@dynamic-labs-wallet/browser 0.0.0-beta.310 → 0.0.0-beta.312

package/index.cjs.js

@@ -1,13 +1,14 @@
 'use strict';
 
 var core = require('@dynamic-labs-wallet/core');
-var web = require('./internal/web');
-var uuid = require('uuid');
+var web = require('#internal/web');
 var semver = require('semver');
+var uuid = require('uuid');
 var logger$1 = require('@dynamic-labs/logger');
-var sdkApiCore = require('@dynamic-labs/sdk-api-core');
+var loadArgon2idWasm = require('argon2id');
 var axios = require('axios');
 var createHttpError = require('http-errors');
+var sdkApiCore = require('@dynamic-labs/sdk-api-core');
 
 function _extends() {
     _extends = Object.assign || function assign(target) {
@@ -41,65 +42,118 @@ const getMPCSigner = ({ chainName, baseRelayUrl })=>{
     return signatureScheme;
 };
 
-const DEFAULT_LOG_LEVEL = logger$1.LogLevel.DEBUG; //todo: change back to info when done debugging
-const STORAGE_KEY = 'dynamic-waas-wallet-client';
-const CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX = 'dynamicWalletKeyShareBackup';
-const SIGNED_SESSION_ID_MIN_VERSION = '4.25.4';
-// Namespace-specific version requirements
-const SIGNED_SESSION_ID_MIN_VERSION_BY_NAMESPACE = {
-    WalletKit: '4.25.4',
-    ClientSDK: '0.1.0-alpha.0'
-};
+/**
+ * Encryption version identifiers
+ */ var EncryptionVersion = /*#__PURE__*/ function(EncryptionVersion) {
+    EncryptionVersion["V1_LEGACY"] = "v1";
+    EncryptionVersion["V2_PBKDF2"] = "v2";
+    EncryptionVersion["V3_ARGON2"] = "v3";
+    return EncryptionVersion;
+}({});
+/**
+ * Current default version for new encryptions
+ */ const ENCRYPTION_VERSION_CURRENT = "v3";
+/**
+ * Algorithm constants
+ */ const PBKDF2_ALGORITHM = 'PBKDF2';
+const HASH_ALGORITHM = 'SHA-256'; // Generic hash algorithm constant
+const ARGON2_ALGORITHM = 'Argon2id';
+const AES_GCM_ALGORITHM = 'AES-GCM';
+const AES_GCM_LENGTH = 256;
+/**
+ * Argon2 configuration constants, values were chosen based on RFC (https://www.rfc-editor.org/rfc/rfc9106.html#name-parameter-choice)
+ * taking into account that this runs in the client, possibly in smartphones with limited resources
+ */ const ARGON2_MEMORY_SIZE = 65536; // 64 MB in KiB
+const ARGON2_ITERATIONS = 3;
+const ARGON2_PARALLELISM = 2;
+const ARGON2_HASH_LENGTH = 32;
+/**
+ * PBKDF2 configuration constants
+ */ const PBKDF2_ITERATIONS_V1 = 100000;
+const PBKDF2_ITERATIONS_V2 = 1000000;
 
-const handleAxiosError = (error, message, context)=>{
-    var _error_response, _error_response1;
-    logger.debug("[DynamicWaasWalletClient] Axios error: " + message, {
-        error: (_error_response = error.response) == null ? void 0 : _error_response.status,
-        message: error.message,
-        context
+/**
+ * Derives a key using Argon2id algorithm
+ * @param params - Key derivation parameters
+ * @param encryptionConfig - Encryption configuration
+ * @returns Promise<CryptoKey>
+ */ const deriveArgon2Key = async ({ password, salt }, encryptionConfig)=>{
+    const argon2id = await loadArgon2idWasm();
+    const argon2Config = encryptionConfig;
+    const passwordBytes = new TextEncoder().encode(password);
+    const hash = argon2id({
+        password: passwordBytes,
+        salt: salt,
+        parallelism: argon2Config.parallelism || ARGON2_PARALLELISM,
+        passes: argon2Config.iterations,
+        memorySize: argon2Config.memorySize || ARGON2_MEMORY_SIZE,
+        tagLength: argon2Config.hashLength || ARGON2_HASH_LENGTH
     });
-    switch((_error_response1 = error.response) == null ? void 0 : _error_response1.status){
-        case 400:
-            throw createHttpError(400, 'Invalid request');
-        case 401:
-            throw createHttpError(401, 'Authorization header or cookie is required');
-        case 403:
-            throw createHttpError(403, 'Forbidden');
-        case 422:
-            throw createHttpError(422, 'Unprocessable content');
-        case 500:
-            throw createHttpError(500, 'Internal server error');
-        default:
-            throw createHttpError(500, 'Internal server error');
-    }
+    return crypto.subtle.importKey('raw', new Uint8Array(hash), {
+        name: encryptionConfig.algorithm,
+        length: encryptionConfig.algorithmLength
+    }, false, [
+        'encrypt',
+        'decrypt'
+    ]);
 };
 
-const logger = new logger$1.Logger('DynamicWaasWalletClient', logger$1.LogLevel.DEBUG);
-const setLoggerContext = ({ environmentId, authMode = core.AuthMode.HEADER, sessionId = undefined, userId = undefined })=>{
-    try {
-        logger$1.Logger.setEnvironmentId(environmentId);
-        logger$1.Logger.globalMetaData.set('sid', sessionId);
-        logger$1.Logger.globalMetaData.set('user_id', userId);
-        logger$1.Logger.globalMetaData.set('auth_mode', authMode);
-    } catch (error) {
-        logError({
-            message: '[DynamicWaasWalletClient] Error setting logger context',
-            error: error,
-            context: {}
-        });
+/**
+ * Encryption configuration for each version
+ */ const ENCRYPTION_VERSIONS = {
+    [EncryptionVersion.V1_LEGACY]: {
+        version: EncryptionVersion.V1_LEGACY,
+        algorithm: AES_GCM_ALGORITHM,
+        keyDerivation: PBKDF2_ALGORITHM,
+        iterations: PBKDF2_ITERATIONS_V1,
+        hashAlgorithm: HASH_ALGORITHM,
+        algorithmLength: AES_GCM_LENGTH
+    },
+    [EncryptionVersion.V2_PBKDF2]: {
+        version: EncryptionVersion.V2_PBKDF2,
+        algorithm: AES_GCM_ALGORITHM,
+        keyDerivation: PBKDF2_ALGORITHM,
+        iterations: PBKDF2_ITERATIONS_V2,
+        hashAlgorithm: HASH_ALGORITHM,
+        algorithmLength: AES_GCM_LENGTH
+    },
+    [EncryptionVersion.V3_ARGON2]: {
+        version: EncryptionVersion.V3_ARGON2,
+        algorithm: AES_GCM_ALGORITHM,
+        keyDerivation: ARGON2_ALGORITHM,
+        iterations: ARGON2_ITERATIONS,
+        hashAlgorithm: ARGON2_ALGORITHM,
+        algorithmLength: AES_GCM_LENGTH,
+        memorySize: ARGON2_MEMORY_SIZE,
+        parallelism: ARGON2_PARALLELISM,
+        hashLength: ARGON2_HASH_LENGTH
     }
 };
-const logError = ({ message, error, context })=>{
-    if (error instanceof axios.AxiosError) {
-        handleAxiosError(error, message, context);
+/**
+ * Helper function to get encryption configuration by version string
+ * @param version - The version string (e.g., 'v1', 'v2', 'v3')
+ * @returns The encryption configuration for the specified version
+ */ const getEncryptionConfig = (version)=>{
+    // If no version specified, use legacy for backward compatibility
+    if (!version) {
+        return ENCRYPTION_VERSIONS[EncryptionVersion.V1_LEGACY];
+    }
+    const config = ENCRYPTION_VERSIONS[version];
+    if (!config) {
+        throw new Error(`Unsupported encryption version: ${version}`);
     }
-    logger.error(message, {
-        error: error instanceof Error ? error.message : 'Unknown error',
-        context
-    });
+    return config;
+};
+/**
+ * Check if a configuration uses Argon2
+ */ const isArgon2Config = (config)=>{
+    return config.keyDerivation === ARGON2_ALGORITHM;
 };
 
-const bytesToBase64 = (arr)=>{
+/**
+ * Utility functions for encryption operations
+ * These functions are separated to avoid circular dependencies
+ */ const bytesToBase64 = (arr)=>{
     return btoa(Array.from(arr, (b)=>String.fromCharCode(b)).join(''));
 };
 const stringToBytes = (str)=>{
@@ -112,168 +166,13 @@ const base64ToBytes = (base64)=>{
 const ensureBase64Padding = (str)=>{
     return str.padEnd(Math.ceil(str.length / 4) * 4, '=');
 };
-const isBrowser = ()=>typeof window !== 'undefined';
-const getClientKeyShareExportFileName = ({ thresholdSignatureScheme, accountAddress })=>{
