@synonymdev/pubky 0.9.3 → 0.10.0-alpha.0

package/index.cjs

@@ -9,9 +9,11 @@ globalThis.fetch = makeFetchCookie(originalFetch);
  * Start and control a pubkyauth authorization flow.
  *
  * Typical flow:
- * 1) `AuthFlow.start(...)` or `pubky.startAuthFlow(...)`
+ * 1) `AuthFlow.start(...)` or `pubky.startCookieAuthFlow(...)`
  * 2) Show `authorizationUrl()` as QR/deeplink to the user’s signing device
  * 3) `awaitApproval()` to receive a ready `Session`
+ *
+ * @deprecated Use `GrantAuthFlow` instead.
  */
 class AuthFlow {
     static __wrap(ptr) {
@@ -36,7 +38,7 @@ class AuthFlow {
      *
      * **Security:** This URL contains the `client_secret` in plaintext.
      * Treat it as a short-lived secret and delete it after the flow completes.
-     * See `Pubky.startAuthFlow()` docs for storage guidance.
+     * See `Pubky.startCookieAuthFlow()` docs for storage guidance.
      *
      * @returns {string} A `pubkyauth://…` or `https://…` URL with channel info.
      *
@@ -87,10 +89,10 @@ class AuthFlow {
     }
     /**
      * Resume a previously started auth flow from its saved `authorizationUrl` (standalone).
-     * Prefer `pubky.resumeAuthFlow()` to reuse a facade client; this creates a default (mainnet) client.
+     * Prefer `pubky.resumeCookieAuthFlow()` to reuse a facade client; this creates a default (mainnet) client.
      *
      * Relay messages expire after ~5 minutes; resume is only viable in that window.
-     * See `Pubky.resumeAuthFlow()` / `Pubky.startAuthFlow()` for full guidance.
+     * See `Pubky.resumeCookieAuthFlow()` / `Pubky.startCookieAuthFlow()` for full guidance.
      *
      * **Security:** `authorizationUrl` contains the `client_secret`.
      * Delete it from storage as soon as resume completes or is abandoned.
@@ -113,7 +115,7 @@ class AuthFlow {
     }
     /**
      * Start a flow (standalone).
-     * Prefer `pubky.startAuthFlow()` to reuse a facade client.
+     * Prefer `pubky.startCookieAuthFlow()` to reuse a facade client.
      *
      * @param {string} capabilities
      * Comma-separated capabilities, e.g. `"/pub/app/:rw,/priv/foo.txt:r"`.
@@ -143,6 +145,8 @@ class AuthFlow {
      * const flow = AuthFlow.start("/pub/my-cool-app/:rw,/pub/pubky.app/:w");
      * renderQRCode(flow.authorizationUrl());
      * const session = await flow.awaitApproval();
+     *
+     * @deprecated Use `GrantAuthFlow.start(...)` instead.
      * @param {Capabilities} capabilities
      * @param {AuthFlowKind} kind
      * @param {string | null} [relay]
@@ -254,7 +258,7 @@ exports.AuthFlowKind = AuthFlowKind;
  * ### Typical usage
  * ```js
  * // Start an auth-only flow (no capabilities)
- * const flow = pubky.startAuthFlow("", relay);
+ * const flow = pubky.startCookieAuthFlow("", relay);
  *
  * // Wait for the signer to approve; returns an AuthToken
  * const token = await flow.awaitToken();
@@ -291,7 +295,7 @@ class AuthToken {
     /**
      * Returns the **capabilities** requested by the flow at the time this token was signed.
      *
-     * Most auth-only flows pass an empty string to `startAuthFlow("", relay)`, so this will
+     * Most auth-only flows pass an empty string to `startCookieAuthFlow("", relay)`, so this will
      * commonly be an empty array.
      *
      * Returns: `string[]`, where each item is the canonical entry `"<scope>:<actions>"`.
@@ -489,6 +493,74 @@ class Client {
 if (Symbol.dispose) Client.prototype[Symbol.dispose] = Client.prototype.free;
 exports.Client = Client;
 
+/**
+ * Cookie-only view over a cookie-backed `Session`.
+ *
+ * Grant-backed sessions do not expose this view; use `session.cookie` and
+ * check for `undefined` before calling cookie-specific methods.
+ */
+class CookieSession {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(CookieSession.prototype);
+        obj.__wbg_ptr = ptr;
+        CookieSessionFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        CookieSessionFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_cookiesession_free(ptr, 0);
+    }
+    /**
+     * Export session metadata for legacy cookie restore.
+     *
+     * The returned string contains no secrets; the browser cookie jar must
+     * still hold the HTTP-only cookie.
+     *
+     * @returns {string}
+     * @returns {string}
+     */
+    export() {
+        let deferred2_0;
+        let deferred2_1;
+        try {
+            const ret = wasm.cookiesession_export(this.__wbg_ptr);
+            var ptr1 = ret[0];
+            var len1 = ret[1];
+            if (ret[3]) {
+                ptr1 = 0; len1 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred2_0 = ptr1;
+            deferred2_1 = len1;
+            return getStringFromWasm0(ptr1, len1);
+        } finally {
+            wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+        }
+    }
+    /**
+     * Export the cookie secret needed to restore this cookie session.
+     *
+     * This is available when the SDK captured the cookie secret, such as in
+     * Node.js. Browser sessions cannot read HTTP-only Set-Cookie values.
+     *
+     * @returns {Promise<string>}
+     * @returns {Promise<string>}
+     */
+    exportSecret() {
+        const ret = wasm.cookiesession_exportSecret(this.__wbg_ptr);
+        return ret;
+    }
+}
+if (Symbol.dispose) CookieSession.prototype[Symbol.dispose] = CookieSession.prototype.free;
+exports.CookieSession = CookieSession;
+
 /**
  * A single event from the event stream.
  *
@@ -773,161 +845,623 @@ class EventStreamBuilder {
 if (Symbol.dispose) EventStreamBuilder.prototype[Symbol.dispose] = EventStreamBuilder.prototype.free;
 exports.EventStreamBuilder = EventStreamBuilder;
 
-class IntoUnderlyingByteSource {
+/**
+ * Start and control a grant-backed pubkyauth authorization flow.
+ *
+ * Typical flow:
+ * 1) `GrantAuthFlow.start(...)` or `pubky.startGrantAuthFlow(...)`
+ * 2) Show `authorizationUrl()` as QR/deeplink to the user's signing device
+ * 3) `awaitApproval()` to receive a grant-backed, self-refreshing `Session`
+ */
+class GrantAuthFlow {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(GrantAuthFlow.prototype);
+        obj.__wbg_ptr = ptr;
+        GrantAuthFlowFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        IntoUnderlyingByteSourceFinalization.unregister(this);
+        GrantAuthFlowFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_intounderlyingbytesource_free(ptr, 0);
+        wasm.__wbg_grantauthflow_free(ptr, 0);
     }
     /**
-     * @returns {number}
+     * Return the authorization deep link (URL) to show as QR or open on the signer device.
+     * @returns {string}
      */
-    get autoAllocateChunkSize() {
-        const ret = wasm.intounderlyingbytesource_autoAllocateChunkSize(this.__wbg_ptr);
-        return ret >>> 0;
-    }
-    cancel() {
-        const ptr = this.__destroy_into_raw();
-        wasm.intounderlyingbytesource_cancel(ptr);
+    get authorizationUrl() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.grantauthflow_authorizationUrl(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
     }
     /**
-     * @param {ReadableByteStreamController} controller
-     * @returns {Promise<any>}
+     * Block until the user approves on their signer device; returns a grant-backed `Session`.
+     * @returns {Promise<Session>}
      */
-    pull(controller) {
-        const ret = wasm.intounderlyingbytesource_pull(this.__wbg_ptr, controller);
+    awaitApproval() {
+        const ret = wasm.grantauthflow_awaitApproval(this.__wbg_ptr);
         return ret;
     }
     /**
-     * @param {ReadableByteStreamController} controller
+     * Resume a previously saved pending grant auth flow (standalone).
