@dynamic-labs-wallet/browser 0.0.0-pr384.2 → 0.0.0-pr526.0

package/index.esm.js

@@ -1,15 +1,15 @@
-import { SigningAlgorithm, MPC_RELAY_PROD_API_URL, getMPCChainConfig, AuthMode, BackupLocation, parseNamespacedVersion, getClientThreshold, MPC_CONFIG, getTSSConfig, WalletOperation, getReshareConfig, FEATURE_FLAGS, ThresholdSignatureScheme, DELEGATED_SHARE_COUNT, verifiedCredentialNameToChainEnum, DynamicApiClient, getEnvironmentFromUrl, IFRAME_DOMAIN_MAP } from '@dynamic-labs-wallet/core';
+import { SigningAlgorithm, MPC_RELAY_PROD_API_URL, getMPCChainConfig, AuthMode, BackupLocation, parseNamespacedVersion, ThresholdSignatureScheme, getClientThreshold, MPC_CONFIG, getTSSConfig, serializeMessageForForwardMPC, WalletOperation, getReshareConfig, FEATURE_FLAGS, verifiedCredentialNameToChainEnum, DynamicApiClient, getEnvironmentFromUrl, IFRAME_DOMAIN_MAP } from '@dynamic-labs-wallet/core';
 export * from '@dynamic-labs-wallet/core';
-import { BIP340, ExportableEd25519, Ecdsa, MessageHash, EcdsaKeygenResult, ExportableEd25519KeygenResult, BIP340KeygenResult } from '#internal/web';
+import { BIP340, ExportableEd25519, Ecdsa, MessageHash, EcdsaSignature, EcdsaKeygenResult, ExportableEd25519KeygenResult, BIP340KeygenResult } from '#internal/web';
 export { BIP340, BIP340InitKeygenResult, BIP340KeygenResult, Ecdsa, EcdsaInitKeygenResult, EcdsaKeygenResult, EcdsaPublicKey, EcdsaSignature, Ed25519, Ed25519InitKeygenResult, Ed25519KeygenResult, MessageHash } from '#internal/web';
 import { gte } from 'semver';
 import { v4 } from 'uuid';
 import { Logger, LogLevel } from '@dynamic-labs/logger';
 export { Logger } from '@dynamic-labs/logger';
+import { ProviderEnum, RoomTypeEnum } from '@dynamic-labs/sdk-api-core';
 import loadArgon2idWasm from 'argon2id';
 import { AxiosError } from 'axios';
 import createHttpError from 'http-errors';
-import { ProviderEnum } from '@dynamic-labs/sdk-api-core';
 
 function _extends() {
     _extends = Object.assign || function assign(target) {
@@ -464,10 +464,12 @@ const SIGNED_SESSION_ID_MIN_VERSION_BY_NAMESPACE = {
     WalletKit: '4.25.4',
     ClientSDK: '0.1.0-alpha.0'
 };
+const ROOM_CACHE_COUNT = 5;
 
 const isBrowser = ()=>typeof window !== 'undefined';
-const getClientKeyShareExportFileName = ({ thresholdSignatureScheme, accountAddress })=>{
-    return `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${thresholdSignatureScheme}-${accountAddress}.json`;
+const getClientKeyShareExportFileName = ({ thresholdSignatureScheme, accountAddress, isGoogleDrive = false })=>{
+    const suffix = isGoogleDrive ? '-google-drive' : '';
+    return `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${thresholdSignatureScheme}-${accountAddress}${suffix}.json`;
 };
 const getClientKeyShareBackupInfo = (params)=>{
     var _params_walletProperties, _params_walletProperties_keyShares_;
@@ -476,7 +478,8 @@ const getClientKeyShareBackupInfo = (params)=>{
         [BackupLocation.GOOGLE_DRIVE]: [],
         [BackupLocation.ICLOUD]: [],
         [BackupLocation.USER]: [],
-        [BackupLocation.EXTERNAL]: []
+        [BackupLocation.EXTERNAL]: [],
+        [BackupLocation.DELEGATED]: []
     };
     if (!(params == null ? void 0 : (_params_walletProperties = params.walletProperties) == null ? void 0 : _params_walletProperties.keyShares)) {
         return {
@@ -606,6 +609,19 @@ const createBackupData = ({ encryptedKeyShares, accountAddress, thresholdSignatu
         }
     };
 };
+const downloadStringAsFile = ({ filename, content, mimeType = 'application/json' })=>{
+    const blob = new Blob([
+        content
+    ], {
+        type: mimeType
+    });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = filename;
+    a.click();
+    URL.revokeObjectURL(url);
+};
 
 /**
  * Uploads a backup to Google Drive App
@@ -652,6 +668,84 @@ const createBackupData = ({ encryptedKeyShares, accountAddress, thresholdSignatu
     }
 };
 
+const ALG_LABEL_RSA = 'HYBRID-RSA-AES-256';
+/**
+ * Convert base64 to base64url encoding
+ */ const toBase64Url = (buffer)=>{
+    const base64 = Buffer.from(buffer).toString('base64');
+    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+};
+/**
+ * Convert ArrayBuffer to base64url
+ */ const arrayBufferToBase64Url = (buffer)=>{
+    return toBase64Url(buffer);
+};
+/**
+ * Import RSA public key from PEM format
+ */ const importRSAPublicKey = async (publicKeyPem)=>{
+    // Remove PEM headers and decode base64
+    const pemHeader = '-----BEGIN PUBLIC KEY-----';
+    const pemFooter = '-----END PUBLIC KEY-----';
+    const pemContents = publicKeyPem.replace(pemHeader, '').replace(pemFooter, '').replace(/\s/g, '');
+    const binaryDer = Buffer.from(pemContents, 'base64').toString('binary');
+    const keyData = new Uint8Array(binaryDer.length);
+    for(let i = 0; i < binaryDer.length; i++){
+        keyData[i] = binaryDer.charCodeAt(i);
+    }
+    return await crypto.subtle.importKey('spki', keyData, {
+        name: 'RSA-OAEP',
+        hash: 'SHA-256'
+    }, false, [
+        'encrypt'
+    ]);
+};
+// encodedEnvelopeBytes intentionally omitted; alg/ct/ek/iv/tag/kid is sufficient
+/**
+ * Encrypts data using HYBRID-RSA-AES-256 encryption scheme with Web Crypto API.
