@synonymdev/pubky 0.14.0 → 0.15.0

package/index.cjs

@@ -65,30 +65,18 @@ async function withSessionStore(mode, operation) {
       const tx = db.transaction(PUBKY_SESSIONS_STORE_NAME, mode);
       const store = tx.objectStore(PUBKY_SESSIONS_STORE_NAME);
       let result;
-      let settled = false;
-
-      function fail(error) {
-        if (settled) return;
-        settled = true;
-        reject(error);
-      }
-
       try {
         const request = operation(store);
         request.onsuccess = () => {
           result = request.result;
         };
-        request.onerror = () => fail(request.error ?? new Error("Pubky session store request failed."));
+        request.onerror = () => reject(request.error ?? new Error("Pubky session store request failed."));
       } catch (error) {
-        fail(error);
+        reject(error);
       }
-      tx.onerror = () => fail(tx.error ?? new Error("Pubky session store transaction failed."));
-      tx.onabort = () => fail(tx.error ?? new Error("Pubky session store transaction aborted."));
-      tx.oncomplete = () => {
-        if (settled) return;
-        settled = true;
-        resolve(result);
-      };
+      tx.onerror = () => reject(tx.error ?? new Error("Pubky session store transaction failed."));
+      tx.onabort = () => reject(tx.error ?? new Error("Pubky session store transaction aborted."));
+      tx.oncomplete = () => resolve(result);
     });
   } finally {
     db.close();
@@ -99,6 +87,7 @@ async function withSessionStore(mode, operation) {
 async function __pubkySessionStoreIsAvailable() {
   if (!globalThis.indexedDB) return false;
   try {
+    if (!globalThis.navigator?.locks) return false;
     const db = await openSessionStoreDb();
     db.close();
     return true;
@@ -108,10 +97,15 @@ async function __pubkySessionStoreIsAvailable() {
 }
 
 /** Persist or replace a browser session record. */
-async function __pubkySessionStorePut(record) {
+async function __pubkySessionStorePut(record, lease) {
   requireIndexedDb();
   try {
-    await withSessionStore("readwrite", (store) => store.put(record));
+    const previous = await __pubkySessionStoreGet(record.id);
+    if (previous?.sharedSession) record.sharedSession = previous.sharedSession;
+    await withSessionStore("readwrite", (store) => {
+      requireSessionLease(lease, true);
+      return store.put(record);
+    });
   } catch (error) {
     throw contextualSessionStoreError("Saving Pubky session failed.", error);
   }
@@ -137,65 +131,130 @@ async function __pubkySessionStoreList() {
   }
 }
 
-/** Remove one browser session record by id. */
-async function __pubkySessionStoreDelete(id) {
-  requireIndexedDb();
-  try {
-    await withSessionStore("readwrite", (store) => store.delete(id));
-  } catch (error) {
-    throw contextualSessionStoreError("Removing Pubky session failed.", error);
-  }
-}
-
-/**
- * Clear saved session records and the delegated keys referenced by those records.
- *
- * Delegated keys not referenced by the supplied ids are intentionally preserved,
- * because they may belong to pending or unsaved grant flows.
- */
-async function __pubkySessionStoreClear(delegatedKeyIds) {
+/** Clear saved sessions and their keys, or every key when clearing all auth state. */
+async function clearSessionStore(allKeys = false) {
   requireIndexedDb();
   const db = await openSessionStoreDb();
   try {
     await new Promise((resolve, reject) => {
       const tx = db.transaction(
-        [PUBKY_SESSIONS_STORE_NAME, PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME],
-        "readwrite",
+        [PUBKY_SESSIONS_STORE_NAME, PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME], "readwrite",
       );
       const sessions = tx.objectStore(PUBKY_SESSIONS_STORE_NAME);
       const keys = tx.objectStore(PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME);
-      sessions.clear();
-      for (const keyId of new Set(delegatedKeyIds ?? [])) {
-        keys.delete(keyId);
-      }
-      tx.oncomplete = () => resolve();
-      tx.onerror = () => reject(tx.error ?? new Error("Clearing Pubky session store failed."));
-      tx.onabort = () => reject(tx.error ?? new Error("Clearing Pubky session store aborted."));
+      const records = sessions.getAll();
+      records.onsuccess = () => {
+        try {
+          if (allKeys) keys.clear();
+          else for (const record of records.result) {
+            if (record.storageMode === "delegated") keys.delete(JSON.parse(record.credential).keyId);
+          }
+          sessions.clear();
+        } catch (error) { tx.abort(); reject(error); }
+      };
+      tx.oncomplete = resolve;
+      tx.onerror = tx.onabort = () => reject(tx.error ?? new Error("Clearing browser sessions failed."));
     });
-  } finally {
-    db.close();
+  } finally { db.close(); }
+}
+
+const SESSION_STORE_LOCK = "pubky-session-store";
+const sessionLeases = new Map();
+let nextSessionLease = 0;
+const sessionChannel = typeof indexedDB !== "undefined" && typeof BroadcastChannel === "function"
+  ? new BroadcastChannel("pubky-session-store") : null;
+function notifySessionChange(detail) {
+  if (typeof globalThis.dispatchEvent === "function") {
+    globalThis.dispatchEvent(new CustomEvent("pubky-session-changed", { detail }));
   }
 }
+if (sessionChannel) sessionChannel.onmessage = event => notifySessionChange(event.data);
+function sessionChanged(id, action) {
+  const detail = { id, action };
+  notifySessionChange(detail);
+  sessionChannel?.postMessage(detail);
+}
 