-    return `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${thresholdSignatureScheme}-${accountAddress}.json`;
-};
-const getClientKeyShareBackupInfo = (params)=>{
-    var _params_walletProperties, _params_walletProperties_keyShares_;
-    const backups = {
-        [core.BackupLocation.DYNAMIC]: [],
-        [core.BackupLocation.GOOGLE_DRIVE]: [],
-        [core.BackupLocation.ICLOUD]: [],
-        [core.BackupLocation.USER]: [],
-        [core.BackupLocation.EXTERNAL]: []
-    };
-    if (!(params == null ? void 0 : (_params_walletProperties = params.walletProperties) == null ? void 0 : _params_walletProperties.keyShares)) {
-        return {
-            backups,
-            passwordEncrypted: false
-        };
-    }
-    params.walletProperties.keyShares.forEach((keyShare)=>{
-        if (backups[keyShare.backupLocation]) {
-            backups[keyShare.backupLocation].push({
-                location: keyShare.backupLocation,
-                keyShareId: keyShare.id,
-                externalKeyShareId: keyShare == null ? void 0 : keyShare.externalKeyShareId
-            });
-        }
-    });
-    const passwordEncrypted = Boolean((_params_walletProperties_keyShares_ = params.walletProperties.keyShares[0]) == null ? void 0 : _params_walletProperties_keyShares_.passwordEncrypted);
-    return {
-        backups,
-        passwordEncrypted
-    };
-};
-/**
- * Helper function to merge keyshares and remove duplicates based on pubkey and secretShare
- * @param existingKeyShares - Array of existing keyshares
- * @param newKeyShares - Array of new keyshares to merge
- * @returns Array of merged unique keyshares
- */ const mergeUniqueKeyShares = (existingKeyShares, newKeyShares)=>{
-    const uniqueKeyShares = newKeyShares.filter((newShare)=>!existingKeyShares.some((existingShare)=>{
-            if (!(newShare == null ? void 0 : newShare.pubkey) || !(existingShare == null ? void 0 : existingShare.pubkey)) return false;
-            return newShare.pubkey.toString() === existingShare.pubkey.toString() && newShare.secretShare === existingShare.secretShare;
-        }));
-    return [
-        ...existingKeyShares,
-        ...uniqueKeyShares
-    ];
-};
-const timeoutPromise = ({ timeInMs, activity = 'Ceremony' })=>{
-    return new Promise((_, reject)=>setTimeout(()=>reject(new Error(`${activity} did not complete in ${timeInMs}ms`)), timeInMs));
-};
-/**
- * Generic helper function to retry a promise-based operations
- *
- * @param operation - The async operation to retry
- * @param config - Configuration options for retry behavior
- * @returns Promise with the operation result
- * @throws Last error encountered after all retries are exhausted
- */ async function retryPromise(operation, { maxAttempts = 5, retryInterval = 500, operationName = 'operation', logContext = {} } = {}) {
-    let attempts = 0;
-    while(attempts < maxAttempts){
-        try {
-            return await operation();
-        } catch (error) {
-            attempts++;
-            if (attempts === maxAttempts) {
-                logger.error(`Failed to execute ${operationName} after ${maxAttempts} attempts`, _extends({}, logContext, {
-                    error: error instanceof Error ? error.message : 'Unknown error'
-                }));
-                throw error;
-            }
-            // Calculate exponential backoff delay
-            const exponentialDelay = retryInterval * 2 ** (attempts - 1);
-            await new Promise((resolve)=>setTimeout(resolve, exponentialDelay));
-        }
-    }
-    // TypeScript needs this even though it's unreachable
-    throw new Error('Unreachable code');
-}
-const formatEvmMessage = (message)=>{
-    if (typeof message === 'string' && message.startsWith('0x')) {
-        const serializedTxBytes = Uint8Array.from(Buffer.from(message.slice(2), 'hex'));
-        return web.MessageHash.keccak256(serializedTxBytes);
-    }
-    return web.MessageHash.keccak256(message);
-};
-const isHexString = (str)=>{
-    // Remove 0x prefix if present
-    const hex = str.startsWith('0x') ? str.slice(2) : str;
-    // Check if string contains only hex characters
-    return /^[0-9A-Fa-f]+$/.test(hex);
-};
-const formatSolanaMessage = (message)=>{
-    if (typeof message === 'string') {
-        if (!isHexString(message)) {
-            return Buffer.from(message).toString('hex');
-        } else {
-            return new Uint8Array(Buffer.from(message, 'hex'));
-        }
-    } else {
-        return message;
-    }
-};
-const formatMessage = (chainName, message)=>{
-    switch(chainName){
-        case 'EVM':
-            return formatEvmMessage(message);
-        case 'SVM':
-            return formatSolanaMessage(message);
-        case 'SUI':
-            return message;
-        default:
-            throw new Error('Unsupported chain name');
-    }
-};
-const getGoogleOAuthAccountId = (verifiedCredentials)=>{
-    const googleVerifiedCredential = verifiedCredentials == null ? void 0 : verifiedCredentials.find((credential)=>credential.oauthProvider === sdkApiCore.ProviderEnum.Google);
-    return googleVerifiedCredential == null ? void 0 : googleVerifiedCredential.id;
-};
-const createBackupData = ({ encryptedKeyShares, accountAddress, thresholdSignatureScheme, hasPassword = true })=>{
-    return {
-        keyShares: encryptedKeyShares,
-        metadata: {
-            createdAt: new Date().toISOString(),
-            accountAddress,
-            thresholdSignatureScheme,
-            hasPassword,
-            encryption: getEncryptionMetadataForVersion(ENCRYPTION_VERSION_CURRENT),
-            encryptionVersion: ENCRYPTION_VERSION_CURRENT,
-            shareCount: encryptedKeyShares.length
-        }
-    };
-};
 
-const ENCRYPTION_VERSION_LEGACY = 'v1';
-const ENCRYPTION_VERSION_CURRENT = 'v2';
-const PBKDF2_ALGORITHM = 'PBKDF2';
-const PBKDF2_HASH_ALGORITHM = 'SHA-256';
-const AES_GCM_ALGORITHM = 'AES-GCM';
-const AES_GCM_LENGTH = 256;
-const ENCRYPTION_VERSIONS = {
-    [ENCRYPTION_VERSION_LEGACY]: {
-        version: ENCRYPTION_VERSION_LEGACY,
-        algorithm: AES_GCM_ALGORITHM,
-        keyDerivation: PBKDF2_ALGORITHM,
-        iterations: 100000,
-        hashAlgorithm: PBKDF2_HASH_ALGORITHM,
-        algorithmLength: AES_GCM_LENGTH
-    },
-    [ENCRYPTION_VERSION_CURRENT]: {
-        version: ENCRYPTION_VERSION_CURRENT,
-        algorithm: AES_GCM_ALGORITHM,
-        keyDerivation: PBKDF2_ALGORITHM,
-        iterations: 1000000,
-        hashAlgorithm: PBKDF2_HASH_ALGORITHM,
-        algorithmLength: AES_GCM_LENGTH
-    }
-};
-ENCRYPTION_VERSIONS[ENCRYPTION_VERSION_CURRENT].iterations;
-ENCRYPTION_VERSIONS[ENCRYPTION_VERSION_LEGACY].iterations;
-const getKey = async ({ password, salt, encryptionConfig })=>{
+/**
+ * Derives a key using PBKDF2 algorithm
+ * @param params - Key derivation parameters
+ * @param encryptionConfig - Encryption configuration
+ * @returns Promise<CryptoKey>
+ */ const derivePBKDF2Key = async ({ password, salt }, encryptionConfig)=>{
     const passwordBytes = stringToBytes(password);
     const initialKey = await crypto.subtle.importKey('raw', passwordBytes, {
         name: 'PBKDF2'
@@ -293,23 +192,30 @@ const getKey = async ({ password, salt, encryptionConfig })=>{
         'decrypt'
     ]);
 };
+
+/**
+ * Get the appropriate key derivation function based on the encryption config
+ */ const getKey = async (params, encryptionConfig)=>{
+    // Use Argon2 for v3, PBKDF2 for v1 and v2
+    if (encryptionConfig.keyDerivation === ARGON2_ALGORITHM) {
+        return deriveArgon2Key(params, encryptionConfig);
+    } else {
+        return derivePBKDF2Key(params, encryptionConfig);
+    }
+};
 /**
  * Encrypts data using the specified encryption version.
