC,CAAC,qBAAqB,KAAK,IAAI;QAC9G,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,WAAW,CAAC,kBAAkB,KAAK,CAAC;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC3E,IAAI,KAAK,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ;QAClH,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,CAAC,CAAe,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAA0B,CAAC,CAAC,CAAC,CAAC;IACtJ,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC;QACxG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM;QAC1C,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1G,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM;QACtD,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvH,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAC5C,CAAC;AACD,SAAS,YAAY,CAAC,KAAmB;IACvC,OAAO,eAAe,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,YAAa,CAAC,SAAS;QACzF,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QAC1F,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC5D,CAAC;AACD,oGAAoG;AACpG,MAAM,UAAU,qBAAqB,CAAC,KAAwE;IAE5G,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC9C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,kBAAkB;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC;QAAC,cAAc,CAAC,uBAAuB,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IACjH,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IACvE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,CAAC;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAO,CAAC,QAAQ,CAAC;IACxH,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ;QACxE,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QACnG,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,oBAAoB,KAAK,MAAM,CAAC,cAAc;QAC3F,CAAC,CAAC,mBAAmB,KAAK,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI;QAAE,IAAI,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,kBAAkB,GAAG,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,kBAAkB,KAAK,SAAS;QACxI,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7B,2BAA2B,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,MAAM;QAC5F,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC1E,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,YAAa,CAAC,SAAS,CAAC,CAAC;QAAE,IAAI,EAAE,CAAC;IACjI,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,KAAuF,EAAE,SAAkB;IAC9I,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC/D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,CAAC;IAC9D,2BAA2B,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,CAAC;IACf,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QAAC,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,gBAAyB,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;YAC9F,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC/E,mBAAmB,EAAE,KAAK,CAAC,cAAc,EAAE,iBAAiB,EAAE,SAAS,CAAC,GAAG;YAC3E,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC3G,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IACnB,qBAAqB,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/packages/core/dist/edge.d.ts

@@ -1,5 +1,7 @@
 export * from './types.js';
 export * from './crypto.js';
 export * from './discovery.js';
+export * from './invite-link.js';
+export * from './invite-sas.js';
 export * from './relay-auth.js';
 export * from './delivery-status.js';

package/dist/packages/core/dist/edge.js

@@ -2,6 +2,8 @@
 export * from './types.js';
 export * from './crypto.js';
 export * from './discovery.js';
+export * from './invite-link.js';
+export * from './invite-sas.js';
 export * from './relay-auth.js';
 export * from './delivery-status.js';
 //# sourceMappingURL=edge.js.map

package/dist/packages/core/dist/edge.js.map

@@ -1 +1 @@
-{"version":3,"file":"edge.js","sourceRoot":"","sources":["../src/edge.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"edge.js","sourceRoot":"","sources":["../src/edge.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC"}

package/dist/packages/core/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './types.js';
+export * from './context-grant.js';
 export * from './crypto.js';
 export * from './schema.js';
 export * from './protocol.js';
@@ -6,7 +7,10 @@ export * from './capability.js';
 export * from './receipts.js';
 export * from './contract.js';
 export * from './discovery.js';
+export * from './invite-link.js';
+export * from './invite-sas.js';
 export * from './connection.js';
 export * from './relay-auth.js';
 export * from './revocation.js';
 export * from './delivery-status.js';
+export * from './delegation.js';

package/dist/packages/core/dist/index.js

@@ -1,4 +1,5 @@
 export * from './types.js';
+export * from './context-grant.js';
 export * from './crypto.js';
 export * from './schema.js';
 export * from './protocol.js';
@@ -6,8 +7,11 @@ export * from './capability.js';
 export * from './receipts.js';
 export * from './contract.js';
 export * from './discovery.js';
+export * from './invite-link.js';
+export * from './invite-sas.js';
 export * from './connection.js';
 export * from './relay-auth.js';
 export * from './revocation.js';
 export * from './delivery-status.js';
+export * from './delegation.js';
 //# sourceMappingURL=index.js.map

package/dist/packages/core/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC"}

