@synonymdev/pubky 0.10.0-alpha.0 → 0.11.0

package/index.cjs

@@ -5,6 +5,464 @@ globalThis.fetch = makeFetchCookie(originalFetch);
 
 /* @ts-self-types="./pubky.d.ts" */
 
+const PUBKY_SESSIONS_DB_NAME = "pubky-auth";
+const PUBKY_SESSIONS_DB_VERSION = 1;
+const PUBKY_SESSIONS_STORE_NAME = "storedSessions";
+const PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME = "delegatedGrantKeys";
+
+/** Assert that IndexedDB is available for browser session persistence. */
+function requireIndexedDb() {
+  if (!globalThis.indexedDB) {
+    throw new Error("Pubky session persistence requires IndexedDB.");
+  }
+}
+
+/** Create an operation-specific error while preserving the IndexedDB cause. 
+ * Used for backwards compatability because old browsers don't support the cause property.
+ */
+function contextualSessionStoreError(message, cause) {
+  const error = new Error(message, { cause });
+  if (cause !== undefined && error.cause === undefined) {
+    error.cause = cause;
+  }
+  return error;
+}
+
+/**
+ * Open the IndexedDB database used for browser auth persistence.
+ *
+ * The database contains session records and delegated WebCrypto key handles so
+ * both stores are created here even though single-store helpers use only one.
+ */
+function openSessionStoreDb() {
+  requireIndexedDb();
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(PUBKY_SESSIONS_DB_NAME, PUBKY_SESSIONS_DB_VERSION);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(PUBKY_SESSIONS_STORE_NAME)) {
+        db.createObjectStore(PUBKY_SESSIONS_STORE_NAME, { keyPath: "id" });
+      }
+      if (!db.objectStoreNames.contains(PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME)) {
+        db.createObjectStore(PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME, { keyPath: "keyId" });
+      }
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error("Opening Pubky session store failed."));
+  });
+}
+
+/**
+ * Run an IndexedDB operation against the stored-session object store.
+ *
+ * The callback receives the object store and returns a request. This wrapper
+ * resolves only after the transaction commits, not when the request succeeds.
+ */
+async function withSessionStore(mode, operation) {
+  const db = await openSessionStoreDb();
+  try {
+    return await new Promise((resolve, reject) => {
+      const tx = db.transaction(PUBKY_SESSIONS_STORE_NAME, mode);
+      const store = tx.objectStore(PUBKY_SESSIONS_STORE_NAME);
+      let result;
+      let settled = false;
+
+      function fail(error) {
+        if (settled) return;
+        settled = true;
+        reject(error);
+      }
+
+      try {
+        const request = operation(store);
+        request.onsuccess = () => {
+          result = request.result;
+        };
+        request.onerror = () => fail(request.error ?? new Error("Pubky session store request failed."));
+      } catch (error) {
+        fail(error);
+      }
+      tx.onerror = () => fail(tx.error ?? new Error("Pubky session store transaction failed."));
+      tx.onabort = () => fail(tx.error ?? new Error("Pubky session store transaction aborted."));
+      tx.oncomplete = () => {
+        if (settled) return;
+        settled = true;
+        resolve(result);
+      };
+    });
+  } finally {
+    db.close();
+  }
+}
+
+/** Return whether browser session persistence can open its IndexedDB database. */
+async function __pubkySessionStoreIsAvailable() {
+  if (!globalThis.indexedDB) return false;
+  try {
+    const db = await openSessionStoreDb();
+    db.close();
+    return true;
+  } catch (_error) {
+    return false;
+  }
+}
+
+/** Persist or replace a browser session record. */
+async function __pubkySessionStorePut(record) {
+  requireIndexedDb();
+  try {
+    await withSessionStore("readwrite", (store) => store.put(record));
+  } catch (error) {
+    throw contextualSessionStoreError("Saving Pubky session failed.", error);
+  }
+}
+
+/** Load a browser session record by id. */
+async function __pubkySessionStoreGet(id) {
+  requireIndexedDb();
+  try {
+    return await withSessionStore("readonly", (store) => store.get(id));
+  } catch (error) {
+    throw contextualSessionStoreError("Reading Pubky session failed.", error);
+  }
+}
+
+/** List all browser session records, returning an empty list if storage is unavailable. */
+async function __pubkySessionStoreList() {
+  if (!globalThis.indexedDB) return [];
+  try {
+    return (await withSessionStore("readonly", (store) => store.getAll())) ?? [];
+  } catch (_error) {
+    return [];
+  }
+}
+
+/** Remove one browser session record by id. */
+async function __pubkySessionStoreDelete(id) {
+  requireIndexedDb();
+  try {
+    await withSessionStore("readwrite", (store) => store.delete(id));
+  } catch (error) {
+    throw contextualSessionStoreError("Removing Pubky session failed.", error);
+  }
+}
+
+/**
+ * Clear saved session records and the delegated keys referenced by those records.
+ *
+ * Delegated keys not referenced by the supplied ids are intentionally preserved,
+ * because they may belong to pending or unsaved grant flows.
+ */
+async function __pubkySessionStoreClear(delegatedKeyIds) {
+  requireIndexedDb();
+  const db = await openSessionStoreDb();
+  try {
+    await new Promise((resolve, reject) => {
+      const tx = db.transaction(
+        [PUBKY_SESSIONS_STORE_NAME, PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME],
+        "readwrite",
+      );
+      const sessions = tx.objectStore(PUBKY_SESSIONS_STORE_NAME);
+      const keys = tx.objectStore(PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME);
+      sessions.clear();
+      for (const keyId of new Set(delegatedKeyIds ?? [])) {
+        keys.delete(keyId);
+      }
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(tx.error ?? new Error("Clearing Pubky session store failed."));
+      tx.onabort = () => reject(tx.error ?? new Error("Clearing Pubky session store aborted."));
+    });
+  } finally {
+    db.close();
+  }
+}
+
+/** Clear all browser auth records, including all delegated key handles. */
+async function __pubkySessionStoreClearAll() {
+  requireIndexedDb();
+  const db = await openSessionStoreDb();
+  try {
+    await new Promise((resolve, reject) => {
+      const tx = db.transaction(
+        [PUBKY_SESSIONS_STORE_NAME, PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME],
+        "readwrite",
+      );
+      tx.objectStore(PUBKY_SESSIONS_STORE_NAME).clear();
+      tx.objectStore(PUBKY_SESSIONS_DELEGATED_KEYS_STORE_NAME).clear();
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(tx.error ?? new Error("Clearing Pubky auth store failed."));
+      tx.onabort = () => reject(tx.error ?? new Error("Clearing Pubky auth store aborted."));
+    });
+  } finally {
+    db.close();
+  }
+}
+
+const PUBKY_GRANT_KEYS_DB_NAME = "pubky-auth";
+const PUBKY_GRANT_KEYS_DB_VERSION = 1;
+const PUBKY_GRANT_KEYS_STORE_NAME = "delegatedGrantKeys";
+const PUBKY_GRANT_KEYS_SESSION_STORE_NAME = "storedSessions";
+let canUseDelegationPromise;
+const TEST_CAN_USE_DELEGATION_OVERRIDE = "__pubkyGrantCanUseDelegationOverride";
+
+/**
+ * Assert that this runtime can persist non-extractable browser signing keys.
+ *
+ * SubtleCrypto is exposed only in secure contexts. We rely on browser feature
+ * detection here so each browser can decide which origins are trustworthy,
+ * including localhost, file://, extension pages, and workers.
+ */
+function requireBrowserCrypto() {
+  const g = globalThis;
+
+  if (!g.crypto?.subtle || !g.indexedDB) {
+    if (!g.isSecureContext) {
+      throw new Error("Delegated grant keys require a secure browser context.");
+    }
+    throw new Error("Delegated grant keys require browser WebCrypto and IndexedDB.");
+  }
+}
+
+function contextualError(message, cause) {
+  const error = new Error(message, { cause });
+  if (cause !== undefined && error.cause === undefined) {
+    error.cause = cause;
+  }
+  return error;
+}
+
+/**
+ * Return whether this runtime appears able to use delegated grant keys.