+     * Prefer `pubky.resumeGrantAuthFlow()` to reuse a facade client.
+     *
+     * **Security:** `savedState` contains the relay secret and PoP client private key.
+     * Store it only temporarily and delete it once the flow completes or is abandoned.
+     *
+     * @param {string} savedState A string produced by `grantFlow.save()`.
+     * @returns {GrantAuthFlow} A flow reconnected to the original relay channel.
+     * @param {string} saved_state
+     * @returns {GrantAuthFlow}
      */
-    start(controller) {
-        wasm.intounderlyingbytesource_start(this.__wbg_ptr, controller);
+    static resume(saved_state) {
+        const ptr0 = passStringToWasm0(saved_state, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.grantauthflow_resume(ptr0, len0);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return GrantAuthFlow.__wrap(ret[0]);
     }
     /**
-     * @returns {ReadableStreamType}
+     * Save sensitive state required to resume this pending grant flow.
+     *
+     * @returns {string} Opaque state for `GrantAuthFlow.resume()` or
+     * `pubky.resumeGrantAuthFlow()`.
+     * @returns {string}
      */
-    get type() {
-        const ret = wasm.intounderlyingbytesource_type(this.__wbg_ptr);
-        return __wbindgen_enum_ReadableStreamType[ret];
+    save() {
+        let deferred2_0;
+        let deferred2_1;
+        try {
+            const ret = wasm.grantauthflow_save(this.__wbg_ptr);
+            var ptr1 = ret[0];
+            var len1 = ret[1];
+            if (ret[3]) {
+                ptr1 = 0; len1 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred2_0 = ptr1;
+            deferred2_1 = len1;
+            return getStringFromWasm0(ptr1, len1);
+        } finally {
+            wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+        }
+    }
+    /**
+     * Start a grant-backed flow (standalone).
+     * Prefer `pubky.startGrantAuthFlow()` to reuse a facade client.
+     *
+     * @param {string} capabilities
+     * Comma-separated capabilities, e.g. `"/pub/app/:rw,/priv/foo.txt:r"`.
+     * Empty string is allowed (no scopes).
+     *
+     * @param {AuthFlowKind} kind
+     * The kind of authentication flow to perform.
+     *
+     * @param {GrantAuthFlowOptions} options
+     * Options for the grant flow: `{ clientId, relay? }`.
+     *
+     * @returns {GrantAuthFlow}
+     * A running grant auth flow. Call `authorizationUrl()` to show the deep link,
+     * then `awaitApproval()` to receive a grant-backed `Session`.
+     * @param {Capabilities} capabilities
+     * @param {AuthFlowKind} kind
+     * @param {GrantAuthFlowOptions} options
+     * @returns {GrantAuthFlow}
+     */
+    static start(capabilities, kind, options) {
+        const ptr0 = passStringToWasm0(capabilities, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        _assertClass(kind, AuthFlowKind);
+        var ptr1 = kind.__destroy_into_raw();
+        const ret = wasm.grantauthflow_start(ptr0, len0, ptr1, options);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return GrantAuthFlow.__wrap(ret[0]);
+    }
+    /**
+     * Non-blocking single poll step (advanced UIs).
+     *
+     * @returns {Promise<Session|undefined>} A session if the approval arrived, otherwise `undefined`.
+     * @returns {Promise<Session | undefined>}
+     */
+    tryPollOnce() {
+        const ret = wasm.grantauthflow_tryPollOnce(this.__wbg_ptr);
+        return ret;
     }
 }
-if (Symbol.dispose) IntoUnderlyingByteSource.prototype[Symbol.dispose] = IntoUnderlyingByteSource.prototype.free;
-exports.IntoUnderlyingByteSource = IntoUnderlyingByteSource;
+if (Symbol.dispose) GrantAuthFlow.prototype[Symbol.dispose] = GrantAuthFlow.prototype.free;
+exports.GrantAuthFlow = GrantAuthFlow;
 
-class IntoUnderlyingSink {
+/**
+ * Summary of an active grant returned by `GrantManager.list()`.
+ */
+class GrantInfo {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(GrantInfo.prototype);
+        obj.__wbg_ptr = ptr;
+        GrantInfoFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        IntoUnderlyingSinkFinalization.unregister(this);
+        GrantInfoFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_intounderlyingsink_free(ptr, 0);
+        wasm.__wbg_grantinfo_free(ptr, 0);
     }
     /**
-     * @param {any} reason
-     * @returns {Promise<any>}
+     * Comma-separated capabilities authorized by the grant.
+     * @returns {string}
      */
-    abort(reason) {
-        const ptr = this.__destroy_into_raw();
-        const ret = wasm.intounderlyingsink_abort(ptr, reason);
-        return ret;
+    get capabilities() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.grantinfo_capabilities(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
     }
     /**
-     * @returns {Promise<any>}
+     * Application identifier.
+     * @returns {string}
      */
-    close() {
-        const ptr = this.__destroy_into_raw();
-        const ret = wasm.intounderlyingsink_close(ptr);
+    get clientId() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.grantinfo_clientId(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Expiry timestamp, in Unix seconds.
+     * @returns {number}
+     */
+    get expiresAt() {
+        const ret = wasm.grantinfo_expiresAt(this.__wbg_ptr);
         return ret;
     }
     /**
-     * @param {any} chunk
-     * @returns {Promise<any>}
+     * Grant identifier used for revocation.
+     * @returns {string}
      */
-    write(chunk) {
-        const ret = wasm.intounderlyingsink_write(this.__wbg_ptr, chunk);
+    get grantId() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.grantinfo_grantId(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Issued-at timestamp, in Unix seconds.
+     * @returns {number}
+     */
+    get issuedAt() {
+        const ret = wasm.grantinfo_issuedAt(this.__wbg_ptr);
         return ret;
     }
 }
-if (Symbol.dispose) IntoUnderlyingSink.prototype[Symbol.dispose] = IntoUnderlyingSink.prototype.free;
-exports.IntoUnderlyingSink = IntoUnderlyingSink;
+if (Symbol.dispose) GrantInfo.prototype[Symbol.dispose] = GrantInfo.prototype.free;
+exports.GrantInfo = GrantInfo;
 
-class IntoUnderlyingSource {
-    static __wrap(ptr) {
-        ptr = ptr >>> 0;
-        const obj = Object.create(IntoUnderlyingSource.prototype);
-        obj.__wbg_ptr = ptr;
-        IntoUnderlyingSourceFinalization.register(obj, obj.__wbg_ptr, obj);
-        return obj;
-    }
+/**
+ * Account-level grant management for a signed-in user.
+ */
+class GrantManager {
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        IntoUnderlyingSourceFinalization.unregister(this);
+        GrantManagerFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_intounderlyingsource_free(ptr, 0);
+        wasm.__wbg_grantmanager_free(ptr, 0);
     }
-    cancel() {
-        const ptr = this.__destroy_into_raw();
-        wasm.intounderlyingsource_cancel(ptr);
+    /**
+     * List all active grants for this user.
+     *
+     * Requires a root-capability session. Non-root sessions surface the
+     * homeserver `403` as the standard request error.
+     *
+     * @returns {Promise<GrantInfo[]>}
+     * @returns {Promise<GrantInfo[]>}
+     */
+    list() {
+        const ret = wasm.grantmanager_list(this.__wbg_ptr);
+        return ret;
     }
     /**
-     * @param {ReadableStreamDefaultController} controller
-     * @returns {Promise<any>}
+     * Create a grant manager authenticated by a session.
