@synonymdev/pubky 0.16.0 → 0.16.2

package/README.md

@@ -237,6 +237,20 @@ for compatibility and expiry behavior.
 await signer.approveAuthRequest("pubkyauth://signin?caps=...&secret=...&relay=...");
 ```
 
+`approveAuthRequest()` approves every requested capability. To approve fewer
+scopes or actions, pass a capabilities string to `approveAuthWithCapabilities()`:
+
+```js
+// The request includes `/pub/example.app/:rwe`; the user approves only read.
+await signer.approveAuthWithCapabilities(authUrl, "/pub/example.app/:r");
+```
+
+See [selecting capabilities on the signing device][select-capabilities] for
+validation rules, empty approvals, and encryption key delivery.
+
+[select-capabilities]:
+  ../../../../docs/scoped-encryption-keys.md#select-capabilities-on-the-signing-device
+
 **Handle a pubkyauth deep link**
 
 General entry point for any supported `pubkyauth://` link. Auth request links

package/index.cjs

@@ -5,6 +5,22 @@ globalThis.fetch = makeFetchCookie(originalFetch);
 
 /* @ts-self-types="./pubky.d.ts" */
 
+function __pubkyRecoveredEncryptionKeys(publicKey, grantId, keys) {
+    return { publicKey, grantId, keys };
+}
+
+async function __pubkyImportEncryptionCryptoKey(bytes) {
+    try {
+        if (!globalThis.crypto?.subtle) {
+            throw new Error("WebCrypto is unavailable; use a secure context.");
+        }
+        return await globalThis.crypto.subtle.importKey(
+            "raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
+    } finally {
+        bytes.fill(0);
+    }
+}
+
 const PUBKY_SESSIONS_DB_NAME = "pubky-auth";
 const PUBKY_SESSIONS_DB_VERSION = 1;
 const PUBKY_SESSIONS_STORE_NAME = "storedSessions";
@@ -553,22 +569,6 @@ async function __pubkyGrantDelegatedSign(keyId, signingInput) {
 }
 
 
-function __pubkyRecoveredEncryptionKeys(publicKey, grantId, keys) {
-    return { publicKey, grantId, keys };
-}
-
-async function __pubkyImportEncryptionCryptoKey(bytes) {
-    try {
-        if (!globalThis.crypto?.subtle) {
-            throw new Error("WebCrypto is unavailable; use a secure context.");
-        }
-        return await globalThis.crypto.subtle.importKey(
-            "raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
-    } finally {
-        bytes.fill(0);
-    }
-}
-
 /**
  * Start and control a pubkyauth authorization flow.
  *
@@ -3997,8 +3997,10 @@ class SessionStorage {
      * @param {Uint8Array} body
      * @returns {Promise<void>}
      * @throws {PubkyError} A lock that has expired or was unlocked rejects with
-     * `RequestError` and status `412`; take a new one and read the file again.
-     * Otherwise as {@link SessionStorage.putBytes}.
+     * `RequestError` and status `412`; take a new one and read the file again. A file
+     * that changed since the write was prepared rejects with status `409`, which can
+     * happen when an earlier change the storage backend ran late lands first; read it
+     * again and retry. Otherwise as {@link SessionStorage.putBytes}.
      * @param {StorageLock} lock
      * @param {Uint8Array} body
      * @returns {Promise<void>}
@@ -4054,8 +4056,10 @@ class SessionStorage {
      * @param {string} body
      * @returns {Promise<void>}
      * @throws {PubkyError} A lock that has expired or was unlocked rejects with
-     * `RequestError` and status `412`; take a new one and read the file again.
-     * Otherwise as {@link SessionStorage.putText}.
+     * `RequestError` and status `412`; take a new one and read the file again. A file
+     * that changed since the write was prepared rejects with status `409`, which can
+     * happen when an earlier change the storage backend ran late lands first; read it
+     * again and retry. Otherwise as {@link SessionStorage.putText}.
      * @param {StorageLock} lock
      * @param {string} body
      * @returns {Promise<void>}
@@ -4170,7 +4174,7 @@ class Signer {
         wasm.__wbg_signer_free(ptr, 0);
     }
     /**
-     * Approve a `pubkyauth://` request URL (encrypts & POSTs the signed AuthToken).
+     * Approve all capabilities in a `pubkyauth://` auth request URL.
      * @param {string} pubkyauth_url
      * @returns {Promise<void>}
      */
@@ -4180,6 +4184,28 @@ class Signer {
         const ret = wasm.signer_approveAuthRequest(this.__wbg_ptr, ptr0, len0);
         return ret;
     }
+    /**
+     * Approve selected capabilities in a `pubkyauth://` auth request URL.
