@synonymdev/pubky 0.15.0 → 0.16.1

package/index.cjs

@@ -5,10 +5,27 @@ globalThis.fetch = makeFetchCookie(originalFetch);
 
 /* @ts-self-types="./pubky.d.ts" */
 
+function __pubkyRecoveredEncryptionKeys(publicKey, grantId, keys) {
+    return { publicKey, grantId, keys };
+}
+
+async function __pubkyImportEncryptionCryptoKey(bytes) {
+    try {
+        if (!globalThis.crypto?.subtle) {
+            throw new Error("WebCrypto is unavailable; use a secure context.");
+        }
+        return await globalThis.crypto.subtle.importKey(
+            "raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
+    } finally {
+        bytes.fill(0);
+    }
+}
+
 const PUBKY_SESSIONS_DB_NAME = "pubky-auth";
 const PUBKY_SESSIONS_DB_VERSION = 1;
 const PUBKY_SESSIONS_STORE_NAME = "storedSessions";
 const PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME = "delegatedGrantKeys";
+const PUBKY_APPROVAL_SESSION_VERSION = "pubky-session-v2";
 
 /** Assert that IndexedDB is available for browser session persistence. */
 function requireIndexedDb() {
@@ -53,25 +70,27 @@ function openSessionStoreDb() {
 }
 
 /**
- * Run an IndexedDB operation against the stored-session object store.
+ * Run an IndexedDB operation across session records and browser keys.
  *
- * The callback receives the object store and returns a request. This wrapper
+ * The callback receives the transaction and returns a request. This wrapper
  * resolves only after the transaction commits, not when the request succeeds.
  */
-async function withSessionStore(mode, operation) {
+async function withSessionStores(mode, operation) {
   const db = await openSessionStoreDb();
   try {
     return await new Promise((resolve, reject) => {
-      const tx = db.transaction(PUBKY_SESSIONS_STORE_NAME, mode);
-      const store = tx.objectStore(PUBKY_SESSIONS_STORE_NAME);
+      const tx = db.transaction(
+        [PUBKY_SESSIONS_STORE_NAME, PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME], mode,
+      );
       let result;
       try {
-        const request = operation(store);
+        const request = operation(tx);
         request.onsuccess = () => {
           result = request.result;
         };
         request.onerror = () => reject(request.error ?? new Error("Pubky session store request failed."));
       } catch (error) {
+        tx.abort();
         reject(error);
       }
       tx.onerror = () => reject(tx.error ?? new Error("Pubky session store transaction failed."));
@@ -101,21 +120,44 @@ async function __pubkySessionStorePut(record, lease) {
   requireIndexedDb();
   try {
     const previous = await __pubkySessionStoreGet(record.id);
-    if (previous?.sharedSession) record.sharedSession = previous.sharedSession;
-    await withSessionStore("readwrite", (store) => {
-      requireSessionLease(lease, true);
-      return store.put(record);
+    if (previous?.version === PUBKY_APPROVAL_SESSION_VERSION && record.version !== previous.version) {
+      throw new Error("Cannot replace a stored approval with an authentication-only record.");
+    }
+    const stored = { ...record };
+    if (previous?.sharedSession) stored.sharedSession = previous.sharedSession;
+    await withSessionStores("readwrite", tx => {
+      const held = requireSessionLease(lease, true);
+      if (held.id !== record.id || held.homeserver !== record.homeserver) {
+        throw new Error("Session record does not match its browser lock.");
+      }
+      return tx.objectStore(PUBKY_SESSIONS_STORE_NAME).put(stored);
     });
   } catch (error) {
     throw contextualSessionStoreError("Saving Pubky session failed.", error);
   }
 }
 
+function sessionMetadata(record) {
+  if (!record) return record;
+  const { version, id, storageMode, publicKey, homeserver, grantId, clientId,
+    capabilities, grantExpiresAt, createdAt } = record;
+  return { version, id, storageMode, publicKey, homeserver, grantId, clientId,
+    capabilities, grantExpiresAt, createdAt,
+    hasStoredApproval: record.signedApproval !== undefined,
+  };
+}
+
+async function __pubkySessionStoreMetadata(id) {
+  return sessionMetadata(await __pubkySessionStoreGet(id));
+}
+
 /** Load a browser session record by id. */
 async function __pubkySessionStoreGet(id) {
   requireIndexedDb();
   try {
-    return await withSessionStore("readonly", (store) => store.get(id));
+    return await withSessionStores("readonly", tx =>
+      tx.objectStore(PUBKY_SESSIONS_STORE_NAME).get(id),
+    );
   } catch (error) {
     throw contextualSessionStoreError("Reading Pubky session failed.", error);
   }
@@ -125,7 +167,10 @@ async function __pubkySessionStoreGet(id) {