package/dist/packages/core/dist/invite-link.d.ts

@@ -0,0 +1,72 @@
+import type { RelayEndpointPolicy } from './discovery.js';
+export declare const INVITE_LINK_CONTEXT = "sealbridge/invite-link/v1";
+/** UTF-8 info labels; each HKDF uses K as IKM and an empty salt (RFC 5869). */
+export declare const INVITE_LINK_HKDF_INFO: Readonly<{
+    id: string;
+    encKey: string;
+    accessKey: string;
+}>;
+export declare const INVITE_LINK_PAD_BLOCK_BYTES = 4096;
+export declare const INVITE_LINK_MAX_PADDED_BYTES = 16384;
+export declare const INVITE_LINK_DEFAULT_TTL_MS: number;
+export declare const INVITE_LINK_MAX_TTL_MS: number;
+export declare const INVITE_LINK_TOKEN_GRACE_MS: number;
+export interface InviteLinkKeys {
+    id: Buffer;
+    encKey: Buffer;
+    accessKey: Buffer;
+}
+export interface InviteLinkCiphertext {
+    id: Uint8Array;
+    /** Encrypted padded plaintext followed by the 16-byte GCM authentication tag. */
+    ciphertext: Uint8Array;
+    nonce: Uint8Array;
+    expiresAt: string;
+}
+/** Relay storage encoding. No K, plaintext, claim tag, or verification number. */
+export interface InviteLinkStorage {
+    id: string;
+    ciphertext: string;
+    nonce: string;
+    expiresAt: string;
+}
+export interface InviteLinkRelayPolicy extends RelayEndpointPolicy {
+    /** Same URL comparison as application relay allow-lists (origin + pathname). */
+    allowedRelayUrls?: readonly string[];
+}
+export interface ParsedInviteLink {
+    v: 1;
+    k: string;
+    relayOrigin: string;
+}
+/** Returns the link deadline and the inner token deadline (link + 24 hours). */
+export declare function inviteLinkExpiry(now?: number, ttlMs?: number): {
+    expiresAt: string;
+    tokenExpiresAt: string;
+};
+/** The returned k is exactly 43 unpadded base64url characters encoding 32 random bytes. */
+export declare function generateInviteLinkKey(): string;
+export declare function deriveInviteLinkKeys(k: string): InviteLinkKeys;
+/** Exact bytes: HMAC-SHA256(accessKey, UTF8("claim") || raw 16-byte id). */
+export declare function inviteLinkClaimTag(accessKey: Uint8Array, id: Uint8Array): Buffer;
+/**
+ * AAD = UTF8(context) || raw id || UTF8(normalizeRelayOrigin(relayOrigin)) ||
+ * UTF8(expiresAt). No separators, length prefixes, JSON, or terminating NULs.
+ * The origin has no path, trailing slash, or default port; ws(s) maps to http(s).
+ */
+export declare function inviteLinkAad(id: Uint8Array, relayOrigin: string, expiresAt: string): Buffer;
+/** Four-byte big-endian UTF-8 byte length, token bytes, then zero padding. */
+export declare function padInviteLinkToken(token: string): Buffer;
+export declare function unpadInviteLinkToken(padded: Uint8Array): string;
+export declare function packInviteLinkCiphertext(value: InviteLinkCiphertext): InviteLinkStorage;
+/** Strict local decoding of an untrusted relay response, without contacting a relay. */
+export declare function unpackInviteLinkCiphertext(value: unknown): InviteLinkCiphertext;
+/** Opaque token wrapping only. Signature/card/relay verification remains the caller's next step. */
+export declare function encryptInviteLink(token: string, k: string, options: {
+    relayOrigin: string;
+    expiresAt: string;
+    now?: number;
+}): InviteLinkCiphertext;
+export declare function decryptInviteLink(value: InviteLinkCiphertext, k: string, relayOrigin: string, now?: number): string;
+/** Only the two v1 fragment forms are accepted. Parsing performs no network I/O. */
+export declare function parseInviteLink(uri: string, policy?: InviteLinkRelayPolicy): ParsedInviteLink;