+ * 1. Generate random AES-256 key
+ * 2. Encrypt AES key with RSA public key
+ * 3. Encrypt data with AES-256-GCM
+ */ const encryptDelegatedKeyShare = async (data, publicKeyPem, keyId)=>{
+    try {
+        // Step 1: Generate a random AES-256 key and 16-byte IV
+        const aesKey = await crypto.subtle.generateKey({
+            name: 'AES-GCM',
+            length: 256
+        }, true, [
+            'encrypt'
+        ]);
+        const iv = crypto.getRandomValues(new Uint8Array(16)); // 128-bit IV for GCM
+        // Step 2: Encrypt the data with AES-256-GCM
+        const plaintext = new TextEncoder().encode(data);
+        const encryptedData = await crypto.subtle.encrypt({
+            name: 'AES-GCM',
+            iv: iv
+        }, aesKey, plaintext);
+        // Extract the auth tag from the encrypted data (last 16 bytes)
+        const encryptedDataArray = new Uint8Array(encryptedData);
+        const authTag = encryptedDataArray.slice(-16);
+        const ciphertext = encryptedDataArray.slice(0, -16);
+        // Step 3: Encrypt the AES key with RSA public key
+        const rsaPublicKey = await importRSAPublicKey(publicKeyPem);
+        // Export the AES key to encrypt it
+        const aesKeyData = await crypto.subtle.exportKey('raw', aesKey);
+        const encryptedAesKey = await crypto.subtle.encrypt({
+            name: 'RSA-OAEP'
+        }, rsaPublicKey, aesKeyData);
+        return _extends({
+            alg: ALG_LABEL_RSA,
+            iv: arrayBufferToBase64Url(iv.buffer),
+            ct: arrayBufferToBase64Url(ciphertext.buffer),
+            tag: arrayBufferToBase64Url(authTag.buffer),
+            ek: arrayBufferToBase64Url(encryptedAesKey)
+        }, keyId ? {
+            kid: keyId
+        } : {});
+    } catch (error) {
+        throw new Error(`Encryption failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+};
+
 const localStorageWriteTest = {
     tested: false,
     writable: false
@@ -721,7 +815,61 @@ const localStorageWriteTest = {
         }
     });
 
+const createDelegationWithGoogleDriveDistribution = ({ existingShares, delegatedShare })=>({
+        dynamicBackendShares: existingShares,
+        googleDriveShares: existingShares,
+        delegatedShare
+    });
+const createDelegationOnlyDistribution = ({ existingShares, delegatedShare })=>({
+        dynamicBackendShares: existingShares,
+        googleDriveShares: [],
+        delegatedShare
+    });
+const createGoogleDriveOnlyDistribution = ({ allShares })=>({
+        dynamicBackendShares: allShares.slice(0, -1),
+        googleDriveShares: allShares.slice(-1)
+    });
+const createDynamicOnlyDistribution = ({ allShares })=>({
+        dynamicBackendShares: allShares,
+        googleDriveShares: []
+    });
+const hasGoogleDriveBackup = (backupInfo)=>{
+    var _backupInfo_backups_BackupLocation_GOOGLE_DRIVE, _backupInfo_backups;
+    var _backupInfo_backups_BackupLocation_GOOGLE_DRIVE_length;
+    return ((_backupInfo_backups_BackupLocation_GOOGLE_DRIVE_length = backupInfo == null ? void 0 : (_backupInfo_backups = backupInfo.backups) == null ? void 0 : (_backupInfo_backups_BackupLocation_GOOGLE_DRIVE = _backupInfo_backups[BackupLocation.GOOGLE_DRIVE]) == null ? void 0 : _backupInfo_backups_BackupLocation_GOOGLE_DRIVE.length) != null ? _backupInfo_backups_BackupLocation_GOOGLE_DRIVE_length : 0) > 0;
+};
+const hasDelegatedBackup = (backupInfo)=>{
+    var _backupInfo_backups_BackupLocation_DELEGATED, _backupInfo_backups;
+    var _backupInfo_backups_BackupLocation_DELEGATED_length;
+    return ((_backupInfo_backups_BackupLocation_DELEGATED_length = backupInfo == null ? void 0 : (_backupInfo_backups = backupInfo.backups) == null ? void 0 : (_backupInfo_backups_BackupLocation_DELEGATED = _backupInfo_backups[BackupLocation.DELEGATED]) == null ? void 0 : _backupInfo_backups_BackupLocation_DELEGATED.length) != null ? _backupInfo_backups_BackupLocation_DELEGATED_length : 0) > 0;
+};
+/**
+ * Distribution for adding Google Drive backup to an existing delegation.
+ * Client's shares go to both Dynamic and Google Drive.
+ * delegatedShare is undefined - we don't re-publish, but preserve the location.
+ */ const createAddGoogleDriveToExistingDelegationDistribution = ({ clientShares })=>({
+        dynamicBackendShares: clientShares,
+        googleDriveShares: clientShares
+    });
+
 class DynamicWalletClient {
+    async initializeForwardMPCClient() {
+        try {
+            await this.apiClient.forwardMPCClient.connect();
+            this.logger.info('Connected to ForwardMPC enclave websocket. Instance: ' + this.instanceId);
+            try {
+                await this.apiClient.forwardMPCClient.handshake();
+                this.logger.debug('Handshaked with ForwardMPC enclave websocket. Instance: ' + this.instanceId);
+            } catch (error) {
+                this.logger.error('Error handshaking with ForwardMPC enclave websocket. Instance: ' + this.instanceId, error);
+            }
+        } catch (error) {
+            this.logger.error('Error connecting to ForwardMPC enclave websocket. Instance: ' + this.instanceId, {
+                error,
+                environmentId: this.environmentId
+            });
+        }
+    }
     getAuthMode() {
         return this.authMode;
     }
@@ -793,30 +941,37 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async initialize() {
+    async initialize(traceContext) {
         if (this.initializePromise) {
             return await this.initializePromise;
         }
         this.logger.debug('[DynamicWaasWalletClient] Initializing Dynamic Waas Wallet SDK');
-        this.initializePromise = this._initialize();
+        this.initializePromise = this._initialize(traceContext);
         const result = await this.initializePromise;
         this.logger.debug('[DynamicWaasWalletClient] Dynamic Waas Wallet SDK initialized');
         return result;
     }
     /**
    * Client initialization logic
-   */ async _initialize() {
+   */ async _initialize(traceContext) {
         try {
             const initializePromises = [
-                this.restoreWallets()
+                this.restoreWallets(),
+                this.createRooms({
+                    roomType: RoomTypeEnum.Threshold,
+                    thresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_TWO,
+                    roomCount: ROOM_CACHE_COUNT
+                })
             ];
             await Promise.all(initializePromises);
             return {
-                error: null
+                error: null,
+                traceContext
             };
         } catch (error) {
             return {
-                error
+                error,
+                traceContext
             };
         }
     }
@@ -895,7 +1050,7 @@ class DynamicWalletClient {
             clientKeygenResults
         };
     }
-    async keyGen({ chainName, thresholdSignatureScheme, onError, onCeremonyComplete }) {
+    async keyGen({ chainName, thresholdSignatureScheme, onError, onCeremonyComplete, traceContext }) {
         const dynamicRequestId = v4();
         try {
             const clientKeygenInitResults = await this.clientInitializeKeyGen({