  * Always uses the latest encryption configuration for new encryptions by default.
  */ const encryptData = async ({ data, password, version = ENCRYPTION_VERSION_CURRENT })=>{
-    const encryptionConfig = ENCRYPTION_VERSIONS[version];
-    if (!encryptionConfig) {
-        throw new Error(`Unsupported encryption version: ${version}`);
-    }
+    const encryptionConfig = getEncryptionConfig(version);
     try {
         // Generate a random salt and IV
         const salt = crypto.getRandomValues(new Uint8Array(16));
         const iv = crypto.getRandomValues(new Uint8Array(12)); // AES-GCM requires 12 bytes
         const key = await getKey({
             password,
-            salt,
-            encryptionConfig
-        });
+            salt
+        }, encryptionConfig);
         // Convert the input string to bytes
         const dataBytes = new TextEncoder().encode(data);
         // Encrypt the data
@@ -325,13 +231,15 @@ const getKey = async ({ password, salt, encryptionConfig })=>{
             version
         };
     } catch (error) {
-        throw new Error('Error encrypting data');
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        throw new Error(`Error encrypting data: ${errorMessage} (version: ${version})`);
     }
 };
 /**
  * Decrypts data with version-based configuration.
  * Uses the version field from the data to determine encryption parameters.
  * Falls back to legacy version for backward compatibility if no version is specified.
+ * For v3 (Argon2), retries with parallelism=1 if an OperationError occurs.
  */ const decryptData = async ({ data, password })=>{
     const { salt, iv, cipher, version } = data;
     // Ensure proper base64 padding for all values
@@ -341,26 +249,42 @@ const getKey = async ({ password, salt, encryptionConfig })=>{
     const saltBytes = base64ToBytes(paddedSalt);
     const ivBytes = base64ToBytes(paddedIv);
     const cipherBytes = base64ToBytes(paddedCipher);
-    let encryptionConfig;
-    // Use version-based configuration if available, otherwise fallback to legacy
-    if (version && ENCRYPTION_VERSIONS[version]) {
-        encryptionConfig = ENCRYPTION_VERSIONS[version];
-    } else {
-        // Fallback to legacy version for backward compatibility
-        encryptionConfig = ENCRYPTION_VERSIONS[ENCRYPTION_VERSION_LEGACY];
-    }
+    // Determine which encryption configuration to use
+    const encryptionConfig = getEncryptionConfig(version);
     try {
         const key = await getKey({
             password,
-            salt: saltBytes,
-            encryptionConfig
-        });
+            salt: saltBytes
+        }, encryptionConfig);
         const decryptedData = await crypto.subtle.decrypt({
             name: AES_GCM_ALGORITHM,
             iv: ivBytes
         }, key, cipherBytes);
         return new TextDecoder().decode(decryptedData);
     } catch (error) {
+        // For a short period of time we lowered the parallelism for v3 (Argon2) to 1 to try to fix issues
+        // for users with limited resources, however this introduced a new issue that the decryption would fail
+        // for existing users with v3 (Argon2) encryption, this is a fallback for a few users.
+        if (error instanceof Error && error.name === 'OperationError' && version === 'v3' && isArgon2Config(encryptionConfig)) {
+            try {
+                // Create a modified config with parallelism=1
+                const modifiedConfig = _extends({}, encryptionConfig, {
+                    parallelism: 1
+                });
+                const key = await getKey({
+                    password,
+                    salt: saltBytes
+                }, modifiedConfig);
+                const decryptedData = await crypto.subtle.decrypt({
+                    name: AES_GCM_ALGORITHM,
+                    iv: ivBytes
+                }, key, cipherBytes);
+                return new TextDecoder().decode(decryptedData);
+            } catch (retryError) {
+                // If retry also fails, throw the original error with additional context
+                throw new Error(`Decryption failed after retry with parallelism=1: ${retryError}`);
+            }
+        }
         throw new Error('Decryption failed: ' + error);
     }
 };
@@ -368,17 +292,21 @@ const getKey = async ({ password, salt, encryptionConfig })=>{
  * Gets encryption metadata for a specific version.
  * Used when we need to include metadata in legacy systems or APIs that require it.
  */ const getEncryptionMetadataForVersion = (version)=>{
-    const encryptionConfig = ENCRYPTION_VERSIONS[version];
-    if (!encryptionConfig) {
-        throw new Error(`Unsupported encryption version: ${version}`);
-    }
-    return {
+    const encryptionConfig = getEncryptionConfig(version);
+    const metadata = {
         algorithm: encryptionConfig.algorithm,
         keyDerivation: encryptionConfig.keyDerivation,
         iterations: encryptionConfig.iterations,
         hashAlgorithm: encryptionConfig.hashAlgorithm,
         algorithmLength: encryptionConfig.algorithmLength
     };
+    // Add Argon2-specific metadata if applicable
+    if (isArgon2Config(encryptionConfig)) {
+        metadata.memorySize = encryptionConfig.memorySize;
+        metadata.parallelism = encryptionConfig.parallelism;
+        metadata.hashLength = encryptionConfig.hashLength;
+    }
+    return metadata;
 };
 
 const GOOGLE_DRIVE_UPLOAD_API = 'https://www.googleapis.com';
@@ -429,52 +357,254 @@ const uploadFileToGoogleDrive = async ({ accessToken, fileName, jsonData, parent
     if (!response.ok) {
         throw new Error('Error uploading file');
     }
-    const result = await response.json();
-    return result; // Return file metadata, including file ID
+    const result = await response.json();
+    return result; // Return file metadata, including file ID
+};
+const listFilesFromGoogleDrive = async ({ accessToken, fileName })=>{
+    // Step 1: List all files inside `appDataFolder` with the specified backup filename
+    const resp = await fetch(`${GOOGLE_DRIVE_UPLOAD_API}/drive/v3/files?q=${encodeURIComponent(`name='${fileName}'`)}&spaces=appDataFolder&orderBy=createdTime desc`, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`
+        }
+    });
+    const data = await resp.json();
+    // If no files found, return null
+    if (!data.files || data.files.length === 0) {
+        return null;
+    }
+    const files = data.files;
+    return files;
+};
+const downloadFileFromGoogleDrive = async ({ accessToken, fileName })=>{
+    const files = await listFilesFromGoogleDrive({
+        accessToken,
+        fileName
+    });
+    if (!files || files.length === 0) {
+        return null;
+    }
+    // Get the most recent file
+    const fileMetadata = files[0];
+    // Fetch the file data using the file ID
+    const fileRes = await fetch(`${GOOGLE_DRIVE_UPLOAD_API}/drive/v3/files/${fileMetadata.id}?alt=media`, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`
+        }
+    });
+    // Read the file's raw data
+    const fileRawData = await fileRes.text();
+    if (fileRawData.length === 0) {
+        return null;
+    }
+    try {
+        // Just parse and return the data without validation
+        // The client will handle validation of the structure
+        return JSON.parse(fileRawData);
+    } catch (error) {
+        return null;
+    }
+};
+
+const handleAxiosError = (error, message, context)=>{
+    var _error_response, _error_response1, _error_response2;
+    logger.error('[DynamicWaasWalletClient] Axios error: ', {
+        message,
+        error: (_error_response = error.response) == null ? void 0 : _error_response.data,
+        status: (_error_response1 = error.response) == null ? void 0 : _error_response1.status,
+        context
+    });
+    switch((_error_response2 = error.response) == null ? void 0 : _error_response2.status){
+        case 400:
+            throw createHttpError(400, 'Invalid request');
+        case 401:
+            throw createHttpError(401, 'Authorization header or cookie is required');
+        case 403:
+            throw createHttpError(403, 'Forbidden');
+        case 422:
+            throw createHttpError(422, 'Unprocessable content');
+        case 500:
+            throw createHttpError(500, 'Internal server error');
+        default:
+            throw createHttpError(500, 'Internal server error');
+    }
+};
+
+const logger = new logger$1.Logger('DynamicWaasWalletClient', logger$1.LogLevel.DEBUG);
+const setLoggerContext = ({ environmentId, authMode = core.AuthMode.HEADER, sessionId = undefined, userId = undefined })=>{
+    try {
+        logger$1.Logger.setEnvironmentId(environmentId);
+        logger$1.Logger.globalMetaData.set('sid', sessionId);
+        logger$1.Logger.globalMetaData.set('user_id', userId);
+        logger$1.Logger.globalMetaData.set('auth_mode', authMode);
+    } catch (error) {
+        logError({
+            message: '[DynamicWaasWalletClient] Error setting logger context',
+            error: error,
+            context: {}
+        });
+    }
+};
+const logError = ({ message, error, context })=>{
+    if (error instanceof axios.AxiosError) {
+        handleAxiosError(error, message, context);
+    }