+     *
+     * Scopes and actions must be covered by the request. An empty string
+     * approves no capabilities. V1 grants deliver keys only for approved `e`
+     * scopes. Supports grant and legacy signin/signup requests.
+     * Invalid capabilities or approvals exceeding the request fail before POST.
+     *
+     * @example
+     * await signer.approveAuthWithCapabilities(authUrl, "/pub/example.app/:r");
+     * @param {string} pubkyauth_url
+     * @param {string} approved_capabilities
+     * @returns {Promise<void>}
+     */
+    approveAuthWithCapabilities(pubkyauth_url, approved_capabilities) {
+        const ptr0 = passStringToWasm0(pubkyauth_url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(approved_capabilities, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.signer_approveAuthWithCapabilities(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+        return ret;
+    }
     /**
      * Create a signer from a `Keypair` (prefer `pubky.signer(kp)`).
      *
@@ -5383,7 +5409,7 @@ function __wbg_get_imports() {
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
-        __wbg___pubkyGrantDelegatedSign_45b22729433b1c79: function(arg0, arg1, arg2, arg3) {
+        __wbg___pubkyGrantDelegatedSign_1a62bf8388fed293: function(arg0, arg1, arg2, arg3) {
             let deferred0_0;
             let deferred0_1;
             let deferred1_0;
@@ -5400,7 +5426,7 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
             }
         },
-        __wbg___pubkyGrantEnsureDelegatedKey_4f1cc4ccb5acf4e8: function(arg0, arg1) {
+        __wbg___pubkyGrantEnsureDelegatedKey_555c8876d02a11aa: function(arg0, arg1) {
             let v0;
             if (arg0 !== 0) {
                 v0 = getStringFromWasm0(arg0, arg1);
@@ -5409,7 +5435,7 @@ function __wbg_get_imports() {
             const ret = __pubkyGrantEnsureDelegatedKey(v0);
             return ret;
         },
-        __wbg___pubkyGrantLoadDelegatedPublicKey_6591f0667321395a: function(arg0, arg1) {
+        __wbg___pubkyGrantLoadDelegatedPublicKey_f1b34a21ea0cde6e: function(arg0, arg1) {
             let deferred0_0;
             let deferred0_1;
             try {
@@ -5421,18 +5447,18 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
             }
         },
-        __wbg___pubkyRecoveredEncryptionKeys_7375e79d20b5b126: function(arg0, arg1, arg2, arg3, arg4) {
+        __wbg___pubkyRecoveredEncryptionKeys_e9143429efc3030f: function(arg0, arg1, arg2, arg3, arg4) {
             const ret = __pubkyRecoveredEncryptionKeys(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3), EncryptionKeys.__wrap(arg4));
             return ret;
         },
-        __wbg___pubkySessionAcquire_356f865b2001b846: function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+        __wbg___pubkySessionAcquire_2270c91b242c47dd: function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
             const ret = __pubkySessionAcquire(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3), arg4 !== 0);
             return ret;
         }, arguments); },
-        __wbg___pubkySessionRelease_3195014f66dee6ac: function(arg0) {
+        __wbg___pubkySessionRelease_eea4e4e2e0b6f186: function(arg0) {
             __pubkySessionRelease(arg0 >>> 0);
         },
-        __wbg___pubkySessionStoreGet_618e59d7f6ad6c2a: function(arg0, arg1) {
+        __wbg___pubkySessionStoreGet_a2bf2ae3f6833d1e: function(arg0, arg1) {
             let deferred0_0;
             let deferred0_1;
             try {
@@ -5444,7 +5470,7 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
             }
         },
-        __wbg___pubkySessionStoreMetadata_a69b8b6778109b6e: function(arg0, arg1) {
+        __wbg___pubkySessionStoreMetadata_50fe94d8b9c3f08d: function(arg0, arg1) {
             let deferred0_0;
             let deferred0_1;
             try {
@@ -5456,23 +5482,23 @@ function __wbg_get_imports() {
                 wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
             }
         },
-        __wbg___pubkySessionStorePut_aa2189e6e7fdc513: function(arg0, arg1) {
+        __wbg___pubkySessionStorePut_832a775a63a9bd6a: function(arg0, arg1) {
             const ret = __pubkySessionStorePut(arg0, arg1 >>> 0);
             return ret;
         },
-        __wbg___pubkySessionWait_a67a8077a61d91d1: function(arg0) {
+        __wbg___pubkySessionWait_5fd2b82f5655b4f2: function(arg0) {