@@ -903,11 +1058,12 @@ class DynamicWalletClient {
                 thresholdSignatureScheme
             });
             const clientKeygenIds = clientKeygenInitResults.map((result)=>result.keygenId);
-            this.logger.debug('[DynamicWaasWalletClient] Initialized client key generation', {
+            this.instrument('[DynamicWaasWalletClient] Initialized client key generation', _extends({
                 clientKeygenIds: clientKeygenIds.join(', '),
                 chainName,
-                thresholdSignatureScheme
-            });
+                thresholdSignatureScheme,
+                key: 'keyGen'
+            }, this.getTraceContext(traceContext)));
             const { roomId, serverKeygenIds } = await this.serverInitializeKeyGen({
                 chainName,
                 clientKeygenIds,
@@ -915,12 +1071,14 @@ class DynamicWalletClient {
                 thresholdSignatureScheme,
                 onCeremonyComplete
             });
-            this.logger.debug('[DynamicWaasWalletClient] Server key generation initialized', {
+            this.instrument('[DynamicWaasWalletClient] Server key generation initialized', _extends({
                 roomId,
                 clientKeygenIds: clientKeygenIds.join(', '),
                 serverKeygenIds: serverKeygenIds.join(', '),
-                chainName
-            });
+                chainName,
+                key: 'keyGen',
+                operation: 'serverKeyGen'
+            }, this.getTraceContext(traceContext)));
             const { rawPublicKey, clientKeygenResults: clientKeyShares } = await this.clientKeyGen({
                 chainName,
                 roomId,
@@ -928,15 +1086,17 @@ class DynamicWalletClient {
                 clientKeygenInitResults,
                 thresholdSignatureScheme
             });
-            this.logger.debug('[DynamicWaasWalletClient] Client key generation completed', {
+            this.instrument('[DynamicWaasWalletClient] Client key generation completed', _extends({
                 roomId,
                 serverKeygenIds: serverKeygenIds.join(', '),
                 clientKeygenIds: clientKeygenIds.join(', '),
                 chainName,
                 thresholdSignatureScheme,
                 rawPublicKey,
-                clientKeySharesCount: clientKeyShares.length
-            });
+                clientKeySharesCount: clientKeyShares.length,
+                key: 'keyGen',
+                operation: 'clientKeyGen'
+            }, this.getTraceContext(traceContext)));
             return {
                 rawPublicKey,
                 clientKeyShares
@@ -945,16 +1105,16 @@ class DynamicWalletClient {
             logError({
                 message: 'Error in keyGen',
                 error: error,
-                context: {
+                context: _extends({
                     chainName,
                     thresholdSignatureScheme,
                     dynamicRequestId
-                }
+                }, this.getTraceContext(traceContext))
             });
             throw error;
         }
     }
-    async importRawPrivateKey({ chainName, privateKey, thresholdSignatureScheme, onError, onCeremonyComplete }) {
+    async importRawPrivateKey({ chainName, privateKey, thresholdSignatureScheme, onError, onCeremonyComplete, traceContext }) {
         const dynamicRequestId = v4();
         try {
             const mpcSigner = getMPCSigner({
@@ -966,11 +1126,13 @@ class DynamicWalletClient {
                 thresholdSignatureScheme
             });
             const clientKeygenIds = clientKeygenInitResults.map((result)=>result.keygenId);
-            this.logger.debug('[DynamicWaasWalletClient] Client key generation initialized', {
+            this.instrument('[DynamicWaasWalletClient] Client key generation initialized', _extends({
                 clientKeygenIds: clientKeygenIds.join(', '),
                 chainName,
-                thresholdSignatureScheme
-            });
+                thresholdSignatureScheme,
+                key: 'importRawPrivateKey',
+                operation: 'clientKeyGen'
+            }, this.getTraceContext(traceContext)));
             const { roomId, serverKeygenIds } = await this.apiClient.importPrivateKey({
                 chainName,
                 clientKeygenIds,
@@ -979,12 +1141,14 @@ class DynamicWalletClient {
                 onError,
                 onCeremonyComplete
             });
-            this.logger.debug('[DynamicWaasWalletClient] Server key generation initialized', {
+            this.instrument('[DynamicWaasWalletClient] Server key generation initialized', _extends({
                 roomId,
                 clientKeygenIds: clientKeygenIds.join(', '),
                 serverKeygenIds: serverKeygenIds.join(', '),
-                chainName
-            });
+                chainName,
+                key: 'importRawPrivateKey',
+                operation: 'serverImportPrivateKey'
+            }, this.getTraceContext(traceContext)));
             const { threshold } = getTSSConfig(thresholdSignatureScheme);
             const clientKeygenResults = await Promise.all(clientKeygenInitResults.map(async (currentInit, index)=>{
                 const otherClientKeygenIds = clientKeygenInitResults.filter((init)=>init.keygenId !== currentInit.keygenId).map((init)=>init.keygenId);
@@ -1009,14 +1173,16 @@ class DynamicWalletClient {
                 keyShare: clientKeygenResult,
                 derivationPath: undefined
             });
-            this.logger.debug('[DynamicWaasWalletClient] Completed import of raw private key', {
+            this.instrument('[DynamicWaasWalletClient] Completed import of raw private key', _extends({
                 rawPublicKey,
                 chainName,
                 thresholdSignatureScheme,
                 roomId,
                 serverKeygenIds: serverKeygenIds.join(', '),
-                clientKeygenIds: clientKeygenIds.join(', ')
-            });
+                clientKeygenIds: clientKeygenIds.join(', '),
+                key: 'importRawPrivateKey',
+                operation: 'importRawPrivateKey'
+            }, this.getTraceContext(traceContext)));
             return {
                 rawPublicKey,
                 clientKeyShares: clientKeygenResults
@@ -1025,16 +1191,16 @@ class DynamicWalletClient {
             logError({
                 message: 'Error in importRawPrivateKey',
                 error: error,
-                context: {
+                context: _extends({
                     chainName,
                     thresholdSignatureScheme,
                     dynamicRequestId
-                }
+                }, this.getTraceContext(traceContext))
             });
             throw error;
         }
     }
-    async serverSign({ walletId, message, isFormatted, mfaToken, context, onError, dynamicRequestId }) {
+    async serverSign({ walletId, message, isFormatted, mfaToken, roomId, context, onError, dynamicRequestId, traceContext }) {
         // Create the room and sign the message
         if (typeof message !== 'string') {