+    logger.error('[DynamicWaasWalletClient] Error in browser client', {
+        error: error instanceof Error ? error.message : String(error),
+        context
+    });
+};
+
+const DEFAULT_LOG_LEVEL = logger$1.LogLevel.DEBUG; //todo: change back to info when done debugging
+const STORAGE_KEY = 'dynamic-waas-wallet-client';
+const CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX = 'dynamicWalletKeyShareBackup';
+const SIGNED_SESSION_ID_MIN_VERSION = '4.25.4';
+// Namespace-specific version requirements
+const SIGNED_SESSION_ID_MIN_VERSION_BY_NAMESPACE = {
+    WalletKit: '4.25.4',
+    ClientSDK: '0.1.0-alpha.0'
+};
+
+const isBrowser = ()=>typeof window !== 'undefined';
+const getClientKeyShareExportFileName = ({ thresholdSignatureScheme, accountAddress })=>{
+    return `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${thresholdSignatureScheme}-${accountAddress}.json`;
+};
+const getClientKeyShareBackupInfo = (params)=>{
+    var _params_walletProperties, _params_walletProperties_keyShares_;
+    const backups = {
+        [core.BackupLocation.DYNAMIC]: [],
+        [core.BackupLocation.GOOGLE_DRIVE]: [],
+        [core.BackupLocation.ICLOUD]: [],
+        [core.BackupLocation.USER]: [],
+        [core.BackupLocation.EXTERNAL]: [],
+        [core.BackupLocation.DELEGATED]: []
+    };
+    if (!(params == null ? void 0 : (_params_walletProperties = params.walletProperties) == null ? void 0 : _params_walletProperties.keyShares)) {
+        return {
+            backups,
+            passwordEncrypted: false
+        };
+    }
+    params.walletProperties.keyShares.forEach((keyShare)=>{
+        if (backups[keyShare.backupLocation]) {
+            backups[keyShare.backupLocation].push({
+                location: keyShare.backupLocation,
+                keyShareId: keyShare.id,
+                externalKeyShareId: keyShare == null ? void 0 : keyShare.externalKeyShareId
+            });
+        }
+    });
+    const passwordEncrypted = Boolean((_params_walletProperties_keyShares_ = params.walletProperties.keyShares[0]) == null ? void 0 : _params_walletProperties_keyShares_.passwordEncrypted);
+    return {
+        backups,
+        passwordEncrypted
+    };
+};
+/**
+ * Helper function to merge keyshares and remove duplicates based on pubkey and secretShare
+ * @param existingKeyShares - Array of existing keyshares
+ * @param newKeyShares - Array of new keyshares to merge
+ * @returns Array of merged unique keyshares
+ */ const mergeUniqueKeyShares = (existingKeyShares, newKeyShares)=>{
+    const uniqueKeyShares = newKeyShares.filter((newShare)=>!existingKeyShares.some((existingShare)=>{
+            if (!(newShare == null ? void 0 : newShare.pubkey) || !(existingShare == null ? void 0 : existingShare.pubkey)) return false;
+            return newShare.pubkey.toString() === existingShare.pubkey.toString() && newShare.secretShare === existingShare.secretShare;
+        }));
+    return [
+        ...existingKeyShares,
+        ...uniqueKeyShares
+    ];
+};
+const timeoutPromise = ({ timeInMs, activity = 'Ceremony' })=>{
+    return new Promise((_, reject)=>setTimeout(()=>reject(new Error(`${activity} did not complete in ${timeInMs}ms`)), timeInMs));
+};
+/**
+ * Generic helper function to retry a promise-based operations
+ *
+ * @param operation - The async operation to retry
+ * @param config - Configuration options for retry behavior
+ * @returns Promise with the operation result
+ * @throws Last error encountered after all retries are exhausted
+ */ async function retryPromise(operation, { maxAttempts = 5, retryInterval = 500, operationName = 'operation', logContext = {} } = {}) {
+    let attempts = 0;
+    while(attempts < maxAttempts){
+        try {
+            return await operation();
+        } catch (error) {
+            var _error_response;
+            attempts++;
+            logger.warn(`Failed to execute ${operationName} on attempt ${attempts}`, _extends({}, logContext, {
+                error: error instanceof Error ? error.message : 'Unknown error',
+                axiosError: error instanceof axios.AxiosError ? (_error_response = error.response) == null ? void 0 : _error_response.data : undefined
+            }));
+            if (attempts === maxAttempts) {
+                var _error_response1;
+                logger.error(`Failed to execute ${operationName} after ${maxAttempts} attempts`, _extends({}, logContext, {
+                    error: error instanceof Error ? error.message : 'Unknown error',
+                    axiosError: error instanceof axios.AxiosError ? (_error_response1 = error.response) == null ? void 0 : _error_response1.data : undefined
+                }));
+                throw error;
+            }
+            // Calculate exponential backoff delay
+            const exponentialDelay = retryInterval * 2 ** (attempts - 1);
+            await new Promise((resolve)=>setTimeout(resolve, exponentialDelay));
+        }
+    }
+    // TypeScript needs this even though it's unreachable
+    throw new Error('Unreachable code');
+}
+const formatEvmMessage = (message)=>{
+    if (typeof message === 'string' && message.startsWith('0x')) {
+        const serializedTxBytes = Uint8Array.from(Buffer.from(message.slice(2), 'hex'));
+        return web.MessageHash.keccak256(serializedTxBytes);
+    }
+    return web.MessageHash.keccak256(message);
 };
-const listFilesFromGoogleDrive = async ({ accessToken, fileName })=>{
-    // Step 1: List all files inside `appDataFolder` with the specified backup filename
-    const resp = await fetch(`${GOOGLE_DRIVE_UPLOAD_API}/drive/v3/files?q=${encodeURIComponent(`name='${fileName}'`)}&spaces=appDataFolder&orderBy=createdTime desc`, {
-        headers: {
-            Authorization: `Bearer ${accessToken}`
+const isHexString = (str)=>{
+    // Remove 0x prefix if present
+    const hex = str.startsWith('0x') ? str.slice(2) : str;
+    // Check if string contains only hex characters
+    return /^[0-9A-Fa-f]+$/.test(hex);
+};
+const formatSolanaMessage = (message)=>{
+    if (typeof message === 'string') {
+        if (!isHexString(message)) {
+            return Buffer.from(message).toString('hex');
+        } else {
+            return new Uint8Array(Buffer.from(message, 'hex'));
         }
-    });
-    const data = await resp.json();
-    // If no files found, return null
-    if (!data.files || data.files.length === 0) {
-        return null;
+    } else {
+        return message;
     }
-    const files = data.files;
-    return files;
 };
-const downloadFileFromGoogleDrive = async ({ accessToken, fileName })=>{
-    const files = await listFilesFromGoogleDrive({
-        accessToken,
-        fileName
-    });
-    if (!files || files.length === 0) {
-        return null;
+const formatMessage = (chainName, message)=>{
+    switch(chainName){
+        case 'EVM':
+            return formatEvmMessage(message);
+        case 'SVM':
+            return formatSolanaMessage(message);
+        case 'SUI':
+            return message;
+        default:
+            throw new Error('Unsupported chain name');
     }
-    // Get the most recent file
-    const fileMetadata = files[0];
-    // Fetch the file data using the file ID
-    const fileRes = await fetch(`${GOOGLE_DRIVE_UPLOAD_API}/drive/v3/files/${fileMetadata.id}?alt=media`, {
-        headers: {
-            Authorization: `Bearer ${accessToken}`
+};
+const getGoogleOAuthAccountId = (verifiedCredentials)=>{
+    const googleVerifiedCredential = verifiedCredentials == null ? void 0 : verifiedCredentials.find((credential)=>credential.oauthProvider === sdkApiCore.ProviderEnum.Google);
+    return googleVerifiedCredential == null ? void 0 : googleVerifiedCredential.id;
+};
+const createBackupData = ({ encryptedKeyShares, accountAddress, thresholdSignatureScheme, hasPassword = true })=>{
+    return {
+        keyShares: encryptedKeyShares,
+        metadata: {
+            createdAt: new Date().toISOString(),
+            accountAddress,
+            thresholdSignatureScheme,
+            hasPassword,
+            encryption: getEncryptionMetadataForVersion(ENCRYPTION_VERSION_CURRENT),
+            encryptionVersion: ENCRYPTION_VERSION_CURRENT,
+            shareCount: encryptedKeyShares.length
         }
-    });
-    // Read the file's raw data
-    const fileRawData = await fileRes.text();
-    if (fileRawData.length === 0) {
-        return null;
-    }
-    try {
-        // Just parse and return the data without validation
-        // The client will handle validation of the structure
-        return JSON.parse(fileRawData);
-    } catch (error) {
-        return null;
-    }
+    };
 };
 
 /**
@@ -591,6 +721,94 @@ const localStorageWriteTest = {
         }
     });
 
+/** Algorithm label for the new hybrid encryption standard */ const ALG_LABEL_RSA = 'HYBRID-RSA-AES-256';
+/**
+ * Convert base64 to base64url encoding
+ */ const toBase64Url = (buffer)=>{
+    const base64 = Buffer.from(buffer).toString('base64');
+    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+};
+/**
+ * Convert ArrayBuffer to base64url
+ */ const arrayBufferToBase64Url = (buffer)=>{
+    return toBase64Url(buffer);
+};
+/**
+ * Import RSA public key from PEM format
+ */ const importRSAPublicKey = async (publicKeyPem)=>{