package/dist/packages/core/dist/invite-link.js

@@ -0,0 +1,225 @@
+// SPDX-License-Identifier: Apache-2.0
+import { createCipheriv, createDecipheriv, createHmac, hkdfSync, randomBytes } from 'node:crypto';
+import { DEFAULT_CLOCK_SKEW_MS, validateRelayEndpointUrl } from './discovery.js';
+import { normalizeRelayOrigin } from './relay-auth.js';
+export const INVITE_LINK_CONTEXT = 'sealbridge/invite-link/v1';
+/** UTF-8 info labels; each HKDF uses K as IKM and an empty salt (RFC 5869). */
+export const INVITE_LINK_HKDF_INFO = Object.freeze({
+    id: INVITE_LINK_CONTEXT + '/id',
+    encKey: INVITE_LINK_CONTEXT + '/enc-key',
+    accessKey: INVITE_LINK_CONTEXT + '/access-key',
+});
+export const INVITE_LINK_PAD_BLOCK_BYTES = 4096;
+export const INVITE_LINK_MAX_PADDED_BYTES = 16384;
+export const INVITE_LINK_DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+export const INVITE_LINK_MAX_TTL_MS = 72 * 60 * 60 * 1000;
+export const INVITE_LINK_TOKEN_GRACE_MS = 24 * 60 * 60 * 1000;
+const NONCE_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+const MAX_LINK_CHARS = 2048;
+const DEFAULT_RELAY = 'https://relay.sealbridge.dev';
+function decodeBase64url(value, minBytes, maxBytes = minBytes) {
+    if (typeof value !== 'string' || value.length > Math.ceil(maxBytes * 4 / 3) ||
+        !/^[A-Za-z0-9_-]+$/.test(value))
+        throw new Error('INVALID_INVITE_LINK_ENCODING');
+    const bytes = Buffer.from(value, 'base64url');
+    if (bytes.length < minBytes || bytes.length > maxBytes || bytes.toString('base64url') !== value)
+        throw new Error('INVALID_INVITE_LINK_ENCODING');
+    return bytes;
+}
+function assertBytes(value, length) {
+    if (!(value instanceof Uint8Array) || value.byteLength !== length)
+        throw new Error('INVALID_INVITE_LINK_BYTES');
+}
+/** Expiries on the storage boundary must be UTC ISO strings with milliseconds. */
+function canonicalExpiry(expiresAt) {
+    if (typeof expiresAt !== 'string' || expiresAt.length !== 24 || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(expiresAt) ||
+        !Number.isFinite(Date.parse(expiresAt)) || new Date(expiresAt).toISOString() !== expiresAt)
+        throw new Error('INVALID_INVITE_LINK_EXPIRY');
+    return expiresAt;
+}
+/** Returns the link deadline and the inner token deadline (link + 24 hours). */
+export function inviteLinkExpiry(now = Date.now(), ttlMs = INVITE_LINK_DEFAULT_TTL_MS) {
+    if (!Number.isSafeInteger(now) || !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > INVITE_LINK_MAX_TTL_MS)
+        throw new Error('INVALID_INVITE_LINK_EXPIRY');
+    try {
+        return {
+            expiresAt: canonicalExpiry(new Date(now + ttlMs).toISOString()),
+            tokenExpiresAt: canonicalExpiry(new Date(now + ttlMs + INVITE_LINK_TOKEN_GRACE_MS).toISOString()),
+        };
+    }
+    catch {
+        throw new Error('INVALID_INVITE_LINK_EXPIRY');
+    }
+}
+/** The returned k is exactly 43 unpadded base64url characters encoding 32 random bytes. */
+export function generateInviteLinkKey() {
+    return randomBytes(32).toString('base64url');
+}
+export function deriveInviteLinkKeys(k) {
+    const key = decodeBase64url(k, 32);
+    const derive = (info, length) => Buffer.from(hkdfSync('sha256', key, Buffer.alloc(0), info, length));
+    return {
+        id: derive(INVITE_LINK_HKDF_INFO.id, 16),
+        encKey: derive(INVITE_LINK_HKDF_INFO.encKey, 32),
+        accessKey: derive(INVITE_LINK_HKDF_INFO.accessKey, 32),
+    };
+}
+/** Exact bytes: HMAC-SHA256(accessKey, UTF8("claim") || raw 16-byte id). */
+export function inviteLinkClaimTag(accessKey, id) {
+    assertBytes(accessKey, 32);
+    assertBytes(id, 16);
+    return createHmac('sha256', accessKey).update('claim', 'utf8').update(id).digest();
+}
+/**
+ * AAD = UTF8(context) || raw id || UTF8(normalizeRelayOrigin(relayOrigin)) ||