+ *
+ * This is a synchronous feature check only. Starting, resuming, or restoring a
+ * delegated flow can still fail later if IndexedDB access is denied, storage is
+ * cleared, or a saved key id no longer exists.
+ */
+function __pubkyGrantIsDelegationAvailable() {
+  const g = globalThis;
+  return Boolean(g.isSecureContext && g.crypto?.subtle && g.indexedDB);
+}
+
+/**
+ * Return whether this runtime can actually create, store, and use browser-held
+ * Ed25519 delegated grant keys.
+ *
+ * Some browser-like runtimes expose secure WebCrypto and IndexedDB but do not
+ * implement Ed25519. Cache the probe because it creates a real CryptoKey and
+ * verifies that IndexedDB can store/delete it.
+ */
+async function __pubkyGrantCanUseDelegation() {
+  const override = globalThis[TEST_CAN_USE_DELEGATION_OVERRIDE];
+  if (override === true || override === false) return override;
+
+  if (!canUseDelegationPromise) {
+    canUseDelegationPromise = (async () => {
+      try {
+        requireBrowserCrypto();
+        const keyId = `__pubky_probe_${randomKeyId()}`;
+        const pair = await crypto.subtle.generateKey({ name: "Ed25519" }, false, ["sign", "verify"]);
+        const publicKeyRaw = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+        const data = new TextEncoder().encode("pubky-delegated-grant-probe");
+        const signature = new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, pair.privateKey, data));
+        if (publicKeyRaw.length !== 32 || signature.length !== 64) return false;
+        await putRecord({
+          keyId,
+          privateKey: pair.privateKey,
+          publicKeyRaw,
+          createdAt: Date.now(),
+        });
+        await deleteRecord(keyId);
+        return true;
+      } catch (_error) {
+        return false;
+      }
+    })();
+  }
+  return await canUseDelegationPromise;
+}
+
+/**
+ * Open the IndexedDB database used for delegated grant keys.
+ *
+ * Records are keyed by the SDK-level key id and contain a non-extractable
+ * CryptoKey plus the raw public key bytes needed for grant metadata.
+ */
+function openGrantKeyDb() {
+  requireBrowserCrypto();
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(PUBKY_GRANT_KEYS_DB_NAME, PUBKY_GRANT_KEYS_DB_VERSION);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(PUBKY_GRANT_KEYS_STORE_NAME)) {
+        db.createObjectStore(PUBKY_GRANT_KEYS_STORE_NAME, { keyPath: "keyId" });
+      }
+      if (!db.objectStoreNames.contains(PUBKY_GRANT_KEYS_SESSION_STORE_NAME)) {
+        db.createObjectStore(PUBKY_GRANT_KEYS_SESSION_STORE_NAME, { keyPath: "id" });
+      }
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error("Opening delegated grant key store failed."));
+  });
+}
+
+/**
+ * Run an IndexedDB operation against the delegated-key object store.
+ *
+ * The callback receives the object store and returns a request. This wrapper
+ * resolves only after the transaction commits, not when the request succeeds.
+ */
+async function withGrantKeyStore(mode, operation) {
+  const db = await openGrantKeyDb();
+  try {
+    return await new Promise((resolve, reject) => {
+      const tx = db.transaction(PUBKY_GRANT_KEYS_STORE_NAME, mode);
+      const store = tx.objectStore(PUBKY_GRANT_KEYS_STORE_NAME);
+      let result;
+      let settled = false;
+
+      function fail(error) {
+        if (settled) return;
+        settled = true;
+        reject(error);
+      }
+
+      try {
+        const request = operation(store);
+        request.onsuccess = () => {
+          result = request.result;
+        };
+        request.onerror = () => fail(request.error ?? new Error("Delegated grant key request failed."));
+      } catch (error) {
+        fail(error);
+      }
+      tx.onerror = () => fail(tx.error ?? new Error("Delegated grant key transaction failed."));
+      tx.onabort = () => fail(tx.error ?? new Error("Delegated grant key transaction aborted."));
+      tx.oncomplete = () => {
+        if (settled) return;
+        settled = true;
+        resolve(result);
+      };
+    });
+  } finally {
+    db.close();
+  }
+}
+
+/**
+ * Load a delegated-key record by key id.
+ *
+ * Returns `undefined` when the key id is unknown. Callers decide whether that
+ * should create a new key or surface a restore/signing error.
+ */
+async function getRecord(keyId) {
+  try {
+    return await withGrantKeyStore("readonly", (store) => store.get(keyId));
+  } catch (error) {
+    throw contextualError("Reading delegated grant key failed.", error);
+  }
+}
+
+/**
+ * Persist a delegated-key record.
+ *
+ * The private key is a non-extractable CryptoKey, so IndexedDB stores a browser
+ * handle rather than raw private key bytes.
+ */
+async function putRecord(record) {
+  try {
+    await withGrantKeyStore("readwrite", (store) => store.put(record));
+  } catch (error) {
+    throw contextualError("Saving delegated grant key failed.", error);
+  }
+}
+
+async function deleteRecord(keyId) {
+  try {
+    await withGrantKeyStore("readwrite", (store) => store.delete(keyId));
+  } catch (error) {
+    throw contextualError("Deleting delegated grant key failed.", error);
+  }
+}
+
+/**
+ * Generate an opaque key id for the IndexedDB record.
+ *
+ * Use randomUUID when available, with a getRandomValues fallback for older
+ * secure browser contexts.
+ */
+function randomKeyId() {
+  if (globalThis.crypto?.randomUUID) return crypto.randomUUID();
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+/**
+ * Ensure a delegated grant signing key exists.
+ *
+ * If `keyId` is provided by an internal restore/reuse path and already exists,
+ * return its public key. Otherwise generate a new non-extractable Ed25519
+ * keypair, store the private CryptoKey in IndexedDB, and return
+ * `{ keyId, publicKey }`.
+ */
+async function __pubkyGrantEnsureDelegatedKey(keyId) {
+  requireBrowserCrypto();
+  const resolvedKeyId = keyId || randomKeyId();
+  const existing = await getRecord(resolvedKeyId);
+  if (existing) {
+    return { keyId: resolvedKeyId, publicKey: new Uint8Array(existing.publicKeyRaw) };
+  }
+
+  const pair = await crypto.subtle.generateKey({ name: "Ed25519" }, false, ["sign", "verify"]);
+  const publicKeyRaw = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+  await putRecord({
+    keyId: resolvedKeyId,
+    privateKey: pair.privateKey,
+    publicKeyRaw,
+    createdAt: Date.now(),
+  });
+  return { keyId: resolvedKeyId, publicKey: publicKeyRaw };
+}
+
+/**
+ * Load the public key bytes for a delegated grant key.
+ *
+ * Used during delegated session restore to verify that saved metadata still
+ * matches the browser-held key.
+ */
+async function __pubkyGrantLoadDelegatedPublicKey(keyId) {
+  requireBrowserCrypto();
+  const existing = await getRecord(keyId);
+  if (!existing) throw new Error(`Delegated grant key not found: ${keyId}`);
+  return new Uint8Array(existing.publicKeyRaw);
+}
+
+/**
+ * Sign a grant PoP JWS signing input with a delegated browser key.
+ *
+ * `signingInput` is the exact ASCII JWS signing input produced by Rust:
+ * `base64url(header) + "." + base64url(claims)`. The raw Ed25519 signature
+ * bytes are returned to Rust, which finishes compact JWS serialization.
+ */
+async function __pubkyGrantDelegatedSign(keyId, signingInput) {
+  requireBrowserCrypto();
+  const existing = await getRecord(keyId);
+  if (!existing?.privateKey) throw new Error(`Delegated grant key not found: ${keyId}`);
+  const data = new TextEncoder().encode(signingInput);
+  return new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, existing.privateKey, data));
+}
+
+/**
+ * Delete a browser-held delegated grant key by id.