-/** Clear all browser auth records, including all delegated key handles. */
-async function __pubkySessionStoreClearAll() {
-  requireIndexedDb();
+function __pubkySessionAcquire(id, homeserver, exclusive) {
+  if (!globalThis.navigator?.locks) throw new Error("Browser sessions require Web Locks in a secure context.");
+  const token = ++nextSessionLease;
+  const abort = new AbortController();
+  let release, ready, failed;
+  const held = new Promise(resolve => { release = resolve; });
+  const waiting = new Promise((resolve, reject) => { ready = resolve; failed = reject; });
+  // Cancellation can drop the Rust future before it starts awaiting this promise.
+  waiting.catch(() => {});
+  const lease = { id, homeserver, exclusive, abort, release, waiting, active: false };
+  sessionLeases.set(token, lease);
+  navigator.locks.request(SESSION_STORE_LOCK, { mode: "shared", signal: abort.signal }, () =>
+    navigator.locks.request(`pubky-shared-session:${homeserver}:${id}`, {
+      mode: exclusive ? "exclusive" : "shared", signal: abort.signal,
+    }, async () => {
+      lease.active = true;
+      ready();
+      await held;
+    })
+  ).catch(failed);
+  return token;
+}
+function __pubkySessionWait(token) {
+  return sessionLeases.get(token).waiting;
+}
+function __pubkySessionRelease(token) {
+  const lease = sessionLeases.get(token);
+  if (!lease) return;
+  lease.active = false;
+  lease.abort.abort();
+  lease.release();
+  sessionLeases.delete(token);
+}
+function requireSessionLease(token, write = false) {
+  const lease = sessionLeases.get(token);
+  if (!lease?.active || (write && !lease.exclusive)) throw new Error("Browser session lock was released.");
+  return lease;
+}
+async function __pubkySharedSessionLoad(token) {
+  const lease = requireSessionLease(token);
+  const record = await __pubkySessionStoreGet(lease.id);
+  if (record && record.homeserver !== lease.homeserver) throw new Error("Stored session homeserver changed.");
+  return record?.sharedSession;
+}
+async function __pubkySharedSessionStore(token, sharedSession) {
+  const lease = requireSessionLease(token, true);
+  const record = await __pubkySessionStoreGet(lease.id);
+  if (!record || record.homeserver !== lease.homeserver) throw new Error("Browser session was removed or changed.");
+  await withSessionStore("readwrite", store => {
+    requireSessionLease(token, true);
+    return store.put({ ...record, sharedSession });
+  });
+}
+async function __pubkySharedSessionRemove(token) {
+  const lease = requireSessionLease(token, true);
+  const record = await __pubkySessionStoreGet(lease.id);
+  if (!record) return;
   const db = await openSessionStoreDb();
   try {
+    requireSessionLease(token, true);
     await new Promise((resolve, reject) => {
-      const tx = db.transaction(
-        [PUBKY_SESSIONS_STORE_NAME, PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME],
-        "readwrite",
-      );
-      tx.objectStore(PUBKY_SESSIONS_STORE_NAME).clear();
-      tx.objectStore(PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME).clear();
-      tx.oncomplete = () => resolve();
-      tx.onerror = () => reject(tx.error ?? new Error("Clearing Pubky auth store failed."));
-      tx.onabort = () => reject(tx.error ?? new Error("Clearing Pubky auth store aborted."));
+      const tx = db.transaction([PUBKY_SESSIONS_STORE_NAME, PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME], "readwrite");
+      tx.objectStore(PUBKY_SESSIONS_STORE_NAME).delete(lease.id);
+      if (record.storageMode === "delegated") {
+        const { keyId } = JSON.parse(record.credential);
+        tx.objectStore(PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME).delete(keyId);
+      }
+      tx.oncomplete = resolve;
+      tx.onerror = tx.onabort = () => reject(tx.error ?? new Error("Removing browser session failed."));
     });
-  } finally {
-    db.close();
-  }
+  } finally { db.close(); }
+  sessionChanged(lease.id, "removed");
+}
+async function __pubkySessionStoreClear() {
+  await navigator.locks.request(SESSION_STORE_LOCK, () => clearSessionStore());
+  sessionChanged(null, "cleared");
+}
+async function __pubkySessionStoreClearAll() {
+  await navigator.locks.request(SESSION_STORE_LOCK, () => clearSessionStore(true));
+  sessionChanged(null, "cleared");
 }
 
 const PUBKY_GRANT_KEYS_DB_NAME = "pubky-auth";
@@ -452,16 +511,6 @@ async function __pubkyGrantDelegatedSign(keyId, signingInput) {
   return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, existing.privateKey, data));
 }
 