+ * UTF8(expiresAt). No separators, length prefixes, JSON, or terminating NULs.
+ * The origin has no path, trailing slash, or default port; ws(s) maps to http(s).
+ */
+export function inviteLinkAad(id, relayOrigin, expiresAt) {
+    assertBytes(id, 16);
+    return Buffer.concat([Buffer.from(INVITE_LINK_CONTEXT), id,
+        Buffer.from(normalizeRelayOrigin(relayOrigin)), Buffer.from(canonicalExpiry(expiresAt))]);
+}
+/** Four-byte big-endian UTF-8 byte length, token bytes, then zero padding. */
+export function padInviteLinkToken(token) {
+    if (typeof token !== 'string' || !token)
+        throw new Error('INVALID_INVITE_LINK_PLAINTEXT');
+    if (token.length > INVITE_LINK_MAX_PADDED_BYTES - 4)
+        throw new Error('INVITE_LINK_TOO_LARGE');
+    const size = Buffer.byteLength(token, 'utf8');
+    if (size > INVITE_LINK_MAX_PADDED_BYTES - 4)
+        throw new Error('INVITE_LINK_TOO_LARGE');
+    if (Buffer.from(token, 'utf8').toString('utf8') !== token)
+        throw new Error('INVALID_INVITE_LINK_PLAINTEXT');
+    const padded = Buffer.alloc(Math.ceil((size + 4) / INVITE_LINK_PAD_BLOCK_BYTES) * INVITE_LINK_PAD_BLOCK_BYTES);
+    padded.writeUInt32BE(size);
+    padded.write(token, 4, size, 'utf8');
+    return padded;
+}
+export function unpadInviteLinkToken(padded) {
+    if (!(padded instanceof Uint8Array) || !validPaddedSize(padded.byteLength))
+        throw new Error('INVALID_INVITE_LINK_PLAINTEXT');
+    const bytes = Buffer.from(padded), size = bytes.readUInt32BE();
+    if (!size || size > bytes.length - 4 ||
+        Math.ceil((size + 4) / INVITE_LINK_PAD_BLOCK_BYTES) * INVITE_LINK_PAD_BLOCK_BYTES !== bytes.length ||
+        bytes.subarray(4 + size).some(byte => byte !== 0))
+        throw new Error('INVALID_INVITE_LINK_PLAINTEXT');
+    const tokenBytes = bytes.subarray(4, 4 + size), token = tokenBytes.toString('utf8');
+    if (!Buffer.from(token, 'utf8').equals(tokenBytes))
+        throw new Error('INVALID_INVITE_LINK_PLAINTEXT');
+    return token;
+}
+function validPaddedSize(size) {
+    return size >= INVITE_LINK_PAD_BLOCK_BYTES && size <= INVITE_LINK_MAX_PADDED_BYTES &&
+        size % INVITE_LINK_PAD_BLOCK_BYTES === 0;
+}
+function validateCiphertext(value) {
+    assertBytes(value.id, 16);
+    assertBytes(value.nonce, NONCE_BYTES);
+    if (!(value.ciphertext instanceof Uint8Array) || !validPaddedSize(value.ciphertext.byteLength - AUTH_TAG_BYTES))
+        throw new Error('INVALID_INVITE_LINK_CIPHERTEXT');
+    canonicalExpiry(value.expiresAt);
+}
+export function packInviteLinkCiphertext(value) {
+    validateCiphertext(value);
+    return {
+        id: Buffer.from(value.id).toString('base64url'),
+        ciphertext: Buffer.from(value.ciphertext).toString('base64url'),
+        nonce: Buffer.from(value.nonce).toString('base64url'),
+        expiresAt: value.expiresAt,
+    };
+}
+/** Strict local decoding of an untrusted relay response, without contacting a relay. */
+export function unpackInviteLinkCiphertext(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) ||
+        Object.keys(value).length !== 4 ||
+        !['id', 'ciphertext', 'nonce', 'expiresAt'].every(key => Object.hasOwn(value, key)))
+        throw new Error('INVALID_INVITE_LINK_STORAGE');
+    const record = value;
+    const decoded = {
+        id: decodeBase64url(record.id, 16),
+        ciphertext: decodeBase64url(record.ciphertext, INVITE_LINK_PAD_BLOCK_BYTES + AUTH_TAG_BYTES, INVITE_LINK_MAX_PADDED_BYTES + AUTH_TAG_BYTES),
+        nonce: decodeBase64url(record.nonce, NONCE_BYTES),
+        expiresAt: canonicalExpiry(record.expiresAt),
+    };
+    validateCiphertext(decoded);
+    return decoded;
+}
+/** Opaque token wrapping only. Signature/card/relay verification remains the caller's next step. */
+export function encryptInviteLink(token, k, options) {