+ *
+ * Used when a persisted delegated session record is removed from the SDK
+ * session store. Missing keys are treated as already deleted.
+ */
+async function __pubkyGrantDeleteDelegatedKey(keyId) {
+  requireBrowserCrypto();
+  await deleteRecord(keyId);
+}
+
 /**
  * Start and control a pubkyauth authorization flow.
  *
@@ -135,6 +593,9 @@ class AuthFlow {
      * Optional HTTP relay base, e.g. `"https://demo.httprelay.io/inbox/"`.
      * Defaults to the default Synonym-hosted relay when omitted.
      *
+     * @param {XCallbackParams} [xCallback]
+     * Optional return destinations for success, error, and cancellation.
+     *
      * @returns {AuthFlow}
      * A running auth flow. Call `authorizationUrl()` to show the deep link,
      * then `awaitApproval()` to receive a `Session`.
@@ -150,16 +611,17 @@ class AuthFlow {
      * @param {Capabilities} capabilities
      * @param {AuthFlowKind} kind
      * @param {string | null} [relay]
+     * @param {XCallbackParams | null} [x_callback]
      * @returns {AuthFlow}
      */
-    static start(capabilities, kind, relay) {
+    static start(capabilities, kind, relay, x_callback) {
         const ptr0 = passStringToWasm0(capabilities, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
         _assertClass(kind, AuthFlowKind);
         var ptr1 = kind.__destroy_into_raw();
         var ptr2 = isLikeNone(relay) ? 0 : passStringToWasm0(relay, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         var len2 = WASM_VECTOR_LEN;
-        const ret = wasm.authflow_start(ptr0, len0, ptr1, ptr2, len2);
+        const ret = wasm.authflow_start(ptr0, len0, ptr1, ptr2, len2, isLikeNone(x_callback) ? 0 : addToExternrefTable0(x_callback));
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
@@ -386,6 +848,103 @@ class AuthToken {
 if (Symbol.dispose) AuthToken.prototype[Symbol.dispose] = AuthToken.prototype.free;
 exports.AuthToken = AuthToken;
 
+/**
+ * Browser-backed durable store for completed grant sessions.
+ */
+class BrowserSessionStore {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(BrowserSessionStore.prototype);
+        obj.__wbg_ptr = ptr;
+        BrowserSessionStoreFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        BrowserSessionStoreFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_browsersessionstore_free(ptr, 0);
+    }
+    /**
+     * Clear all local stored session records for this origin.
+     *
+     * Delegated keys referenced by those stored session records are removed.
+     * Delegated keys that only belong to pending grant flows are preserved.
+     * @returns {Promise<void>}
+     */
+    clear() {
+        const ret = wasm.browsersessionstore_clear(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Clear all browser auth persistence owned by this SDK origin.
+     *
+     * This removes all stored session records and all browser-held delegated
+     * grant keys, including keys for pending delegated grant flows. Saved
+     * delegated flow state becomes unrestorable. This does not revoke remote
+     * grants or immediately invalidate already-live in-memory sessions.
+     * @returns {Promise<void>}
+     */
+    clearAll() {
+        const ret = wasm.browsersessionstore_clearAll(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Whether IndexedDB is available for durable session persistence.
+     * @returns {Promise<boolean>}
+     */
+    isAvailable() {
+        const ret = wasm.browsersessionstore_isAvailable(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * List all locally stored sessions for this origin.
+     * @returns {Promise<StoredSessionInfo[]>}
+     */
+    list() {
+        const ret = wasm.browsersessionstore_list(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Remove local stored session metadata and any SDK-owned delegated key for that record.
+     * @param {string} id
+     * @returns {Promise<void>}
+     */
+    remove(id) {
+        const ptr0 = passStringToWasm0(id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.browsersessionstore_remove(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
+    /**
+     * Restore a specific stored session by id.
+     * @param {string} id
+     * @returns {Promise<Session>}
+     */
+    restore(id) {
+        const ptr0 = passStringToWasm0(id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.browsersessionstore_restore(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
+    /**
+     * Persist a completed grant session in IndexedDB.
+     * @param {Session} session
+     * @returns {Promise<StoredSessionInfo>}
+     */
+    save(session) {
+        _assertClass(session, Session);
+        const ret = wasm.browsersessionstore_save(this.__wbg_ptr, session.__wbg_ptr);
+        return ret;
+    }
+}
+if (Symbol.dispose) BrowserSessionStore.prototype[Symbol.dispose] = BrowserSessionStore.prototype.free;
+exports.BrowserSessionStore = BrowserSessionStore;
+
 /**
  * Low-level HTTP bridge used by the Pubky facade and actors.
  *
@@ -561,6 +1120,89 @@ class CookieSession {
 if (Symbol.dispose) CookieSession.prototype[Symbol.dispose] = CookieSession.prototype.free;
 exports.CookieSession = CookieSession;
 
+/**
+ * Parsed direct signup deeplink.
+ */
+class DirectSignupDeepLink {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(DirectSignupDeepLink.prototype);
+        obj.__wbg_ptr = ptr;
+        DirectSignupDeepLinkFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        DirectSignupDeepLinkFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_directsignupdeeplink_free(ptr, 0);
+    }
+    /**
+     * Homeserver public key requested for account creation.
+     * @returns {PublicKey}
+     */
+    get homeserver() {
+        const ret = wasm.directsignupdeeplink_homeserver(this.__wbg_ptr);
+        return PublicKey.__wrap(ret);
+    }
+    /**
+     * Parse a direct signup deeplink URL.
+     * @param {string} url
+     * @returns {DirectSignupDeepLink}
+     */
+    static parse(url) {
+        const ptr0 = passStringToWasm0(url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.directsignupdeeplink_parse(ptr0, len0);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return DirectSignupDeepLink.__wrap(ret[0]);
+    }
+    /**
+     * Optional signup token included in the request.
+     * @returns {string | undefined}
+     */
+    get signupToken() {
+        const ret = wasm.directsignupdeeplink_signupToken(this.__wbg_ptr);
+        let v1;
+        if (ret[0] !== 0) {
+            v1 = getStringFromWasm0(ret[0], ret[1]).slice();
+            wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        }
+        return v1;
+    }
+    /**
+     * @returns {string}
+     */
+    toString() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.directsignupdeeplink_toString(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Optional x-callback-url metadata carried by this deep link.
+     * @returns {XCallbackParams}
+     */
+    get xCallback() {
+        const ret = wasm.directsignupdeeplink_xCallback(this.__wbg_ptr);
+        return ret;
+    }
+}
+if (Symbol.dispose) DirectSignupDeepLink.prototype[Symbol.dispose] = DirectSignupDeepLink.prototype.free;
+exports.DirectSignupDeepLink = DirectSignupDeepLink;
+
 /**
  * A single event from the event stream.
  *
@@ -674,6 +1316,15 @@ exports.Event = Event;
  *   console.log(event.eventType, event.resource.path);
  * }
  * ```
+ *
+ * @example
+ * ```typescript
+ * // Private events: attach a session and request a `/priv/...` path.
+ * const stream = await pubky.eventStreamForUser(userPubkey, null)
+ *   .session(session)
+ *   .path("/priv/app/")
+ *   .subscribe();
+ * ```
  */
 class EventStreamBuilder {
     static __wrap(ptr) {
@@ -777,12 +1428,17 @@ class EventStreamBuilder {
         return EventStreamBuilder.__wrap(ret);
     }
     /**
-     * Filter events by path prefix.
+     * Filter events by path. Call once per path to receive the
+     * union of several scopes (e.g. `/pub/` plus a private `/priv/app/`).
+     *
+     * Format: a path WITHOUT the `pubky://` scheme or user pubkey. A trailing
+     * slash matches a directory and all its descendants (`/pub/files/`); no
+     * trailing slash matches an exact file (`/pub/notes.txt`).