-/**
- * Delete a browser-held delegated grant key by id.
- *
- * Used when a persisted delegated session record is removed from the SDK
- * session store. Missing keys are treated as already deleted.
- */
-async function __pubkyGrantDeleteDelegatedKey(keyId) {
-  requireBrowserCrypto();
-  await deleteRecord(keyId);
-}
 
 /**
  * Start and control a pubkyauth authorization flow.
@@ -873,7 +922,7 @@ class BrowserSessionStore {
      * This removes all stored session records and all browser-held delegated
      * grant keys, including keys for pending delegated grant flows. Saved
      * delegated flow state becomes unrestorable. This does not revoke remote
-     * grants or immediately invalidate already-live in-memory sessions.
+     * grants. Browser-managed handles stop working when their saved record is removed.
      * @returns {Promise<void>}
      */
     clearAll() {
@@ -892,7 +941,7 @@ class BrowserSessionStore {
         return ret;
     }
     /**
-     * Whether IndexedDB is available for durable session persistence.
+     * Whether IndexedDB and Web Locks are available.
      * @returns {Promise<boolean>}
      */
     isAvailable() {
@@ -920,6 +969,9 @@ class BrowserSessionStore {
     }
     /**
      * Restore a specific stored session by id.
+     *
+     * Shares one bearer with other tabs on this origin. Requires IndexedDB and
+     * Web Locks in a secure browser context.
      * @param {string} id
      * @returns {Promise<Session>}
      */
@@ -3560,7 +3612,8 @@ exports.SessionInfo = SessionInfo;
  * Only {@link SessionStorage.exists} and {@link SessionStorage.stats} treat
  * HTTP 404/410 as missing. Other HTTP failures, including 401/403 and 5xx, reject.
  * Writes require write permission and can fail on directory targets (400),
- * file/directory path conflicts (409), or exceeded quotas (507).
+ * file/directory path conflicts (409), a path someone holds a
+ * {@link StorageLock} on (423), or exceeded quotas (507).
  */
 class SessionStorage {
     static __wrap(ptr) {
@@ -3579,6 +3632,22 @@ class SessionStorage {
         const ptr = this.__destroy_into_raw();
         wasm.__wbg_sessionstorage_free(ptr, 0);
     }
+    /**
+     * `DELETE` the path of a lock this client holds. The lock stays in place.
+     *
+     * @param {StorageLock} lock A lock this client holds.
+     * @returns {Promise<void>}
+     * @throws {PubkyError} A lock that has expired or was unlocked rejects with
+     * `RequestError` and status `412`; take a new one.
+     * Otherwise as {@link SessionStorage.delete}.
+     * @param {StorageLock} lock
+     * @returns {Promise<void>}
+     */
+    deleteLocked(lock) {
+        _assertClass(lock, StorageLock);
+        const ret = wasm.sessionstorage_deleteLocked(this.__wbg_ptr, lock.__wbg_ptr);
+        return ret;
+    }
     /**
      * Delete a file. Directory targets are unsupported.
      *
@@ -3700,6 +3769,52 @@ class SessionStorage {
         const ret = wasm.sessionstorage_list(this.__wbg_ptr, ptr0, len0, ptr1, len1, isLikeNone(reverse) ? 0xFFFFFF : reverse ? 1 : 0, isLikeNone(limit) ? 0xFFFFFF : limit, isLikeNone(shallow) ? 0xFFFFFF : shallow ? 1 : 0);
         return ret;
     }
+    /**
+     * Take an exclusive write lock on a file at an **absolute session path**.
+     *
+     * The file need not exist; locking a free path reserves it. `timeoutSeconds` is
+     * the lifetime asked for; the homeserver caps it, and
+     * {@link StorageLock.timeoutSeconds} tells what was granted. A write made under
+     * the lock keeps it alive until the write ends, so it need not cover the upload itself.
+     *
+     * @param {Path} path File path; must not end with `/`.
+     * @param {number} timeoutSeconds Lifetime to ask for, in seconds; rounded down to
+     * whole seconds, and at least 1.
+     * @returns {Promise<StorageLock>} The granted lock.
+     * @throws {PubkyError} `InvalidInput` for a negative, NaN or out-of-range timeout;
+     * a path that is already locked rejects with `RequestError` and status `423`;
+     * directory targets with `400`; a homeserver without lock support with `405`.
+     * See {@link SessionStorage} for shared errors.
+     * @param {Path} path
+     * @param {number} timeout_seconds
+     * @returns {Promise<StorageLock>}
+     */
+    lock(path, timeout_seconds) {