 async function __pubkySessionStoreList() {
   if (!globalThis.indexedDB) return [];
   try {
-    return (await withSessionStore("readonly", (store) => store.getAll())) ?? [];
+    const records = await withSessionStores("readonly", tx =>
+      tx.objectStore(PUBKY_SESSIONS_STORE_NAME).getAll(),
+    );
+    return records.map(sessionMetadata);
   } catch (_error) {
     return [];
   }
@@ -223,9 +268,9 @@ async function __pubkySharedSessionStore(token, sharedSession) {
   const lease = requireSessionLease(token, true);
   const record = await __pubkySessionStoreGet(lease.id);
   if (!record || record.homeserver !== lease.homeserver) throw new Error("Browser session was removed or changed.");
-  await withSessionStore("readwrite", store => {
+  await withSessionStores("readwrite", tx => {
     requireSessionLease(token, true);
-    return store.put({ ...record, sharedSession });
+    return tx.objectStore(PUBKY_SESSIONS_STORE_NAME).put({ ...record, sharedSession });
   });
 }
 async function __pubkySharedSessionRemove(token) {
@@ -504,9 +549,21 @@ async function __pubkyGrantLoadDelegatedPublicKey(keyId) {
  * bytes are returned to Rust, which finishes compact JWS serialization.
  */
 async function __pubkyGrantDelegatedSign(keyId, signingInput) {
-  requireBrowserCrypto();
-  const existing = await getRecord(keyId);
-  if (!existing?.privateKey) throw new Error(`Delegated grant key not found: ${keyId}`);
+  let existing;
+  try {
+    requireBrowserCrypto();
+    existing = await getRecord(keyId);
+    if (!existing?.privateKey) throw new Error(`Delegated grant key not found: ${keyId}`);
+  } catch (cause) {
+    // getRecord wraps IndexedDB failures; retain the underlying diagnostic.
+    const detail = cause?.cause ?? cause;
+    const error = contextualError(
+      `Delegated grant signing key unavailable: ${detail?.message ?? String(detail)}`,
+      cause,
+    );
+    error.code = "SigningKeyUnavailable";
+    throw error;
+  }
   const data = new TextEncoder().encode(signingInput);
   return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, existing.privateKey, data));
 }
@@ -967,6 +1024,23 @@ class BrowserSessionStore {
         const ret = wasm.browsersessionstore_remove(this.__wbg_ptr, ptr0, len0);
         return ret;
     }
+    /**
+     * Recover a stored session's encryption keys without network access.
+     * Verifies the signed approval, exact grant binding, and requested session
+     * identity. Works after grant expiry/revocation and without the delegated
+     * WebCrypto signing key.
+     * Restore material is stored as plaintext in IndexedDB.
+     * Bare-grant records return undefined; signed approvals without `e` scopes
+     * return an empty bundle. Creates no session.
+     * @param {string} id
+     * @returns {Promise<EncryptionKeys | undefined>}
+     */
+    restoreEncryptionKeys(id) {
+        const ptr0 = passStringToWasm0(id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.browsersessionstore_restoreEncryptionKeys(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
     /**
      * Restore a specific stored session by id.
      *
@@ -982,7 +1056,11 @@ class BrowserSessionStore {
         return ret;
     }
     /**
-     * Persist a completed grant session in IndexedDB.
+     * Persist a completed grant session and its optional signed approval.
+     * Confidential restore material is stored as plaintext in IndexedDB.
+     * Delegated signing keys remain non-extractable WebCrypto keys.
+     * Records are identified by user and grant ID. Reauthorizing the same
+     * client creates a separate record; use the returned ID to restore it.
      * @param {Session} session
      * @returns {Promise<StoredSessionInfo>}
      */
@@ -1257,6 +1335,90 @@ class DirectSignupDeepLink {
 if (Symbol.dispose) DirectSignupDeepLink.prototype[Symbol.dispose] = DirectSignupDeepLink.prototype.free;
 exports.DirectSignupDeepLink = DirectSignupDeepLink;
 
+/**
+ * Verified scoped encryption keys obtained from a session or offline recovery.
+ * This object owns its secrets independently of the session and grants no storage
+ * access. Call `free()` when finished; secret bytes are zeroized on free/drop.
+ */
+class EncryptionKeys {
+    static __wrap(ptr) {
+        const obj = Object.create(EncryptionKeys.prototype);
+        obj.__wbg_ptr = ptr;
+        EncryptionKeysFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        EncryptionKeysFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_encryptionkeys_free(ptr, 0);
+    }
+    /**
+     * Derive a non-extractable AES-GCM-256 key for WebCrypto encryption/decryption.