+     *
+     * @param {Session} session
+     * @returns {GrantManager}
+     * @param {Session} session
      */
-    pull(controller) {
-        const ret = wasm.intounderlyingsource_pull(this.__wbg_ptr, controller);
+    constructor(session) {
+        _assertClass(session, Session);
+        const ret = wasm.grantmanager_new(session.__wbg_ptr);
+        this.__wbg_ptr = ret >>> 0;
+        GrantManagerFinalization.register(this, this.__wbg_ptr, this);
+        return this;
+    }
+    /**
+     * Revoke a specific grant by id.
+     *
+     * Requires a root-capability session. Malformed ids throw
+     * `InvalidInput`.
+     *
+     * @param {string} grantId
+     * @returns {Promise<void>}
+     * @param {string} grant_id
+     * @returns {Promise<void>}
+     */
+    revoke(grant_id) {
+        const ptr0 = passStringToWasm0(grant_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.grantmanager_revoke(this.__wbg_ptr, ptr0, len0);
         return ret;
     }
 }
-if (Symbol.dispose) IntoUnderlyingSource.prototype[Symbol.dispose] = IntoUnderlyingSource.prototype.free;
-exports.IntoUnderlyingSource = IntoUnderlyingSource;
+if (Symbol.dispose) GrantManager.prototype[Symbol.dispose] = GrantManager.prototype.free;
+exports.GrantManager = GrantManager;
 
-class Keypair {
+/**
+ * Grant-only view over a grant-backed `Session`.
+ *
+ * Cookie-backed sessions do not expose this view; use `session.grant` and
+ * check for `undefined` before calling grant-session methods.
+ */
+class GrantSession {
     static __wrap(ptr) {
         ptr = ptr >>> 0;
-        const obj = Object.create(Keypair.prototype);
+        const obj = Object.create(GrantSession.prototype);
         obj.__wbg_ptr = ptr;
-        KeypairFinalization.register(obj, obj.__wbg_ptr, obj);
+        GrantSessionFinalization.register(obj, obj.__wbg_ptr, obj);
         return obj;
     }
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        KeypairFinalization.unregister(this);
+        GrantSessionFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_keypair_free(ptr, 0);
+        wasm.__wbg_grantsession_free(ptr, 0);
     }
     /**
-     * Create a recovery file for this keypair (encrypted with the given passphrase).
-     * @param {string} passphrase
-     * @returns {Uint8Array}
+     * Export the durable refresh material needed to restore this grant session.
+     *
+     * Treat the returned string as bearer-equivalent secret material until the
+     * grant expires or is revoked.
+     *
+     * @returns {Promise<string>}
+     * @returns {Promise<string>}
      */
-    createRecoveryFile(passphrase) {
-        const ptr0 = passStringToWasm0(passphrase, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.keypair_createRecoveryFile(this.__wbg_ptr, ptr0, len0);
+    exportSecret() {
+        const ret = wasm.grantsession_exportSecret(this.__wbg_ptr);
         return ret;
     }
     /**
-     * Decrypt a recovery file and return a Keypair (decrypted with the given passphrase).
-     * @param {Uint8Array} recovery_file
-     * @param {string} passphrase
-     * @returns {Keypair}
+     * Current grant id (`jti`) backing this session.
+     *
+     * @returns {Promise<string>}
+     * @returns {Promise<string>}
+     */
+    grantId() {
+        const ret = wasm.grantsession_grantId(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Full grant session metadata.
+     *
+     * @returns {Promise<GrantSessionInfo>}
+     * @returns {Promise<GrantSessionInfo>}
+     */
+    sessionInfo() {
+        const ret = wasm.grantsession_sessionInfo(this.__wbg_ptr);
+        return ret;
+    }
+}
+if (Symbol.dispose) GrantSession.prototype[Symbol.dispose] = GrantSession.prototype.free;
+exports.GrantSession = GrantSession;
+
+/**
+ * Grant-specific session metadata returned by `grant.sessionInfo()`.
+ */
+class GrantSessionInfo {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(GrantSessionInfo.prototype);
+        obj.__wbg_ptr = ptr;
+        GrantSessionInfoFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        GrantSessionInfoFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_grantsessioninfo_free(ptr, 0);
+    }
+    /**
+     * Authorized capabilities for this session.
+     * @returns {string[]}
+     */
+    get capabilities() {
+        const ret = wasm.grantsessioninfo_capabilities(this.__wbg_ptr);
+        var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
+        return v1;
+    }
+    /**
+     * Application identifier.
+     * @returns {string}
+     */
+    get clientId() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.grantsessioninfo_clientId(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Session creation timestamp, in Unix seconds.
+     * @returns {number}
+     */
+    get createdAt() {
+        const ret = wasm.grantsessioninfo_createdAt(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Underlying grant expiry timestamp, in Unix seconds.
+     * @returns {number}
+     */
+    get grantExpiresAt() {
+        const ret = wasm.grantsessioninfo_grantExpiresAt(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Grant id this session was minted from.
+     * @returns {string}
+     */
+    get grantId() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.grantsessioninfo_grantId(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Homeserver that issued this session.
+     * @returns {PublicKey}
+     */
+    get homeserver() {
+        const ret = wasm.grantsessioninfo_homeserver(this.__wbg_ptr);
+        return PublicKey.__wrap(ret);
+    }
+    /**
+     * User public key for this session.
+     * @returns {PublicKey}
+     */
+    get publicKey() {
+        const ret = wasm.grantsessioninfo_publicKey(this.__wbg_ptr);
+        return PublicKey.__wrap(ret);
+    }
+    /**
+     * Bearer token expiry timestamp, in Unix seconds.
+     * @returns {number}
+     */
+    get tokenExpiresAt() {
+        const ret = wasm.grantsessioninfo_tokenExpiresAt(this.__wbg_ptr);
+        return ret;
+    }
+}
+if (Symbol.dispose) GrantSessionInfo.prototype[Symbol.dispose] = GrantSessionInfo.prototype.free;
+exports.GrantSessionInfo = GrantSessionInfo;
+
+class IntoUnderlyingByteSource {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        IntoUnderlyingByteSourceFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_intounderlyingbytesource_free(ptr, 0);
+    }
+    /**
+     * @returns {number}
+     */
+    get autoAllocateChunkSize() {
+        const ret = wasm.intounderlyingbytesource_autoAllocateChunkSize(this.__wbg_ptr);
+        return ret >>> 0;
+    }
+    cancel() {
+        const ptr = this.__destroy_into_raw();
+        wasm.intounderlyingbytesource_cancel(ptr);
+    }
+    /**
+     * @param {ReadableByteStreamController} controller
+     * @returns {Promise<any>}
+     */
+    pull(controller) {
+        const ret = wasm.intounderlyingbytesource_pull(this.__wbg_ptr, controller);
+        return ret;
+    }
+    /**
+     * @param {ReadableByteStreamController} controller
+     */
+    start(controller) {
+        wasm.intounderlyingbytesource_start(this.__wbg_ptr, controller);
+    }
+    /**
+     * @returns {ReadableStreamType}
+     */
+    get type() {
+        const ret = wasm.intounderlyingbytesource_type(this.__wbg_ptr);
+        return __wbindgen_enum_ReadableStreamType[ret];
+    }
+}
+if (Symbol.dispose) IntoUnderlyingByteSource.prototype[Symbol.dispose] = IntoUnderlyingByteSource.prototype.free;
+exports.IntoUnderlyingByteSource = IntoUnderlyingByteSource;
+
+class IntoUnderlyingSink {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        IntoUnderlyingSinkFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_intounderlyingsink_free(ptr, 0);
+    }
+    /**
+     * @param {any} reason
+     * @returns {Promise<any>}
+     */
+    abort(reason) {
+        const ptr = this.__destroy_into_raw();
+        const ret = wasm.intounderlyingsink_abort(ptr, reason);
+        return ret;
+    }
+    /**
+     * @returns {Promise<any>}
+     */
+    close() {
+        const ptr = this.__destroy_into_raw();
+        const ret = wasm.intounderlyingsink_close(ptr);
+        return ret;
+    }
+    /**
+     * @param {any} chunk
+     * @returns {Promise<any>}
+     */
+    write(chunk) {
+        const ret = wasm.intounderlyingsink_write(this.__wbg_ptr, chunk);
+        return ret;
+    }
+}
+if (Symbol.dispose) IntoUnderlyingSink.prototype[Symbol.dispose] = IntoUnderlyingSink.prototype.free;
+exports.IntoUnderlyingSink = IntoUnderlyingSink;
+
+class IntoUnderlyingSource {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(IntoUnderlyingSource.prototype);
+        obj.__wbg_ptr = ptr;
+        IntoUnderlyingSourceFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        IntoUnderlyingSourceFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_intounderlyingsource_free(ptr, 0);
+    }
+    cancel() {
+        const ptr = this.__destroy_into_raw();
+        wasm.intounderlyingsource_cancel(ptr);
+    }
+    /**
+     * @param {ReadableStreamDefaultController} controller
+     * @returns {Promise<any>}
+     */
+    pull(controller) {
+        const ret = wasm.intounderlyingsource_pull(this.__wbg_ptr, controller);
+        return ret;
+    }
+}
+if (Symbol.dispose) IntoUnderlyingSource.prototype[Symbol.dispose] = IntoUnderlyingSource.prototype.free;
+exports.IntoUnderlyingSource = IntoUnderlyingSource;
+
+class Keypair {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(Keypair.prototype);
+        obj.__wbg_ptr = ptr;
+        KeypairFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        KeypairFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_keypair_free(ptr, 0);
+    }
+    /**
+     * Create a recovery file for this keypair (encrypted with the given passphrase).
