Design doc for a second, narrower credential type alongside
UPLOAD_PASSWORD — time-boxed, use-limited, revocable invite links that
skip the password gate entirely. Self-contained for a fresh agent to
implement: covers the data model, the atomic single-use consumption
race, why invite tokens belong in a query param (not the URL fragment,
unlike the download decryption key), and points at npm-statuspage's
just-built admin-panel pattern as the template for the admin gate.
Not implemented — design stage.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