+     * Rejects directories and files outside approved scopes. Requires WebCrypto.
+     * Temporary JS key bytes are cleared after import, including on failure.
+     * @param {string} path
+     * @returns {Promise<CryptoKey>}
+     */
+    deriveCryptoKeyForPath(path) {
+        const ptr0 = passStringToWasm0(path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.encryptionkeys_deriveCryptoKeyForPath(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
+    /**
+     * Derive a 32-byte content key for a canonical decoded file path.
+     * Rejects directories and files outside the approved scopes. The caller
+     * owns the JS byte copy and should clear it after use.
+     * @param {string} path
+     * @returns {Uint8Array}
+     */
+    deriveForPath(path) {
+        const ptr0 = passStringToWasm0(path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.encryptionkeys_deriveForPath(this.__wbg_ptr, ptr0, len0);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
+    /**
+     * Recover authenticated identity and keys from an exportLocalSecret() token offline.
+     * Verifies the signed approval and grant binding even if the grant expired
+     * or was revoked. Bare-grant tokens return undefined; signed approvals
+     * without `e` scopes return a result with an empty key bundle.
+     * Check publicKey (z-base-32) against the expected account and grantId
+     * against the expected grant before using keys. Call keys.free() when done.
+     * @param {string} token
+     * @returns {RecoveredEncryptionKeys | undefined}
+     */
+    static fromLocalSecret(token) {
+        const ptr0 = passStringToWasm0(token, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.encryptionkeys_fromLocalSecret(ptr0, len0);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
+    /**
+     * Approved scopes; directory scopes cover descendant files.
+     * @returns {string[]}
+     */
+    get scopes() {
+        const ret = wasm.encryptionkeys_scopes(this.__wbg_ptr);
+        var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]);
+        wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
+        return v1;
+    }
+}
+if (Symbol.dispose) EncryptionKeys.prototype[Symbol.dispose] = EncryptionKeys.prototype.free;
+exports.EncryptionKeys = EncryptionKeys;
+
 /**
  * A single event from the event stream.
  *
@@ -1678,7 +1840,8 @@ class GrantAuthFlow {
      * Resume a previously saved pending grant auth flow (standalone).
      * Prefer `pubky.resumeGrantAuthFlow()` to reuse a facade client.
      *
-     * **Security:** `savedState` contains the relay secret and PoP client private key.
+     * **Security:** `savedState` contains the PoP client private key and either
+     * a shared relay secret or a temporary HPKE recipient secret.
      * Store it only temporarily and delete it once the flow completes or is abandoned.
      *
      * @param {string} savedState A string produced by `grantFlow.saveLocal()`.
@@ -1698,9 +1861,9 @@ class GrantAuthFlow {
     /**
      * Save sensitive state required to resume this delegated pending grant flow.
      *
-     * This does not export the delegated private key, but it includes the relay
-     * secret in the authorization URL. Store it only temporarily and delete it
-     * once the flow completes or is abandoned.
+     * This includes either a shared relay secret or a temporary HPKE recipient
+     * secret. Store it only temporarily and delete it once the flow completes
+     * or is abandoned.
      * @returns {string}
      */
     saveDelegated() {
@@ -1988,11 +2151,40 @@ class GrantSession {
         const ptr = this.__destroy_into_raw();
         wasm.__wbg_grantsession_free(ptr, 0);
     }
+    /**
+     * Sign JSON data and return both the custom proof and its root-signed grant.
+     * Data follows `JSON.stringify` semantics, e.g. `undefined` properties are omitted.
+     * Each proof carries its signing time (`iat`) and a random `nonce`.
+     * Makes no network requests. Your applications handle freshness and replay protection.
+     * @param {JsonValue} data
+     * @returns {Promise<CustomPop>}
+     */
+    createCustomPop(data) {
+        const ret = wasm.grantsession_createCustomPop(this.__wbg_ptr, data);
+        return ret;
+    }
+    /**
+     * Return scoped keys with the same derivation API as offline recovered keys.
+     * Bare grants return `undefined`; signed approvals without `e` scopes
+     * return an object with empty scopes.
+     * Each access creates an owned copy. Keep it for repeated use and call
+     * `free()` when finished. It remains usable after this view or its session
+     * is freed, signed out, or revoked; freeing it does not affect the session.