+        const ptr0 = passStringToWasm0(path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.sessionstorage_lock(this.__wbg_ptr, ptr0, len0, timeout_seconds);
+        return ret;
+    }
+    /**
+     * `PUT` binary data to the path of a lock this client holds.
+     *
+     * @param {StorageLock} lock A lock this client holds.
+     * @param {Uint8Array} body
+     * @returns {Promise<void>}
+     * @throws {PubkyError} A lock that has expired or was unlocked rejects with
+     * `RequestError` and status `412`; take a new one and read the file again.
+     * Otherwise as {@link SessionStorage.putBytes}.
+     * @param {StorageLock} lock
+     * @param {Uint8Array} body
+     * @returns {Promise<void>}
+     */
+    putBytesLocked(lock, body) {
+        _assertClass(lock, StorageLock);
+        const ptr0 = passArray8ToWasm0(body, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.sessionstorage_putBytesLocked(this.__wbg_ptr, lock.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
     /**
      * Create or replace a file with binary data at an absolute session path.
      *
@@ -3737,6 +3852,26 @@ class SessionStorage {
         const ret = wasm.sessionstorage_putJson(this.__wbg_ptr, ptr0, len0, body);
         return ret;
     }
+    /**
+     * `PUT` text to the path of a lock this client holds.
+     *
+     * @param {StorageLock} lock A lock this client holds.
+     * @param {string} body
+     * @returns {Promise<void>}
+     * @throws {PubkyError} A lock that has expired or was unlocked rejects with
+     * `RequestError` and status `412`; take a new one and read the file again.
+     * Otherwise as {@link SessionStorage.putText}.
+     * @param {StorageLock} lock
+     * @param {string} body
+     * @returns {Promise<void>}
+     */
+    putTextLocked(lock, body) {
+        _assertClass(lock, StorageLock);
+        const ptr0 = passStringToWasm0(body, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.sessionstorage_putTextLocked(this.__wbg_ptr, lock.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
     /**
      * Create or replace a file with text at an absolute session path.
      *
@@ -3756,6 +3891,29 @@ class SessionStorage {
         const ret = wasm.sessionstorage_putText(this.__wbg_ptr, ptr0, len0, ptr1, len1);
         return ret;
     }
+    /**
+     * Restart the lifetime of a lock this client holds.
+     *
+     * On success the lock carries the newly granted
+     * {@link StorageLock.timeoutSeconds}.
+     *
+     * @param {StorageLock} lock A lock this client holds.
+     * @param {number} timeoutSeconds Lifetime to ask for, in seconds; rounded down to
+     * whole seconds, and at least 1.
+     * @returns {Promise<void>}
+     * @throws {PubkyError} A lock that has expired or was unlocked rejects with
+     * `RequestError` and status `412`; take a new one and read the file again.
+     * `InvalidInput` for a negative, NaN or out-of-range timeout.
+     * See {@link SessionStorage} for shared errors.
+     * @param {StorageLock} lock
+     * @param {number} timeout_seconds
+     * @returns {Promise<void>}
+     */
+    refreshLock(lock, timeout_seconds) {
+        _assertClass(lock, StorageLock);
+        const ret = wasm.sessionstorage_refreshLock(this.__wbg_ptr, lock.__wbg_ptr, timeout_seconds);
+        return ret;
+    }
     /**
      * Get metadata for an absolute, session-scoped path (e.g. `"/pub/app/file.json"`).
      *
@@ -3773,6 +3931,21 @@ class SessionStorage {
         const ret = wasm.sessionstorage_stats(this.__wbg_ptr, ptr0, len0);
         return ret;
     }
+    /**
+     * Release a lock this client holds.
+     *
+     * @param {StorageLock} lock A lock this client holds.
+     * @returns {Promise<void>}
+     * @throws {PubkyError} A lock that no longer exists rejects with `RequestError`
+     * and status `409`. See {@link SessionStorage} for shared errors.
+     * @param {StorageLock} lock
+     * @returns {Promise<void>}
+     */
+    unlock(lock) {
+        _assertClass(lock, StorageLock);
+        const ret = wasm.sessionstorage_unlock(this.__wbg_ptr, lock.__wbg_ptr);
+        return ret;
+    }
 }
 if (Symbol.dispose) SessionStorage.prototype[Symbol.dispose] = SessionStorage.prototype.free;
 exports.SessionStorage = SessionStorage;
@@ -4501,6 +4674,107 @@ class SignupGrantDeepLink {
 if (Symbol.dispose) SignupGrantDeepLink.prototype[Symbol.dispose] = SignupGrantDeepLink.prototype.free;
 exports.SignupGrantDeepLink = SignupGrantDeepLink;
 
