Sharing

// Resolve the recipient first. This returns the recipient's hybrid public-key
// bundle: x25519PublicKey (classical) + mlKemPublicKey (post-quantum), plus
// the algo strings advertised on their at.opake.publicKey/self record.
const recipient = await opake.resolveIdentity("bob.bsky.social");

// Direct share. Writes an at.opake.grant record on YOUR PDS that wraps
// the document's content key to BOTH halves of the recipient's hybrid
// bundle. The grant lives under your repo; the recipient discovers it
// via the indexer.
const fm = await opake.cabinet();
await fm.share(
  documentUri,
  recipient.did,
  recipient.x25519PublicKey,
  recipient.mlKemPublicKey,
  "read",
  "For your review — draft v2",
);

import { OpakeError } from "@opake/sdk";

try {
  const recipient = await opake.resolveIdentity(handleOrDid);
  await fm.share(
    documentUri,
    recipient.did,
    recipient.x25519PublicKey,
    recipient.mlKemPublicKey,
    "read",
  );
} catch (err) {
  if (err instanceof OpakeError && err.kind === "RecipientNotReady") {
    // The target has a valid atproto identity but hasn't published an
    // Opake public key yet (hasn't used Opake). Queue a pending share;
    // the daemon will retry until they sign up or it expires (7 days).
    await fm.createPendingShare(documentUri, handleOrDid, "read", null);
    return;
  }
  throw err;
}

const grants = await fm.listShares();
for (const g of grants) {
  // g: { uri, document, recipient, createdAt }
  console.log(`Shared ${g.document} with ${g.recipient}`);
}

// Grants don't carry the document filename directly; metadata stays
// encrypted on the wire. If you need names, do a separate
// getDocumentMetadata lookup per document URI.

await fm.revokeShare(grantUri);
// The grant record is deleted from your PDS. The indexer removes it
// from its index on the next firehose event; the recipient's
// watchInbox fires with the updated (shorter) list.
//
// Caveat: revocation is forward-only. If the recipient already
// decrypted and saved the key, you can't take that back. If the
// document needs to be unreadable to the ex-recipient going forward,
// delete-and-reupload instead of revoke.

const grants = await opake.listInbox();
for (const g of grants) {
  // g: { uri, ownerDid, documentUri, createdAt }
  // ownerDid is the DID of whoever shared with you.
  console.log(`Shared with you: ${g.documentUri} from ${g.authorDid}`);
}

const watcher = opake.watchInbox((snapshot) => {
  // snapshot.loaded is false while the keeper is bootstrapping. Once
  // the initial listInbox completes, it flips to true and fires again
  // with the current entries.
  renderInbox(snapshot.entries, snapshot.loaded);
});

// Stop listening when you're done.
watcher.close();

// Peek at the metadata (filename, MIME type, size, etc.) without
// downloading the blob. Useful for rendering a "shared with me" list.
const { filename, metadata } = await opake.resolveGrantMetadata(grantUri);

// Download and decrypt in full.
const { filename: f, data } = await opake.downloadFromGrant(grantUri);
saveAsFile(f, new Blob([data]));

// List queued shares that haven't landed as grants yet.
const pending = await opake.listPendingShares();
for (const p of pending) {
  // p: { uri, document, recipient, createdAt }
  console.log(`Pending: ${p.document} → ${p.recipient}`);
}

// Manually kick the retry loop. The daemon runs this on a schedule too.
const outcome = await opake.retryPendingShares();
// { checked, completed, expired, still_pending, failed }

// Cancel a specific pending share.
await opake.cancelPendingShare(pendingShareUri);