+     * @param {string} passphrase
+     * @returns {Uint8Array}
+     */
+    createRecoveryFile(passphrase) {
+        const ptr0 = passStringToWasm0(passphrase, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.keypair_createRecoveryFile(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
+    /**
+     * Decrypt a recovery file and return a Keypair (decrypted with the given passphrase).
+     * @param {Uint8Array} recovery_file
+     * @param {string} passphrase
+     * @returns {Keypair}
      */
     static fromRecoveryFile(recovery_file, passphrase) {
         const ptr0 = passArray8ToWasm0(recovery_file, wasm.__wbindgen_malloc);
@@ -1254,12 +1788,13 @@ class Pubky {
         return PublicStorage.__wrap(ret);
     }
     /**
-     * Restore a session from a previously exported snapshot, using this instance's client.
+     * Restore a session from a previously exported token or snapshot, using this instance's client.
      *
-     * This does **not** read or write any secrets. It revalidates the session metadata with
-     * the server using the browser-managed HTTP-only cookie that must still be present.
+     * Accepts grant secret tokens from `session.exportSecret()` and legacy cookie
+     * secret tokens. Also accepts legacy cookie metadata snapshots from `session.export()`.
+     * Grant restore mints a fresh short-lived bearer.
      *
-     * @param {string} exported A string produced by `session.export()`.
+     * @param {string} exported A string produced by `session.exportSecret()` or legacy `session.export()`.
      * @returns {Promise<Session>}
      * A rehydrated session bound to this SDK's HTTP client.
      *
@@ -1282,7 +1817,7 @@ class Pubky {
      *
      * **Security:** The URL contains the `client_secret` in plaintext.
      * Delete it from storage as soon as the resumed flow completes.
-     * See `startAuthFlow()` docs for full storage guidance.
+     * See `startCookieAuthFlow()` docs for full storage guidance.
      *
      * @param {string} authorizationUrl The `pubkyauth://…` URL from a previous flow.
      * @returns {AuthFlow} A flow reconnected to the original relay channel.
@@ -1292,15 +1827,35 @@ class Pubky {
      * @param {string} authorization_url
      * @returns {AuthFlow}
      */
-    resumeAuthFlow(authorization_url) {
+    resumeCookieAuthFlow(authorization_url) {
         const ptr0 = passStringToWasm0(authorization_url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.pubky_resumeAuthFlow(this.__wbg_ptr, ptr0, len0);
+        const ret = wasm.pubky_resumeCookieAuthFlow(this.__wbg_ptr, ptr0, len0);
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
         return AuthFlow.__wrap(ret[0]);
     }
+    /**
+     * Resume a previously saved pending grant auth flow.
+     *
+     * **Security:** `savedState` contains the relay secret and PoP client private key.
+     * Delete it from storage as soon as the resumed flow completes.
+     *
+     * @param {string} savedState A string produced by `grantFlow.save()`.
+     * @returns {GrantAuthFlow} A flow reconnected to the original relay channel.
+     * @param {string} saved_state
+     * @returns {GrantAuthFlow}
+     */
+    resumeGrantAuthFlow(saved_state) {
+        const ptr0 = passStringToWasm0(saved_state, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.pubky_resumeGrantAuthFlow(this.__wbg_ptr, ptr0, len0);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return GrantAuthFlow.__wrap(ret[0]);
+    }
     /**
      * Create a `Signer` from an existing `Keypair`.
      *
@@ -1309,7 +1864,7 @@ class Pubky {
      *
      * @example
      * const signer = pubky.signer(Keypair.random());
-     * const session = await signer.signup(homeserverPk, null);
+     * await signer.signup(homeserverPk);
      * @param {Keypair} keypair
      * @returns {Signer}
      */
@@ -1347,26 +1902,61 @@ class Pubky {
      * - `{ name: "RequestError" }` if the flow cannot be started (network/relay)
      *
      * @example
-     * const flow = pubky.startAuthFlow("/pub/my-cool-app/:rw");
-     * renderQr(flow.authorizationUrl);
-     * const session = await flow.awaitApproval();
+     * const flow = pubky.startCookieAuthFlow("/pub/my-cool-app/:rw");
+     * renderQr(flow.authorizationUrl);
+     * const session = await flow.awaitApproval();
+     * @param {Capabilities} capabilities
+     * @param {AuthFlowKind} kind
+     * @param {string | null} [relay]
+     * @returns {AuthFlow}
+     */
+    startCookieAuthFlow(capabilities, kind, relay) {
+        const ptr0 = passStringToWasm0(capabilities, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        _assertClass(kind, AuthFlowKind);
+        var ptr1 = kind.__destroy_into_raw();
+        var ptr2 = isLikeNone(relay) ? 0 : passStringToWasm0(relay, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var len2 = WASM_VECTOR_LEN;
+        const ret = wasm.pubky_startCookieAuthFlow(this.__wbg_ptr, ptr0, len0, ptr1, ptr2, len2);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return AuthFlow.__wrap(ret[0]);
+    }
+    /**
+     * Start a grant-backed **pubkyauth** flow.
+     *
+     * Grant auth uses a user-signed grant JWS plus Proof-of-Possession and
+     * returns a self-refreshing session.
+     *
+     * @param {string} capabilities Comma-separated caps, e.g. `"/pub/app/:rw,/pub/foo/file:r"`.
+     * @param {AuthFlowKind} kind The kind of authentication flow to perform.
+     * @param {GrantAuthFlowOptions} options Options for the grant flow: `{ clientId, relay? }`.
+     * @returns {GrantAuthFlow}
+     * A running grant auth flow. Show `authorizationUrl` as QR/deeplink,
+     * then `awaitApproval()` to obtain a grant-backed `Session`.