+    // Remove PEM headers and decode base64
+    const pemHeader = '-----BEGIN PUBLIC KEY-----';
+    const pemFooter = '-----END PUBLIC KEY-----';
+    const pemContents = publicKeyPem.replace(pemHeader, '').replace(pemFooter, '').replace(/\s/g, '');
+    const binaryDer = Buffer.from(pemContents, 'base64').toString('binary');
+    const keyData = new Uint8Array(binaryDer.length);
+    for(let i = 0; i < binaryDer.length; i++){
+        keyData[i] = binaryDer.charCodeAt(i);
+    }
+    return await crypto.subtle.importKey('spki', keyData, {
+        name: 'RSA-OAEP',
+        hash: 'SHA-256'
+    }, false, [
+        'encrypt'
+    ]);
+};
+/**
+ * Creates the encoded envelope bytes from the encrypted data components
+ */ const createEncodedEnvelopeBytes = (iv, ciphertext, authTag, encryptedAesKey)=>{
+    const envelopeData = {
+        algorithm: ALG_LABEL_RSA,
+        iv: arrayBufferToBase64Url(iv.buffer),
+        encryptedData: arrayBufferToBase64Url(ciphertext.buffer),
+        authTag: arrayBufferToBase64Url(authTag.buffer),
+        encryptedKey: arrayBufferToBase64Url(encryptedAesKey)
+    };
+    return Buffer.from(new TextEncoder().encode(JSON.stringify(envelopeData))).toString('base64');
+};
+/**
+ * Encrypts data using HYBRID-RSA-AES-256 encryption scheme with Web Crypto API.
+ * 1. Generate random AES-256 key
+ * 2. Encrypt AES key with RSA public key
+ * 3. Encrypt data with AES-256-GCM
+ */ const encryptDelegatedKeyShare = async (data, publicKeyPem)=>{
+    try {
+        // Step 1: Generate a random AES-256 key and 16-byte IV
+        const aesKey = await crypto.subtle.generateKey({
+            name: 'AES-GCM',
+            length: 256
+        }, true, [
+            'encrypt'
+        ]);
+        const iv = crypto.getRandomValues(new Uint8Array(16)); // 128-bit IV for GCM
+        // Step 2: Encrypt the data with AES-256-GCM
+        const plaintext = new TextEncoder().encode(data);
+        const encryptedData = await crypto.subtle.encrypt({
+            name: 'AES-GCM',
+            iv: iv
+        }, aesKey, plaintext);
+        // Extract the auth tag from the encrypted data (last 16 bytes)
+        const encryptedDataArray = new Uint8Array(encryptedData);
+        const authTag = encryptedDataArray.slice(-16);
+        const ciphertext = encryptedDataArray.slice(0, -16);
+        // Step 3: Encrypt the AES key with RSA public key
+        const rsaPublicKey = await importRSAPublicKey(publicKeyPem);
+        // Export the AES key to encrypt it
+        const aesKeyData = await crypto.subtle.exportKey('raw', aesKey);
+        const encryptedAesKey = await crypto.subtle.encrypt({
+            name: 'RSA-OAEP'
+        }, rsaPublicKey, aesKeyData);
+        return {
+            algorithm: ALG_LABEL_RSA,
+            iv: arrayBufferToBase64Url(iv.buffer),
+            encryptedData: arrayBufferToBase64Url(ciphertext.buffer),
+            authTag: arrayBufferToBase64Url(authTag.buffer),
+            encryptedKey: arrayBufferToBase64Url(encryptedAesKey),
+            encodedEnvelopeBytes: createEncodedEnvelopeBytes(iv, ciphertext, authTag, encryptedAesKey)
+        };
+    } catch (error) {
+        throw new Error(`Encryption failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+};
+
 class DynamicWalletClient {
     getAuthMode() {
         return this.authMode;
@@ -656,7 +874,7 @@ class DynamicWalletClient {
             this.sessionId = sessionId;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error initializing logger context',
+                message: 'Error initializing logger context',
                 error: error,
                 context: {}
             });
@@ -813,7 +1031,7 @@ class DynamicWalletClient {
             };
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in keyGen',
+                message: 'Error in keyGen',
                 error: error,
                 context: {
                     chainName,
@@ -893,7 +1111,7 @@ class DynamicWalletClient {
             };
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in importRawPrivateKey',
+                message: 'Error in importRawPrivateKey',
                 error: error,
                 context: {
                     chainName,
@@ -904,7 +1122,7 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async serverSign({ walletId, message, isFormatted, mfaToken, context, onError }) {
+    async serverSign({ walletId, message, isFormatted, mfaToken, context, onError, dynamicRequestId }) {
         // Create the room and sign the message
         if (typeof message !== 'string') {
             message = `0x${Buffer.from(message).toString('hex')}`;
@@ -913,14 +1131,14 @@ class DynamicWalletClient {
             walletId,
             message,
             isFormatted,
-            dynamicRequestId: uuid.v4(),
+            dynamicRequestId,
             mfaToken,
             context: context ? JSON.parse(JSON.stringify(context, (_key, value)=>typeof value === 'bigint' ? value.toString() : value)) : undefined,
             onError
         });
         return data;
     }
-    async clientSign({ chainName, message, roomId, keyShare, derivationPath, isFormatted }) {
+    async clientSign({ chainName, message, roomId, keyShare, derivationPath, isFormatted, dynamicRequestId }) {
         try {
             const mpcSigner = getMPCSigner({
                 chainName,
@@ -938,13 +1156,14 @@ class DynamicWalletClient {
             return signature;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in clientSign',
+                message: 'Error in clientSign',
                 error: error,
                 context: {
                     chainName,
                     roomId,
                     derivationPath,
-                    isFormatted
+                    isFormatted,
+                    dynamicRequestId
                 }
             });
             throw error;
@@ -952,6 +1171,7 @@ class DynamicWalletClient {
     }
     //todo: need to modify with imported flag
     async sign({ accountAddress, message, chainName, password = undefined, isFormatted = false, signedSessionId, mfaToken, context, onError }) {
+        const dynamicRequestId = uuid.v4();
         try {
             await this.verifyPassword({
                 accountAddress,
@@ -972,13 +1192,15 @@ class DynamicWalletClient {
                 isFormatted,
                 mfaToken,
                 context,
-                onError
+                onError,
+                dynamicRequestId
             });
             this.logger.debug('[DynamicWaasWalletClient] Server sign completed', {
                 message,
                 accountAddress,
                 walletId: wallet.walletId,
-                roomId: data.roomId
+                roomId: data.roomId,
+                dynamicRequestId
             });
             const derivationPath = wallet.derivationPath && wallet.derivationPath != '' ? new Uint32Array(Object.values(JSON.parse(wallet.derivationPath))) : undefined;
             // Perform the client sign and return the signature
@@ -991,7 +1213,8 @@ class DynamicWalletClient {
                 roomId: data.roomId,
                 keyShare: clientKeyShares[0],
                 derivationPath,
-                isFormatted
+                isFormatted,
+                dynamicRequestId
             });
             this.logger.debug('[DynamicWaasWalletClient] Client sign completed', {
                 chainName,
@@ -1003,12 +1226,13 @@ class DynamicWalletClient {
             return signature;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in sign',
+                message: 'Error in sign',
                 error: error,
                 context: {
                     accountAddress,
                     chainName,
-                    isFormatted: isFormatted ? 'true' : 'false'
+                    isFormatted: isFormatted ? 'true' : 'false',
+                    dynamicRequestId
                 }
             });
             throw error;
@@ -1056,7 +1280,7 @@ class DynamicWalletClient {
             });
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in refreshWalletAccountShares',
+                message: 'Error in refreshWalletAccountShares',
                 error: error,
                 context: {
                     accountAddress,
@@ -1121,6 +1345,7 @@ class DynamicWalletClient {
     async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, backupToGoogleDrive = false, delegateToProjectEnvironment = false, mfaToken }) {
         const dynamicRequestId = uuid.v4();
         try {
+            var _publicKey_key, _publicKey_key1;
             await this.verifyPassword({
                 accountAddress,
                 password,
@@ -1172,35 +1397,54 @@ class DynamicWalletClient {
                 chainName,
                 baseRelayUrl: this.baseMPCRelayApiUrl
             });
-            const reshareResults = await Promise.all([
-                ...newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldMpcConfig.threshold, newMpcConfig.threshold, keygenResult, allPartyKeygenIds)),
-                ...existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newMpcConfig.threshold, keyShare, allPartyKeygenIds))