+     * @returns {EncryptionKeys | undefined}
+     */
+    get encryptionKeys() {
+        const ret = wasm.grantsession_encryptionKeys(this.__wbg_ptr);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return ret[0] === 0 ? undefined : EncryptionKeys.__wrap(ret[0]);
+    }
     /**
      * Export the portable local secret material needed to restore this grant session.
      *
      * Treat the returned string as bearer-equivalent secret material until the
-     * grant expires or is revoked.
+     * grant expires or is revoked. Included scoped keys remain sensitive after
+     * expiry or revocation.
      *
      * @returns {Promise<string>}
      * @returns {Promise<string>}
@@ -2829,8 +3021,9 @@ class Pubky {
     /**
      * Resume a previously saved pending grant auth flow.
      *
-     * **Security:** `savedState` contains the relay secret and PoP client private key.
-     * Delete it from storage as soon as the resumed flow completes.
+     * **Security:** `savedState` contains the PoP client private key and either
+     * a shared relay secret or a temporary HPKE private key. Delete it from
+     * storage when the flow completes or is abandoned.
      *
      * @param {string} savedState A string produced by `grantFlow.saveLocal()`.
      * @returns {GrantAuthFlow} A flow reconnected to the original relay channel.
@@ -2922,11 +3115,13 @@ class Pubky {
      *
      * Grant auth uses a user-signed grant JWS plus Proof-of-Possession and
      * returns a self-refreshing session.
+     * Select `approvalFormat: "signedApprovalV1"` and include `e` on scopes that need content
+     * keys. Storage `r` and `w` alone do not deliver encryption keys.
      *
      * @param {string} capabilities Comma-separated caps, e.g. `"/pub/app/:rw,/pub/foo/file:r"`.
      * @param {AuthFlowKind} kind The kind of authentication flow to perform.
      * @param {GrantAuthFlowOptions} options Options for the grant flow:
-     * `{ clientId, relay?, xCallback? }`.
+     * `{ clientId, relay?, xCallback?, approvalFormat? }`.
      * @returns {Promise<GrantAuthFlow>}
      * A running grant auth flow. Show `authorizationUrl` as QR/deeplink,
      * then `awaitApproval()` to obtain a grant-backed `Session`.
@@ -3975,7 +4170,7 @@ class Signer {
         wasm.__wbg_signer_free(ptr, 0);
     }
     /**
-     * Approve a `pubkyauth://` request URL (encrypts & POSTs the signed AuthToken).
+     * Approve all capabilities in a `pubkyauth://` auth request URL.
      * @param {string} pubkyauth_url
      * @returns {Promise<void>}
      */
@@ -3985,6 +4180,28 @@ class Signer {
         const ret = wasm.signer_approveAuthRequest(this.__wbg_ptr, ptr0, len0);
         return ret;
     }
+    /**
+     * Approve selected capabilities in a `pubkyauth://` auth request URL.
+     *
+     * Scopes and actions must be covered by the request. An empty string
+     * approves no capabilities. V1 grants deliver keys only for approved `e`
+     * scopes. Supports grant and legacy signin/signup requests.
+     * Invalid capabilities or approvals exceeding the request fail before POST.
+     *
+     * @example
+     * await signer.approveAuthWithCapabilities(authUrl, "/pub/example.app/:r");
+     * @param {string} pubkyauth_url
+     * @param {string} approved_capabilities
+     * @returns {Promise<void>}
+     */
+    approveAuthWithCapabilities(pubkyauth_url, approved_capabilities) {
+        const ptr0 = passStringToWasm0(pubkyauth_url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(approved_capabilities, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.signer_approveAuthWithCapabilities(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+        return ret;
+    }
     /**
      * Create a signer from a `Keypair` (prefer `pubky.signer(kp)`).
      *
@@ -4041,7 +4258,8 @@ class Signer {
     /**
      * Blocking sign-in. Waits for PKDNS publish to complete (slower; safer).
      *
-     * Creates a valid grant-backed homeserver Session with root capabilities.
+     * Creates a grant-backed homeserver session with root storage access (`/:rw`).
+     * Encryption keys require an explicit `e` request through a signed approval flow.
      * `clientId` is shown in the user's grant/session list.
      * @param {string} clientId App identifier, typically a domain.
      *
@@ -4078,7 +4296,8 @@ class Signer {
     /**
      * Fast sign-in for a returning user. Publishes PKDNS in the background.
      *
-     * Creates a valid grant-backed homeserver Session with root capabilities.
+     * Creates a grant-backed homeserver session with root storage access (`/:rw`).
+     * Encryption keys require an explicit `e` request through a signed approval flow.
      * `clientId` is shown in the user's grant/session list.
      * @param {string} clientId App identifier, typically a domain.