+    const now = options.now ?? Date.now(), deadline = Date.parse(canonicalExpiry(options.expiresAt));
+    if (!Number.isSafeInteger(now) || deadline <= now || deadline - now > INVITE_LINK_MAX_TTL_MS)
+        throw new Error('INVALID_INVITE_LINK_EXPIRY');
+    const keys = deriveInviteLinkKeys(k), nonce = randomBytes(NONCE_BYTES);
+    const cipher = createCipheriv('aes-256-gcm', keys.encKey, nonce, { authTagLength: AUTH_TAG_BYTES });
+    cipher.setAAD(inviteLinkAad(keys.id, options.relayOrigin, options.expiresAt));
+    const ciphertext = Buffer.concat([cipher.update(padInviteLinkToken(token)), cipher.final(), cipher.getAuthTag()]);
+    return { id: keys.id, nonce, ciphertext, expiresAt: options.expiresAt };
+}
+export function decryptInviteLink(value, k, relayOrigin, now = Date.now()) {
+    try {
+        validateCiphertext(value);
+        if (!Number.isSafeInteger(now) || Date.parse(value.expiresAt) <= now - DEFAULT_CLOCK_SKEW_MS)
+            throw new Error();
+        const keys = deriveInviteLinkKeys(k);
+        if (!keys.id.equals(value.id))
+            throw new Error();
+        const ciphertext = Buffer.from(value.ciphertext);
+        const decipher = createDecipheriv('aes-256-gcm', keys.encKey, value.nonce, { authTagLength: AUTH_TAG_BYTES });
+        decipher.setAAD(inviteLinkAad(value.id, relayOrigin, value.expiresAt));
+        decipher.setAuthTag(ciphertext.subarray(-AUTH_TAG_BYTES));
+        return unpadInviteLinkToken(Buffer.concat([decipher.update(ciphertext.subarray(0, -AUTH_TAG_BYTES)), decipher.final()]));
+    }
+    catch {
+        throw new Error('INVITE_LINK_DECRYPTION_FAILED');
+    }
+}
+function normalizeAllowlistUrl(value, policy) {
+    validateRelayEndpointUrl(value, policy);
+    const url = new URL(value);
+    return url.origin + url.pathname.replace(/\/+$/, '');
+}
+/** Only the two v1 fragment forms are accepted. Parsing performs no network I/O. */
+export function parseInviteLink(uri, policy = {}) {
+    if (typeof uri !== 'string' || uri.length > MAX_LINK_CHARS || /\s/.test(uri))
+        throw new Error('INVALID_INVITE_LINK');
+    // Match the literal URL prefix: URL normalization must not erase a query,
+    // credentials, default port, dot-segment path, control character, or extra slash.
+    const match = /^(?:https:\/\/sealbridge\.app\/j|sealbridge:\/\/join)#([^\s#?]+)$/.exec(uri);
+    if (!match)
+        throw new Error('INVALID_INVITE_LINK');
+    const fields = new Map();
+    for (const field of match[1].split('&')) {
+        const part = /^(v|k|r)=([^=]+)$/.exec(field);
+        if (!part || fields.has(part[1]))
+            throw new Error('INVALID_INVITE_LINK');
+        fields.set(part[1], part[2]);
+    }
+    if (fields.get('v') !== '1' || !fields.has('k'))
+        throw new Error('INVALID_INVITE_LINK');
+    const k = fields.get('k');
+    decodeBase64url(k, 32);
+    let relayOrigin = DEFAULT_RELAY;
+    if (fields.has('r')) {
+        let host;
+        try {
+            host = decodeURIComponent(fields.get('r'));
+        }
+        catch {
+            throw new Error('INVALID_INVITE_LINK');
+        }
+        // r is a host[:port], including bracketed IPv6, never a URL or a path.
+        if (/\s/.test(host) || !/^[A-Za-z0-9.\[\]:-]+$/.test(host))
+            throw new Error('INVALID_INVITE_LINK');
+        const relay = 'https://' + host;
+        validateRelayEndpointUrl(relay, policy);
+        relayOrigin = normalizeRelayOrigin(relay);
+    }
+    validateRelayEndpointUrl(relayOrigin, policy);
+    if (policy.allowedRelayUrls !== undefined &&
+        !policy.allowedRelayUrls.map(value => normalizeAllowlistUrl(value, policy)).includes(relayOrigin))
+        throw new Error('INVITE_LINK_RELAY_NOT_ALLOWED');
+    return { v: 1, k, relayOrigin };
+}
+//# sourceMappingURL=invite-link.js.map