+            const existingResharePromises = existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newMpcConfig.threshold, keyShare, allPartyKeygenIds));
+            const newResharePromises = newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldMpcConfig.threshold, newMpcConfig.threshold, keygenResult, allPartyKeygenIds));
+            // Run both share parties in parallel by group
+            const [existingReshareResults, newReshareResults] = await Promise.all([
+                Promise.all(existingResharePromises),
+                Promise.all(newResharePromises)
             ]);
+            const clientKeyshares = delegateToProjectEnvironment ? [
+                ...existingReshareResults
+            ] : [
+                ...existingReshareResults,
+                ...newReshareResults
+            ];
             this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
                 thresholdSignatureScheme: newThresholdSignatureScheme
             });
             await this.setClientKeySharesToLocalStorage({
                 accountAddress,
-                clientKeyShares: reshareResults,
+                clientKeyShares: clientKeyshares,
                 overwriteOrMerge: 'overwrite'
             });
-            if (delegateToProjectEnvironment) {
-                await this.storeEncryptedBackupByDelegatedWallet({
-                    accountAddress,
-                    password,
-                    signedSessionId
-                });
-            } else {
-                await this.storeEncryptedBackupByWallet({
-                    accountAddress,
-                    password,
-                    signedSessionId,
-                    backupToGoogleDrive
-                });
+            await this.storeEncryptedBackupByWallet({
+                accountAddress,
+                password,
+                signedSessionId,
+                backupToGoogleDrive,
+                delegatedLocations: newReshareResults.map(()=>({
+                        location: core.BackupLocation.DELEGATED
+                    }))
+            });
+            const publicKey = await this.apiClient.getDelegatedEncryptionKey({
+                environmentId: this.environmentId
+            });
+            if (!(publicKey == null ? void 0 : (_publicKey_key = publicKey.key) == null ? void 0 : _publicKey_key.publicKeyPemB64)) {
+                throw new Error('Public key not found');
             }
+            const encryptedDelegatedKeyShareEnvelope = await encryptDelegatedKeyShare(JSON.stringify(clientKeyshares[0]), publicKey == null ? void 0 : (_publicKey_key1 = publicKey.key) == null ? void 0 : _publicKey_key1.publicKeyPemB64);
+            await this.apiClient.publishDelegatedKeyShare({
+                walletId: this.walletMap[accountAddress].walletId,
+                encryptedKeyShare: encryptedDelegatedKeyShareEnvelope == null ? void 0 : encryptedDelegatedKeyShareEnvelope.encodedEnvelopeBytes,
+                encryptionVersion: ENCRYPTION_VERSION_CURRENT,
+                signedSessionId,
+                requiresSignedSessionId: this.requiresSignedSessionId(),
+                dynamicRequestId
+            });
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in reshare',
+                message: 'Error in reshare, resetting wallet to previous state',
                 error: error,
                 context: {
                     accountAddress,
@@ -1211,36 +1455,14 @@ class DynamicWalletClient {
                     dynamicRequestId
                 }
             });
-            throw error;
-        }
-    }
-    async sendKeySharesToDelegatedAccess({ accountAddress, chainName, delegatedKeyShares, environmentId, userId, walletId }) {
-        try {
-            if (!this.delegatedAccessEndpoint) {
-                throw new Error('Cannot send key shares to delegated access because delegated access endpoint is not set');
-            }
-            const delegatedAccessEndpoint = this.delegatedAccessEndpoint;
-            const response = await fetch(delegatedAccessEndpoint, {
-                method: 'POST',
-                body: JSON.stringify({
-                    chainName,
-                    accountAddress,
-                    delegatedKeyShares,
-                    environmentId,
-                    userId,
-                    walletId
-                })
+            // reset user wallet when reshare fails, this would allow the client to recover wallets from an active state
+            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+                thresholdSignatureScheme: oldThresholdSignatureScheme
             });
-            const data = await response.json();
-            return data;
-        } catch (error) {
-            logError({
-                message: '[DynamicWaasWalletClient] Error in sendKeySharesToDelegatedAccess',
-                error: error,
-                context: {
-                    accountAddress,
-                    chainName
-                }
+            await this.setClientKeySharesToLocalStorage({
+                accountAddress,
+                clientKeyShares: [],
+                overwriteOrMerge: 'overwrite'
             });
             throw error;
         }
@@ -1251,15 +1473,9 @@ class DynamicWalletClient {
             if (!delegateToProjectEnvironment) {
                 throw new Error('Delegation is not allowed for this project environment');
             }
-            const environmentSettings = await this.apiClient.getEnvironmentSettings();
-            const delegatedAccessEndpoint = environmentSettings.sdk.waas.delegatedAccessEndpoint;
-            if (!delegatedAccessEndpoint) {
-                throw new Error('Cannot delegate key shares because verified access endpoint is not set in the environment settings');
-            }
-            this.delegatedAccessEndpoint = delegatedAccessEndpoint;
             const wallet = await this.getWallet({
                 accountAddress,
-                walletOperation: core.WalletOperation.REACH_ALL_PARTIES,
+                walletOperation: core.WalletOperation.RESHARE,
                 password,
                 signedSessionId
             });
@@ -1267,28 +1483,23 @@ class DynamicWalletClient {
                 throw new Error('Delegation is not allowed for SUI');
             }
             const currentThresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
-            if (currentThresholdSignatureScheme === core.ThresholdSignatureScheme.TWO_OF_TWO) {
-                // Reshare to 2-of-3, which will automatically handle the backup distribution
-                await this.reshare({
-                    chainName: this.walletMap[accountAddress].chainName,
-                    accountAddress,
-                    oldThresholdSignatureScheme: currentThresholdSignatureScheme,
-                    newThresholdSignatureScheme: core.ThresholdSignatureScheme.TWO_OF_THREE,
-                    password,
-                    signedSessionId,
-                    backupToGoogleDrive: false,
-                    delegateToProjectEnvironment: true,
-                    mfaToken
-                });
-                const backupInfo = this.walletMap[accountAddress].clientKeySharesBackupInfo;
-                const delegatedKeyShares = backupInfo.backups[core.BackupLocation.EXTERNAL] || [];
-                return delegatedKeyShares;
-            } else {
-                throw new Error('Delegation is not allowed for this threshold signature scheme');
-            }
+            await this.reshare({
+                chainName: this.walletMap[accountAddress].chainName,
+                accountAddress,
+                oldThresholdSignatureScheme: currentThresholdSignatureScheme,
+                newThresholdSignatureScheme: core.ThresholdSignatureScheme.TWO_OF_THREE,
+                password,
+                signedSessionId,
+                backupToGoogleDrive: false,
+                delegateToProjectEnvironment: true,
+                mfaToken
+            });
+            const backupInfo = this.walletMap[accountAddress].clientKeySharesBackupInfo;
+            const delegatedKeyShares = backupInfo.backups[core.BackupLocation.DELEGATED] || [];
+            return delegatedKeyShares;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in delegateKeyShares',
+                message: 'Error in delegateKeyShares',
                 error: error,
                 context: {
                     accountAddress
@@ -1355,7 +1566,7 @@ class DynamicWalletClient {
             };
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in exportKey',
+                message: 'Error in exportKey',
                 error: error,
                 context: {
                     accountAddress,
@@ -1403,7 +1614,7 @@ class DynamicWalletClient {
             };
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in offlineExportKey',
+                message: 'Error in offlineExportKey',
                 error: error,
                 context: {
                     chainName
@@ -1441,7 +1652,7 @@ class DynamicWalletClient {
             return (parsedWalletObject == null ? void 0 : parsedWalletObject.clientKeyShares) || [];
         } catch (error) {
             logError({
-                message: `[DynamicWaasWalletClient] Error parsing clientKeyShares: ${error} for accountAddress: ${accountAddress}`,