+/**
+ * An exclusive write lock on one file path, granted by the homeserver.
+ *
+ * While the lock lives, only writes that present it are accepted on the path;
+ * every other write, and every other {@link SessionStorage.lock}, rejects with
+ * `423 Locked`. The lock ends when it is {@link SessionStorage.unlock | unlocked}
+ * or when its {@link StorageLock.timeoutSeconds} runs out without a
+ * {@link SessionStorage.refreshLock | refresh}, so a client that disappears never
+ * blocks a path for long.
+ *
+ * The lock is a bearer token: whoever holds this value, and may write the path,
+ * can use and release the lock.
+ *
+ * Calls that take the lock may overlap: a {@link SessionStorage.refreshLock | refresh}
+ * can run while a locked write is in flight.
+ *
+ * @example
+ * const lock = await session.storage.lock("/pub/my.app/state.json", 30);
+ * const state = await session.storage.getText(lock.path);
+ * await session.storage.putTextLocked(lock, state);
+ * await session.storage.unlock(lock);
+ */
+class StorageLock {
+    static __wrap(ptr) {
+        const obj = Object.create(StorageLock.prototype);
+        obj.__wbg_ptr = ptr;
+        StorageLockFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        StorageLockFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_storagelock_free(ptr, 0);
+    }
+    /**
+     * Value of the `If` header that presents this lock on a write.
+     * @returns {string}
+     */
+    ifHeader() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.storagelock_ifHeader(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * The locked path.
+     * @returns {Path}
+     */
+    get path() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.storagelock_path(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Lifetime the homeserver granted at the last `lock` or `refreshLock`, in seconds,
+     * counted from when that call resolved. It may be shorter than what was asked for.
+     * It is not the time remaining: note when the call resolved to know when to refresh.
+     * @returns {number}
+     */
+    get timeoutSeconds() {
+        const ret = wasm.storagelock_timeoutSeconds(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * The lock token URL, `opaquelocktoken:<uuid>`.
+     * @returns {string}
+     */
+    get token() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.storagelock_token(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+}
+if (Symbol.dispose) StorageLock.prototype[Symbol.dispose] = StorageLock.prototype.free;
+exports.StorageLock = StorageLock;
+
 /**
  * Metadata for a session saved in the browser session store.
  */
@@ -4747,14 +5021,18 @@ const import1 = {
   __pubkyGrantEnsureDelegatedKey,
   __pubkyGrantLoadDelegatedPublicKey,
   __pubkyGrantDelegatedSign,
-  __pubkyGrantDeleteDelegatedKey,
 };
 const import2 = {
   __pubkySessionStoreIsAvailable,
   __pubkySessionStorePut,
   __pubkySessionStoreGet,
   __pubkySessionStoreList,
-  __pubkySessionStoreDelete,
+  __pubkySessionAcquire,
+  __pubkySessionWait,
+  __pubkySessionRelease,
+  __pubkySharedSessionLoad,
+  __pubkySharedSessionStore,
+  __pubkySharedSessionRemove,
   __pubkySessionStoreClear,
   __pubkySessionStoreClearAll,
 };
@@ -4763,7 +5041,12 @@ const import3 = {
   __pubkySessionStorePut,
   __pubkySessionStoreGet,
   __pubkySessionStoreList,
-  __pubkySessionStoreDelete,
+  __pubkySessionAcquire,
+  __pubkySessionWait,
+  __pubkySessionRelease,
+  __pubkySharedSessionLoad,
+  __pubkySharedSessionStore,
+  __pubkySharedSessionRemove,
   __pubkySessionStoreClear,
   __pubkySessionStoreClearAll,
 };
@@ -4772,7 +5055,12 @@ const import4 = {
   __pubkySessionStorePut,
   __pubkySessionStoreGet,
   __pubkySessionStoreList,
-  __pubkySessionStoreDelete,
+  __pubkySessionAcquire,
+  __pubkySessionWait,
+  __pubkySessionRelease,
+  __pubkySharedSessionLoad,
+  __pubkySharedSessionStore,
+  __pubkySharedSessionRemove,
   __pubkySessionStoreClear,
   __pubkySessionStoreClearAll,
 };
@@ -4781,26 +5069,21 @@ const import5 = {
   __pubkySessionStorePut,
   __pubkySessionStoreGet,
   __pubkySessionStoreList,
-  __pubkySessionStoreDelete,
+  __pubkySessionAcquire,
+  __pubkySessionWait,
+  __pubkySessionRelease,
+  __pubkySharedSessionLoad,
+  __pubkySharedSessionStore,
+  __pubkySharedSessionRemove,
   __pubkySessionStoreClear,
   __pubkySessionStoreClearAll,
 };
 const import6 = {
-  __pubkySessionStoreIsAvailable,
-  __pubkySessionStorePut,
-  __pubkySessionStoreGet,
-  __pubkySessionStoreList,
-  __pubkySessionStoreDelete,
-  __pubkySessionStoreClear,
-  __pubkySessionStoreClearAll,
-};
-const import7 = {
   __pubkyGrantIsDelegationAvailable,
   __pubkyGrantCanUseDelegation,
   __pubkyGrantEnsureDelegatedKey,
   __pubkyGrantLoadDelegatedPublicKey,
   __pubkyGrantDelegatedSign,
-  __pubkyGrantDeleteDelegatedKey,
 };
 
