ReadonlyencryptionReturn scoped keys with the same derivation API as offline recovered keys.
Bare grants return undefined; signed approvals without e scopes
return an object with empty scopes.
Each access creates an owned copy. Keep it for repeated use and call
free() when finished. It remains usable after this view or its session
is freed, signed out, or revoked; freeing it does not affect the session.
Sign JSON data and return both the custom proof and its root-signed grant.
Data follows JSON.stringify semantics, e.g. undefined properties are omitted.
Each proof carries its signing time (iat) and a random nonce.
Makes no network requests. Your applications handle freshness and replay protection.
Export the portable local secret material needed to restore this grant session.
Treat the returned string as bearer-equivalent secret material until the grant expires or is revoked. Included scoped keys remain sensitive after expiry or revocation.
Current grant id (jti) backing this session.
Full grant session metadata.
Grant-only view over a grant-backed
Session.Cookie-backed sessions do not expose this view; use
session.grantand check forundefinedbefore calling grant-session methods.