+                message: `Error parsing clientKeyShares: Error for accountAddress:`,
                 error: error,
                 context: {
                     accountAddress
@@ -1487,7 +1698,8 @@ class DynamicWalletClient {
    * @param params.signedSessionId - Optional signed session ID for authentication
    * @param params.backupToGoogleDrive - Whether to backup to Google Drive (defaults to false)
    * @returns Promise with backup metadata including share locations and IDs
-   */ async storeEncryptedBackupByWallet({ accountAddress, clientKeyShares = undefined, password = undefined, signedSessionId, backupToGoogleDrive = false }) {
+   */ async storeEncryptedBackupByWallet({ accountAddress, clientKeyShares = undefined, password = undefined, signedSessionId, backupToGoogleDrive = false, delegatedLocations = [] }) {
+        const dynamicRequestId = uuid.v4();
         try {
             var _this_walletMap_accountAddress, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_GOOGLE_DRIVE, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups, _this_walletMap_accountAddress_clientKeySharesBackupInfo, _this_walletMap_accountAddress1;
             const keySharesToBackup = clientKeyShares != null ? clientKeyShares : await this.getClientKeySharesFromLocalStorage({
@@ -1496,7 +1708,7 @@ class DynamicWalletClient {
             if (!((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.walletId)) {
                 const error = new Error(`WalletId not found for accountAddress ${accountAddress}`);
                 logError({
-                    message: '[DynamicWaasWalletClient] Error in storeEncryptedBackupByWallet, wallet or walletId not found from the wallet map',
+                    message: 'Error in storeEncryptedBackupByWallet, wallet or walletId not found from the wallet map',
                     error,
                     context: {
                         accountAddress,
@@ -1533,7 +1745,8 @@ class DynamicWalletClient {
                 encryptionVersion: ENCRYPTION_VERSION_CURRENT,
                 signedSessionId,
                 authMode: this.authMode,
-                requiresSignedSessionId: this.requiresSignedSessionId()
+                requiresSignedSessionId: this.requiresSignedSessionId(),
+                dynamicRequestId
             });
             if (data.keyShareIds.length === 0) {
                 throw new Error('No key shares were backed up');
@@ -1553,9 +1766,13 @@ class DynamicWalletClient {
                     location: core.BackupLocation.GOOGLE_DRIVE
                 });
             }
+            if ((delegatedLocations == null ? void 0 : delegatedLocations.length) > 0) {
+                locations.push(...delegatedLocations);
+            }
             const backupData = await this.apiClient.markKeySharesAsBackedUp({
                 walletId: this.walletMap[accountAddress].walletId,
-                locations
+                locations,
+                dynamicRequestId
             });
             const updatedBackupInfo = getClientKeyShareBackupInfo({
                 walletProperties: {
@@ -1576,109 +1793,11 @@ class DynamicWalletClient {
             return data;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in storeEncryptedBackupByWallet',
+                message: 'Error in storeEncryptedBackupByWallet',
                 error: error,
                 context: {
-                    accountAddress
-                }
-            });
-            throw error;
-        }
-    }
-    async storeEncryptedBackupByDelegatedWallet({ accountAddress, clientKeyShares = undefined, password = undefined, signedSessionId }) {
-        try {
-            var _this_walletMap_accountAddress, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_EXTERNAL, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups, _this_walletMap_accountAddress_clientKeySharesBackupInfo, _this_walletMap_accountAddress1;
-            const keySharesToBackup = clientKeyShares != null ? clientKeyShares : await this.getClientKeySharesFromLocalStorage({
-                accountAddress
-            });
-            if (!((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.walletId)) {
-                const error = new Error(`WalletId not found for accountAddress ${accountAddress}`);
-                logError({
-                    message: '[DynamicWaasWalletClient] Error in storeEncryptedBackupByWallet, wallet or walletId not found from the wallet map',
-                    error,
-                    context: {
-                        accountAddress,
-                        walletMap: this.walletMap
-                    }
-                });
-                throw error;
-            }
-            let dynamicClientKeyShares = [];
-            let delegatedKeyShares = [];
-            const encryptedKeyShares = await Promise.all(keySharesToBackup.map((keyShare)=>this.encryptKeyShare({
-                    keyShare,
-                    password
-                })));
-            const hasExistingDelegatedBackup = ((_this_walletMap_accountAddress1 = this.walletMap[accountAddress]) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo = _this_walletMap_accountAddress1.clientKeySharesBackupInfo) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups = _this_walletMap_accountAddress_clientKeySharesBackupInfo.backups) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_EXTERNAL = _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups[core.BackupLocation.EXTERNAL]) == null ? void 0 : _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_EXTERNAL.length) > 0;
-            const shouldBackupToDelegated = hasExistingDelegatedBackup || keySharesToBackup.length >= 2;
-            if (shouldBackupToDelegated) {
-                // For 2 shares: 1 to backend, 1 to delegated
-                // For 3+ shares: N-1 to backend, 1 to delegated
-                dynamicClientKeyShares = encryptedKeyShares.slice(0, -core.DELEGATED_SHARE_COUNT);
-                delegatedKeyShares = encryptedKeyShares.slice(-core.DELEGATED_SHARE_COUNT);
-            } else {
-                dynamicClientKeyShares = encryptedKeyShares;
-            }
-            const data = await this.apiClient.storeEncryptedBackupByWallet({
-                walletId: this.walletMap[accountAddress].walletId,
-                encryptedKeyShares: dynamicClientKeyShares,
-                passwordEncrypted: Boolean(password) && password !== this.environmentId,
-                encryptionVersion: ENCRYPTION_VERSION_CURRENT,
-                signedSessionId,
-                authMode: this.authMode,
-                requiresSignedSessionId: this.requiresSignedSessionId()
-            });
-            await this.apiClient.markKeySharesAsBackedUp({
-                walletId: this.walletMap[accountAddress].walletId,
-                locations: [
-                    {
-                        location: core.BackupLocation.DYNAMIC
-                    }
-                ]
-            });
-            if (delegatedKeyShares.length > 0) {
-                const wallet = this.walletMap[accountAddress];
-                var _this_userId;
-                const delegatedKeyShareIds = await this.sendKeySharesToDelegatedAccess({
                     accountAddress,
-                    chainName: wallet.chainName,
-                    environmentId: this.environmentId,
-                    walletId: wallet.walletId,
-                    userId: (_this_userId = this.userId) != null ? _this_userId : '',
-                    delegatedKeyShares: delegatedKeyShares
-                });
-                data.keyShares.push({
-                    backupLocation: core.BackupLocation.EXTERNAL,
-                    id: delegatedKeyShareIds
-                });
-                //todo: combine with user share service backup once other branch is merged
-                await this.apiClient.markKeySharesAsBackedUp({
-                    walletId: this.walletMap[accountAddress].walletId,
-                    locations: [
-                        {
-                            location: core.BackupLocation.EXTERNAL
-                        }
-                    ]
-                });
-            }
-            const updatedBackupInfo = getClientKeyShareBackupInfo({
-                walletProperties: {
-                    derivationPath: this.walletMap[accountAddress].derivationPath,
-                    keyShares: data.keyShares,
-                    thresholdSignatureScheme: this.walletMap[accountAddress].thresholdSignatureScheme
-                }
-            });
-            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
-                clientKeySharesBackupInfo: updatedBackupInfo
-            });
-            await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
-            return data;
-        } catch (error) {
-            logError({
-                message: '[DynamicWaasWalletClient] Error in storeEncryptedBackupByDelegatedWallet',
-                error: error,
-                context: {
-                    accountAddress
+                    dynamicRequestId
                 }
             });
             throw error;
@@ -1725,8 +1844,9 @@ class DynamicWalletClient {