 function __wbg_get_imports() {
@@ -4821,7 +5104,7 @@ function __wbg_get_imports() {
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
-        __wbg___pubkyGrantDelegatedSign_75d50e1487a4c01e: function(arg0, arg1, arg2, arg3) {
+        __wbg___pubkyGrantDelegatedSign_3145fede89a925f4: function(arg0, arg1, arg2, arg3) {
             let deferred0_0;
             let deferred0_1;
             let deferred1_0;
@@ -4838,19 +5121,7 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
             }
         },
-        __wbg___pubkyGrantDeleteDelegatedKey_8c61ee224046056d: function(arg0, arg1) {
-            let deferred0_0;
-            let deferred0_1;
-            try {
-                deferred0_0 = arg0;
-                deferred0_1 = arg1;
-                const ret = __pubkyGrantDeleteDelegatedKey(getStringFromWasm0(arg0, arg1));
-                return ret;
-            } finally {
-                wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
-            }
-        },
-        __wbg___pubkyGrantEnsureDelegatedKey_70e2f9e5fbabf7e4: function(arg0, arg1) {
+        __wbg___pubkyGrantEnsureDelegatedKey_1067334e491ee176: function(arg0, arg1) {
             let v0;
             if (arg0 !== 0) {
                 v0 = getStringFromWasm0(arg0, arg1);
@@ -4859,7 +5130,7 @@ function __wbg_get_imports() {
             const ret = __pubkyGrantEnsureDelegatedKey(v0);
             return ret;
         },
-        __wbg___pubkyGrantLoadDelegatedPublicKey_5fed290b4e324487: function(arg0, arg1) {
+        __wbg___pubkyGrantLoadDelegatedPublicKey_162cec02a5e4b65f: function(arg0, arg1) {
             let deferred0_0;
             let deferred0_1;
             try {
@@ -4871,19 +5142,14 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
             }
         },
-        __wbg___pubkySessionStoreDelete_c4feadf1aabc11f4: function(arg0, arg1) {
-            let deferred0_0;
-            let deferred0_1;
-            try {
-                deferred0_0 = arg0;
-                deferred0_1 = arg1;
-                const ret = __pubkySessionStoreDelete(getStringFromWasm0(arg0, arg1));
-                return ret;
-            } finally {
-                wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
-            }
+        __wbg___pubkySessionAcquire_9cbf23c9cb4de2dd: function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+            const ret = __pubkySessionAcquire(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3), arg4 !== 0);
+            return ret;
+        }, arguments); },
+        __wbg___pubkySessionRelease_61113613898f8369: function(arg0) {
+            __pubkySessionRelease(arg0 >>> 0);
         },
-        __wbg___pubkySessionStoreGet_faa5b9fdbff7a8b0: function(arg0, arg1) {
+        __wbg___pubkySessionStoreGet_bf3d995400545463: function(arg0, arg1) {
             let deferred0_0;
             let deferred0_1;
             try {
@@ -4895,6 +5161,26 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
             }
         },
+        __wbg___pubkySessionStorePut_a1073209d38242cc: function(arg0, arg1) {
+            const ret = __pubkySessionStorePut(arg0, arg1 >>> 0);
+            return ret;
+        },
+        __wbg___pubkySessionWait_21c5e8e3be5de6ff: function(arg0) {
+            const ret = __pubkySessionWait(arg0 >>> 0);
+            return ret;
+        },
+        __wbg___pubkySharedSessionLoad_5cd9c74d47bf2afd: function(arg0) {
+            const ret = __pubkySharedSessionLoad(arg0 >>> 0);
+            return ret;
+        },
+        __wbg___pubkySharedSessionRemove_56831ee1430cf7ad: function(arg0) {
+            const ret = __pubkySharedSessionRemove(arg0 >>> 0);
+            return ret;
+        },
+        __wbg___pubkySharedSessionStore_beb384d555af114b: function(arg0, arg1) {
+            const ret = __pubkySharedSessionStore(arg0 >>> 0, arg1);
+            return ret;
+        },
         __wbg___wbindgen_bigint_get_as_i64_b482365c149396c8: function(arg0, arg1) {
             const v = arg1;
             const ret = typeof(v) === 'bigint' ? v : undefined;
@@ -5062,6 +5348,10 @@ function __wbg_get_imports() {
             const ret = Event.__wrap(arg0);
             return ret;
         },
+        __wbg_fetch_1182c189ace424aa: function(arg0) {
+            const ret = fetch(arg0);
+            return ret;
+        },
         __wbg_fetch_7a37768ab67c5bd8: function(arg0) {
             const ret = fetch(arg0);
             return ret;
@@ -5070,10 +5360,6 @@ function __wbg_get_imports() {
             const ret = arg0.fetch(arg1);
             return ret;
         },
-        __wbg_fetch_bed2d90618c78f90: function(arg0) {
-            const ret = fetch(arg0);
-            return ret;
-        },
         __wbg_from_a39669ce566077da: function(arg0) {
             const ret = Array.from(arg0);
             return ret;
@@ -5265,7 +5551,7 @@ function __wbg_get_imports() {
                     const a = state0.a;
                     state0.a = 0;
                     try {