+     *
+     * @example
+     * const flow = pubky.startGrantAuthFlow(
+     *   "/pub/my-cool-app/:rw",
+     *   AuthFlowKind.signin(),
+     *   { clientId: "my-cool-app.example" },
+     * );
      * @param {Capabilities} capabilities
      * @param {AuthFlowKind} kind
-     * @param {string | null} [relay]
-     * @returns {AuthFlow}
+     * @param {GrantAuthFlowOptions} options
+     * @returns {GrantAuthFlow}
      */
-    startAuthFlow(capabilities, kind, relay) {
+    startGrantAuthFlow(capabilities, kind, options) {
         const ptr0 = passStringToWasm0(capabilities, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
         _assertClass(kind, AuthFlowKind);
         var ptr1 = kind.__destroy_into_raw();
-        var ptr2 = isLikeNone(relay) ? 0 : passStringToWasm0(relay, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        var len2 = WASM_VECTOR_LEN;
-        const ret = wasm.pubky_startAuthFlow(this.__wbg_ptr, ptr0, len0, ptr1, ptr2, len2);
+        const ret = wasm.pubky_startGrantAuthFlow(this.__wbg_ptr, ptr0, len0, ptr1, options);
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
-        return AuthFlow.__wrap(ret[0]);
+        return GrantAuthFlow.__wrap(ret[0]);
     }
     /**
      * Create a Pubky facade preconfigured for a **local testnet**.
@@ -1830,6 +2420,18 @@ class Session {
         const ptr = this.__destroy_into_raw();
         wasm.__wbg_session_free(ptr, 0);
     }
+    /**
+     * Cookie-only view for cookie-backed sessions.
+     *
+     * Grant-backed sessions return `undefined`.
+     *
+     * @returns {CookieSession|undefined}
+     * @returns {CookieSession | undefined}
+     */
+    get cookie() {
+        const ret = wasm.session_cookie(this.__wbg_ptr);
+        return ret === 0 ? undefined : CookieSession.__wrap(ret);
+    }
     /**
      * Export the session metadata so it can be restored after a tab refresh.
      *
@@ -1838,6 +2440,8 @@ class Session {
      *
      * @returns {string}
      * A base64 string to store (e.g. in `localStorage`).
+     *
+     * @deprecated Prefer `exportSecret()` for grant sessions.
      * @returns {string}
      */
     export() {
@@ -1852,6 +2456,36 @@ class Session {
             wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
         }
     }
+    /**
+     * Export the secret material needed to restore this session.
+     *
+     * For grant sessions this exports the grant JWS and PoP client secret; restoring
+     * mints a fresh bearer. For legacy cookie sessions this exports the cookie secret
+     * when the SDK owns it.
+     *
+     * Treat the returned string as a bearer-equivalent secret until the grant or
+     * cookie session expires or is revoked.
+     *
+     * @returns {Promise<string>}
+     * A secret token that can be passed to `pubky.restoreSession()`.
+     * @returns {Promise<string>}
+     */
+    exportSecret() {
+        const ret = wasm.session_exportSecret(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Grant-only management view for grant-backed sessions.
+     *
+     * Cookie-backed sessions return `undefined`.
+     *
+     * @returns {GrantSession|undefined}
+     * @returns {GrantSession | undefined}
+     */
+    get grant() {
+        const ret = wasm.session_grant(this.__wbg_ptr);
+        return ret === 0 ? undefined : GrantSession.__wrap(ret);
+    }
     /**
      * Retrieve immutable info about this session (user & capabilities).
      *
@@ -1873,6 +2507,8 @@ class Session {
      * @param {Client=} client
      * Optional client to reuse transport configuration.
      * @returns {Promise<Session>}
+     *
+     * @deprecated Prefer `Pubky.restoreSession(...)`.
      * @param {string} exported
      * @param {Client | null} [client]
      * @returns {Promise<Session>}
@@ -1967,7 +2603,7 @@ if (Symbol.dispose) SessionInfo.prototype[Symbol.dispose] = SessionInfo.prototyp
 exports.SessionInfo = SessionInfo;
 
 /**
- * Read/write storage scoped to **your** session (absolute paths: `/pub/...`).
+ * Read/write storage scoped to **your** session (absolute paths: `/pub/...` or `/priv/...`).
  */
 class SessionStorage {
     static __wrap(ptr) {
@@ -2173,144 +2809,416 @@ exports.SessionStorage = SessionStorage;
  * - Approve pubkyauth requests
  * - Publish PKDNS when signer-bound
  */
-class Signer {
+class Signer {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(Signer.prototype);
+        obj.__wbg_ptr = ptr;
+        SignerFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        SignerFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_signer_free(ptr, 0);
+    }
+    /**
+     * Approve a `pubkyauth://` request URL (encrypts & POSTs the signed AuthToken).
+     * @param {string} pubkyauth_url
+     * @returns {Promise<void>}
+     */
+    approveAuthRequest(pubkyauth_url) {
+        const ptr0 = passStringToWasm0(pubkyauth_url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.signer_approveAuthRequest(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
+    /**
+     * Create a signer from a `Keypair` (prefer `pubky.signer(kp)`).
+     *
+     * @param {Keypair} keypair
+     * @returns {Signer}
+     * @param {Keypair} keypair
+     * @returns {Signer}
+     */
+    static fromKeypair(keypair) {
+        _assertClass(keypair, Keypair);
+        const ret = wasm.signer_fromKeypair(keypair.__wbg_ptr);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return Signer.__wrap(ret[0]);
+    }
+    /**
+     * Get a PKDNS actor bound to this signer's client & keypair (publishing enabled).
+     *
+     * @returns {Pkdns}
+     *
+     * @example
+     * await signer.pkdns.publishHomeserverIfStale(homeserverPk);
+     * @returns {Pkdns}
+     */
+    get pkdns() {
+        const ret = wasm.signer_pkdns(this.__wbg_ptr);
+        return Pkdns.__wrap(ret);
+    }
+    /**
+     * Get the public key of this signer.
+     *
+     * @returns {PublicKey}
+     * @returns {PublicKey}
+     */
+    get publicKey() {
+        const ret = wasm.signer_publicKey(this.__wbg_ptr);
+        return PublicKey.__wrap(ret);
+    }
+    /**
+     * Fast sign-in for a returning user. Publishes PKDNS in the background.
+     *
+     * Creates a valid grant-backed homeserver Session with root capabilities.
+     * `clientId` is shown in the user's grant/session list.
+     * @param {string} clientId App identifier, typically a domain.
+     *
+     * @returns {Promise<Session>}
+     *
+     * @throws {PubkyError}
+     * @param {string} client_id
+     * @returns {Promise<Session>}
+     */
+    signin(client_id) {
+        const ptr0 = passStringToWasm0(client_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.signer_signin(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
+    /**
+     * Blocking sign-in. Waits for PKDNS publish to complete (slower; safer).
+     *
+     * Creates a valid grant-backed homeserver Session with root capabilities.
+     * `clientId` is shown in the user's grant/session list.
+     * @param {string} clientId App identifier, typically a domain.
+     *
+     * @returns {Promise<Session>}
+     * @param {string} client_id
+     * @returns {Promise<Session>}
+     */
+    signinBlocking(client_id) {
+        const ptr0 = passStringToWasm0(client_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.signer_signinBlocking(this.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
+    /**
+     * Legacy cookie signin. Prefer `signin(clientId)`.
+     *
+     * @deprecated Prefer `signin(clientId)`.
+     * @returns {Promise<Session>}
+     */
+    signinCookie() {
+        const ret = wasm.signer_signinCookie(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Legacy cookie blocking signin. Prefer `signinBlocking(clientId)`.
+     *
+     * @deprecated Prefer `signinBlocking(clientId)`.
+     * @returns {Promise<Session>}
+     */
+    signinCookieBlocking() {
+        const ret = wasm.signer_signinCookieBlocking(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * Sign up at a homeserver.
+     *
+     * Creates the account and publishes PKDNS. Call `signin(clientId)` to create a session.
+     *
+     * @param {PublicKey} homeserver The homeserver’s public key.
+     * @param {string|null} signupToken Invite/registration token or `null`.
+     * @returns {Promise<void>}
+     *
+     * @throws {PubkyError}
+     * - `AuthenticationError` (bad/expired token)
+     * - `RequestError` (network/server)
+     * @param {PublicKey} homeserver
+     * @param {string | null} [signup_token]
+     * @returns {Promise<void>}
+     */
+    signup(homeserver, signup_token) {
+        _assertClass(homeserver, PublicKey);
+        var ptr0 = isLikeNone(signup_token) ? 0 : passStringToWasm0(signup_token, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var len0 = WASM_VECTOR_LEN;
+        const ret = wasm.signer_signup(this.__wbg_ptr, homeserver.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
+    /**
+     * Legacy cookie signup. Prefer `signup()` plus `signin(clientId)`.