      *
@@ -4256,6 +4475,22 @@ class SigninGrantDeepLink {
         const ptr = this.__destroy_into_raw();
         wasm.__wbg_signingrantdeeplink_free(ptr, 0);
     }
+    /**
+     * Negotiated approval format: `bareGrant` or `signedApprovalV1`.
+     * @returns {string}
+     */
+    get approvalFormat() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signingrantdeeplink_approvalFormat(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
     /**
      * Base HTTP relay inbox URL used by this auth request.
      *
@@ -4320,6 +4555,19 @@ class SigninGrantDeepLink {
         const ret = wasm.signingrantdeeplink_clientPublicKey(this.__wbg_ptr);
         return PublicKey.__wrap(ret);
     }
+    /**
+     * The 32-byte ephemeral HPKE public key from `epk`, or `undefined`
+     * for a shared-secret link. The relay channel ID is the unpadded
+     * base64url encoding of BLAKE3("pubky-grant-relay-channel-v1" || 0x00 || epk),
+     * where `||` concatenates bytes and `epk` is the raw 32-byte public key.
+     *
+     * @returns {Uint8Array|undefined}
+     * @returns {Uint8Array | undefined}
+     */
+    get ephemeralPublicKey() {
+        const ret = wasm.signingrantdeeplink_ephemeralPublicKey(this.__wbg_ptr);
+        return ret;
+    }
     /**
      * Parse a grant signin deeplink URL.
      *
@@ -4339,12 +4587,11 @@ class SigninGrantDeepLink {
         return SigninGrantDeepLink.__wrap(ret[0]);
     }
     /**
-     * Relay channel secret embedded in the deeplink.
+     * Shared relay secret, or `undefined` for an HPKE link.
+     * Keep this secret confidential until the flow completes or is abandoned.
      *
-     * Treat this as sensitive temporary auth-flow material.
-     *
-     * @returns {Uint8Array}
-     * @returns {Uint8Array}
+     * @returns {Uint8Array|undefined}
+     * @returns {Uint8Array | undefined}
      */
     get secret() {
         const ret = wasm.signingrantdeeplink_secret(this.__wbg_ptr);
@@ -4522,6 +4769,22 @@ class SignupGrantDeepLink {
         const ptr = this.__destroy_into_raw();
         wasm.__wbg_signupgrantdeeplink_free(ptr, 0);
     }
+    /**
+     * Negotiated approval format: `bareGrant` or `signedApprovalV1`.
+     * @returns {string}
+     */
+    get approvalFormat() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signupgrantdeeplink_approvalFormat(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
     /**
      * Base HTTP relay inbox URL used by this auth request.
      *
@@ -4586,6 +4849,19 @@ class SignupGrantDeepLink {
         const ret = wasm.signupgrantdeeplink_clientPublicKey(this.__wbg_ptr);
         return PublicKey.__wrap(ret);
     }
+    /**
+     * The 32-byte ephemeral HPKE public key from `epk`, or `undefined`
+     * for a shared-secret link. The relay channel ID is the unpadded
+     * base64url encoding of BLAKE3("pubky-grant-relay-channel-v1" || 0x00 || epk),
+     * where `||` concatenates bytes and `epk` is the raw 32-byte public key.
+     *
+     * @returns {Uint8Array|undefined}
+     * @returns {Uint8Array | undefined}
+     */
+    get ephemeralPublicKey() {
+        const ret = wasm.signupgrantdeeplink_ephemeralPublicKey(this.__wbg_ptr);
+        return ret;
+    }
     /**
      * Homeserver public key requested for account creation.
      *
@@ -4615,12 +4891,11 @@ class SignupGrantDeepLink {
         return SignupGrantDeepLink.__wrap(ret[0]);
     }
     /**
-     * Relay channel secret embedded in the deeplink.
+     * Shared relay secret, or `undefined` for an HPKE link.
+     * Keep this secret confidential until the flow completes or is abandoned.
      *
-     * Treat this as sensitive temporary auth-flow material.
-     *
-     * @returns {Uint8Array}
-     * @returns {Uint8Array}
+     * @returns {Uint8Array|undefined}
+     * @returns {Uint8Array | undefined}
      */
     get secret() {
         const ret = wasm.signupgrantdeeplink_secret(this.__wbg_ptr);
@@ -4984,7 +5259,8 @@ exports.setLogLevel = setLogLevel;
 /**
  * Validate and normalize a capabilities string.
  *
- * - Normalizes action order (`wr` -> `rw`)
+ * - Normalizes action order (`wr` -> `rw`, `ewr` -> `rwe`).