-                        return wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke___js_sys_9e06d9a37a23efa4___Function_fn_wasm_bindgen_ce198afa7cd4a644___JsValue_____wasm_bindgen_ce198afa7cd4a644___sys__Undefined___js_sys_9e06d9a37a23efa4___Function_fn_wasm_bindgen_ce198afa7cd4a644___JsValue_____wasm_bindgen_ce198afa7cd4a644___sys__Undefined_______true_(a, state0.b, arg0, arg1);
+                        return wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___js_sys_5fd4844d262c835b___Function_fn_wasm_bindgen_6fb33c0245079662___JsValue_____wasm_bindgen_6fb33c0245079662___sys__Undefined___js_sys_5fd4844d262c835b___Function_fn_wasm_bindgen_6fb33c0245079662___JsValue_____wasm_bindgen_6fb33c0245079662___sys__Undefined_______true_(a, state0.b, arg0, arg1);
                     } finally {
                         state0.a = a;
                     }
@@ -5457,6 +5743,10 @@ function __wbg_get_imports() {
             const ret = arg0.status;
             return ret;
         },
+        __wbg_storagelock_new: function(arg0) {
+            const ret = StorageLock.__wrap(arg0);
+            return ret;
+        },
         __wbg_storedsessioninfo_new: function(arg0) {
             const ret = StoredSessionInfo.__wrap(arg0);
             return ret;
@@ -5508,18 +5798,18 @@ function __wbg_get_imports() {
             console.warn(arg0, arg1, arg2, arg3);
         },
         __wbindgen_generic_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 133, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke___wasm_bindgen_ce198afa7cd4a644___JsValue__core_ed718c3d60ebd546___result__Result_____wasm_bindgen_ce198afa7cd4a644___JsError___true_);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 129, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___wasm_bindgen_6fb33c0245079662___JsValue__core_608f92abc48d28da___result__Result_____wasm_bindgen_6fb33c0245079662___JsError___true_);
             return ret;
         },
         __wbindgen_generic_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 275, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke___wasm_bindgen_ce198afa7cd4a644___JsValue______true_);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 267, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___wasm_bindgen_6fb33c0245079662___JsValue______true_);
             return ret;
         },
         __wbindgen_generic_0000000000000003: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 273, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke_______true_);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 269, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen_6fb33c0245079662___convert__closures_____invoke_______true_);
             return ret;
         },
         __wbindgen_generic_0000000000000004: function(arg0) {
@@ -5557,14 +5847,14 @@ function __wbg_get_imports() {
         __wbindgen_generic_000000000000000a: function(arg0, arg1) {
             var v0 = getArrayJsValueFromWasm0(arg0, arg1);
             wasm.__wbindgen_free(arg0, arg1 * 4, 4);
-            // Cast intrinsic for `Vector(RustStruct { name: "GrantInfo", unique_crate_identifier: "pubky-wasm-77c580e5b10ee397" }) -> Externref`.
+            // Cast intrinsic for `Vector(RustStruct { name: "GrantInfo", unique_crate_identifier: "pubky-wasm-7d6e91dad805c24f" }) -> Externref`.
             const ret = v0;
             return ret;
         },
         __wbindgen_generic_000000000000000b: function(arg0, arg1) {
             var v0 = getArrayJsValueFromWasm0(arg0, arg1);
             wasm.__wbindgen_free(arg0, arg1 * 4, 4);
-            // Cast intrinsic for `Vector(RustStruct { name: "StoredSessionInfo", unique_crate_identifier: "pubky-wasm-77c580e5b10ee397" }) -> Externref`.
+            // Cast intrinsic for `Vector(RustStruct { name: "StoredSessionInfo", unique_crate_identifier: "pubky-wasm-7d6e91dad805c24f" }) -> Externref`.
             const ret = v0;
             return ret;
         },
@@ -5581,33 +5871,32 @@ function __wbg_get_imports() {
     return {
         __proto__: null,
         "./pubky_bg.js": import0,
-        "./snippets/pubky-wasm-77c580e5b10ee397/inline1.js": import1,
-        "./snippets/pubky-wasm-77c580e5b10ee397/inline0.js": import2,
-        "./snippets/pubky-wasm-77c580e5b10ee397/inline0.js": import3,
-        "./snippets/pubky-wasm-77c580e5b10ee397/inline0.js": import4,
-        "./snippets/pubky-wasm-77c580e5b10ee397/inline0.js": import5,
-        "./snippets/pubky-wasm-77c580e5b10ee397/inline0.js": import6,
-        "./snippets/pubky-wasm-77c580e5b10ee397/inline1.js": import7,
+        "./snippets/pubky-wasm-7d6e91dad805c24f/inline1.js": import1,
+        "./snippets/pubky-wasm-7d6e91dad805c24f/inline0.js": import2,
+        "./snippets/pubky-wasm-7d6e91dad805c24f/inline0.js": import3,
+        "./snippets/pubky-wasm-7d6e91dad805c24f/inline0.js": import4,
+        "./snippets/pubky-wasm-7d6e91dad805c24f/inline0.js": import5,
+        "./snippets/pubky-wasm-7d6e91dad805c24f/inline1.js": import6,
     };
 }
 
