nx_invite_token.nx

nx_invite_token.nx -- SECRET single-use, expiring, realm+level-scoped INVITE TOKEN store. Purpose: let a remote party (e.g. a law firm) self-register their OWN credential on an admin.<domain> portal WITHOUT a guessable handle being the only gate -- they present a secret single-use invite token that an owner minted out-of-band. The token is the bearer secret; the server stores ONLY sha256(token) so a stolen store cannot reconstruct any live token (rule: secrets never at rest in the clear). Storage doctrine (ADDITIVE-ONLY, per global rule 13), modeled on hub/nx_user_account_store.nx (nx_uas_append): append-only text log, one row per line, a single sys_write of < 512 bytes => atomic on the substrate (O_APPEND). LATEST row for a token-hash WINS. Single-use = consume appends a superseding "consumed" row; history is never deleted. THE TOKEN: inv_issue mints 32 CSPRNG bytes -> 64 lowercase-hex chars (out_token_hex) = the bearer secret returned to the caller. The STORED identity is sha256(out_token_hex) hex-encoded. inv_check/inv_consume re-hash the presented hex token the SAME way (sha256 of the 64-hex bytes), so issue and check agree by construction. (Hashing the printable hex token -- not re-decoding to raw -- keeps the wire contract one opaque string and avoids a decode step on the hot path.) Row formats (space-delimited, '\n'-terminated; realm is a space/newline-free realm id): issued: INV issued <hash:64hex> <realm> <level:dec> <expiry:hex16>\n consumed: INV consumed <hash:64hex> <ts:hex16>\n COMPOSES: nx_syscalls (openat_append/read_file/fsync/write), nx_csprng (nx_csprng_fill), nx_sha256 (sha256_digest -- the canonical substrate SHA-256 one-shot). COMPOSED BY: _hdl_build/nx_docportal_admin_daemon (POST /admin/register invite gate). license_tier: ORIGINAL