             message = `0x${Buffer.from(message).toString('hex')}`;
@@ -1045,44 +1211,101 @@ class DynamicWalletClient {
             isFormatted,
             dynamicRequestId,
             mfaToken,
+            roomId,
             context: context ? JSON.parse(JSON.stringify(context, (_key, value)=>typeof value === 'bigint' ? value.toString() : value)) : undefined,
-            onError
+            onError,
+            forwardMPCClientEnabled: this.forwardMPCEnabled,
+            traceContext
         });
         return data;
     }
-    async clientSign({ chainName, message, roomId, keyShare, derivationPath, isFormatted, dynamicRequestId }) {
+    async forwardMPCClientSign({ chainName, message, roomId, keyShare, derivationPath, formattedMessage, dynamicRequestId, isFormatted, traceContext }) {
+        try {
+            if (!this.apiClient.forwardMPCClient.connected) {
+                await this.initializeForwardMPCClient();
+            }
+            const messageForForwardMPC = serializeMessageForForwardMPC({
+                message,
+                isFormatted,
+                chainName
+            });
+            this.logger.info('Forward MPC enabled, signing message with forward MPC', this.getTraceContext(traceContext));
+            const signature = await this.apiClient.forwardMPCClient.signMessage({
+                keyshare: keyShare,
+                message: chainName === 'SVM' ? formattedMessage : messageForForwardMPC,
+                relayDomain: this.baseMPCRelayApiUrl || '',
+                signingAlgo: chainName === 'EVM' ? 'ECDSA' : 'ED25519',
+                hashAlgo: chainName === 'EVM' && !isFormatted ? 'keccak256' : undefined,
+                derivationPath: derivationPath,
+                roomUuid: roomId
+            });
+            const signatureBytes = signature.data.signature;
+            if (!(signatureBytes instanceof Uint8Array)) {
+                throw new TypeError(`Invalid signature format: expected Uint8Array, got ${typeof signatureBytes}`);
+            }
+            // Convert to EcdsaSignature
+            if (chainName === 'EVM') {
+                const ecdsaSignature = EcdsaSignature.fromBuffer(signatureBytes);
+                return ecdsaSignature;
+            } else {
+                return signatureBytes;
+            }
+        } catch (error) {
+            this.logger.error('Error signing message with forward MPC client', {
+                error,
+                environmentId: this.environmentId,
+                userId: this.userId,
+                dynamicRequestId
+            });
+            throw error;
+        }
+    }
+    async clientSign({ chainName, message, roomId, keyShare, derivationPath, isFormatted, dynamicRequestId, traceContext }) {
         try {
             const mpcSigner = getMPCSigner({
                 chainName,
                 baseRelayUrl: this.baseMPCRelayApiUrl
             });
             const formattedMessage = isFormatted ? new MessageHash(message) : formatMessage(chainName, message);
-            this.logger.debug('[DynamicWaasWalletClient] Starting client sign', {
+            this.logger.debug('[DynamicWaasWalletClient] Starting client sign', _extends({
                 chainName,
                 message,
                 roomId,
                 derivationPath,
                 isFormatted
-            });
+            }, this.getTraceContext(traceContext)));
+            if (this.forwardMPCEnabled) {
+                return this.forwardMPCClientSign({
+                    chainName,
+                    message,
+                    roomId,
+                    keyShare,
+                    derivationPath,
+                    formattedMessage,
+                    dynamicRequestId,
+                    isFormatted,
+                    traceContext
+                });
+            }
             const signature = await mpcSigner.sign(roomId, keyShare, formattedMessage, derivationPath);
             return signature;
         } catch (error) {
             logError({
                 message: 'Error in clientSign',
                 error: error,
-                context: {
+                context: _extends({
                     chainName,
                     roomId,
                     derivationPath,
                     isFormatted,
                     dynamicRequestId
-                }
+                }, this.getTraceContext(traceContext))
             });
             throw error;
         }
     }
     //todo: need to modify with imported flag
-    async sign({ accountAddress, message, chainName, password = undefined, isFormatted = false, signedSessionId, mfaToken, context, onError }) {
+    async sign({ accountAddress, message, chainName, password = undefined, isFormatted = false, signedSessionId, mfaToken, context, onError, traceContext }) {
         const dynamicRequestId = v4();
         try {
             await this.verifyPassword({
@@ -1097,23 +1320,41 @@ class DynamicWalletClient {
                 walletOperation: WalletOperation.SIGN_MESSAGE,
                 signedSessionId
             });
-            // Perform the server sign
-            const data = await this.serverSign({
+            const room = await this.getRoom();
+            let roomId = room == null ? void 0 : room.roomId;
+            if (roomId) {
+                this.instrument('[DynamicWaasWalletClient] Using cached room', _extends({
+                    key: 'sign',
+                    operation: 'cachedRoomFound',
+                    accountAddress,
+                    chainName,
+                    walletId: wallet.walletId,
+                    roomId
+                }, this.getTraceContext(traceContext)));
+            }
+            // Perform the server sign - always call, but only await if roomId is not provided
+            const serverSignPromise = this.serverSign({
                 walletId: wallet.walletId,
                 message,
                 isFormatted,
                 mfaToken,
+                roomId,
                 context,
                 onError,
-                dynamicRequestId
+                dynamicRequestId,
+                traceContext
             });
-            this.logger.debug('[DynamicWaasWalletClient] Server sign completed', {
+            // Only await if roomId is not provided
+            roomId = roomId != null ? roomId : (await serverSignPromise).roomId;
+            this.instrument('[DynamicWaasWalletClient] Server sign completed', _extends({
                 message,
                 accountAddress,
                 walletId: wallet.walletId,
-                roomId: data.roomId,
-                dynamicRequestId
-            });
+                roomId,
+                dynamicRequestId,
+                key: 'sign',
+                operation: 'serverSign'
+            }, this.getTraceContext(traceContext)));
             const derivationPath = wallet.derivationPath && wallet.derivationPath != '' ? new Uint32Array(Object.values(JSON.parse(wallet.derivationPath))) : undefined;
             // Perform the client sign and return the signature
