---
'@pdsjs/core': minor
'@pdsjs/cloudflare': patch
'@pdsjs/storage-sqlite': patch
'@pdsjs/readonly': patch
'@pdsjs/node': patch
'@pdsjs/deno': patch
---

Every account has an `#atproto_kem` key: a P-256 key published in its DID
document beside `#atproto`, which a space syncer uses to agree a per-request
secret with the repo host. It never signs.

New accounts get one in their genesis PLC operation, from onboarding,
`scripts/setup.js` and the start wizard. `/init` takes an optional `kemKey`
(32 bytes of hex) and generates one when it is left out. Migrating in stores a
fresh key for the owner to publish.

Existing accounts are backfilled at startup and hourly (Cloudflare: on the
hourly alarm). When this server's key is a rotation key and the DID's
`atproto_pds` endpoint is this server, the PDS publishes the key with a PLC
update; otherwise it stores the key and logs a warning to publish it by hand.
A key is kept only after it is published, so a failed publish is retried.

`getRecommendedDidCredentials` includes `atproto_kem`, and
`submitPlcOperation` refuses an operation whose `atproto_kem` is not the stored
key (`Incorrect KEM key`). `describeServer` reports `spacesAlpha: true` when
spaces are enabled.

`ActorStoragePort` gains `getKemKey()`/`setKemKey()`, and `ExtensionHost`
gains `getKemKey()`. `@pdsjs/core/kem` exports `generateKemKey` and
`kemDidKey`, and `buildPlcOperation` takes a `kemDidKey`.