+     *
+     * @deprecated Prefer `signup()` followed by `signin(clientId)`.
+     * @param {PublicKey} homeserver
+     * @param {string | null} [signup_token]
+     * @returns {Promise<Session>}
+     */
+    signupCookie(homeserver, signup_token) {
+        _assertClass(homeserver, PublicKey);
+        var ptr0 = isLikeNone(signup_token) ? 0 : passStringToWasm0(signup_token, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var len0 = WASM_VECTOR_LEN;
+        const ret = wasm.signer_signupCookie(this.__wbg_ptr, homeserver.__wbg_ptr, ptr0, len0);
+        return ret;
+    }
+}
+if (Symbol.dispose) Signer.prototype[Symbol.dispose] = Signer.prototype.free;
+exports.Signer = Signer;
+
+class SigninDeepLink {
+    static __wrap(ptr) {
+        ptr = ptr >>> 0;
+        const obj = Object.create(SigninDeepLink.prototype);
+        obj.__wbg_ptr = ptr;
+        SigninDeepLinkFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        SigninDeepLinkFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_signindeeplink_free(ptr, 0);
+    }
+    /**
+     * @returns {string}
+     */
+    get baseRelayUrl() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signindeeplink_baseRelayUrl(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * @returns {string}
+     */
+    get capabilities() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signindeeplink_capabilities(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * @param {string} url
+     * @returns {SigninDeepLink}
+     */
+    static parse(url) {
+        const ptr0 = passStringToWasm0(url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.signindeeplink_parse(ptr0, len0);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return SigninDeepLink.__wrap(ret[0]);
+    }
+    /**
+     * @returns {Uint8Array}
+     */
+    get secret() {
+        const ret = wasm.signindeeplink_secret(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * @returns {string}
+     */
+    toString() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signindeeplink_toString(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+}
+if (Symbol.dispose) SigninDeepLink.prototype[Symbol.dispose] = SigninDeepLink.prototype.free;
+exports.SigninDeepLink = SigninDeepLink;
+
+/**
+ * Parsed grant-based signin deeplink.
+ *
+ * This is useful for tools, tests, and signer UIs that need to inspect a
+ * `pubky://signin-grant` authorization URL before approving it.
+ */
+class SigninGrantDeepLink {
     static __wrap(ptr) {
         ptr = ptr >>> 0;
-        const obj = Object.create(Signer.prototype);
+        const obj = Object.create(SigninGrantDeepLink.prototype);
         obj.__wbg_ptr = ptr;
-        SignerFinalization.register(obj, obj.__wbg_ptr, obj);
+        SigninGrantDeepLinkFinalization.register(obj, obj.__wbg_ptr, obj);
         return obj;
     }
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        SignerFinalization.unregister(this);
+        SigninGrantDeepLinkFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_signer_free(ptr, 0);
+        wasm.__wbg_signingrantdeeplink_free(ptr, 0);
     }
     /**
-     * Approve a `pubkyauth://` request URL (encrypts & POSTs the signed AuthToken).
-     * @param {string} pubkyauth_url
-     * @returns {Promise<void>}
+     * Base HTTP relay inbox URL used by this auth request.
+     *
+     * @returns {string}
+     * @returns {string}
      */
-    approveAuthRequest(pubkyauth_url) {
-        const ptr0 = passStringToWasm0(pubkyauth_url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.signer_approveAuthRequest(this.__wbg_ptr, ptr0, len0);
-        return ret;
+    get baseRelayUrl() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signingrantdeeplink_baseRelayUrl(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
     }
     /**
-     * Create a signer from a `Keypair` (prefer `pubky.signer(kp)`).
+     * Capabilities requested by the application.
      *
-     * @param {Keypair} keypair
-     * @returns {Signer}
-     * @param {Keypair} keypair
-     * @returns {Signer}
+     * @returns {string}
+     * @returns {string}
      */
-    static fromKeypair(keypair) {
-        _assertClass(keypair, Keypair);
-        const ret = wasm.signer_fromKeypair(keypair.__wbg_ptr);
-        if (ret[2]) {
-            throw takeFromExternrefTable0(ret[1]);
+    get capabilities() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signingrantdeeplink_capabilities(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
         }
-        return Signer.__wrap(ret[0]);
     }
     /**
-     * Get a PKDNS actor bound to this signer's client & keypair (publishing enabled).
-     *
-     * @returns {Pkdns}
+     * Application identifier shown in the user's grant/session list.
      *
-     * @example
-     * await signer.pkdns.publishHomeserverIfStale(homeserverPk);
-     * @returns {Pkdns}
+     * @returns {string}
+     * @returns {string}
      */
-    get pkdns() {
-        const ret = wasm.signer_pkdns(this.__wbg_ptr);
-        return Pkdns.__wrap(ret);
+    get clientId() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signingrantdeeplink_clientId(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
     }
     /**
-     * Get the public key of this signer.
+     * Public key for the Proof-of-Possession client created by the application.
      *
      * @returns {PublicKey}
      * @returns {PublicKey}
      */
-    get publicKey() {
-        const ret = wasm.signer_publicKey(this.__wbg_ptr);
+    get clientPublicKey() {
+        const ret = wasm.signingrantdeeplink_clientPublicKey(this.__wbg_ptr);
         return PublicKey.__wrap(ret);
     }
     /**
-     * Fast sign-in for a returning user. Publishes PKDNS in the background.
+     * Parse a grant signin deeplink URL.
      *
-     * Creates a valid homeserver Session with root capabilities
-     *
-     * @returns {Promise<Session>}
-     *
-     * @throws {PubkyError}
-     * @returns {Promise<Session>}
+     * @param {string} url
+     * @returns {SigninGrantDeepLink}
+     * @throws {PubkyError} `InvalidInput` when the URL is malformed or not a grant signin link.
+     * @param {string} url
+     * @returns {SigninGrantDeepLink}
      */
-    signin() {
-        const ret = wasm.signer_signin(this.__wbg_ptr);
-        return ret;
+    static parse(url) {
+        const ptr0 = passStringToWasm0(url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.signingrantdeeplink_parse(ptr0, len0);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return SigninGrantDeepLink.__wrap(ret[0]);
     }
     /**
-     * Blocking sign-in. Waits for PKDNS publish to complete (slower; safer).
+     * Relay channel secret embedded in the deeplink.
      *
-     * Creates a valid homeserver Session with root capabilities
+     * Treat this as sensitive temporary auth-flow material.
      *
-     * @returns {Promise<Session>}
-     * @returns {Promise<Session>}
+     * @returns {Uint8Array}
+     * @returns {Uint8Array}
      */
-    signinBlocking() {
-        const ret = wasm.signer_signinBlocking(this.__wbg_ptr);
+    get secret() {
+        const ret = wasm.signingrantdeeplink_secret(this.__wbg_ptr);
         return ret;
     }
     /**
-     * Sign up at a homeserver. Returns a ready `Session`.
+     * Serialize this parsed deeplink back to its URL form.
      *
-     * Creates a valid homeserver Session with root capabilities
-     *
-     * @param {PublicKey} homeserver The homeserver’s public key.
-     * @param {string|null} signupToken Invite/registration token or `null`.
