@shuttle.technology/authorization 0.1.0 → 0.2.0

package/dist/accountLists.d.ts

@@ -0,0 +1,28 @@
+export interface SessionProjection {
+    requestId: string;
+    items: Array<{
+        sessionId: string;
+        clientId: string;
+        state: string;
+        createdAt: string;
+        expiresAt: string;
+        current: boolean;
+    }>;
+    hasMore: boolean;
+    nextCursor?: string;
+}
+export interface WalletProjection {
+    requestId: string;
+    items: Array<{
+        walletId: string;
+        network: string;
+        address: string;
+        state: string;
+        generation: string;
+        mappingVersion: string;
+    }>;
+    hasMore: boolean;
+    nextCursor?: string;
+}
+export declare function parseSessionPage(payload: unknown): SessionProjection;
+export declare function parseWalletPage(payload: unknown): WalletProjection;

package/dist/accountLists.js

@@ -0,0 +1,27 @@
+/**
+ * Two paged lists of the account's own: its sessions (`GET /v1/sessions`)
+ * and the wallets the provider created for it (`GET /v1/wallets`), each read
+ * as strictly as every other answer.
+ */
+import { ClientFlowError, canonicalDecimal, opaqueId, record } from "./auth.js";
+import { pageEnvelope, pageProjection } from "./pages.js";
+export function parseSessionPage(payload) {
+    const root = pageEnvelope(payload);
+    const items = root.items.map((value) => {
+        const item = record(value, ["session_id", "client_id", "state", "created_at", "expires_at", "current"]);
+        if (!opaqueId(item.session_id) || !opaqueId(item.client_id) || typeof item.state !== "string" || typeof item.created_at !== "string" || typeof item.expires_at !== "string" || typeof item.current !== "boolean")
+            throw new ClientFlowError("invalid_server_response");
+        return { sessionId: item.session_id, clientId: item.client_id, state: item.state, createdAt: item.created_at, expiresAt: item.expires_at, current: item.current };
+    });
+    return pageProjection(root.request_id, items, root.has_more, root.next_cursor);
+}
+export function parseWalletPage(payload) {
+    const root = pageEnvelope(payload);
+    const items = root.items.map((value) => {
+        const item = record(value, ["wallet_id", "network", "address", "state", "generation", "mapping_version"]);
+        if (!opaqueId(item.wallet_id) || typeof item.network !== "string" || typeof item.address !== "string" || typeof item.state !== "string" || !canonicalDecimal(item.generation) || !canonicalDecimal(item.mapping_version))
+            throw new ClientFlowError("invalid_server_response");
+        return { walletId: item.wallet_id, network: item.network, address: item.address, state: item.state, generation: item.generation, mappingVersion: item.mapping_version };
+    });
+    return pageProjection(root.request_id, items, root.has_more, root.next_cursor);
+}

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+import { type AuthorizationErrorCode } from "./errors.ts";
 export declare const identityMethods: readonly ["google", "apple", "telegram", "passkey"];
 export type IdentityMethod = (typeof identityMethods)[number];
 export type AuthIntent = "signup" | "login";
@@ -7,8 +8,9 @@ export declare class ClientFlowError extends Error {
     readonly code: string;
     constructor(code: string);
 }
+/** A refusal the provider answered, with one code of its ErrorCode enum (`AuthorizationErrorCodes`). */
 export declare class AuthorizationError extends Error {
-    readonly code: string;
+    readonly code: AuthorizationErrorCode;
     readonly retryable: boolean;
     readonly nextAction: NextAction;
     readonly requestId: string;
@@ -19,7 +21,7 @@ export declare class AuthorizationError extends Error {
     };
     readonly status: number;
     constructor(input: {
-        code: string;
+        code: AuthorizationErrorCode;
         retryable: boolean;
         nextAction: NextAction;
         requestId: string;
@@ -31,15 +33,14 @@ export declare class AuthorizationError extends Error {
         status: number;
     });
 }
+/** isAuthorizationError tells a provider refusal, and with codes one of those. */
+export declare function isAuthorizationError(error: unknown, ...codes: AuthorizationErrorCode[]): error is AuthorizationError;
+/**
+ * abortable waits for work, or rejects with the signal's reason as soon as
+ * the signal aborts; the work itself goes on for whoever else waits for it.
