diff --git a/www/common/common-ui-elements.js b/www/common/common-ui-elements.js
index c67181574..27fd67dca 100644
--- a/www/common/common-ui-elements.js
+++ b/www/common/common-ui-elements.js
@@ -1650,7 +1650,7 @@ define([
                     placeholder: 'password...' // XXX
                 }),
                 h('br'),
-                linkMessage = h('textarea', {
+                linkMessage = h('textarea', { // XXX ansuz hitting enter submits...
                     placeholder: 'note...' // XXX
                 })
             ]),
diff --git a/www/common/invitation.js b/www/common/invitation.js
index 4126d30f3..0bad771de 100644
--- a/www/common/invitation.js
+++ b/www/common/invitation.js
@@ -1,5 +1,5 @@
 (function () {
-var factory = function (/* Util, Cred, nThen */) {
+var factory = function (Hash, Nacl/*, Util, Cred, nThen */) {
     var Invite = {};
 
     /* XXX ansuz
@@ -20,12 +20,13 @@ var factory = function (/* Util, Cred, nThen */) {
     Invite.deriveSeeds = function (key) {
         var seeds = {};
 
-        var scrypt_seed;
-        var preview_secrets;
+/*
         var preview_channel;
         var preview_cryptKey;
+*/
+        var preview_secrets;
         (function () {
-            var b64_seed = hashData.key;
+            var b64_seed = key;
             if (typeof(b64_seed) !== 'string') {
                 return console.error('invite seed is not a string');
             }
@@ -46,28 +47,32 @@ var factory = function (/* Util, Cred, nThen */) {
     // seed => bytes64
     Invite.deriveBytes = function (scrypt_seed, cb) {
         // XXX do scrypt stuff...
-
+        cb = cb;
     };
 
     Invite.derivePreviewHash = function (preview_seed) {
-
+        preview_seed = preview_seed;
     };
 
     return Invite;
 };
     if (typeof(module) !== 'undefined' && module.exports) {
         module.exports = factory(
+            require("../common-hash"),
+            require("tweetnacl/nacl-fast"),
             require("../common-util"),
             require("../common-credential.js"),
             require("nthen")
         );
     } else if ((typeof(define) !== 'undefined' && define !== null) && (define.amd !== null)) {
         define([
+            '/common/common-hash.js',
             '/common/common-util.js',
             '/common/common-credential.js',
             '/bower_components/nthen/index.js',
-        ], function (Util, Cred, nThen) {
-            return factory(Util, nThen);
+            '/bower_components/tweetnacl/nacl-fast.min.js',
+        ], function (Hash, Util, Cred, nThen) {
+            return factory(Hash, window.nacl, Util, Cred, nThen);
         });
     }
 }());
diff --git a/www/common/outer/invitation.js b/www/common/outer/invitation.js
index c6199bf4c..baf44e677 100644
--- a/www/common/outer/invitation.js
+++ b/www/common/outer/invitation.js
@@ -3,23 +3,50 @@ var factory = function (Util, Cred, nThen) {
     nThen = nThen; // XXX
     var Invite = {};
 
-/* 
-    TODO key derivation
-
-    scrypt(seed, passwd) => {
-        curve: {
-            private,
-            public,
-        },
-        ed: {
-            private,
-            public,
-        }
-        cryptKey,
-        channel
-    }
+/*  INPUTS
+
+    * password (for scrypt)
+    * message (personal note)
+    * link hash
+    * bytes64 (scrypt output)
+    * preview_hash
+
+*/
+
+
+/*  DERIVATIONS
+
+    * components corresponding to www/common/invitation.js
+    * preview_hash => components
+      * channel
+      * cryptKey
+    * b64_bytes
+      * curvePrivate => curvePublic
+      * edSeed => edPrivate => edPublic
+
 */
 
+
+/*  IO / FUNCTIONALITY
+
+    * creator
+      * generate a random signKey (prevent writes to preview channel)
+      * encrypt and upload the preview content
+        * via CryptGet
+        * owned by:
+          * the ephemeral edPublic
+          * the invite creator
+      * create a roster entry for the invitation
+        * with encrypted notes for the creator
+    * redeemer
+      * get the preview content
+      * redeem the invite
+        * add yourself to the roster
+        * add the team to your proxy-manager
+
+*/
+
+
     var BYTES_REQUIRED = 256;
 
     Invite.deriveKeys = function (seed, passwd, cb) {
diff --git a/www/common/outer/team.js b/www/common/outer/team.js
index 884c92598..8217f030e 100644
--- a/www/common/outer/team.js
+++ b/www/common/outer/team.js
@@ -10,6 +10,7 @@ define([
     '/common/outer/roster.js',
     '/common/common-messaging.js',
     '/common/common-feedback.js',
+    '/common/outer/invitation.js',
 
     '/bower_components/chainpad-listmap/chainpad-listmap.js',
     '/bower_components/chainpad-crypto/crypto.js',
@@ -19,7 +20,7 @@ define([
     '/bower_components/saferphore/index.js',
     '/bower_components/tweetnacl/nacl-fast.min.js',
 ], function (Util, Hash, Constants, Realtime,
-             ProxyManager, UserObject, SF, Roster, Messaging, Feedback,
+             ProxyManager, UserObject, SF, Roster, Messaging, Feedback, Invite,
              Listmap, Crypto, CpNetflux, ChainPad, nThen, Saferphore) {
     var Team = {};
 
@@ -1259,7 +1260,9 @@ define([
         ctx.store.messenger.openTeamChat(team.getChatData(), onUpdate, cId, cb);
     };
 
+    // XXX ansuz
     var createInviteLink = function (ctx, data, cId, cb) {
+        Invite = Invite;
         var team = ctx.teams[data.teamId];
         team = team;
         /*
@@ -1277,6 +1280,7 @@ define([
         });
         */
     };
+    // XXX ansuz
     var getLinkData = function (ctx, data, cId, cb) {
         /*
         var password = data.password;