-     * @returns {Promise<Session>}
-     *
-     * @throws {PubkyError}
-     * - `AuthenticationError` (bad/expired token)
-     * - `RequestError` (network/server)
-     * @param {PublicKey} homeserver
-     * @param {string | null} [signup_token]
-     * @returns {Promise<Session>}
+     * @returns {string}
+     * @returns {string}
      */
-    signup(homeserver, signup_token) {
-        _assertClass(homeserver, PublicKey);
-        var ptr0 = isLikeNone(signup_token) ? 0 : passStringToWasm0(signup_token, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        var len0 = WASM_VECTOR_LEN;
-        const ret = wasm.signer_signup(this.__wbg_ptr, homeserver.__wbg_ptr, ptr0, len0);
-        return ret;
+    toString() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signingrantdeeplink_toString(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
     }
 }
-if (Symbol.dispose) Signer.prototype[Symbol.dispose] = Signer.prototype.free;
-exports.Signer = Signer;
+if (Symbol.dispose) SigninGrantDeepLink.prototype[Symbol.dispose] = SigninGrantDeepLink.prototype.free;
+exports.SigninGrantDeepLink = SigninGrantDeepLink;
 
-class SigninDeepLink {
+class SignupDeepLink {
     static __wrap(ptr) {
         ptr = ptr >>> 0;
-        const obj = Object.create(SigninDeepLink.prototype);
+        const obj = Object.create(SignupDeepLink.prototype);
         obj.__wbg_ptr = ptr;
-        SigninDeepLinkFinalization.register(obj, obj.__wbg_ptr, obj);
+        SignupDeepLinkFinalization.register(obj, obj.__wbg_ptr, obj);
         return obj;
     }
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        SigninDeepLinkFinalization.unregister(this);
+        SignupDeepLinkFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_signindeeplink_free(ptr, 0);
+        wasm.__wbg_signupdeeplink_free(ptr, 0);
     }
     /**
      * @returns {string}
@@ -2319,7 +3227,7 @@ class SigninDeepLink {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.signindeeplink_baseRelayUrl(this.__wbg_ptr);
+            const ret = wasm.signupdeeplink_baseRelayUrl(this.__wbg_ptr);
             deferred1_0 = ret[0];
             deferred1_1 = ret[1];
             return getStringFromWasm0(ret[0], ret[1]);
@@ -2334,7 +3242,7 @@ class SigninDeepLink {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.signindeeplink_capabilities(this.__wbg_ptr);
+            const ret = wasm.signupdeeplink_capabilities(this.__wbg_ptr);
             deferred1_0 = ret[0];
             deferred1_1 = ret[1];
             return getStringFromWasm0(ret[0], ret[1]);
@@ -2342,26 +3250,45 @@ class SigninDeepLink {
             wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
         }
     }
+    /**
+     * @returns {PublicKey}
+     */
+    get homeserver() {
+        const ret = wasm.signupdeeplink_homeserver(this.__wbg_ptr);
+        return PublicKey.__wrap(ret);
+    }
     /**
      * @param {string} url
-     * @returns {SigninDeepLink}
+     * @returns {SignupDeepLink}
      */
     static parse(url) {
         const ptr0 = passStringToWasm0(url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.signindeeplink_parse(ptr0, len0);
+        const ret = wasm.signupdeeplink_parse(ptr0, len0);
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
-        return SigninDeepLink.__wrap(ret[0]);
+        return SignupDeepLink.__wrap(ret[0]);
     }
     /**
      * @returns {Uint8Array}
      */
     get secret() {
-        const ret = wasm.signindeeplink_secret(this.__wbg_ptr);
+        const ret = wasm.signupdeeplink_secret(this.__wbg_ptr);
         return ret;
     }
+    /**
+     * @returns {string | undefined}
+     */
+    get signupToken() {
+        const ret = wasm.signupdeeplink_signupToken(this.__wbg_ptr);
+        let v1;
+        if (ret[0] !== 0) {
+            v1 = getStringFromWasm0(ret[0], ret[1]).slice();
+            wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        }
+        return v1;
+    }
     /**
      * @returns {string}
      */
@@ -2369,7 +3296,7 @@ class SigninDeepLink {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.signindeeplink_toString(this.__wbg_ptr);
+            const ret = wasm.signupdeeplink_toString(this.__wbg_ptr);
             deferred1_0 = ret[0];
             deferred1_1 = ret[1];
             return getStringFromWasm0(ret[0], ret[1]);
@@ -2378,35 +3305,44 @@ class SigninDeepLink {
         }
     }
 }
-if (Symbol.dispose) SigninDeepLink.prototype[Symbol.dispose] = SigninDeepLink.prototype.free;
-exports.SigninDeepLink = SigninDeepLink;
+if (Symbol.dispose) SignupDeepLink.prototype[Symbol.dispose] = SignupDeepLink.prototype.free;
+exports.SignupDeepLink = SignupDeepLink;
 
-class SignupDeepLink {
+/**
+ * Parsed grant-based signup deeplink.
+ *
+ * This is useful for tools, tests, and signer UIs that need to inspect a
+ * `pubky://signup-grant` authorization URL before approving it.
+ */
+class SignupGrantDeepLink {
     static __wrap(ptr) {
         ptr = ptr >>> 0;
-        const obj = Object.create(SignupDeepLink.prototype);
+        const obj = Object.create(SignupGrantDeepLink.prototype);
         obj.__wbg_ptr = ptr;
-        SignupDeepLinkFinalization.register(obj, obj.__wbg_ptr, obj);
+        SignupGrantDeepLinkFinalization.register(obj, obj.__wbg_ptr, obj);
         return obj;
     }
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        SignupDeepLinkFinalization.unregister(this);
+        SignupGrantDeepLinkFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_signupdeeplink_free(ptr, 0);
+        wasm.__wbg_signupgrantdeeplink_free(ptr, 0);
     }
     /**
+     * Base HTTP relay inbox URL used by this auth request.
+     *
+     * @returns {string}
      * @returns {string}
      */
     get baseRelayUrl() {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.signupdeeplink_baseRelayUrl(this.__wbg_ptr);
+            const ret = wasm.signupgrantdeeplink_baseRelayUrl(this.__wbg_ptr);
             deferred1_0 = ret[0];
             deferred1_1 = ret[1];
             return getStringFromWasm0(ret[0], ret[1]);
@@ -2415,13 +3351,34 @@ class SignupDeepLink {
         }
     }
     /**
+     * Capabilities requested by the application.
+     *
+     * @returns {string}
      * @returns {string}
      */
     get capabilities() {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.signupdeeplink_capabilities(this.__wbg_ptr);
+            const ret = wasm.signupgrantdeeplink_capabilities(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * Application identifier shown in the user's grant/session list.
+     *
+     * @returns {string}
+     * @returns {string}
+     */
+    get clientId() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.signupgrantdeeplink_clientId(this.__wbg_ptr);
             deferred1_0 = ret[0];
             deferred1_1 = ret[1];
             return getStringFromWasm0(ret[0], ret[1]);
@@ -2430,37 +3387,63 @@ class SignupDeepLink {
         }
     }
     /**
+     * Public key for the Proof-of-Possession client created by the application.
+     *
+     * @returns {PublicKey}
+     * @returns {PublicKey}
+     */
+    get clientPublicKey() {
+        const ret = wasm.signupgrantdeeplink_clientPublicKey(this.__wbg_ptr);
+        return PublicKey.__wrap(ret);
+    }
+    /**
+     * Homeserver public key requested for account creation.
+     *
+     * @returns {PublicKey}
      * @returns {PublicKey}
      */
     get homeserver() {
-        const ret = wasm.signupdeeplink_homeserver(this.__wbg_ptr);
+        const ret = wasm.signupgrantdeeplink_homeserver(this.__wbg_ptr);
         return PublicKey.__wrap(ret);
     }
     /**
+     * Parse a grant signup deeplink URL.
+     *
      * @param {string} url
-     * @returns {SignupDeepLink}
+     * @returns {SignupGrantDeepLink}
+     * @throws {PubkyError} `InvalidInput` when the URL is malformed or not a grant signup link.