+ * - `e` requests scoped encryption/decryption keys in V1 grant approvals.
  * - Throws `InvalidInput` identifying the first malformed entry.
  *
  * @param {string} input
@@ -5015,16 +5291,27 @@ function validateCapabilities(input) {
     }
 }
 exports.validateCapabilities = validateCapabilities;
+
+/**
+ * Verify both signatures, grant binding, and grant validity against the local clock.
+ * Allows 30 seconds of future clock skew by default; never extends grant expiry.
+ * Does not check replay, application authorization, or homeserver revocation.
+ * @param {CustomPop} credentials
+ * @param {CustomPopVerificationOptions | null} [options]
+ * @returns {VerifiedCustomPop}
+ */
+function verifyCustomGrantPop(credentials, options) {
+    const ret = wasm.verifyCustomGrantPop(credentials, isLikeNone(options) ? 0 : addToExternrefTable0(options));
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return takeFromExternrefTable0(ret[0]);
+}
+exports.verifyCustomGrantPop = verifyCustomGrantPop;
 const import1 = {
-  __pubkyGrantIsDelegationAvailable,
-  __pubkyGrantCanUseDelegation,
-  __pubkyGrantEnsureDelegatedKey,
-  __pubkyGrantLoadDelegatedPublicKey,
-  __pubkyGrantDelegatedSign,
-};
-const import2 = {
   __pubkySessionStoreIsAvailable,
   __pubkySessionStorePut,
+  __pubkySessionStoreMetadata,
   __pubkySessionStoreGet,
   __pubkySessionStoreList,
   __pubkySessionAcquire,
@@ -5036,9 +5323,10 @@ const import2 = {
   __pubkySessionStoreClear,
   __pubkySessionStoreClearAll,
 };
-const import3 = {
+const import2 = {
   __pubkySessionStoreIsAvailable,
   __pubkySessionStorePut,
+  __pubkySessionStoreMetadata,
   __pubkySessionStoreGet,
   __pubkySessionStoreList,
   __pubkySessionAcquire,
@@ -5050,9 +5338,10 @@ const import3 = {
   __pubkySessionStoreClear,
   __pubkySessionStoreClearAll,
 };
-const import4 = {
+const import3 = {
   __pubkySessionStoreIsAvailable,
   __pubkySessionStorePut,
+  __pubkySessionStoreMetadata,
   __pubkySessionStoreGet,
   __pubkySessionStoreList,
   __pubkySessionAcquire,
@@ -5064,9 +5353,10 @@ const import4 = {
   __pubkySessionStoreClear,
   __pubkySessionStoreClearAll,
 };
-const import5 = {
+const import4 = {
   __pubkySessionStoreIsAvailable,
   __pubkySessionStorePut,
+  __pubkySessionStoreMetadata,
   __pubkySessionStoreGet,
   __pubkySessionStoreList,
   __pubkySessionAcquire,
@@ -5078,7 +5368,18 @@ const import5 = {
   __pubkySessionStoreClear,
   __pubkySessionStoreClearAll,
 };
+const import5 = {
+  __pubkyGrantIsDelegationAvailable,
+  __pubkyGrantCanUseDelegation,
+  __pubkyGrantEnsureDelegatedKey,
+  __pubkyGrantLoadDelegatedPublicKey,
+  __pubkyGrantDelegatedSign,
+};
 const import6 = {
+  __pubkyRecoveredEncryptionKeys,
+  __pubkyImportEncryptionCryptoKey,
+};
+const import7 = {
   __pubkyGrantIsDelegationAvailable,
   __pubkyGrantCanUseDelegation,
   __pubkyGrantEnsureDelegatedKey,
@@ -5104,7 +5405,7 @@ function __wbg_get_imports() {
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
-        __wbg___pubkyGrantDelegatedSign_3145fede89a925f4: function(arg0, arg1, arg2, arg3) {
+        __wbg___pubkyGrantDelegatedSign_78f7f9da0ae4d1e7: function(arg0, arg1, arg2, arg3) {
             let deferred0_0;
             let deferred0_1;
             let deferred1_0;
@@ -5121,7 +5422,7 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
             }
         },
-        __wbg___pubkyGrantEnsureDelegatedKey_1067334e491ee176: function(arg0, arg1) {
+        __wbg___pubkyGrantEnsureDelegatedKey_8db39436266230bf: function(arg0, arg1) {
             let v0;
             if (arg0 !== 0) {
                 v0 = getStringFromWasm0(arg0, arg1);
@@ -5130,7 +5431,7 @@ function __wbg_get_imports() {
             const ret = __pubkyGrantEnsureDelegatedKey(v0);
             return ret;
         },
-        __wbg___pubkyGrantLoadDelegatedPublicKey_162cec02a5e4b65f: function(arg0, arg1) {
+        __wbg___pubkyGrantLoadDelegatedPublicKey_e68eaea44047aa67: function(arg0, arg1) {
             let deferred0_0;
             let deferred0_1;
             try {
@@ -5142,14 +5443,18 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
             }
         },