    * @returns The Google OAuth Account ID
    * @throws Error if no Google OAuth account ID is found
    */ async getGoogleOauthAccountIdOrThrow(accountAddress) {
+        const dynamicRequestId = uuid.v4();
         try {
-            const user = await this.apiClient.getUser();
+            const user = await this.apiClient.getUser(dynamicRequestId);
             const oauthAccountId = getGoogleOAuthAccountId(user == null ? void 0 : user.verifiedCredentials);
             if (!oauthAccountId) {
                 const error = new Error('No Google OAuth account ID found');
@@ -1743,10 +1863,11 @@ class DynamicWalletClient {
             return oauthAccountId;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in getGoogleOauthAccountIdOrThrow',
+                message: 'Error in getGoogleOauthAccountIdOrThrow',
                 error: error,
                 context: {
-                    accountAddress
+                    accountAddress,
+                    dynamicRequestId
                 }
             });
             throw error;
@@ -1816,7 +1937,7 @@ class DynamicWalletClient {
             return decryptedKeyShares;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in recoverEncryptedBackupByWallet',
+                message: 'Error in recoverEncryptedBackupByWallet',
                 error: error,
                 context: {
                     accountAddress,
@@ -1882,7 +2003,7 @@ class DynamicWalletClient {
             }
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in backupKeySharesToGoogleDrive',
+                message: 'Error in backupKeySharesToGoogleDrive',
                 error: error,
                 context: {
                     accountAddress
@@ -1930,7 +2051,7 @@ class DynamicWalletClient {
             return;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in backupKeySharesToGoogleDrive',
+                message: 'Error in backupKeySharesToGoogleDrive',
                 error: error,
                 context: {
                     accountAddress
@@ -1962,7 +2083,7 @@ class DynamicWalletClient {
                     }));
             } catch (error) {
                 logError({
-                    message: '[DynamicWaasWalletClient] Failed to download backup from Google Drive',
+                    message: 'Failed to download backup from Google Drive',
                     error: error,
                     context: {
                         accountAddress,
@@ -1974,7 +2095,7 @@ class DynamicWalletClient {
             if (!backupData) {
                 const error = new Error('No backup file found');
                 logError({
-                    message: '[DynamicWaasWalletClient] No backup file found',
+                    message: 'No backup file found',
                     error: new Error('No backup file found'),
                     context: {
                         accountAddress,
@@ -1987,7 +2108,7 @@ class DynamicWalletClient {
             if (!backupData.keyShares || !backupData.metadata) {
                 const error = new Error('Invalid backup format: missing keyShares or metadata');
                 logError({
-                    message: '[DynamicWaasWalletClient] Invalid backup format: missing keyShares or metadata',
+                    message: 'Invalid backup format: missing keyShares or metadata',
                     error,
                     context: {
                         accountAddress,
@@ -2009,7 +2130,7 @@ class DynamicWalletClient {
             return decryptedKeyShares;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in restoreBackupFromGoogleDrive',
+                message: 'Error in restoreBackupFromGoogleDrive',
                 error: error,
                 context: {
                     accountAddress
@@ -2141,7 +2262,7 @@ class DynamicWalletClient {
             });
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in verifyPassword',
+                message: 'Error in verifyPassword',
                 error: error,
                 context: {
                     accountAddress
@@ -2193,6 +2314,7 @@ class DynamicWalletClient {
         return true;
     }
     async getWalletClientKeyShareBackupInfo({ accountAddress }) {
+        const dynamicRequestId = uuid.v4();
         try {
             var _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups, _this_walletMap_accountAddress_clientKeySharesBackupInfo, _this_walletMap_accountAddress, _user_verifiedCredentials;
             // Return existing backup info if it exists
@@ -2200,23 +2322,25 @@ class DynamicWalletClient {
                 return this.walletMap[accountAddress].clientKeySharesBackupInfo;
             }
             // Get backup info from server
-            const user = await this.apiClient.getUser();
+            const user = await this.apiClient.getUser(dynamicRequestId);
             const wallet = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.find((vc)=>vc.address.toLowerCase() === accountAddress.toLowerCase());
             return getClientKeyShareBackupInfo({
                 walletProperties: wallet == null ? void 0 : wallet.walletProperties
             });
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in getWalletClientKeyShareBackupInfo',
+                message: 'Error in getWalletClientKeyShareBackupInfo',
                 error: error,
                 context: {
-                    accountAddress
+                    accountAddress,
+                    dynamicRequestId
                 }
             });
             throw error;
         }
     }
     async getWallet({ accountAddress, walletOperation = core.WalletOperation.NO_OPERATION, shareCount = undefined, password = undefined, signedSessionId }) {
+        const dynamicRequestId = uuid.v4();
         try {
             var _user_verifiedCredentials;
             const existingWalletCheck = await this.checkWalletFields({
@@ -2229,7 +2353,7 @@ class DynamicWalletClient {
                 return this.walletMap[accountAddress];
             }
             // Fetch and restore wallet from server
-            const user = await this.apiClient.getUser();
+            const user = await this.apiClient.getUser(dynamicRequestId);
             const wallet = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.find((vc)=>vc.address.toLowerCase() === accountAddress.toLowerCase());
             this.logger.debug('[DynamicWaasWalletClient] Restoring wallet', wallet);
             const walletProperties = wallet.walletProperties;
@@ -2275,21 +2399,23 @@ class DynamicWalletClient {
             return this.walletMap[accountAddress];
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in getWallet',
+                message: 'Error in getWallet',
                 error: error,
                 context: {
                     accountAddress,
                     walletOperation,
-                    shareCount
+                    shareCount,
+                    dynamicRequestId
                 }
             });
             throw error;
         }
     }
     async getWallets() {
+        const dynamicRequestId = uuid.v4();
         try {
             var _user_verifiedCredentials;
-            const user = await this.apiClient.getUser();
+            const user = await this.apiClient.getUser(dynamicRequestId);
             this.userId = user.id;
             const waasWallets = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.filter((vc)=>vc.walletName === 'dynamicwaas');
             const wallets = waasWallets.map((vc)=>{
@@ -2322,9 +2448,11 @@ class DynamicWalletClient {
             return wallets;
         } catch (error) {
             logError({
-                message: '[DynamicWaasWalletClient] Error in getWallets',
+                message: 'Error in getWallets',
                 error: error,
-                context: {}
+                context: {
+                    dynamicRequestId
+                }
             });
             throw error;
         }
@@ -2342,7 +2470,6 @@ class DynamicWalletClient {
     sdkVersion }){
         this.userId = undefined;
         this.sessionId = undefined;
-        this.delegatedAccessEndpoint = undefined;
         this.initializePromise = null;
         this.logger = logger;
         this.walletMap = {} // todo: store in session storage
@@ -2455,10 +2582,7 @@ exports.ERROR_SIGN_MESSAGE = ERROR_SIGN_MESSAGE;
 exports.ERROR_SIGN_TYPED_DATA = ERROR_SIGN_TYPED_DATA;
 exports.ERROR_VERIFY_MESSAGE_SIGNATURE = ERROR_VERIFY_MESSAGE_SIGNATURE;
 exports.ERROR_VERIFY_TRANSACTION_SIGNATURE = ERROR_VERIFY_TRANSACTION_SIGNATURE;
-exports.base64ToBytes = base64ToBytes;
-exports.bytesToBase64 = bytesToBase64;
 exports.createBackupData = createBackupData;
-exports.ensureBase64Padding = ensureBase64Padding;
 exports.formatEvmMessage = formatEvmMessage;
 exports.formatMessage = formatMessage;
 exports.getClientKeyShareBackupInfo = getClientKeyShareBackupInfo;
@@ -2470,7 +2594,6 @@ exports.isBrowser = isBrowser;
 exports.isHexString = isHexString;
 exports.mergeUniqueKeyShares = mergeUniqueKeyShares;
 exports.retryPromise = retryPromise;
-exports.stringToBytes = stringToBytes;
 exports.timeoutPromise = timeoutPromise;
 Object.keys(core).forEach(function (k) {
     if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {