feat(web): add account workspaces and signed content flows

web/src/core-bridge/worker/channelGrant.ts

@@ -21,17 +21,12 @@ export async function sealChannelGrant(link: string, recipient: string, publicKe
 export async function openChannelGrant(payload: string, recipient: string, channelId: string, privateKey: JsonWebKey,
   role: 'owner' | 'member', origin: string): Promise<ParsedChannelLink> {
   const plain = await decryptInvitation(payload, recipient, channelId, privateKey);
-  let parsed: ReturnType<typeof parseChannelLink>;
-  if (plain.startsWith('{')) {
-    const grant = JSON.parse(plain) as ChannelGrant;
-    if (grant.v !== 1 || grant.channelId !== channelId || grant.role !== role || !['enc', 'raw'].includes(grant.mode)
-        || !grant.keys || typeof grant.keys !== 'object') throw new Error('空间授权包校验失败');
-    parsed = parseChannelLink(makeLink(origin, channelId, grant.keys));
-    if (!parsed.ok || parsed.link.mode !== grant.mode) throw new Error('空间授权包模式不匹配');
-  } else {
-    // Existing invitations hold an encrypted link; their secret never becomes a navigation URL.
-    parsed = parseChannelLink(plain);
-  }
+  let grant: ChannelGrant;
+  try { grant = JSON.parse(plain) as ChannelGrant; } catch { throw new Error('空间授权包格式无效'); }
+  if (!grant || grant.v !== 1 || grant.channelId !== channelId || grant.role !== role || !['enc', 'raw'].includes(grant.mode)
+      || !grant.keys || typeof grant.keys !== 'object') throw new Error('空间授权包校验失败');
+  const parsed = parseChannelLink(makeLink(origin, channelId, grant.keys));
+  if (!parsed.ok || parsed.link.mode !== grant.mode) throw new Error('空间授权包模式不匹配');
   if (!parsed.ok || parsed.link.id !== channelId || parsed.link.isOwner !== (role === 'owner')) throw new Error('空间授权包权限不匹配');
   return parsed.link;
 }