      *
-     * Format: Path WITHOUT `pubky://` scheme or user pubkey (e.g., "/pub/files/" or "/pub/").
-     * Only events whose path starts with this prefix are returned.
+     * Private (`/priv/...`) paths require a session attached via `session()`;
+     * without one the homeserver rejects the subscription with 401.
      *
-     * @param {string} path - Path prefix to filter by
+     * @param {string} path - Path filter (repeatable)
      * @returns {EventStreamBuilder} - Builder for chaining
      * @param {string} path
      * @returns {EventStreamBuilder}
@@ -811,6 +1467,26 @@ class EventStreamBuilder {
         const ret = wasm.eventstreambuilder_reverse(ptr);
         return EventStreamBuilder.__wrap(ret);
     }
+    /**
+     * Authenticate the subscription with a user `Session`.
+     *
+     * Required to receive private (`/priv/...`) events: the session credential
+     * (grant or cookie) is attached so the homeserver can authorize each private
+     * `path()` against the session's read capabilities. Public subscriptions
+     * don't need this.
+     *
+     *
+     * @param {Session} session - The authenticated session
+     * @returns {EventStreamBuilder} - Builder for chaining
+     * @param {Session} session
+     * @returns {EventStreamBuilder}
+     */
+    session(session) {
+        const ptr = this.__destroy_into_raw();
+        _assertClass(session, Session);
+        const ret = wasm.eventstreambuilder_session(ptr, session.__wbg_ptr);
+        return EventStreamBuilder.__wrap(ret);
+    }
     /**
      * Subscribe to the event stream.
      *
@@ -895,6 +1571,18 @@ class GrantAuthFlow {
         const ret = wasm.grantauthflow_awaitApproval(this.__wbg_ptr);
         return ret;
     }
+    /**
+     * Whether delegated grant auth is available in the current JS runtime.
+     *
+     * This checks for a secure browser context with WebCrypto `crypto.subtle`
+     * and IndexedDB. It is a coarse synchronous feature-detection helper only;
+     * some runtimes expose those primitives without Ed25519 support.
+     * @returns {boolean}
+     */
+    static get isDelegationAvailable() {
+        const ret = wasm.grantauthflow_isDelegationAvailable();
+        return ret !== 0;
+    }
     /**
      * Resume a previously saved pending grant auth flow (standalone).
      * Prefer `pubky.resumeGrantAuthFlow()` to reuse a facade client.
@@ -902,7 +1590,7 @@ class GrantAuthFlow {
      * **Security:** `savedState` contains the relay secret and PoP client private key.
      * Store it only temporarily and delete it once the flow completes or is abandoned.
      *
-     * @param {string} savedState A string produced by `grantFlow.save()`.
+     * @param {string} savedState A string produced by `grantFlow.saveLocal()`.
      * @returns {GrantAuthFlow} A flow reconnected to the original relay channel.
      * @param {string} saved_state
      * @returns {GrantAuthFlow}
@@ -914,20 +1602,62 @@ class GrantAuthFlow {
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
-        return GrantAuthFlow.__wrap(ret[0]);
+        return GrantAuthFlow.__wrap(ret[0]);
+    }
+    /**
+     * Resume a previously saved pending delegated grant auth flow.
+     *
+     * Runtime: delegated grant keys require a secure browser context with
+     * WebCrypto `crypto.subtle` and IndexedDB. The saved `keyId` must still
+     * exist in IndexedDB for the same origin. Unsupported runtimes reject with
+     * `ClientStateError`.
+     * @param {string} saved_state
+     * @returns {Promise<GrantAuthFlow>}
+     */
+    static resumeDelegated(saved_state) {
+        const ptr0 = passStringToWasm0(saved_state, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.grantauthflow_resumeDelegated(ptr0, len0);
+        return ret;
+    }
+    /**
+     * Save sensitive state required to resume this delegated pending grant flow.
+     *
+     * This does not export the delegated private key, but it includes the relay
+     * secret in the authorization URL. Store it only temporarily and delete it
+     * once the flow completes or is abandoned.
+     * @returns {string}
+     */
+    saveDelegated() {
+        let deferred2_0;
+        let deferred2_1;
+        try {
+            const ret = wasm.grantauthflow_saveDelegated(this.__wbg_ptr);
+            var ptr1 = ret[0];
+            var len1 = ret[1];
+            if (ret[3]) {
+                ptr1 = 0; len1 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred2_0 = ptr1;
+            deferred2_1 = len1;
+            return getStringFromWasm0(ptr1, len1);
+        } finally {
+            wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+        }
     }
     /**
-     * Save sensitive state required to resume this pending grant flow.
+     * Save sensitive state required to resume this pending local grant flow.
      *
      * @returns {string} Opaque state for `GrantAuthFlow.resume()` or
      * `pubky.resumeGrantAuthFlow()`.
      * @returns {string}
      */
-    save() {
+    saveLocal() {
         let deferred2_0;
         let deferred2_1;
         try {
-            const ret = wasm.grantauthflow_save(this.__wbg_ptr);
+            const ret = wasm.grantauthflow_saveLocal(this.__wbg_ptr);
             var ptr1 = ret[0];
             var len1 = ret[1];
             if (ret[3]) {
@@ -942,8 +1672,8 @@ class GrantAuthFlow {
         }
     }
     /**
-     * Start a grant-backed flow (standalone).
-     * Prefer `pubky.startGrantAuthFlow()` to reuse a facade client.
+     * Start a grant-backed flow with a new DHT client.
+     * Prefer `pubky.startGrantAuthFlow()` to reuse a facade DHT client.
      *
      * @param {string} capabilities
      * Comma-separated capabilities, e.g. `"/pub/app/:rw,/priv/foo.txt:r"`.
@@ -953,7 +1683,7 @@ class GrantAuthFlow {
      * The kind of authentication flow to perform.
      *
      * @param {GrantAuthFlowOptions} options
-     * Options for the grant flow: `{ clientId, relay? }`.
+     * Options for the grant flow: `{ clientId, relay?, xCallback? }`.
      *
      * @returns {GrantAuthFlow}
      * A running grant auth flow. Call `authorizationUrl()` to show the deep link,
@@ -974,6 +1704,28 @@ class GrantAuthFlow {
         }
         return GrantAuthFlow.__wrap(ret[0]);
     }
+    /**
+     * Start a browser delegated grant-backed flow.
+     *
+     * The SDK creates a fresh non-extractable WebCrypto Ed25519 key in
+     * IndexedDB and uses that key for grant Proof-of-Possession signing.
+     *
+     * Runtime: delegated grant keys require a secure browser context with
+     * WebCrypto `crypto.subtle` and IndexedDB. Unsupported runtimes reject
+     * with `ClientStateError`.
+     * @param {Capabilities} capabilities
+     * @param {AuthFlowKind} kind
+     * @param {GrantAuthFlowOptions} options
+     * @returns {Promise<GrantAuthFlow>}
+     */
+    static startDelegated(capabilities, kind, options) {
+        const ptr0 = passStringToWasm0(capabilities, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        _assertClass(kind, AuthFlowKind);
+        var ptr1 = kind.__destroy_into_raw();
+        const ret = wasm.grantauthflow_startDelegated(ptr0, len0, ptr1, options);
+        return ret;
+    }
     /**
      * Non-blocking single poll step (advanced UIs).
      *
@@ -1164,7 +1916,7 @@ class GrantSession {
         wasm.__wbg_grantsession_free(ptr, 0);
     }
     /**
-     * Export the durable refresh material needed to restore this grant session.
+     * Export the portable local secret material needed to restore this grant session.
      *
      * Treat the returned string as bearer-equivalent secret material until the
      * grant expires or is revoked.
@@ -1172,8 +1924,8 @@ class GrantSession {
      * @returns {Promise<string>}
      * @returns {Promise<string>}
      */
-    exportSecret() {
-        const ret = wasm.grantsession_exportSecret(this.__wbg_ptr);
+    exportLocalSecret() {
+        const ret = wasm.grantsession_exportLocalSecret(this.__wbg_ptr);
         return ret;
     }
     /**
@@ -1561,6 +2313,8 @@ class Pkdns {
      * Resolve the homeserver for **this** user (requires keypair).