-        __wbg___pubkySessionAcquire_9cbf23c9cb4de2dd: function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+        __wbg___pubkyRecoveredEncryptionKeys_b1fcbbfa114eb3ca: function(arg0, arg1, arg2, arg3, arg4) {
+            const ret = __pubkyRecoveredEncryptionKeys(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3), EncryptionKeys.__wrap(arg4));
+            return ret;
+        },
+        __wbg___pubkySessionAcquire_de9717d53c8b9829: function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
             const ret = __pubkySessionAcquire(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3), arg4 !== 0);
             return ret;
         }, arguments); },
-        __wbg___pubkySessionRelease_61113613898f8369: function(arg0) {
+        __wbg___pubkySessionRelease_0cc80a30918c48e4: function(arg0) {
             __pubkySessionRelease(arg0 >>> 0);
         },
-        __wbg___pubkySessionStoreGet_bf3d995400545463: function(arg0, arg1) {
+        __wbg___pubkySessionStoreGet_4212c4496bdd7e95: function(arg0, arg1) {
             let deferred0_0;
             let deferred0_1;
             try {
@@ -5161,23 +5466,35 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
             }
         },
-        __wbg___pubkySessionStorePut_a1073209d38242cc: function(arg0, arg1) {
+        __wbg___pubkySessionStoreMetadata_1ca42b0124ac7bda: function(arg0, arg1) {
+            let deferred0_0;
+            let deferred0_1;
+            try {
+                deferred0_0 = arg0;
+                deferred0_1 = arg1;
+                const ret = __pubkySessionStoreMetadata(getStringFromWasm0(arg0, arg1));
+                return ret;
+            } finally {
+                wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
+            }
+        },
+        __wbg___pubkySessionStorePut_950dc07537c9b99b: function(arg0, arg1) {
             const ret = __pubkySessionStorePut(arg0, arg1 >>> 0);
             return ret;
         },
-        __wbg___pubkySessionWait_21c5e8e3be5de6ff: function(arg0) {
+        __wbg___pubkySessionWait_0b154edd2f3697be: function(arg0) {
             const ret = __pubkySessionWait(arg0 >>> 0);
             return ret;
         },
-        __wbg___pubkySharedSessionLoad_5cd9c74d47bf2afd: function(arg0) {
+        __wbg___pubkySharedSessionLoad_e99bffd1e2cbc147: function(arg0) {
             const ret = __pubkySharedSessionLoad(arg0 >>> 0);
             return ret;
         },
-        __wbg___pubkySharedSessionRemove_56831ee1430cf7ad: function(arg0) {
+        __wbg___pubkySharedSessionRemove_ba5487e63035a9a9: function(arg0) {
             const ret = __pubkySharedSessionRemove(arg0 >>> 0);
             return ret;
         },
-        __wbg___pubkySharedSessionStore_beb384d555af114b: function(arg0, arg1) {
+        __wbg___pubkySharedSessionStore_507e41f8a033dcc1: function(arg0, arg1) {
             const ret = __pubkySharedSessionStore(arg0 >>> 0, arg1);
             return ret;
         },
@@ -5330,6 +5647,10 @@ function __wbg_get_imports() {
             const ret = arg0.done;
             return ret;
         },
+        __wbg_encryptionkeys_new: function(arg0) {
+            const ret = EncryptionKeys.__wrap(arg0);
+            return ret;
+        },
         __wbg_enqueue_6cb545d22db14f33: function() { return handleError(function (arg0, arg1) {
             arg0.enqueue(arg1);
         }, arguments); },
@@ -5348,7 +5669,7 @@ function __wbg_get_imports() {
             const ret = Event.__wrap(arg0);
             return ret;
         },
-        __wbg_fetch_1182c189ace424aa: function(arg0) {
+        __wbg_fetch_66895227032f0bdf: function(arg0) {
             const ret = fetch(arg0);
             return ret;
         },
@@ -5435,6 +5756,16 @@ function __wbg_get_imports() {
             const ret = result;
             return ret;
         },
+        __wbg_instanceof_CryptoKey_98e09fab6f03bfea: function(arg0) {
+            let result;
+            try {
+                result = arg0 instanceof CryptoKey;
+            } catch (_) {
+                result = false;
+            }
+            const ret = result;
+            return ret;
+        },
         __wbg_instanceof_Error_fe6fa771c78ee4cf: function(arg0) {
             let result;