             const clientKeyShares = await this.getClientKeySharesFromLocalStorage({
@@ -1122,35 +1363,39 @@ class DynamicWalletClient {
             const signature = await this.clientSign({
                 chainName,
                 message,
-                roomId: data.roomId,
+                roomId,
                 keyShare: clientKeyShares[0],
                 derivationPath,
                 isFormatted,
-                dynamicRequestId
+                dynamicRequestId,
+                traceContext
             });
-            this.logger.debug('[DynamicWaasWalletClient] Client sign completed', {
+            this.instrument('[DynamicWaasWalletClient] Client sign completed', _extends({
+                accountAddress,
                 chainName,
                 message,
-                roomId: data.roomId,
+                roomId,
                 derivationPath,
-                isFormatted
-            });
+                isFormatted,
+                key: 'sign',
+                operation: 'clientSign'
+            }, this.getTraceContext(traceContext)));
             return signature;
         } catch (error) {
             logError({
                 message: 'Error in sign',
                 error: error,
-                context: {
+                context: _extends({
                     accountAddress,
                     chainName,
                     isFormatted: isFormatted ? 'true' : 'false',
                     dynamicRequestId
-                }
+                }, this.getTraceContext(traceContext))
             });
             throw error;
         }
     }
-    async refreshWalletAccountShares({ accountAddress, chainName, password = undefined, signedSessionId, mfaToken }) {
+    async refreshWalletAccountShares({ accountAddress, chainName, password = undefined, signedSessionId, mfaToken, traceContext }) {
         const dynamicRequestId = v4();
         try {
             await this.verifyPassword({
@@ -1194,11 +1439,11 @@ class DynamicWalletClient {
             logError({
                 message: 'Error in refreshWalletAccountShares',
                 error: error,
-                context: {
+                context: _extends({
                     accountAddress,
                     chainName,
                     dynamicRequestId
-                }
+                }, this.getTraceContext(traceContext))
             });
             throw error;
         }
@@ -1254,7 +1499,7 @@ class DynamicWalletClient {
             existingClientKeyShares
         };
     }
-    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, backupToGoogleDrive = false, delegateToProjectEnvironment = false, mfaToken }) {
+    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, backupToGoogleDrive = false, delegateToProjectEnvironment = false, mfaToken, revokeDelegation = false }) {
         const dynamicRequestId = v4();
         try {
             await this.verifyPassword({
@@ -1293,7 +1538,8 @@ class DynamicWalletClient {
                 newThresholdSignatureScheme,
                 dynamicRequestId,
                 delegateToProjectEnvironment,
-                mfaToken
+                mfaToken,
+                revokeDelegation
             });
             const { roomId, serverKeygenIds, newServerKeygenIds = [] } = data;
             // Get the MPC config for the threshold signature scheme
@@ -1308,35 +1554,68 @@ class DynamicWalletClient {
                 chainName,
                 baseRelayUrl: this.baseMPCRelayApiUrl
             });
-            const reshareResults = await Promise.all([
-                ...newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldMpcConfig.threshold, newMpcConfig.threshold, keygenResult, allPartyKeygenIds)),
-                ...existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newMpcConfig.threshold, keyShare, allPartyKeygenIds))
+            const existingResharePromises = existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newMpcConfig.threshold, keyShare, allPartyKeygenIds));
+            const newResharePromises = newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldMpcConfig.threshold, newMpcConfig.threshold, keygenResult, allPartyKeygenIds));
+            // Run both share parties in parallel by group
+            const [existingReshareResults, newReshareResults] = await Promise.all([
+                Promise.all(existingResharePromises),
+                Promise.all(newResharePromises)
             ]);
+            const clientKeysharesToLocalStorage = delegateToProjectEnvironment ? [
+                ...existingReshareResults
+            ] : [
+                ...existingReshareResults,
+                ...newReshareResults
+            ];
             this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
                 thresholdSignatureScheme: newThresholdSignatureScheme
             });
+            // store client key shares to localStorage
             await this.setClientKeySharesToLocalStorage({
                 accountAddress,
-                clientKeyShares: reshareResults,
+                clientKeyShares: clientKeysharesToLocalStorage,
                 overwriteOrMerge: 'overwrite'
             });
-            if (delegateToProjectEnvironment) {
-                await this.storeEncryptedBackupByDelegatedWallet({
-                    accountAddress,
-                    password,
-                    signedSessionId
+            const allClientShares = [
+                ...existingReshareResults,
+                ...newReshareResults
+            ];
+            let distribution;
+            if (delegateToProjectEnvironment && backupToGoogleDrive) {
+                // Delegation + Google Drive: Client's existing share backs up to both Dynamic and Google Drive.
+                // The new share goes to the webhook for delegation.
+                distribution = createDelegationWithGoogleDriveDistribution({
+                    existingShares: existingReshareResults,
+                    delegatedShare: newReshareResults[0]
+                });
+            } else if (delegateToProjectEnvironment) {
+                // Delegation only: Client's existing share backs up to Dynamic.
+                // The new share goes to the webhook for delegation. No Google Drive backup.
+                distribution = createDelegationOnlyDistribution({
+                    existingShares: existingReshareResults,
+                    delegatedShare: newReshareResults[0]
+                });
+            } else if (backupToGoogleDrive) {
+                // Google Drive only: Split shares between Dynamic (N-1) and Google Drive (1).
+                // The last share (new share) goes to Google Drive.
+                distribution = createGoogleDriveOnlyDistribution({
+                    allShares: allClientShares
                 });
             } else {
-                await this.storeEncryptedBackupByWallet({
-                    accountAddress,
-                    password,
-                    signedSessionId,
-                    backupToGoogleDrive
+                // No delegation, no Google Drive: All shares go to Dynamic backend only.