      *
      * @returns {Promise<PublicKey|undefined>} Homeserver public key or `undefined` if not found.
+     * @throws When no keypair is attached, Pkarr resolution fails, or a resolved `_pubky` target
+     *   is malformed.
      * @returns {Promise<PublicKey | undefined>}
      */
     getHomeserver() {
@@ -1571,7 +2325,9 @@ class Pkdns {
      * Resolve the homeserver for a given public key (read-only).
      *
      * @param {PublicKey} user
-     * @returns {Promise<PublicKey|undefined>} Homeserver public key or `undefined` if not found.
+     * @returns {Promise<PublicKey|undefined>} Homeserver public key, or `undefined` when the
+     *   user has no resolvable homeserver record.
+     * @throws When Pkarr resolution fails or a resolved `_pubky` target is malformed.
      * @param {PublicKey} pubky
      * @returns {Promise<PublicKey | undefined>}
      */
@@ -1655,6 +2411,18 @@ class Pubky {
         const ptr = this.__destroy_into_raw();
         wasm.__wbg_pubky_free(ptr, 0);
     }
+    /**
+     * Browser-backed store for explicitly persisted completed grant sessions.
+     *
+     * Use `browserSessionStore.save(session)` after a successful grant auth flow to make
+     * the session restorable after reload. The store supports multiple accounts
+     * and multiple grants per account.
+     * @returns {BrowserSessionStore}
+     */
+    get browserSessionStore() {
+        const ret = wasm.pubky_browserSessionStore(this.__wbg_ptr);
+        return BrowserSessionStore.__wrap(ret);
+    }
     /**
      * Access the underlying HTTP client (advanced).
      *
@@ -1739,7 +2507,9 @@ class Pubky {
      * Uses an internal read-only Pkdns actor.
      *
      * @param {PublicKey} user
-     * @returns {Promise<PublicKey|undefined>} Homeserver public key or `undefined` if not found.
+     * @returns {Promise<PublicKey|undefined>} Homeserver public key, or `undefined` when the
+     *   user has no resolvable homeserver record.
+     * @throws When Pkarr resolution fails or a resolved `_pubky` target is malformed.
      * @param {PublicKey} user_public_key
      * @returns {Promise<PublicKey | undefined>}
      */
@@ -1790,11 +2560,11 @@ class Pubky {
     /**
      * Restore a session from a previously exported token or snapshot, using this instance's client.
      *
-     * Accepts grant secret tokens from `session.exportSecret()` and legacy cookie
+     * Accepts grant secret tokens from `session.exportLocalSecret()` and legacy cookie
      * secret tokens. Also accepts legacy cookie metadata snapshots from `session.export()`.
      * Grant restore mints a fresh short-lived bearer.
      *
-     * @param {string} exported A string produced by `session.exportSecret()` or legacy `session.export()`.
+     * @param {string} exported A string produced by `session.exportLocalSecret()` or legacy `session.export()`.
      * @returns {Promise<Session>}
      * A rehydrated session bound to this SDK's HTTP client.
      *
@@ -1812,11 +2582,17 @@ class Pubky {
     /**
      * Resume a previously started **pubkyauth** flow from its saved `authorizationUrl`.
      *
+     * If the user refreshes or navigates away mid-flow, WASM memory is lost and
+     * the original `AuthFlow` object is gone. You can reconnect to the same relay
+     * channel by saving the `authorizationUrl` beforehand and calling this method
+     * after reload.
+     *
      * The relay inbox retains messages for **~5 minutes**. Resume is only
      * viable within that window; afterwards start a fresh flow.
      *
      * **Security:** The URL contains the `client_secret` in plaintext.
-     * Delete it from storage as soon as the resumed flow completes.
+     * Store it in `sessionStorage` (scoped to the tab), **not** `localStorage`,
+     * and delete it as soon as the resumed flow completes or is abandoned.
      * See `startCookieAuthFlow()` docs for full storage guidance.
      *
      * @param {string} authorizationUrl The `pubkyauth://…` URL from a previous flow.
@@ -1824,6 +2600,23 @@ class Pubky {
      * @throws {PubkyError}
      * - `{ name: "AuthenticationError" }` if the URL is invalid or not a signin/signup link
      * - `{ name: "RequestError" }` on network/relay failure
+     *
+     * @example
+     * // 1) Before a potential refresh, persist the URL.
+     * const flow = pubky.startCookieAuthFlow("/pub/my-cool-app/:rw", AuthFlowKind.signin());
+     * sessionStorage.setItem("pubky-auth-url", flow.authorizationUrl);
+     * renderQr(flow.authorizationUrl);
+     *
+     * // 2) After reload, resume from the saved URL.
+     * const savedUrl = sessionStorage.getItem("pubky-auth-url");
+     * if (savedUrl) {
+     *   try {
+     *     const resumed = pubky.resumeCookieAuthFlow(savedUrl);
+     *     const session = await resumed.awaitApproval();
+     *   } finally {
+     *     sessionStorage.removeItem("pubky-auth-url");
+     *   }
+     * }
      * @param {string} authorization_url
      * @returns {AuthFlow}
      */
@@ -1836,13 +2629,29 @@ class Pubky {
         }
         return AuthFlow.__wrap(ret[0]);
     }
+    /**
+     * Resume a previously saved pending delegated grant auth flow.
+     *
+     * Runtime: delegated grant keys require a secure browser context with
+     * WebCrypto `crypto.subtle` and IndexedDB. The saved `keyId` must still
+     * exist in IndexedDB for the same origin. Unsupported runtimes reject with
+     * `ClientStateError`.
+     * @param {string} saved_state
+     * @returns {Promise<GrantAuthFlow>}
+     */
+    resumeDelegatedGrantAuthFlow(saved_state) {
+        const ptr0 = passStringToWasm0(saved_state, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.pubky_resumeDelegatedGrantAuthFlow(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
     /**
      * Resume a previously saved pending grant auth flow.
      *
      * **Security:** `savedState` contains the relay secret and PoP client private key.
      * Delete it from storage as soon as the resumed flow completes.
      *
-     * @param {string} savedState A string produced by `grantFlow.save()`.
+     * @param {string} savedState A string produced by `grantFlow.saveLocal()`.
      * @returns {GrantAuthFlow} A flow reconnected to the original relay channel.
      * @param {string} saved_state
      * @returns {GrantAuthFlow}
@@ -1893,6 +2702,7 @@ class Pubky {
      * - `AuthFlowKind.signin()` - Sign in to an existing account.
      * - `AuthFlowKind.signup(homeserverPublicKey, signupToken)` - Sign up for a new account.
      * @param {string=} relay Optional HTTP relay base (e.g. `"https://…/inbox/"`).
+     * @param {XCallbackParams=} xCallback Optional app return destinations.
      * @returns {AuthFlow}
      * A running auth flow. Show `authorizationUrl` as QR/deeplink,
      * then `awaitApproval()` to obtain a `Session`.
@@ -1908,16 +2718,17 @@ class Pubky {
      * @param {Capabilities} capabilities
      * @param {AuthFlowKind} kind
      * @param {string | null} [relay]
+     * @param {XCallbackParams | null} [x_callback]
      * @returns {AuthFlow}
      */
-    startCookieAuthFlow(capabilities, kind, relay) {
+    startCookieAuthFlow(capabilities, kind, relay, x_callback) {
         const ptr0 = passStringToWasm0(capabilities, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
         _assertClass(kind, AuthFlowKind);
         var ptr1 = kind.__destroy_into_raw();
         var ptr2 = isLikeNone(relay) ? 0 : passStringToWasm0(relay, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         var len2 = WASM_VECTOR_LEN;
-        const ret = wasm.pubky_startCookieAuthFlow(this.__wbg_ptr, ptr0, len0, ptr1, ptr2, len2);
+        const ret = wasm.pubky_startCookieAuthFlow(this.__wbg_ptr, ptr0, len0, ptr1, ptr2, len2, isLikeNone(x_callback) ? 0 : addToExternrefTable0(x_callback));
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
@@ -1931,13 +2742,14 @@ class Pubky {
      *
      * @param {string} capabilities Comma-separated caps, e.g. `"/pub/app/:rw,/pub/foo/file:r"`.
      * @param {AuthFlowKind} kind The kind of authentication flow to perform.
-     * @param {GrantAuthFlowOptions} options Options for the grant flow: `{ clientId, relay? }`.
-     * @returns {GrantAuthFlow}
+     * @param {GrantAuthFlowOptions} options Options for the grant flow:
+     * `{ clientId, relay?, xCallback? }`.
+     * @returns {Promise<GrantAuthFlow>}
      * A running grant auth flow. Show `authorizationUrl` as QR/deeplink,
      * then `awaitApproval()` to obtain a grant-backed `Session`.
      *
      * @example
-     * const flow = pubky.startGrantAuthFlow(
+     * const flow = await pubky.startGrantAuthFlow(
      *   "/pub/my-cool-app/:rw",
      *   AuthFlowKind.signin(),
      *   { clientId: "my-cool-app.example" },
@@ -1945,7 +2757,7 @@ class Pubky {
      * @param {Capabilities} capabilities
      * @param {AuthFlowKind} kind
      * @param {GrantAuthFlowOptions} options
-     * @returns {GrantAuthFlow}
+     * @returns {Promise<GrantAuthFlow>}
      */
     startGrantAuthFlow(capabilities, kind, options) {
         const ptr0 = passStringToWasm0(capabilities, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
@@ -1953,10 +2765,7 @@ class Pubky {
         _assertClass(kind, AuthFlowKind);
         var ptr1 = kind.__destroy_into_raw();
         const ret = wasm.pubky_startGrantAuthFlow(this.__wbg_ptr, ptr0, len0, ptr1, options);
-        if (ret[2]) {
-            throw takeFromExternrefTable0(ret[1]);
-        }
-        return GrantAuthFlow.__wrap(ret[0]);
+        return ret;
     }
     /**
      * Create a Pubky facade preconfigured for a **local testnet**.
@@ -2393,6 +3202,14 @@ class SeedExportDeepLink {
             wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
         }
     }
+    /**
+     * Optional x-callback-url metadata carried by this deep link.
+     * @returns {XCallbackParams}
+     */
+    get xCallback() {
+        const ret = wasm.seedexportdeeplink_xCallback(this.__wbg_ptr);
+        return ret;
+    }
 }
 if (Symbol.dispose) SeedExportDeepLink.prototype[Symbol.dispose] = SeedExportDeepLink.prototype.free;
 exports.SeedExportDeepLink = SeedExportDeepLink;
@@ -2441,7 +3258,7 @@ class Session {
      * @returns {string}
      * A base64 string to store (e.g. in `localStorage`).
      *
-     * @deprecated Prefer `exportSecret()` for grant sessions.
+     * @deprecated Prefer `exportLocalSecret()` for grant sessions.
      * @returns {string}
      */
     export() {
@@ -2457,11 +3274,12 @@ class Session {
         }
     }
     /**
-     * Export the secret material needed to restore this session.
+     * Export the local secret material needed to restore this session.
      *
-     * For grant sessions this exports the grant JWS and PoP client secret; restoring
-     * mints a fresh bearer. For legacy cookie sessions this exports the cookie secret
-     * when the SDK owns it.
+     * For local grant sessions this exports the grant JWS and PoP client secret;
+     * restoring mints a fresh bearer. For legacy cookie sessions this exports the
+     * cookie secret when the SDK owns it. Delegated browser grant sessions cannot
+     * export raw secret material; use `BrowserSessionStore`.
      *
      * Treat the returned string as a bearer-equivalent secret until the grant or
      * cookie session expires or is revoked.
@@ -2470,8 +3288,8 @@ class Session {
      * A secret token that can be passed to `pubky.restoreSession()`.
      * @returns {Promise<string>}
      */
-    exportSecret() {
-        const ret = wasm.session_exportSecret(this.__wbg_ptr);
+    exportLocalSecret() {
+        const ret = wasm.session_exportLocalSecret(this.__wbg_ptr);
         return ret;
     }
     /**
@@ -2854,6 +3672,20 @@ class Signer {
         }
         return Signer.__wrap(ret[0]);
     }
+    /**
+     * Handle a `pubkyauth://` deep link.
+     *
+     * Auth requests are approved through their relay. A `direct_signup` link
+     * creates an account on its target homeserver.
+     * @param {string} pubkyauth_url
+     * @returns {Promise<void>}
+     */
+    handleDeepLink(pubkyauth_url) {
+        const ptr0 = passStringToWasm0(pubkyauth_url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.signer_handleDeepLink(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
     /**
      * Get a PKDNS actor bound to this signer's client & keypair (publishing enabled).
      *
@@ -3058,6 +3890,14 @@ class SigninDeepLink {
             wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
         }
     }
+    /**
+     * Optional x-callback-url metadata carried by this deep link.
+     * @returns {XCallbackParams}
+     */
+    get xCallback() {
+        const ret = wasm.signindeeplink_xCallback(this.__wbg_ptr);
+        return ret;
+    }
 }
 if (Symbol.dispose) SigninDeepLink.prototype[Symbol.dispose] = SigninDeepLink.prototype.free;
 exports.SigninDeepLink = SigninDeepLink;
@@ -3198,6 +4038,14 @@ class SigninGrantDeepLink {
             wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
         }
     }
+    /**
+     * Optional x-callback-url metadata carried by this deep link.
+     * @returns {XCallbackParams}
+     */
+    get xCallback() {
+        const ret = wasm.signingrantdeeplink_xCallback(this.__wbg_ptr);
+        return ret;
+    }
 }
 if (Symbol.dispose) SigninGrantDeepLink.prototype[Symbol.dispose] = SigninGrantDeepLink.prototype.free;
 exports.SigninGrantDeepLink = SigninGrantDeepLink;
@@ -3304,6 +4152,14 @@ class SignupDeepLink {
             wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
         }
     }
+    /**
+     * Optional x-callback-url metadata carried by this deep link.
+     * @returns {XCallbackParams}
+     */
+    get xCallback() {
+        const ret = wasm.signupdeeplink_xCallback(this.__wbg_ptr);
+        return ret;
+    }
 }
 if (Symbol.dispose) SignupDeepLink.prototype[Symbol.dispose] = SignupDeepLink.prototype.free;
 exports.SignupDeepLink = SignupDeepLink;
@@ -3469,10 +4325,165 @@ class SignupGrantDeepLink {
             wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
         }
     }
+    /**
+     * Optional x-callback-url metadata carried by this deep link.
+     * @returns {XCallbackParams}
+     */
+    get xCallback() {
+        const ret = wasm.signupgrantdeeplink_xCallback(this.__wbg_ptr);
+        return ret;
+    }
 }
 if (Symbol.dispose) SignupGrantDeepLink.prototype[Symbol.dispose] = SignupGrantDeepLink.prototype.free;
 exports.SignupGrantDeepLink = SignupGrantDeepLink;
 
+/**
+ * Metadata for a session saved in the browser session store.
+ */
+class StoredSessionInfo {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(StoredSessionInfo.prototype);
+        obj.__wbg_ptr = ptr;
+        StoredSessionInfoFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        StoredSessionInfoFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_storedsessioninfo_free(ptr, 0);
+    }
+    /**
+     * Authorized capabilities.
+     * @returns {string[]}
+     */
+    get capabilities() {
+        const ret = wasm.storedsessioninfo_capabilities(this.__wbg_ptr);
+        var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
+        return v1;
+    }
+    /**
+     * Application/client identifier.