             try {
@@ -5508,6 +5839,10 @@ function __wbg_get_imports() {
         __wbg_log_d4082f66a52944c3: function(arg0, arg1, arg2, arg3) {
             console.log(arg0, arg1, arg2, arg3);
         },
+        __wbg_message_1cbc5bc03dcf1dee: function(arg0) {
+            const ret = arg0.message;
+            return ret;
+        },
         __wbg_msCrypto_bd5a034af96bcba6: function(arg0) {
             const ret = arg0.msCrypto;
             return ret;
@@ -5798,17 +6133,17 @@ function __wbg_get_imports() {
             console.warn(arg0, arg1, arg2, arg3);
         },
         __wbindgen_generic_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 129, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 125, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___wasm_bindgen_6fb33c0245079662___JsValue__core_608f92abc48d28da___result__Result_____wasm_bindgen_6fb33c0245079662___JsError___true_);
             return ret;
         },
         __wbindgen_generic_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 267, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 281, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___wasm_bindgen_6fb33c0245079662___JsValue______true_);
             return ret;
         },
         __wbindgen_generic_0000000000000003: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 269, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 279, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen_6fb33c0245079662___convert__closures_____invoke_______true_);
             return ret;
         },
@@ -5847,14 +6182,14 @@ function __wbg_get_imports() {
         __wbindgen_generic_000000000000000a: function(arg0, arg1) {
             var v0 = getArrayJsValueFromWasm0(arg0, arg1);
             wasm.__wbindgen_free(arg0, arg1 * 4, 4);
-            // Cast intrinsic for `Vector(RustStruct { name: "GrantInfo", unique_crate_identifier: "pubky-wasm-7d6e91dad805c24f" }) -> Externref`.
+            // Cast intrinsic for `Vector(RustStruct { name: "GrantInfo", unique_crate_identifier: "pubky-wasm-6e41d7b4dc13a4fc" }) -> Externref`.
             const ret = v0;
             return ret;
         },
         __wbindgen_generic_000000000000000b: function(arg0, arg1) {
             var v0 = getArrayJsValueFromWasm0(arg0, arg1);
             wasm.__wbindgen_free(arg0, arg1 * 4, 4);
-            // Cast intrinsic for `Vector(RustStruct { name: "StoredSessionInfo", unique_crate_identifier: "pubky-wasm-7d6e91dad805c24f" }) -> Externref`.
+            // Cast intrinsic for `Vector(RustStruct { name: "StoredSessionInfo", unique_crate_identifier: "pubky-wasm-6e41d7b4dc13a4fc" }) -> Externref`.
             const ret = v0;
             return ret;
         },
@@ -5871,12 +6206,13 @@ function __wbg_get_imports() {
     return {
         __proto__: null,
         "./pubky_bg.js": import0,
-        "./snippets/pubky-wasm-7d6e91dad805c24f/inline1.js": import1,
-        "./snippets/pubky-wasm-7d6e91dad805c24f/inline0.js": import2,
-        "./snippets/pubky-wasm-7d6e91dad805c24f/inline0.js": import3,
-        "./snippets/pubky-wasm-7d6e91dad805c24f/inline0.js": import4,
-        "./snippets/pubky-wasm-7d6e91dad805c24f/inline0.js": import5,
-        "./snippets/pubky-wasm-7d6e91dad805c24f/inline1.js": import6,
+        "./snippets/pubky-wasm-6e41d7b4dc13a4fc/inline1.js": import1,
+        "./snippets/pubky-wasm-6e41d7b4dc13a4fc/inline1.js": import2,
+        "./snippets/pubky-wasm-6e41d7b4dc13a4fc/inline1.js": import3,
+        "./snippets/pubky-wasm-6e41d7b4dc13a4fc/inline1.js": import4,
+        "./snippets/pubky-wasm-6e41d7b4dc13a4fc/inline2.js": import5,
+        "./snippets/pubky-wasm-6e41d7b4dc13a4fc/inline0.js": import6,
+        "./snippets/pubky-wasm-6e41d7b4dc13a4fc/inline2.js": import7,
     };
 }
 
@@ -5937,6 +6273,9 @@ const CookieSessionFinalization = (typeof FinalizationRegistry === 'undefined')
 const DirectSignupDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_directsignupdeeplink_free(ptr, 1));
+const EncryptionKeysFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_encryptionkeys_free(ptr, 1));
 const EventFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_event_free(ptr, 1));