+ */
+export declare function abortable<T>(work: Promise<T>, signal?: AbortSignal): Promise<T>;
 export declare function parseAuthorizationError(payload: unknown, status: number): AuthorizationError;
-type ErrorExpectation = {
-    status: number;
-    retryable: boolean;
-    nextAction: NextAction;
-};
-declare const errorCatalog: Readonly<Record<string, ErrorExpectation>>;
-export type AuthorizationErrorCode = keyof typeof errorCatalog;
-export declare function isAuthorizationErrorCode(value: unknown): value is AuthorizationErrorCode;
 export declare function newHandoffBinding(crypto: Crypto): Promise<{
     state: string;
     verifier: string;
@@ -65,4 +66,3 @@ export declare function deadlineAfter(created: string, expires: string): boolean
 export declare function unexpiredRFC3339(value: unknown, nowMs: number): value is string;
 export declare function record(value: unknown, required: readonly string[], optional?: readonly string[]): Record<string, unknown>;
 export declare function isNextAction(value: unknown): value is NextAction;
-export {};

package/dist/auth.js

@@ -1,3 +1,4 @@
+import { AuthorizationErrorContracts, isAuthorizationErrorCode, operationIdCodes, possibleCommitStatus } from "./errors.js";
 export const identityMethods = ["google", "apple", "telegram", "passkey"];
 export class ClientFlowError extends Error {
     code;
@@ -7,6 +8,7 @@ export class ClientFlowError extends Error {
         this.code = code;
     }
 }
+/** A refusal the provider answered, with one code of its ErrorCode enum (`AuthorizationErrorCodes`). */
 export class AuthorizationError extends Error {
     code;
     retryable;
@@ -27,6 +29,28 @@ export class AuthorizationError extends Error {
         this.status = input.status;
     }
 }
+/** isAuthorizationError tells a provider refusal, and with codes one of those. */
+export function isAuthorizationError(error, ...codes) {
+    return error instanceof AuthorizationError && (codes.length === 0 || codes.includes(error.code));
+}
+/**
+ * abortable waits for work, or rejects with the signal's reason as soon as
+ * the signal aborts; the work itself goes on for whoever else waits for it.
+ */
+export function abortable(work, signal) {
+    if (!signal)
+        return work;
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        if (signal.aborted) {
+            work.catch(() => { });
+            abort();
+            return;
+        }
+        signal.addEventListener("abort", abort, { once: true });
+        work.then((value) => { signal.removeEventListener("abort", abort); resolve(value); }, (error) => { signal.removeEventListener("abort", abort); reject(error); });
+    });
+}
 export function parseAuthorizationError(payload, status) {
     const outer = record(payload, ["error"]);
     const error = record(outer.error, ["code", "retryable", "next_action", "request_id"], ["operation_id", "window"]);
@@ -36,9 +60,10 @@ export function parseAuthorizationError(payload, status) {
     if (error.operation_id !== undefined && !opaqueId(error.operation_id)) {
         throw new ClientFlowError("invalid_error_response");
     }
-    const expected = errorCatalog[error.code];
-    const possibleCommit = possibleCommitCodes.has(error.code) && error.operation_id !== undefined && error.retryable === false && error.next_action === "lookup_operation";
-    if (!expected || expected.status !== status || (!possibleCommit && (error.retryable !== expected.retryable || error.next_action !== expected.nextAction))) {
+    const expected = isAuthorizationErrorCode(error.code) ? AuthorizationErrorContracts[error.code] : undefined;
+    const possibleCommit = expected !== undefined && error.operation_id !== undefined && error.retryable === false && error.next_action === "lookup_operation" &&
+        status === possibleCommitStatus(error.code);
+    if (!expected || (!possibleCommit && (expected.status !== status || error.retryable !== expected.retryable || error.next_action !== expected.nextAction))) {
         throw new ClientFlowError("invalid_error_response");
     }
     if (error.operation_id !== undefined && !possibleCommit && !operationIdCodes.has(error.code)) {
@@ -74,57 +99,6 @@ export function parseAuthorizationError(payload, status) {
         status,
     });
 }
-const errorCatalog = Object.freeze({
-    INVALID_REQUEST: { status: 400, retryable: false, nextAction: "none" },
-    REGISTRATION_SCOPE_SELECTION_REQUIRED: { status: 409, retryable: false, nextAction: "none" },
-    CURSOR_INVALID: { status: 400, retryable: false, nextAction: "none" },
-    UNSUPPORTED_VERSION: { status: 400, retryable: false, nextAction: "none" },
-    UNAUTHORIZED: { status: 401, retryable: false, nextAction: "reauthenticate" },
-    SCOPE_DENIED: { status: 403, retryable: false, nextAction: "none" },
-    ORIGIN_NOT_ALLOWED: { status: 403, retryable: false, nextAction: "none" },
-    LIMIT_PER_TRANSFER_EXCEEDED: { status: 403, retryable: false, nextAction: "none" },
-    LIMIT_DAILY_EXCEEDED: { status: 403, retryable: false, nextAction: "none" },
-    RECIPIENT_NOT_ALLOWED: { status: 403, retryable: false, nextAction: "none" },
-    CONFIRMATION_METHOD_UNAVAILABLE: { status: 403, retryable: false, nextAction: "use_passkey" },
-    USER_PROOF_REQUIRED: { status: 403, retryable: false, nextAction: "sign_user_request" },
-    USER_PROOF_INVALID: { status: 403, retryable: false, nextAction: "sign_user_request" },
-    REQUEST_GRANT_INVALID: { status: 403, retryable: false, nextAction: "use_passkey" },
-    NOT_FOUND: { status: 404, retryable: false, nextAction: "none" },
-    IDENTITY_NOT_REGISTERED: { status: 409, retryable: false, nextAction: "start_signup" },
-    IDENTITY_ALREADY_REGISTERED: { status: 409, retryable: false, nextAction: "start_login" },
-    IDENTITY_ALREADY_LINKED: { status: 409, retryable: false, nextAction: "none" },
-    ACCOUNT_REFERENCE_UNBOUND: { status: 409, retryable: false, nextAction: "none" },
-    LAST_FACTOR: { status: 409, retryable: false, nextAction: "none" },
-    CONFIRMATION_REPLAYED: { status: 409, retryable: false, nextAction: "none" },
-    CANNOT_CANCEL: { status: 409, retryable: false, nextAction: "none" },
-    VERSION_CONFLICT: { status: 409, retryable: false, nextAction: "refresh_resource" },
-    AUTHORIZATION_STALE: { status: 409, retryable: false, nextAction: "refresh_resource" },
-    IDEMPOTENCY_CONFLICT: { status: 409, retryable: false, nextAction: "lookup_operation" },
-    USER_PROOF_REPLAYED: { status: 409, retryable: false, nextAction: "lookup_operation" },
-    OPERATION_NOT_AUTHORIZED: { status: 409, retryable: false, nextAction: "use_passkey" },
-    RESULT_NOT_READY: { status: 409, retryable: true, nextAction: "wait_for_result" },
-    TRANSFER_IN_FLIGHT: { status: 409, retryable: true, nextAction: "retry_same_request" },
-    ATTEMPT_EXPIRED: { status: 410, retryable: false, nextAction: "reauthenticate" },
-    OPERATION_EXPIRED: { status: 410, retryable: false, nextAction: "none" },
-    RESULT_EXPIRED: { status: 410, retryable: false, nextAction: "none" },
-    RESYNC_REQUIRED: { status: 410, retryable: false, nextAction: "resync_streams" },
-    USER_PROOF_EXPIRED: { status: 410, retryable: false, nextAction: "sign_user_request" },
-    CAPABILITY_UNAVAILABLE: { status: 422, retryable: false, nextAction: "none" },
-    RECOVERY_UNAVAILABLE: { status: 422, retryable: false, nextAction: "none" },
-    PAYLOAD_NOT_SUPPORTED: { status: 422, retryable: false, nextAction: "none" },
-    RATE_LIMITED: { status: 429, retryable: true, nextAction: "retry_same_request" },
-    DEPENDENCY_UNAVAILABLE: { status: 503, retryable: true, nextAction: "retry_same_request" },
-    NETWORK_FEE_TOO_HIGH: { status: 503, retryable: true, nextAction: "retry_same_request" },
-    TENANT_AUTH_UNAVAILABLE: { status: 503, retryable: true, nextAction: "retry_same_request" },
-    AUDIT_UNAVAILABLE: { status: 503, retryable: true, nextAction: "retry_same_request" },
-    ADAPTER_INTEGRITY_CONFLICT: { status: 503, retryable: false, nextAction: "none" },
-    INTERNAL_ERROR: { status: 500, retryable: true, nextAction: "retry_same_request" },
-});
-export function isAuthorizationErrorCode(value) {
-    return typeof value === "string" && Object.prototype.hasOwnProperty.call(errorCatalog, value);
-}
-const possibleCommitCodes = new Set(["DEPENDENCY_UNAVAILABLE", "TENANT_AUTH_UNAVAILABLE", "AUDIT_UNAVAILABLE", "INTERNAL_ERROR"]);
-const operationIdCodes = new Set(["IDEMPOTENCY_CONFLICT", "USER_PROOF_REPLAYED", "RESULT_NOT_READY", "OPERATION_EXPIRED", "RESULT_EXPIRED", "OPERATION_NOT_AUTHORIZED", "ADAPTER_INTEGRITY_CONFLICT"]);
 function opaqueCursor(value) {
     return typeof value === "string" && value.length > 0;
 }

package/dist/client.d.ts

@@ -1,162 +1,53 @@
 import { type ClientChannel, type IdentityMethod } from "./auth.ts";
-import { type AccountIdentity, type ConfirmationChallenge, type HostedIdentityFlow, type IdentityVerificationMethod, type LocalOperation, type LocalOperationCreate, type LocalOperationResult, type PasskeyBootstrapResult, type ServiceReadScope, type VerifiedIdentityResult } from "./slice4.ts";
+import { type Session } from "./credentials.ts";
+import { type ClientConfiguration, type ClientSettings, type PublicClientConfiguration } from "./configuration.ts";
+import { type SessionProjection, type WalletProjection } from "./accountLists.ts";
+import { type ServiceGrantInput, type ServiceGrantPage, type ServiceGrantTarget } from "./serviceGrants.ts";
+import { type AccountIdentity, type ConfirmationChallenge, type HostedIdentityFlow, type IdentityVerificationMethod, type LocalOperation, type LocalOperationCreate, type LocalOperationResult, type PasskeyBootstrapResult, type VerifiedIdentityResult } from "./slice4.ts";
+import { type MeProjection } from "./me.ts";
+import { type HostedSignIn } from "./redirects.ts";
+import { type MobileBrowserBridge, type MobileSecureStorage } from "./mobile.ts";
+export type { MobileAssociationInput, MobileAssociationVerification, MobileBrowserBridge, MobileSecureStorage } from "./mobile.ts";
 import { StreamsReads } from "./streams.ts";
 import { LinkedWallets } from "./linkedWallets.ts";
-export { LinkedWallets, eventOfTransaction, isWalletLimitRefusal, resumeCursor, sendEvents, transferFinal, WalletLimitRefusals } from "./linkedWallets.ts";
-export type { AssetBalance, LinkedWalletBalances, NetworkBalanceStatus, NetworkBalances, ListedSend, SendPage, TransferOutcome, TransferState, TransferStatus, WalletConnection, LinkedWallet, WalletLinkChallenge, WalletLinkAssertion, LinkedRegistrationCreate, LinkedRegistrationOperation, LinkedRegistrationDisplay, LinkedRegistrationPurgedDisplay, LinkedRegistrationResult, LinkedRegistrationListOptions, LinkedEventsOptions, LinkedStreamsRegistration, LinkedStreamsRegistrationList, LinkedSendInput, LinkedReplaceInput, LinkedSendDisplay, ReplaceAction, LinkedTransportKey, LimitAsset, WalletCeiling, WalletLimitRefusal, WalletLimits, WalletLimitsDisplay, WalletLimitsInput } from "./linkedWallets.ts";
+export { DebitPermissions, LinkedWallets, MaxDebitAssets, MaxDebitRecipients, eventOfTransaction, isWalletLimitRefusal, resumeCursor, sendEvents, transferFinal, WalletLimitRefusals } from "./linkedWallets.ts";
+export type { AssetBalance, LinkedWalletBalances, NetworkBalanceStatus, NetworkBalances, ListedSend, SendPage, TransferOutcome, TransferState, TransferStatus, WalletConnection, LinkedWallet, WalletLinkChallenge, WalletLinkAssertion, LinkedRegistrationCreate, LinkedRegistrationOperation, LinkedRegistrationDisplay, LinkedRegistrationPurgedDisplay, LinkedRegistrationResult, LinkedRegistrationListOptions, LinkedEventsOptions, LinkedStreamsRegistration, LinkedStreamsRegistrationList, LinkedSendInput, LinkedReplaceInput, LinkedSendDisplay, ReplaceAction, LinkedTransportKey, LimitAsset, WalletCeiling, WalletLimitRefusal, WalletLimits, WalletLimitsDisplay, WalletLimitsInput, DebitAsset, DebitAssetBound, DebitPermission, DebitPermissionDisplay, DebitPermissionInput, DebitPermissionList, DebitPermissionRevokeDisplay, DebitPermissionState, DebitShareKeys } from "./linkedWallets.ts";
 import { type UserWalletOperation, type UserWalletOperationCreate, type WalletResult } from "./walletOperations.ts";
+import { type WalletCreateInput } from "./walletCreateGrant.ts";
+export type { ConsentDebitOutcome, DebitTerms } from "./consentDebit.ts";
+export type { WalletCreateGrant, WalletCreateGrantOutcome, WalletCreateInput } from "./walletCreateGrant.ts";
 import { type PageOptions } from "./pages.ts";
 export type { PageOptions } from "./pages.ts";
-export { AuthorizationError, ClientFlowError } from "./auth.ts";
+export type { ClientConfiguration, ClientSettings, PublicClientConfiguration } from "./configuration.ts";
+export type { SessionProjection, WalletProjection } from "./accountLists.ts";
+export type { AccountServiceGrant, ServiceGrantInput, ServiceGrantPage, ServiceGrantState, ServiceGrantTarget } from "./serviceGrants.ts";
+export { AuthorizationErrorCodes, AuthorizationErrorContracts, ModeCRefusals, isAuthorizationErrorCode, isModeCRefusal } from "./errors.ts";
+export type { AuthorizationErrorCode, AuthorizationErrorContract, ModeCRefusal } from "./errors.ts";
+export type { MeProjection, MeWallet } from "./me.ts";
+export { AuthorizationError, ClientFlowError, isAuthorizationError } from "./auth.ts";
+export { webRenewalRequiresNavigation } from "./webRenewal.ts";
 export type { AuthIntent, ClientChannel, IdentityMethod, NextAction } from "./auth.ts";
+export type { HostedSignIn } from "./redirects.ts";
 export { pollAuthoritative } from "./poll.ts";
 export type { PollDisposition, PollOptions, PollResult } from "./poll.ts";
 export type { AccountIdentity, ConfirmationChallenge, HostedIdentityFlow, IdentityVerificationMethod, LocalOperation, LocalOperationCreate, LocalOperationResult, PasskeyBootstrapResult, ResultRecipient, ServiceReadScope, VerifiedIdentityResult, } from "./slice4.ts";
 export { MaxTransferCommentBytes, MaxWalletMessageBytes, ReplaceActions, transferComment, walletMaterialPurged } from "./walletOperations.ts";
-export type { UserWalletAuthorizationBasis, UserWalletDisplay, UserWalletEffectState, UserWalletOperation, UserWalletOperationCreate, UserWalletOperationKind, UserWalletPurgedDisplay, UserWalletState, WalletResult, WalletResultKind, } from "./walletOperations.ts";
-export interface ClientConfiguration {
-    mode: "mode_b";
-    channel: ClientChannel;
-    authorizationOrigin: string;
-    applicationOrigin?: string;
-    redirectUri: string;
-    publishableClientId: string;
-    tenantId: string;
-    applicationId: string;
-    environmentId: string;
-    methods: readonly IdentityMethod[];
-    mobileApplicationIdentifier?: string;
-}
-export interface PublicClientConfiguration {
-    requestId: string;
-    id: string;
-    name: string;
-    environmentId: string;
-    methods: readonly IdentityMethod[];
-    providerOrigin: string;
-    rpId: string;
-    redirects: readonly string[];
-    platform: ClientChannel;
-}
-export interface FetchRequest {
-    url: string;
-    method?: string;
-    headers?: Record<string, string>;
-    body?: string;
-    credentials?: "include" | "omit";
-    cache?: "no-store";
-    signal?: AbortSignal;
-}
-export interface FetchResponse {
-    status: number;
-    ok: boolean;
-    json(): Promise<unknown>;
-    /** The answer as it arrives and its headers; only a signal stream reads them. */
-    body?: ReadableStream<Uint8Array> | null;
-    headers?: {
-        get(name: string): string | null;
-    };
-}
-export type FetchLike = (url: string, init?: Omit<FetchRequest, "url">) => Promise<FetchResponse>;
-export interface MobileSecureStorage {
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string): Promise<void>;
-    delete(key: string): Promise<void>;
-}
-export interface MobileAssociationInput {
-    redirectUri: string;
-    applicationIdentifier: string;
-}
-export interface MobileAssociationVerification {
-    source: "os_verified_https_association";
-    redirectUri: string;
-    applicationIdentifier: string;
-}
-/**
- * Host/native trust boundary. Implementations must ask the operating system to
- * verify the configured HTTPS app/universal-link association. This result is a
- * port contract, not cryptographic proof produced by this TypeScript package.
- */
-export interface MobileBrowserBridge {
-    verifyAssociatedRedirect(input: MobileAssociationInput): Promise<MobileAssociationVerification | null>;
-    openSystemBrowser(url: string): Promise<void> | void;
-}
-interface CommonDependencies {
-    fetch?: FetchLike;
-    crypto?: Crypto;
-    now?: () => number;
-}
-export interface WebDependencies extends CommonDependencies {
-    currentOrigin: () => string;
-    /**
-     * Opens a separate top-level browsing context. Restore requires the host to
-     * return the final registered app redirect while this caller stays alive so
-     * its state and PKCE verifier remain only in memory.
-     */
-    openHosted: (url: string) => Promise<string | void> | string | void;
-}
-export interface MobileDependencies extends CommonDependencies {
-    browserBridge: MobileBrowserBridge;
-    secureStorage: MobileSecureStorage;
-}
-export type ClientDependencies = WebDependencies | MobileDependencies;
-export interface AuthAttempt {
-    requestId: string;
-    attemptId: string;
-    launchUrl: string;
-    expiresAt: number;
-}
-export interface Session {
-    requestId: string;
-    accessExpiresAt: number;
-    accountId: string;
-    sessionId: string;
-    setupRequired?: boolean;
-}
-export interface MeProjection {
-    requestId: string;
-    account: {
-        accountId: string;
-        version: string;
-        setupRequired: boolean;
-    };
-    sessionId: string;
-    serverTime: number;
-}
-export interface SessionProjection {
-    requestId: string;
-    items: Array<{
-        sessionId: string;
-        clientId: string;
-        state: string;
-        createdAt: string;
-        expiresAt: string;
-        current: boolean;
-    }>;
-    hasMore: boolean;
-    nextCursor?: string;
-}
-export interface WalletProjection {
-    requestId: string;
-    items: Array<{
-        walletId: string;
-        network: string;
-        address: string;
-        state: string;
-        generation: string;
-        mappingVersion: string;
-    }>;
-    hasMore: boolean;
-    nextCursor?: string;
-}
+export type { UserWalletAuthorizationBasis, UserWalletDisplay, UserWalletEffectState, UserWalletOperation, UserWalletOperationCreate, UserWalletOperationKind, UserWalletPurgedDisplay, UserWalletState, WalletResult, WalletResultKind, DeviceSharePackage, } from "./walletOperations.ts";
+export type { AuthAttempt, ClientDependencies, FetchLike, FetchRequest, FetchResponse, MobileDependencies, WebDependencies } from "./clientTypes.ts";
+import { type DeviceShareStore } from "./deviceShares.ts";
+export type { DeviceRecoveryOptions, DeviceShareRecord, DeviceShareStore } from "./deviceShares.ts";
+import type { ClientDependencies, FetchLike, AuthAttempt } from "./clientTypes.ts";
+export type { Session } from "./credentials.ts";
 type NormalizedDependencies = {
     fetch: FetchLike;
     crypto: Crypto;
     now: () => number;
-    launch: (url: string) => Promise<string | void>;
+    launch: (url: string, signal?: AbortSignal) => Promise<string | void>;
     secureStorage?: MobileSecureStorage;
+    browserBridge?: MobileBrowserBridge;
+    deviceShares?: DeviceShareStore;
 };
-export declare function initializeAuthorizationClient(configuration: ClientConfiguration, dependencies: ClientDependencies): Promise<AuthorizationClient>;
+export declare function initializeAuthorizationClient(settings: ClientSettings, dependencies: ClientDependencies): Promise<AuthorizationClient>;
 export declare class AuthorizationClient {
     #private;
     readonly capabilities: {
@@ -167,7 +58,13 @@ export declare class AuthorizationClient {
     readonly publicConfiguration?: PublicClientConfiguration;
     constructor(configuration: ClientConfiguration, dependencies: NormalizedDependencies, publicConfiguration?: PublicClientConfiguration);
     get hasSession(): boolean;
+    /**
+     * signup and login open the hosted sign-in page (on mobile: verify the app link, open the system browser,
+     * exchange what it hands back and resolve with the session). Given a method, they begin that attempt.
+     */
+    signup(): Promise<HostedSignIn>;
     signup(method: IdentityMethod): Promise<AuthAttempt>;
+    login(): Promise<HostedSignIn>;
     login(method: IdentityMethod): Promise<AuthAttempt>;
     bootstrapPasskey(signal?: AbortSignal): Promise<HostedIdentityFlow>;
     verifyIdentity(method: IdentityVerificationMethod, signal?: AbortSignal): Promise<HostedIdentityFlow>;
@@ -179,26 +76,19 @@ export declare class AuthorizationClient {
     createIdentityLink(verifiedIdentityHandle: string, idempotencyKey: string, signal?: AbortSignal): Promise<LocalOperation>;
     createIdentityUnlink(identityId: string, idempotencyKey: string, signal?: AbortSignal): Promise<LocalOperation>;
     createSessionRevocation(sessionId: string, idempotencyKey: string, signal?: AbortSignal): Promise<LocalOperation>;
-    createServiceGrant(input: {
-        walletId: string;
-        servicePrincipalId: string;
-        enabled: boolean;
-        scopes: ServiceReadScope[];
-        externalRef?: string;
-    }, idempotencyKey: string, signal?: AbortSignal): Promise<LocalOperation>;
+    /** createServiceGrant asks to give one service read access to one of the account's wallets, or to change it; the person confirms it with a passkey. */
+    createServiceGrant(input: ServiceGrantInput, idempotencyKey: string, signal?: AbortSignal): Promise<LocalOperation>;
+    /** revokeServiceGrant asks to withdraw the grant of one service on one wallet (`enabled: false`); the person confirms it with a passkey. */
+    revokeServiceGrant(target: ServiceGrantTarget, idempotencyKey: string, signal?: AbortSignal): Promise<LocalOperation>;
+    /** serviceGrants lists the grants the account gave services, in every state, newest first. */
+    serviceGrants(input?: AbortSignal | PageOptions): Promise<ServiceGrantPage>;
     operation(operationId: string, signal?: AbortSignal): Promise<LocalOperation>;
     challengeOperation(operationId: string, credentialId: string, signal?: AbortSignal): Promise<ConfirmationChallenge>;
     completeOperationConfirmation(callbackUri: string, signal?: AbortSignal): Promise<LocalOperation>;
-    /**
-     * createWalletOperation admits one Mode B wallet intent on POST /v1/operations.
-     * The closed body is validated locally against the current session account
-     * before the request leaves the client (source §1.3, §2.2).
-     */
+    /** createWalletOperation admits one Mode B wallet intent, its closed body checked locally first (source §1.3, §2.2). */
     createWalletOperation(create: UserWalletOperationCreate, idempotencyKey: string, signal?: AbortSignal): Promise<UserWalletOperation>;
-    createWallet(input: {
-        network: string;
-        recipientPublicKey: string;
-    }, idempotencyKey: string, signal?: AbortSignal): Promise<UserWalletOperation>;
+    /** Without recipientPublicKey the SDK makes the device key and keeps the share (deviceShares.ts); grant opens the wallet to a service in the same confirmation (walletCreateGrant.ts). */
+    createWallet(input: WalletCreateInput, idempotencyKey: string, signal?: AbortSignal): Promise<UserWalletOperation>;
     signWithWallet(input: {
         walletId: string;
         network: string;
@@ -222,17 +112,10 @@ export declare class AuthorizationClient {
     }, idempotencyKey: string, signal?: AbortSignal): Promise<UserWalletOperation>;
     /** walletOperation reads the safe wallet status on GET /v1/operations/{operation_id}. */
     walletOperation(operationId: string, signal?: AbortSignal): Promise<UserWalletOperation>;
-    /**
-     * challengeWalletOperation reuses the shared confirmation challenge route and
-     * pending-state bookkeeping; the wallet and local challenge contracts are the
-     * same closed response.
-     */
+    /** challengeWalletOperation is challengeOperation: the wallet and local challenges are one closed response. */
     challengeWalletOperation(operationId: string, credentialId: string, signal?: AbortSignal): Promise<ConfirmationChallenge>;
     completeWalletOperationConfirmation(callbackUri: string, signal?: AbortSignal): Promise<UserWalletOperation>;
-    /**
-     * executeWalletOperation claims one confirmed wallet effect. The first claim
-     * answers 202 and an exact replay answers 200; both carry the same operation.
-     */
+    /** executeWalletOperation claims one confirmed wallet effect: 202, or 200 for an exact replay, with the same operation. */
     executeWalletOperation(operationId: string, version: string, idempotencyKey: string, signal?: AbortSignal): Promise<UserWalletOperation>;
     /** walletOperationResult reads the protected wallet output for its frozen recipient. */
     walletOperationResult(operationId: string, signal?: AbortSignal): Promise<WalletResult>;
@@ -240,25 +123,30 @@ export declare class AuthorizationClient {
     /** HTTP-only Auth-owned links and session-authorized Streams registration. */
     linkedWallets(): LinkedWallets;
     /**
-     * streams binds the two authorized Streams reads of source §2.6 to this
-     * session's protected GET, so the account caller reuses the one access-token
-     * and refresh path. The read contract, its types and its bounds live in the
-     * `./streams` entry point, which this file deliberately does not re-export; a
-     * service caller constructs `StreamsReads` there with its own credentialed
-     * GET. The caller supplies the stable `idempotencyKey` in each read's options;
-     * it is forwarded unchanged on the original GET and any protected 401 retry.
+     * streams binds the authorized Streams reads (source §2.6, `./streams`) to this session's protected GET;
+     * each read's `idempotencyKey` is forwarded unchanged on the GET and any 401 retry.
      */
     streams(): StreamsReads;
     operationResult(operationId: string, signal?: AbortSignal): Promise<LocalOperationResult>;
     cancel(attemptId: string): "local_canceled";
+    /** exchangeHandoff exchanges the redirect back for the session; a signal ends only this caller's wait, never the exchange. */
     exchangeHandoff(callbackUri: string, signal?: AbortSignal): Promise<Session>;
+    /** restoreSession is the top-level restore on the web (webRenewal.ts); on mobile it is refreshSession. */
     restoreSession(signal?: AbortSignal): Promise<Session>;
+    /** refreshSession renews in the background: on the web from the provider's cookie, on mobile with the stored refresh token. */
     refreshSession(signal?: AbortSignal): Promise<Session>;
+    /** logout ends the session here at once and asks the provider to end it; a signal ends only this caller's wait, never the revocation. */
     logout(signal?: AbortSignal): Promise<{
         localCleared: true;
         serverDisposition: "server_revoked" | "server_unconfirmed";
     }>;
+    /**
+     * accessToken is the session's access token for the app's own backend, renewed first when it has
+     * less than 30 seconds to live or a read was refused with it. Never store it or put it in a URL.
+     */
+    accessToken(signal?: AbortSignal): Promise<string>;
     me(signal?: AbortSignal): Promise<MeProjection>;
     sessions(input?: AbortSignal | PageOptions): Promise<SessionProjection>;
+    /** wallets pages the account's own wallets, kind "wallet" in me(), which lists them with the linked ones. */
     wallets(input?: AbortSignal | PageOptions): Promise<WalletProjection>;
 }