Temporary approach: --grant flag on download command. Recipient passes the grant URI explicitly. Flow: fetch grant from owner PDS (public) → extract wrapped key + document URI → fetch document record (public) → fetch blob (public) → unwrap key → decrypt. Will be replaced by auto-discovery when inbox command exists. Needs: get_blob_public in client/did.rs, download_shared in documents/download.rs, --grant flag in CLI.
Temporary approach: --grant flag on download command. Recipient passes the grant URI explicitly. Flow: fetch grant from owner PDS (public) → extract wrapped key + document URI → fetch document record (public) → fetch blob (public) → unwrap key → decrypt. Will be replaced by auto-discovery when inbox command exists. Needs: get_blob_public in client/did.rs, download_shared in documents/download.rs, --grant flag in CLI.