+                distribution = createDynamicOnlyDistribution({
+                    allShares: allClientShares
                 });
             }
+            await this.backupSharesWithDistribution({
+                accountAddress,
+                password,
+                signedSessionId,
+                distribution
+            });
         } catch (error) {
             logError({
-                message: 'Error in reshare',
+                message: 'Error in reshare, resetting wallet to previous state',
                 error: error,
                 context: {
                     accountAddress,
@@ -1347,52 +1626,25 @@ class DynamicWalletClient {
                     dynamicRequestId
                 }
             });
-            throw error;
-        }
-    }
-    async sendKeySharesToDelegatedAccess({ accountAddress, chainName, delegatedKeyShares, environmentId, userId, walletId }) {
-        try {
-            if (!this.delegatedAccessEndpoint) {
-                throw new Error('Cannot send key shares to delegated access because delegated access endpoint is not set');
-            }
-            const delegatedAccessEndpoint = this.delegatedAccessEndpoint;
-            const response = await fetch(delegatedAccessEndpoint, {
-                method: 'POST',
-                body: JSON.stringify({
-                    chainName,
-                    accountAddress,
-                    delegatedKeyShares,
-                    environmentId,
-                    userId,
-                    walletId
-                })
+            // reset user wallet when reshare fails, this would allow the client to recover wallets from an active state
+            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+                thresholdSignatureScheme: oldThresholdSignatureScheme
             });
-            const data = await response.json();
-            return data;
-        } catch (error) {
-            logError({
-                message: 'Error in sendKeySharesToDelegatedAccess',
-                error: error,
-                context: {
-                    accountAddress,
-                    chainName
-                }
+            await this.setClientKeySharesToLocalStorage({
+                accountAddress,
+                clientKeyShares: [],
+                overwriteOrMerge: 'overwrite'
             });
             throw error;
         }
     }
-    async delegateKeyShares({ accountAddress, password = undefined, signedSessionId, mfaToken }) {
+    async performDelegationOperation({ accountAddress, password, signedSessionId, mfaToken, newThresholdSignatureScheme, revokeDelegation = false, operationName }) {
         try {
+            var _this_walletMap_accountAddress;
             const delegateToProjectEnvironment = this.featureFlags && this.featureFlags[FEATURE_FLAGS.ENABLE_DELEGATED_KEY_SHARES_FLAG] === true;
             if (!delegateToProjectEnvironment) {
                 throw new Error('Delegation is not allowed for this project environment');
             }
-            const environmentSettings = await this.apiClient.getEnvironmentSettings();
-            const delegatedAccessEndpoint = environmentSettings.sdk.waas.delegatedAccessEndpoint;
-            if (!delegatedAccessEndpoint) {
-                throw new Error('Cannot delegate key shares because verified access endpoint is not set in the environment settings');
-            }
-            this.delegatedAccessEndpoint = delegatedAccessEndpoint;
             const wallet = await this.getWallet({
                 accountAddress,
                 walletOperation: WalletOperation.REACH_ALL_PARTIES,
@@ -1403,28 +1655,21 @@ class DynamicWalletClient {
                 throw new Error('Delegation is not allowed for SUI');
             }
             const currentThresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
-            if (currentThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO) {
-                // Reshare to 2-of-3, which will automatically handle the backup distribution
-                await this.reshare({
-                    chainName: this.walletMap[accountAddress].chainName,
-                    accountAddress,
-                    oldThresholdSignatureScheme: currentThresholdSignatureScheme,
-                    newThresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_THREE,
-                    password,
-                    signedSessionId,
-                    backupToGoogleDrive: false,
-                    delegateToProjectEnvironment: true,
-                    mfaToken
-                });
-                const backupInfo = this.walletMap[accountAddress].clientKeySharesBackupInfo;
-                const delegatedKeyShares = backupInfo.backups[BackupLocation.EXTERNAL] || [];
-                return delegatedKeyShares;
-            } else {
-                throw new Error('Delegation is not allowed for this threshold signature scheme');
-            }
+            await this.reshare({
+                chainName: this.walletMap[accountAddress].chainName,
+                accountAddress,
+                oldThresholdSignatureScheme: currentThresholdSignatureScheme,
+                newThresholdSignatureScheme,
+                password,
+                signedSessionId,
+                backupToGoogleDrive: hasGoogleDriveBackup((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.clientKeySharesBackupInfo),
+                delegateToProjectEnvironment: true,
+                mfaToken,
+                revokeDelegation
+            });
         } catch (error) {
             logError({
-                message: 'Error in delegateKeyShares',
+                message: `Error in ${operationName}`,
                 error: error,
                 context: {
                     accountAddress
@@ -1433,7 +1678,31 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async exportKey({ accountAddress, chainName, password = undefined, signedSessionId, mfaToken }) {
+    async delegateKeyShares({ accountAddress, password = undefined, signedSessionId, mfaToken }) {
+        await this.performDelegationOperation({
+            accountAddress,
+            password,
+            signedSessionId,
+            mfaToken,
+            newThresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_THREE,
+            operationName: 'delegateKeyShares'
+        });
+        const backupInfo = this.walletMap[accountAddress].clientKeySharesBackupInfo;
+        const delegatedKeyShares = backupInfo.backups[BackupLocation.DELEGATED] || [];
+        return delegatedKeyShares;
+    }
+    async revokeDelegation({ accountAddress, password = undefined, signedSessionId, mfaToken }) {
+        await this.performDelegationOperation({
+            accountAddress,
+            password,
+            signedSessionId,
+            mfaToken,
+            newThresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_TWO,
+            revokeDelegation: true,
+            operationName: 'revokeDelegation'
+        });
+    }
+    async exportKey({ accountAddress, chainName, password = undefined, signedSessionId, mfaToken, traceContext }) {
         const dynamicRequestId = v4();
         try {
             const wallet = await this.getWallet({
@@ -1459,24 +1728,24 @@ class DynamicWalletClient {
                 dynamicRequestId,
                 mfaToken
             });
-            this.logger.debug('[DynamicWaasWalletClient] Starting export of private key', {
+            this.logger.debug('[DynamicWaasWalletClient] Starting export of private key', _extends({
                 accountAddress,
                 chainName,
                 walletId: wallet.walletId,
                 exportId,
                 roomId: data.roomId
-            });
+            }, this.getTraceContext(traceContext)));
             const keyExportRaw = await mpcSigner.exportFullPrivateKey(data.roomId, clientKeyShares[0], exportId);
             if (!keyExportRaw) {
                 throw new Error('Error exporting private key');
             }
-            this.logger.debug('[DynamicWaasWalletClient] Completed export of private key', {
+            this.logger.debug('[DynamicWaasWalletClient] Completed export of private key', _extends({
                 accountAddress,
                 chainName,
                 walletId: wallet.walletId,
                 exportId,
                 roomId: data.roomId
-            });
+            }, this.getTraceContext(traceContext)));
             const derivationPath = wallet.derivationPath && wallet.derivationPath != '' ? new Uint32Array(Object.values(JSON.parse(wallet.derivationPath))) : undefined;
             let derivedPrivateKey;
             if (mpcSigner instanceof Ecdsa) {
@@ -1493,11 +1762,11 @@ class DynamicWalletClient {
             logError({
                 message: 'Error in exportKey',
                 error: error,
-                context: {
+                context: _extends({
                     accountAddress,
                     chainName,
                     dynamicRequestId
-                }
+                }, this.getTraceContext(traceContext))
             });
             throw error;
         }
@@ -1597,43 +1866,14 @@ class DynamicWalletClient {
         });
         await ((_this_storage = this.storage) == null ? void 0 : _this_storage.setItem(accountAddress, stringifiedClientKeyShares));
     }
-    /**
-   * Central backup orchestrator that encrypts and stores wallet key shares.
-   *
-   * This method serves as the main backup coordinator, handling the distribution of encrypted
-   * key shares between Dynamic's backend and Google Drive based on the wallet's threshold scheme.
-   * It is used by multiple operations including reshare, refresh, and manual backup requests.