             const ret = __pubkySessionWait(arg0 >>> 0);
             return ret;
         },
-        __wbg___pubkySharedSessionLoad_4190e716399b75e0: function(arg0) {
+        __wbg___pubkySharedSessionLoad_c69d86a0a8d83739: function(arg0) {
             const ret = __pubkySharedSessionLoad(arg0 >>> 0);
             return ret;
         },
-        __wbg___pubkySharedSessionRemove_f037c015c530dc4d: function(arg0) {
+        __wbg___pubkySharedSessionRemove_2d46ed7e88cf9aea: function(arg0) {
             const ret = __pubkySharedSessionRemove(arg0 >>> 0);
             return ret;
         },
-        __wbg___pubkySharedSessionStore_3e370536d89738a5: function(arg0, arg1) {
+        __wbg___pubkySharedSessionStore_7de3e1f4d6897d65: function(arg0, arg1) {
             const ret = __pubkySharedSessionStore(arg0 >>> 0, arg1);
             return ret;
         },
@@ -5647,11 +5673,11 @@ function __wbg_get_imports() {
             const ret = Event.__wrap(arg0);
             return ret;
         },
-        __wbg_fetch_7a37768ab67c5bd8: function(arg0) {
+        __wbg_fetch_5aa263e0c14b0c5f: function(arg0) {
             const ret = fetch(arg0);
             return ret;
         },
-        __wbg_fetch_8ce5bc1de67f3146: function(arg0) {
+        __wbg_fetch_7a37768ab67c5bd8: function(arg0) {
             const ret = fetch(arg0);
             return ret;
         },
@@ -6116,12 +6142,12 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_generic_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 284, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 281, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen_6fb33c0245079662___convert__closures_____invoke___wasm_bindgen_6fb33c0245079662___JsValue______true_);
             return ret;
         },
         __wbindgen_generic_0000000000000003: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 282, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 279, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen_6fb33c0245079662___convert__closures_____invoke_______true_);
             return ret;
         },
@@ -6160,14 +6186,14 @@ function __wbg_get_imports() {
         __wbindgen_generic_000000000000000a: function(arg0, arg1) {
             var v0 = getArrayJsValueFromWasm0(arg0, arg1);
             wasm.__wbindgen_free(arg0, arg1 * 4, 4);
-            // Cast intrinsic for `Vector(RustStruct { name: "GrantInfo", unique_crate_identifier: "pubky-wasm-a72b7beb1b0b81b7" }) -> Externref`.
+            // Cast intrinsic for `Vector(RustStruct { name: "GrantInfo", unique_crate_identifier: "pubky-wasm-de62feec958b8982" }) -> Externref`.
             const ret = v0;
             return ret;
         },
         __wbindgen_generic_000000000000000b: function(arg0, arg1) {
             var v0 = getArrayJsValueFromWasm0(arg0, arg1);
             wasm.__wbindgen_free(arg0, arg1 * 4, 4);
-            // Cast intrinsic for `Vector(RustStruct { name: "StoredSessionInfo", unique_crate_identifier: "pubky-wasm-a72b7beb1b0b81b7" }) -> Externref`.
+            // Cast intrinsic for `Vector(RustStruct { name: "StoredSessionInfo", unique_crate_identifier: "pubky-wasm-de62feec958b8982" }) -> Externref`.
             const ret = v0;
             return ret;
         },
@@ -6184,13 +6210,13 @@ function __wbg_get_imports() {
     return {
         __proto__: null,
         "./pubky_bg.js": import0,
-        "./snippets/pubky-wasm-a72b7beb1b0b81b7/inline0.js": import1,
-        "./snippets/pubky-wasm-a72b7beb1b0b81b7/inline0.js": import2,
-        "./snippets/pubky-wasm-a72b7beb1b0b81b7/inline0.js": import3,
-        "./snippets/pubky-wasm-a72b7beb1b0b81b7/inline0.js": import4,
-        "./snippets/pubky-wasm-a72b7beb1b0b81b7/inline1.js": import5,
-        "./snippets/pubky-wasm-a72b7beb1b0b81b7/inline2.js": import6,
-        "./snippets/pubky-wasm-a72b7beb1b0b81b7/inline1.js": import7,
+        "./snippets/pubky-wasm-de62feec958b8982/inline1.js": import1,
+        "./snippets/pubky-wasm-de62feec958b8982/inline1.js": import2,
+        "./snippets/pubky-wasm-de62feec958b8982/inline1.js": import3,
+        "./snippets/pubky-wasm-de62feec958b8982/inline1.js": import4,
+        "./snippets/pubky-wasm-de62feec958b8982/inline2.js": import5,
+        "./snippets/pubky-wasm-de62feec958b8982/inline0.js": import6,
+        "./snippets/pubky-wasm-de62feec958b8982/inline2.js": import7,
     };
 }