-function wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke_______true_(arg0, arg1) {
-    wasm.wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke_______true_(arg0, arg1);
+function wasm_bindgen_6fb33c0245079662___convert__closures_____invoke_______true_(arg0, arg1) {
+    wasm.wasm_bindgen_6fb33c0245079662___convert__closures_____invoke_______true_(arg0, arg1);
 }
 
-function wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke___wasm_bindgen_ce198afa7cd4a644___JsValue______true_(arg0, arg1, arg2) {
-    wasm.wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke___wasm_bindgen_ce198afa7cd4a644___JsValue______true_(arg0, arg1, arg2);
+function wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___wasm_bindgen_6fb33c0245079662___JsValue______true_(arg0, arg1, arg2) {
+    wasm.wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___wasm_bindgen_6fb33c0245079662___JsValue______true_(arg0, arg1, arg2);
 }
 
-function wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke___wasm_bindgen_ce198afa7cd4a644___JsValue__core_ed718c3d60ebd546___result__Result_____wasm_bindgen_ce198afa7cd4a644___JsError___true_(arg0, arg1, arg2) {
-    const ret = wasm.wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke___wasm_bindgen_ce198afa7cd4a644___JsValue__core_ed718c3d60ebd546___result__Result_____wasm_bindgen_ce198afa7cd4a644___JsError___true_(arg0, arg1, arg2);
+function wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___wasm_bindgen_6fb33c0245079662___JsValue__core_608f92abc48d28da___result__Result_____wasm_bindgen_6fb33c0245079662___JsError___true_(arg0, arg1, arg2) {
+    const ret = wasm.wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___wasm_bindgen_6fb33c0245079662___JsValue__core_608f92abc48d28da___result__Result_____wasm_bindgen_6fb33c0245079662___JsError___true_(arg0, arg1, arg2);
     if (ret[1]) {
         throw takeFromExternrefTable0(ret[0]);
     }
 }
 
-function wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke___js_sys_9e06d9a37a23efa4___Function_fn_wasm_bindgen_ce198afa7cd4a644___JsValue_____wasm_bindgen_ce198afa7cd4a644___sys__Undefined___js_sys_9e06d9a37a23efa4___Function_fn_wasm_bindgen_ce198afa7cd4a644___JsValue_____wasm_bindgen_ce198afa7cd4a644___sys__Undefined_______true_(arg0, arg1, arg2, arg3) {
-    wasm.wasm_bindgen_ce198afa7cd4a644___convert__closures_____invoke___js_sys_9e06d9a37a23efa4___Function_fn_wasm_bindgen_ce198afa7cd4a644___JsValue_____wasm_bindgen_ce198afa7cd4a644___sys__Undefined___js_sys_9e06d9a37a23efa4___Function_fn_wasm_bindgen_ce198afa7cd4a644___JsValue_____wasm_bindgen_ce198afa7cd4a644___sys__Undefined_______true_(arg0, arg1, arg2, arg3);
+function wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___js_sys_5fd4844d262c835b___Function_fn_wasm_bindgen_6fb33c0245079662___JsValue_____wasm_bindgen_6fb33c0245079662___sys__Undefined___js_sys_5fd4844d262c835b___Function_fn_wasm_bindgen_6fb33c0245079662___JsValue_____wasm_bindgen_6fb33c0245079662___sys__Undefined_______true_(arg0, arg1, arg2, arg3) {
+    wasm.wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___js_sys_5fd4844d262c835b___Function_fn_wasm_bindgen_6fb33c0245079662___JsValue_____wasm_bindgen_6fb33c0245079662___sys__Undefined___js_sys_5fd4844d262c835b___Function_fn_wasm_bindgen_6fb33c0245079662___JsValue_____wasm_bindgen_6fb33c0245079662___sys__Undefined_______true_(arg0, arg1, arg2, arg3);
 }
 
 
@@ -5732,6 +6021,9 @@ const SignupDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
 const SignupGrantDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_signupgrantdeeplink_free(ptr, 1));
+const StorageLockFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_storagelock_free(ptr, 1));
 const StoredSessionInfoFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_storedsessioninfo_free(ptr, 1));