+     * @param {string} url
+     * @returns {SignupGrantDeepLink}
      */
     static parse(url) {
         const ptr0 = passStringToWasm0(url, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.signupdeeplink_parse(ptr0, len0);
+        const ret = wasm.signupgrantdeeplink_parse(ptr0, len0);
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
-        return SignupDeepLink.__wrap(ret[0]);
+        return SignupGrantDeepLink.__wrap(ret[0]);
     }
     /**
+     * Relay channel secret embedded in the deeplink.
+     *
+     * Treat this as sensitive temporary auth-flow material.
+     *
+     * @returns {Uint8Array}
      * @returns {Uint8Array}
      */
     get secret() {
-        const ret = wasm.signupdeeplink_secret(this.__wbg_ptr);
+        const ret = wasm.signupgrantdeeplink_secret(this.__wbg_ptr);
         return ret;
     }
     /**
+     * Optional signup token included in the request.
+     *
+     * @returns {string|undefined}
      * @returns {string | undefined}
      */
     get signupToken() {
-        const ret = wasm.signupdeeplink_signupToken(this.__wbg_ptr);
+        const ret = wasm.signupgrantdeeplink_signupToken(this.__wbg_ptr);
         let v1;
         if (ret[0] !== 0) {
             v1 = getStringFromWasm0(ret[0], ret[1]).slice();
@@ -2469,13 +3452,16 @@ class SignupDeepLink {
         return v1;
     }
     /**
+     * Serialize this parsed deeplink back to its URL form.
+     *
+     * @returns {string}
      * @returns {string}
      */
     toString() {
         let deferred1_0;
         let deferred1_1;
         try {
-            const ret = wasm.signupdeeplink_toString(this.__wbg_ptr);
+            const ret = wasm.signupgrantdeeplink_toString(this.__wbg_ptr);
             deferred1_0 = ret[0];
             deferred1_1 = ret[1];
             return getStringFromWasm0(ret[0], ret[1]);
@@ -2484,8 +3470,8 @@ class SignupDeepLink {
         }
     }
 }
-if (Symbol.dispose) SignupDeepLink.prototype[Symbol.dispose] = SignupDeepLink.prototype.free;
-exports.SignupDeepLink = SignupDeepLink;
+if (Symbol.dispose) SignupGrantDeepLink.prototype[Symbol.dispose] = SignupGrantDeepLink.prototype.free;
+exports.SignupGrantDeepLink = SignupGrantDeepLink;
 
 /**
  * Resolve a `pubky://` or `pubky<pk>/…` identifier into the homeserver transport URL.
@@ -2723,7 +3709,7 @@ function __wbg_get_imports() {
             const ret = arg0.catch(arg1);
             return ret;
         },
-        __wbg_clearTimeout_2256f1e7b94ef517: function(arg0) {
+        __wbg_clearTimeout_333bba87532ab9d3: function(arg0) {
             const ret = clearTimeout(arg0);
             return ret;
         },
@@ -2762,15 +3748,15 @@ function __wbg_get_imports() {
             const ret = Event.__wrap(arg0);
             return ret;
         },
-        __wbg_fetch_0d322c0aed196b8b: function(arg0, arg1) {
-            const ret = arg0.fetch(arg1);
+        __wbg_fetch_074561c3e313c86f: function(arg0) {
+            const ret = fetch(arg0);
             return ret;
         },
-        __wbg_fetch_2886d266cfda795f: function(arg0) {
-            const ret = fetch(arg0);
+        __wbg_fetch_0d322c0aed196b8b: function(arg0, arg1) {
+            const ret = arg0.fetch(arg1);
             return ret;
         },
-        __wbg_fetch_43b2f110608a59ff: function(arg0) {
+        __wbg_fetch_95042ac3d1e49f53: function(arg0) {
             const ret = fetch(arg0);
             return ret;
         },
@@ -2812,6 +3798,14 @@ function __wbg_get_imports() {
             const ret = arg0.value;
             return ret;
         },
+        __wbg_grantinfo_new: function(arg0) {
+            const ret = GrantInfo.__wrap(arg0);
+            return ret;
+        },
+        __wbg_grantsessioninfo_new: function(arg0) {
+            const ret = GrantSessionInfo.__wrap(arg0);
+            return ret;
+        },
         __wbg_has_880f1d472f7cecba: function() { return handleError(function (arg0, arg1) {
             const ret = Reflect.has(arg0, arg1);
             return ret;
@@ -3051,7 +4045,7 @@ function __wbg_get_imports() {
             const ret = Session.__wrap(arg0);
             return ret;
         },
-        __wbg_setTimeout_b188b3bcc8977c7d: function(arg0, arg1) {
+        __wbg_setTimeout_3a808dd861dd3c12: function(arg0, arg1) {
             const ret = setTimeout(arg0, arg1);
             return ret;
         },
@@ -3182,18 +4176,18 @@ function __wbg_get_imports() {
             console.warn(arg0, arg1, arg2, arg3);
         },
         __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 209, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hde4a3c4bb985e67d);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 127, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__ha6e3ae977799a830);
             return ret;
         },
         __wbindgen_cast_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 99, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__ha6e3ae977799a830);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 240, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hde4a3c4bb985e67d);
             return ret;
         },
         __wbindgen_cast_0000000000000003: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 206, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__hde4b18e0209e0218);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 237, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h8579194ccdaf276b);
             return ret;
         },
         __wbindgen_cast_0000000000000004: function(arg0) {
@@ -3222,6 +4216,13 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000009: function(arg0, arg1) {
+            var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
+            wasm.__wbindgen_free(arg0, arg1 * 4, 4);
+            // Cast intrinsic for `Vector(NamedExternref("GrantInfo")) -> Externref`.
+            const ret = v0;
+            return ret;
+        },
+        __wbindgen_cast_000000000000000a: function(arg0, arg1) {
             var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
             wasm.__wbindgen_free(arg0, arg1 * 4, 4);
             // Cast intrinsic for `Vector(NamedExternref("string")) -> Externref`.
@@ -3244,8 +4245,8 @@ function __wbg_get_imports() {
     };
 }
 
-function wasm_bindgen__convert__closures_____invoke__hde4b18e0209e0218(arg0, arg1) {
-    wasm.wasm_bindgen__convert__closures_____invoke__hde4b18e0209e0218(arg0, arg1);
+function wasm_bindgen__convert__closures_____invoke__h8579194ccdaf276b(arg0, arg1) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h8579194ccdaf276b(arg0, arg1);
 }
 
 function wasm_bindgen__convert__closures_____invoke__hde4a3c4bb985e67d(arg0, arg1, arg2) {
@@ -3289,12 +4290,30 @@ const AuthTokenFinalization = (typeof FinalizationRegistry === 'undefined')
 const ClientFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_client_free(ptr >>> 0, 1));
+const CookieSessionFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_cookiesession_free(ptr >>> 0, 1));
 const EventFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_event_free(ptr >>> 0, 1));
 const EventStreamBuilderFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_eventstreambuilder_free(ptr >>> 0, 1));
+const GrantAuthFlowFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_grantauthflow_free(ptr >>> 0, 1));
+const GrantInfoFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_grantinfo_free(ptr >>> 0, 1));
+const GrantManagerFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_grantmanager_free(ptr >>> 0, 1));
+const GrantSessionFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_grantsession_free(ptr >>> 0, 1));
+const GrantSessionInfoFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_grantsessioninfo_free(ptr >>> 0, 1));
 const IntoUnderlyingByteSourceFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_intounderlyingbytesource_free(ptr >>> 0, 1));
@@ -3340,9 +4359,15 @@ const SignerFinalization = (typeof FinalizationRegistry === 'undefined')
 const SigninDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_signindeeplink_free(ptr >>> 0, 1));
+const SigninGrantDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_signingrantdeeplink_free(ptr >>> 0, 1));
 const SignupDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_signupdeeplink_free(ptr >>> 0, 1));
+const SignupGrantDeepLinkFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_signupgrantdeeplink_free(ptr >>> 0, 1));
 
 function addToExternrefTable0(obj) {
     const idx = wasm.__externref_table_alloc();