+     * @returns {string}
+     */
+    get clientId() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.storedsessioninfo_clientId(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Local save timestamp, in Unix milliseconds.
+     * @returns {number}
+     */
+    get createdAt() {
+        const ret = wasm.storedsessioninfo_createdAt(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Underlying grant expiry timestamp, in Unix seconds.
+     * @returns {number}
+     */
+    get grantExpiresAt() {
+        const ret = wasm.storedsessioninfo_grantExpiresAt(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Grant identifier backing this stored session.
+     * @returns {string}
+     */
+    get grantId() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.storedsessioninfo_grantId(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Homeserver public key as z32.
+     * @returns {string}
+     */
+    get homeserver() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.storedsessioninfo_homeserver(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Stable local identifier for this stored session.
+     * @returns {string}
+     */
+    get id() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.storedsessioninfo_id(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * User public key as z32.
+     * @returns {string}
+     */
+    get publicKey() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.storedsessioninfo_publicKey(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * `delegated` for origin-bound WebCrypto sessions, `localSecret` for raw local PoP secret storage.
+     * @returns {string}
+     */
+    get storageMode() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.storedsessioninfo_storageMode(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+}
+if (Symbol.dispose) StoredSessionInfo.prototype[Symbol.dispose] = StoredSessionInfo.prototype.free;
+exports.StoredSessionInfo = StoredSessionInfo;
+
 /**
  * Resolve a `pubky://` or `pubky<pk>/…` identifier into the homeserver transport URL.
  *
@@ -3537,12 +4548,12 @@ exports.setLogLevel = setLogLevel;
  * Validate and normalize a capabilities string.
  *
  * - Normalizes action order (`wr` -> `rw`)
- * - Throws `InvalidInput` listing malformed entries.
+ * - Throws `InvalidInput` identifying the first malformed entry.
  *
  * @param {string} input
  * @returns {string} Normalized string (same shape as input).
  * @throws {PubkyError} `{ name: "InvalidInput" }` with a helpful message.
- * The error's `data` field is `{ invalidEntries: string[] }` listing malformed tokens.
+ * The error's `data` field is `{ invalidEntries: string[] }` containing the malformed token.
  * @param {string} input
  * @returns {string}
  */
@@ -3567,6 +4578,68 @@ function validateCapabilities(input) {
     }
 }
 exports.validateCapabilities = validateCapabilities;
+const import1 = {
+  __pubkyGrantIsDelegationAvailable,
+  __pubkyGrantCanUseDelegation,
+  __pubkyGrantEnsureDelegatedKey,
+  __pubkyGrantLoadDelegatedPublicKey,
+  __pubkyGrantDelegatedSign,
+  __pubkyGrantDeleteDelegatedKey,
+};
+const import2 = {
+  __pubkySessionStoreIsAvailable,
+  __pubkySessionStorePut,
+  __pubkySessionStoreGet,
+  __pubkySessionStoreList,
+  __pubkySessionStoreDelete,
+  __pubkySessionStoreClear,
+  __pubkySessionStoreClearAll,
+};
+const import3 = {
+  __pubkySessionStoreIsAvailable,
+  __pubkySessionStorePut,
+  __pubkySessionStoreGet,
+  __pubkySessionStoreList,
+  __pubkySessionStoreDelete,
+  __pubkySessionStoreClear,
+  __pubkySessionStoreClearAll,
+};
+const import4 = {
+  __pubkySessionStoreIsAvailable,
+  __pubkySessionStorePut,
+  __pubkySessionStoreGet,
+  __pubkySessionStoreList,
+  __pubkySessionStoreDelete,
+  __pubkySessionStoreClear,
+  __pubkySessionStoreClearAll,
+};
+const import5 = {
+  __pubkySessionStoreIsAvailable,
+  __pubkySessionStorePut,
+  __pubkySessionStoreGet,
+  __pubkySessionStoreList,
+  __pubkySessionStoreDelete,
+  __pubkySessionStoreClear,
+  __pubkySessionStoreClearAll,
+};
+const import6 = {
+  __pubkySessionStoreIsAvailable,
+  __pubkySessionStorePut,
+  __pubkySessionStoreGet,
+  __pubkySessionStoreList,
+  __pubkySessionStoreDelete,
+  __pubkySessionStoreClear,
+  __pubkySessionStoreClearAll,
+};
+const import7 = {
+  __pubkyGrantIsDelegationAvailable,
+  __pubkyGrantCanUseDelegation,
+  __pubkyGrantEnsureDelegatedKey,
+  __pubkyGrantLoadDelegatedPublicKey,
+  __pubkyGrantDelegatedSign,
+  __pubkyGrantDeleteDelegatedKey,
+};
+
 function __wbg_get_imports() {
     const import0 = {
         __proto__: null,
@@ -3581,6 +4654,80 @@ function __wbg_get_imports() {
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
+        __wbg___pubkyGrantDelegatedSign_5cb443da0321d209: function(arg0, arg1, arg2, arg3) {
+            let deferred0_0;
+            let deferred0_1;
+            let deferred1_0;
+            let deferred1_1;
+            try {
+                deferred0_0 = arg0;
+                deferred0_1 = arg1;
+                deferred1_0 = arg2;
+                deferred1_1 = arg3;
+                const ret = __pubkyGrantDelegatedSign(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3));
+                return ret;
+            } finally {
+                wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
+                wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+            }
+        },
+        __wbg___pubkyGrantDeleteDelegatedKey_0f4d62b84caef0fa: function(arg0, arg1) {
+            let deferred0_0;
+            let deferred0_1;
+            try {
+                deferred0_0 = arg0;
+                deferred0_1 = arg1;
+                const ret = __pubkyGrantDeleteDelegatedKey(getStringFromWasm0(arg0, arg1));
+                return ret;
+            } finally {
+                wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
+            }
+        },
+        __wbg___pubkyGrantEnsureDelegatedKey_8e535d8d53f48fdc: function(arg0, arg1) {
+            let v0;
+            if (arg0 !== 0) {
+                v0 = getStringFromWasm0(arg0, arg1).slice();
+                wasm.__wbindgen_free(arg0, arg1 * 1, 1);
+            }
+            const ret = __pubkyGrantEnsureDelegatedKey(v0);
+            return ret;
+        },
+        __wbg___pubkyGrantLoadDelegatedPublicKey_501aaeb6b721477e: function(arg0, arg1) {
+            let deferred0_0;
+            let deferred0_1;
+            try {
+                deferred0_0 = arg0;
+                deferred0_1 = arg1;
+                const ret = __pubkyGrantLoadDelegatedPublicKey(getStringFromWasm0(arg0, arg1));
+                return ret;
+            } finally {
+                wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
+            }
+        },
+        __wbg___pubkySessionStoreDelete_9809101d930e5c86: function(arg0, arg1) {
+            let deferred0_0;
+            let deferred0_1;
+            try {
+                deferred0_0 = arg0;
+                deferred0_1 = arg1;
+                const ret = __pubkySessionStoreDelete(getStringFromWasm0(arg0, arg1));
+                return ret;
+            } finally {
+                wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
+            }
+        },
+        __wbg___pubkySessionStoreGet_c67e79fe9c058d05: function(arg0, arg1) {
+            let deferred0_0;
+            let deferred0_1;
+            try {
+                deferred0_0 = arg0;
+                deferred0_1 = arg1;
+                const ret = __pubkySessionStoreGet(getStringFromWasm0(arg0, arg1));
+                return ret;
+            } finally {
+                wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
+            }
+        },
         __wbg___wbindgen_bigint_get_as_i64_3d3aba5d616c6a51: function(arg0, arg1) {
             const v = arg1;
             const ret = typeof(v) === 'bigint' ? v : undefined;
@@ -3756,7 +4903,7 @@ function __wbg_get_imports() {
             const ret = arg0.fetch(arg1);
             return ret;
         },
-        __wbg_fetch_95042ac3d1e49f53: function(arg0) {