package/dist/packages/core/dist/invite-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-link.js","sourceRoot":"","sources":["../src/invite-link.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAEjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAC/D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,mBAAmB,GAAG,KAAK;IAC/B,MAAM,EAAE,mBAAmB,GAAG,UAAU;IACxC,SAAS,EAAE,mBAAmB,GAAG,aAAa;CAC/C,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAClD,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9D,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,aAAa,GAAG,8BAA8B,CAAC;AA+BrD,SAAS,eAAe,CAAC,KAAc,EAAE,QAAgB,EAAE,QAAQ,GAAG,QAAQ;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC;QACvE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAC7F,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB,EAAE,MAAc;IACpD,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM;QAC/D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,SAAS,CAAC;QAC5H,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS;QAC5F,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,GAAG,0BAA0B;IAGnF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,sBAAsB;QAC5G,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO;YACL,SAAS,EAAE,eAAe,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/D,cAAc,EAAE,eAAe,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,0BAA0B,CAAC,CAAC,WAAW,EAAE,CAAC;SAClG,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAAC,CAAC;AAC5D,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB;IACnC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAS;IAC5C,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrH,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,EAAE,CAAC;QAChD,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,SAAqB,EAAE,EAAc;IACtE,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3B,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpB,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAAc,EAAE,WAAmB,EAAE,SAAiB;IAClF,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QACrC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,4BAA4B,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,IAAI,GAAG,4BAA4B,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,2BAA2B,CAAC,GAAG,2BAA2B,CAAC,CAAC;IAC/G,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,IAAI,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IAC/D,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,2BAA2B,CAAC,GAAG,2BAA2B,KAAK,KAAK,CAAC,MAAM;QAClG,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxG,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,IAAI,2BAA2B,IAAI,IAAI,IAAI,4BAA4B;QAChF,IAAI,GAAG,2BAA2B,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA2B;IACrD,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1B,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,YAAY,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,GAAG,cAAc,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAA2B;IAClE,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC/C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC/D,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAC/B,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,KAA0B,CAAC;IAC1C,MAAM,OAAO,GAAG;QACd,EAAE,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;QAClC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,2BAA2B,GAAG,cAAc,EACzF,4BAA4B,GAAG,cAAc,CAAC;QAChD,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC;QACjD,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;KAC7C,CAAC;IACF,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,CAAS,EAAE,OAE3D;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,GAAG,IAAI,QAAQ,GAAG,GAAG,GAAG,sBAAsB;QAC1F,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IACpG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAClH,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAA2B,EAAE,CAAS,EAAE,WAAmB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7G,IAAI,CAAC;QACH,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,GAAG,qBAAqB;YAC1F,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9G,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACvE,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,OAAO,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3H,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,MAA2B;IACvE,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,SAAgC,EAAE;IAC7E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,0EAA0E;IAC1E,kFAAkF;IAClF,MAAM,KAAK,GAAG,mEAAmE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxF,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAC3B,eAAe,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvB,IAAI,WAAW,GAAG,aAAa,CAAC;IAChC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAC;QAAC,CAAC;QACpD,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAAC,CAAC;QACjD,uEAAuE;QACvE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC;QAChC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;QACrC,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC"}

package/dist/packages/core/dist/invite-sas.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Link-path verification number. inviteDigest is the existing canonical
+ * `sha256:<64 lowercase hex digits>` string (digest of the verified Invite),
+ * encoded as UTF-8 including the prefix, not decoded hex or a hash of token text.
+ * Read the first four SHA-256 bytes as an unsigned big-endian integer.
+ */
+export declare function inviteLinkVerificationNumber(inviteDigest: string): string;