+        __wbg_fetch_7888dbbb5aebe24d: function(arg0) {
             const ret = fetch(arg0);
             return ret;
         },
@@ -3798,6 +4945,14 @@ function __wbg_get_imports() {
             const ret = arg0.value;
             return ret;
         },
+        __wbg_get_with_ref_key_6412cf3094599694: function(arg0, arg1) {
+            const ret = arg0[arg1];
+            return ret;
+        },
+        __wbg_grantauthflow_new: function(arg0) {
+            const ret = GrantAuthFlow.__wrap(arg0);
+            return ret;
+        },
         __wbg_grantinfo_new: function(arg0) {
             const ret = GrantInfo.__wrap(arg0);
             return ret;
@@ -3943,7 +5098,7 @@ function __wbg_get_imports() {
                     const a = state0.a;
                     state0.a = 0;
                     try {
-                        return wasm_bindgen__convert__closures_____invoke__h019e2b449b0ca0d0(a, state0.b, arg0, arg1);
+                        return wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke___js_sys_4b0493a0be09c0f___Function_fn_wasm_bindgen_77cee878d4ea2fd9___JsValue_____wasm_bindgen_77cee878d4ea2fd9___sys__Undefined___js_sys_4b0493a0be09c0f___Function_fn_wasm_bindgen_77cee878d4ea2fd9___JsValue_____wasm_bindgen_77cee878d4ea2fd9___sys__Undefined_______true_(a, state0.b, arg0, arg1);
                     } finally {
                         state0.a = a;
                     }
@@ -4129,6 +5284,10 @@ function __wbg_get_imports() {
             const ret = arg0.status;
             return ret;
         },
+        __wbg_storedsessioninfo_new: function(arg0) {
+            const ret = StoredSessionInfo.__wrap(arg0);
+            return ret;
+        },
         __wbg_stringify_91082ed7a5a5769e: function() { return handleError(function (arg0) {
             const ret = JSON.stringify(arg0);
             return ret;
@@ -4176,18 +5335,18 @@ function __wbg_get_imports() {
             console.warn(arg0, arg1, arg2, arg3);
         },
         __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 127, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__ha6e3ae977799a830);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 130, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke___wasm_bindgen_77cee878d4ea2fd9___JsValue__core_9b3796e30d99ddb7___result__Result_____wasm_bindgen_77cee878d4ea2fd9___JsError___true_);
             return ret;
         },
         __wbindgen_cast_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 240, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hde4a3c4bb985e67d);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 266, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke___wasm_bindgen_77cee878d4ea2fd9___JsValue______true_);
             return ret;
         },
         __wbindgen_cast_0000000000000003: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 237, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h8579194ccdaf276b);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 264, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke_______true_);
             return ret;
         },
         __wbindgen_cast_0000000000000004: function(arg0) {
@@ -4223,6 +5382,13 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_000000000000000a: function(arg0, arg1) {
+            var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
+            wasm.__wbindgen_free(arg0, arg1 * 4, 4);
+            // Cast intrinsic for `Vector(NamedExternref("StoredSessionInfo")) -> Externref`.
+            const ret = v0;
+            return ret;
+        },
+        __wbindgen_cast_000000000000000b: function(arg0, arg1) {
             var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
             wasm.__wbindgen_free(arg0, arg1 * 4, 4);
             // Cast intrinsic for `Vector(NamedExternref("string")) -> Externref`.
@@ -4242,26 +5408,33 @@ function __wbg_get_imports() {
     return {
         __proto__: null,
         "./pubky_bg.js": import0,
+        "./snippets/pubky-wasm-aeccd1286880adbb/inline1.js": import1,
+        "./snippets/pubky-wasm-aeccd1286880adbb/inline0.js": import2,
+        "./snippets/pubky-wasm-aeccd1286880adbb/inline0.js": import3,
+        "./snippets/pubky-wasm-aeccd1286880adbb/inline0.js": import4,
+        "./snippets/pubky-wasm-aeccd1286880adbb/inline0.js": import5,
+        "./snippets/pubky-wasm-aeccd1286880adbb/inline0.js": import6,
+        "./snippets/pubky-wasm-aeccd1286880adbb/inline1.js": import7,
     };
 }
 
-function wasm_bindgen__convert__closures_____invoke__h8579194ccdaf276b(arg0, arg1) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h8579194ccdaf276b(arg0, arg1);
+function wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke_______true_(arg0, arg1) {
+    wasm.wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke_______true_(arg0, arg1);
 }
 
-function wasm_bindgen__convert__closures_____invoke__hde4a3c4bb985e67d(arg0, arg1, arg2) {
-    wasm.wasm_bindgen__convert__closures_____invoke__hde4a3c4bb985e67d(arg0, arg1, arg2);
+function wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke___wasm_bindgen_77cee878d4ea2fd9___JsValue______true_(arg0, arg1, arg2) {
+    wasm.wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke___wasm_bindgen_77cee878d4ea2fd9___JsValue______true_(arg0, arg1, arg2);
 }
 
-function wasm_bindgen__convert__closures_____invoke__ha6e3ae977799a830(arg0, arg1, arg2) {
-    const ret = wasm.wasm_bindgen__convert__closures_____invoke__ha6e3ae977799a830(arg0, arg1, arg2);
+function wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke___wasm_bindgen_77cee878d4ea2fd9___JsValue__core_9b3796e30d99ddb7___result__Result_____wasm_bindgen_77cee878d4ea2fd9___JsError___true_(arg0, arg1, arg2) {
+    const ret = wasm.wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke___wasm_bindgen_77cee878d4ea2fd9___JsValue__core_9b3796e30d99ddb7___result__Result_____wasm_bindgen_77cee878d4ea2fd9___JsError___true_(arg0, arg1, arg2);
     if (ret[1]) {
         throw takeFromExternrefTable0(ret[0]);
     }
 }
 
-function wasm_bindgen__convert__closures_____invoke__h019e2b449b0ca0d0(arg0, arg1, arg2, arg3) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h019e2b449b0ca0d0(arg0, arg1, arg2, arg3);
+function wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke___js_sys_4b0493a0be09c0f___Function_fn_wasm_bindgen_77cee878d4ea2fd9___JsValue_____wasm_bindgen_77cee878d4ea2fd9___sys__Undefined___js_sys_4b0493a0be09c0f___Function_fn_wasm_bindgen_77cee878d4ea2fd9___JsValue_____wasm_bindgen_77cee878d4ea2fd9___sys__Undefined_______true_(arg0, arg1, arg2, arg3) {
+    wasm.wasm_bindgen_77cee878d4ea2fd9___convert__closures_____invoke___js_sys_4b0493a0be09c0f___Function_fn_wasm_bindgen_77cee878d4ea2fd9___JsValue_____wasm_bindgen_77cee878d4ea2fd9___sys__Undefined___js_sys_4b0493a0be09c0f___Function_fn_wasm_bindgen_77cee878d4ea2fd9___JsValue_____wasm_bindgen_77cee878d4ea2fd9___sys__Undefined_______true_(arg0, arg1, arg2, arg3);
 }
 
 
@@ -4287,12 +5460,18 @@ const AuthFlowKindFinalization = (typeof FinalizationRegistry === 'undefined')
 const AuthTokenFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_authtoken_free(ptr >>> 0, 1));
+const BrowserSessionStoreFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_browsersessionstore_free(ptr >>> 0, 1));
 const ClientFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_client_free(ptr >>> 0, 1));
 const CookieSessionFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_cookiesession_free(ptr >>> 0, 1));
+const DirectSignupDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_directsignupdeeplink_free(ptr >>> 0, 1));
 const EventFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_event_free(ptr >>> 0, 1));
@@ -4368,6 +5547,9 @@ const SignupDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
 const SignupGrantDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_signupgrantdeeplink_free(ptr >>> 0, 1));
+const StoredSessionInfoFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_storedsessioninfo_free(ptr >>> 0, 1));
 
 function addToExternrefTable0(obj) {
     const idx = wasm.__externref_table_alloc();