-   *
-   * **Backup Distribution Strategy:**
-   * - **Single share wallets**: All shares stored on Dynamic's backend only
-   * - **Multi-share wallets (2+)**: When backing up to Google Drive, N-1 shares on Dynamic's backend, 1 share on Google Drive
-   * - **Multi-share wallets (2+)**: When not backing up to Google Drive, all shares on Dynamic's backend
-   *
-   * **Process Flow:**
-   * 1. Encrypts all client key shares with the provided password (or environment ID if no password)
-   * 2. For multi-share wallets (2+): conditionally distributes N-1 to backend, 1 to Google Drive
-   * 3. For other configurations: stores all shares on Dynamic's backend
-   * 4. Updates backup metadata and synchronizes wallet state
-   * 5. Persists the updated wallet map to local storage
-   *
-   * @param params - The backup operation parameters
-   * @param params.accountAddress - The account address of the wallet to backup
-   * @param params.clientKeyShares - Optional specific key shares to backup (uses localStorage if not provided)
-   * @param params.password - Optional password for encryption (uses environment ID if not provided)
-   * @param params.signedSessionId - Optional signed session ID for authentication
-   * @param params.backupToGoogleDrive - Whether to backup to Google Drive (defaults to false)
-   * @returns Promise with backup metadata including share locations and IDs
-   */ async storeEncryptedBackupByWallet({ accountAddress, clientKeyShares = undefined, password = undefined, signedSessionId, backupToGoogleDrive = false }) {
+    async backupSharesWithDistribution({ accountAddress, password, signedSessionId, distribution, preserveDelegatedLocation = false }) {
         const dynamicRequestId = v4();
         try {
-            var _this_walletMap_accountAddress, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_GOOGLE_DRIVE, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups, _this_walletMap_accountAddress_clientKeySharesBackupInfo, _this_walletMap_accountAddress1;
-            const keySharesToBackup = clientKeyShares != null ? clientKeyShares : await this.getClientKeySharesFromLocalStorage({
-                accountAddress
-            });
+            var _this_walletMap_accountAddress;
             if (!((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.walletId)) {
                 const error = new Error(`WalletId not found for accountAddress ${accountAddress}`);
                 logError({
-                    message: 'Error in storeEncryptedBackupByWallet, wallet or walletId not found from the wallet map',
+                    message: 'Error in backupSharesWithDistribution, wallet or walletId not found from the wallet map',
                     error,
                     context: {
                         accountAddress,
@@ -1642,55 +1882,73 @@ class DynamicWalletClient {
                 });
                 throw error;
             }
-            // TODO(zfaizal2): throw error if signedSessionId is not provided after service deploy
-            let dynamicClientKeyShares = [];
-            let googleDriveKeyShares = [];
-            const encryptedKeyShares = await Promise.all(keySharesToBackup.map((keyShare)=>this.encryptKeyShare({
-                    keyShare,
-                    password
-                })));
-            const hasExistingGoogleDriveBackup = ((_this_walletMap_accountAddress1 = this.walletMap[accountAddress]) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo = _this_walletMap_accountAddress1.clientKeySharesBackupInfo) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups = _this_walletMap_accountAddress_clientKeySharesBackupInfo.backups) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_GOOGLE_DRIVE = _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups[BackupLocation.GOOGLE_DRIVE]) == null ? void 0 : _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_GOOGLE_DRIVE.length) > 0;
-            // Backup to Google Drive if:
-            // 1. Explicitly requested via flag, OR
-            // 2. User already has Google Drive backups
-            const shouldBackupToGoogleDrive = backupToGoogleDrive || hasExistingGoogleDriveBackup;
-            if (shouldBackupToGoogleDrive && keySharesToBackup.length >= 2) {
-                // For 2 shares: 1 to backend, 1 to Google Drive
-                // For 3+ shares: N-1 to backend, 1 to Google Drive
-                const googleDriveShareCount = 1;
-                dynamicClientKeyShares = encryptedKeyShares.slice(0, -googleDriveShareCount);
-                googleDriveKeyShares = encryptedKeyShares.slice(-googleDriveShareCount);
-            } else {
-                dynamicClientKeyShares = encryptedKeyShares;
-            }
-            const data = await this.apiClient.storeEncryptedBackupByWallet({
-                walletId: this.walletMap[accountAddress].walletId,
-                encryptedKeyShares: dynamicClientKeyShares,
-                passwordEncrypted: Boolean(password) && password !== this.environmentId,
-                encryptionVersion: ENCRYPTION_VERSION_CURRENT,
-                signedSessionId,
-                authMode: this.authMode,
-                requiresSignedSessionId: this.requiresSignedSessionId(),
-                dynamicRequestId
-            });
-            if (data.keyShareIds.length === 0) {
-                throw new Error('No key shares were backed up');
-            }
-            const locations = [
-                {
+            const locations = [];
+            if (distribution.dynamicBackendShares.length > 0) {
+                const encryptedDynamicShares = await Promise.all(distribution.dynamicBackendShares.map((keyShare)=>this.encryptKeyShare({
+                        keyShare,
+                        password
+                    })));
+                const data = await this.apiClient.storeEncryptedBackupByWallet({
+                    walletId: this.walletMap[accountAddress].walletId,
+                    encryptedKeyShares: encryptedDynamicShares,
+                    passwordEncrypted: Boolean(password) && password !== this.environmentId,
+                    encryptionVersion: ENCRYPTION_VERSION_CURRENT,
+                    signedSessionId,
+                    authMode: this.authMode,
+                    requiresSignedSessionId: this.requiresSignedSessionId(),
+                    dynamicRequestId
+                });
+                if (data.keyShareIds.length === 0) {
+                    throw new Error('No key shares were backed up to Dynamic backend');
+                }
+                locations.push({
                     location: BackupLocation.DYNAMIC,
                     externalKeyShareId: data.keyShareIds[0]
-                }
-            ];
-            if (googleDriveKeyShares.length > 0) {
+                });
+            }
+            if (distribution.googleDriveShares.length > 0) {
+                const encryptedGoogleDriveShares = await Promise.all(distribution.googleDriveShares.map((keyShare)=>this.encryptKeyShare({
+                        keyShare,
+                        password
+                    })));
                 await this.uploadKeySharesToGoogleDrive({
                     accountAddress,
-                    encryptedKeyShares: googleDriveKeyShares
+                    encryptedKeyShares: encryptedGoogleDriveShares
                 });
                 locations.push({
                     location: BackupLocation.GOOGLE_DRIVE
                 });
             }
+            if (distribution.delegatedShare) {
+                var _publicKey_key, _publicKey_key1, _publicKey_key2;
+                const publicKey = await this.apiClient.getDelegatedEncryptionKey({
+                    environmentId: this.environmentId
+                });
+                if (!(publicKey == null ? void 0 : (_publicKey_key = publicKey.key) == null ? void 0 : _publicKey_key.publicKeyPemB64)) {
+                    throw new Error('Public key not found');
+                }
+                var _publicKey_key_keyId;
+                const encryptedDelegatedKeyShareEnvelope = await encryptDelegatedKeyShare(JSON.stringify(distribution.delegatedShare), publicKey == null ? void 0 : (_publicKey_key1 = publicKey.key) == null ? void 0 : _publicKey_key1.publicKeyPemB64, (_publicKey_key_keyId = publicKey == null ? void 0 : (_publicKey_key2 = publicKey.key) == null ? void 0 : _publicKey_key2.keyId) != null ? _publicKey_key_keyId : publicKey == null ? void 0 : publicKey.keyId);
+                const { status } = await this.apiClient.publishDelegatedKeyShare({
+                    walletId: this.walletMap[accountAddress].walletId,
+                    encryptedKeyShare: encryptedDelegatedKeyShareEnvelope,
+                    signedSessionId,
+                    requiresSignedSessionId: this.requiresSignedSessionId(),
+                    dynamicRequestId
+                });
+                if (status !== 200) {
+                    throw new Error('Failed to publish delegated key share');
+                }
+                locations.push({
+                    location: BackupLocation.DELEGATED
+                });
+            }
+            // Preserve existing delegated location without re-publishing
+            if (preserveDelegatedLocation && !distribution.delegatedShare) {
+                locations.push({
+                    location: BackupLocation.DELEGATED
+                });
+            }
             const backupData = await this.apiClient.markKeySharesAsBackedUp({
                 walletId: this.walletMap[accountAddress].walletId,
                 locations,
@@ -1712,10 +1970,10 @@ class DynamicWalletClient {
                 clientKeySharesBackupInfo: updatedBackupInfo
             });
             await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
-            return data;
+            return backupData;
         } catch (error) {
             logError({
-                message: 'Error in storeEncryptedBackupByWallet',
+                message: 'Error in backupSharesWithDistribution',
                 error: error,
                 context: {
                     accountAddress,
@@ -1725,109 +1983,87 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async storeEncryptedBackupByDelegatedWallet({ accountAddress, clientKeyShares = undefined, password = undefined, signedSessionId }) {
-        const dynamicRequestId = v4();
-        try {
-            var _this_walletMap_accountAddress, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_EXTERNAL, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups, _this_walletMap_accountAddress_clientKeySharesBackupInfo, _this_walletMap_accountAddress1;
-            const keySharesToBackup = clientKeyShares != null ? clientKeyShares : await this.getClientKeySharesFromLocalStorage({
-                accountAddress
-            });
-            if (!((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.walletId)) {
-                const error = new Error(`WalletId not found for accountAddress ${accountAddress}`);
-                logError({
-                    message: 'Error in storeEncryptedBackupByWallet, wallet or walletId not found from the wallet map',
-                    error,
-                    context: {
-                        accountAddress,
-                        walletMap: this.walletMap
-                    }
-                });
-                throw error;
-            }
-            let dynamicClientKeyShares = [];
-            let delegatedKeyShares = [];
-            const encryptedKeyShares = await Promise.all(keySharesToBackup.map((keyShare)=>this.encryptKeyShare({
-                    keyShare,
-                    password
-                })));
-            const hasExistingDelegatedBackup = ((_this_walletMap_accountAddress1 = this.walletMap[accountAddress]) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo = _this_walletMap_accountAddress1.clientKeySharesBackupInfo) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups = _this_walletMap_accountAddress_clientKeySharesBackupInfo.backups) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_EXTERNAL = _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups[BackupLocation.EXTERNAL]) == null ? void 0 : _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_EXTERNAL.length) > 0;
-            const shouldBackupToDelegated = hasExistingDelegatedBackup || keySharesToBackup.length >= 2;
-            if (shouldBackupToDelegated) {
-                // For 2 shares: 1 to backend, 1 to delegated
-                // For 3+ shares: N-1 to backend, 1 to delegated
-                dynamicClientKeyShares = encryptedKeyShares.slice(0, -DELEGATED_SHARE_COUNT);
-                delegatedKeyShares = encryptedKeyShares.slice(-DELEGATED_SHARE_COUNT);
-            } else {
-                dynamicClientKeyShares = encryptedKeyShares;
-            }
-            const data = await this.apiClient.storeEncryptedBackupByWallet({
-                walletId: this.walletMap[accountAddress].walletId,
-                encryptedKeyShares: dynamicClientKeyShares,
-                passwordEncrypted: Boolean(password) && password !== this.environmentId,
-                encryptionVersion: ENCRYPTION_VERSION_CURRENT,
-                signedSessionId,
-                authMode: this.authMode,
-                requiresSignedSessionId: this.requiresSignedSessionId(),
-                dynamicRequestId
-            });
-            await this.apiClient.markKeySharesAsBackedUp({
-                walletId: this.walletMap[accountAddress].walletId,
-                dynamicRequestId,
-                locations: [
-                    {
-                        location: BackupLocation.DYNAMIC
-                    }
-                ]
-            });
-            if (delegatedKeyShares.length > 0) {
-                const wallet = this.walletMap[accountAddress];
-                var _this_userId;
-                const delegatedKeyShareIds = await this.sendKeySharesToDelegatedAccess({
-                    accountAddress,
-                    chainName: wallet.chainName,
-                    environmentId: this.environmentId,
-                    walletId: wallet.walletId,
-                    userId: (_this_userId = this.userId) != null ? _this_userId : '',
-                    delegatedKeyShares: delegatedKeyShares
-                });
-                data.keyShares.push({
-                    backupLocation: BackupLocation.EXTERNAL,
-                    id: delegatedKeyShareIds
-                });
-                //todo: combine with user share service backup once other branch is merged
-                await this.apiClient.markKeySharesAsBackedUp({
-                    walletId: this.walletMap[accountAddress].walletId,
-                    locations: [
-                        {
-                            location: BackupLocation.EXTERNAL
-                        }
-                    ],
-                    dynamicRequestId
-                });
-            }
-            const updatedBackupInfo = getClientKeyShareBackupInfo({
-                walletProperties: {
-                    derivationPath: this.walletMap[accountAddress].derivationPath,
-                    keyShares: data.keyShares,
-                    thresholdSignatureScheme: this.walletMap[accountAddress].thresholdSignatureScheme
-                }
-            });
-            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
-                clientKeySharesBackupInfo: updatedBackupInfo
+    /**
+   * Central backup orchestrator that encrypts and stores wallet key shares.
+   *
+   * This method serves as the main backup coordinator, handling the distribution of encrypted
+   * key shares between Dynamic's backend and Google Drive based on the wallet's threshold scheme.
+   * It is used by multiple operations including reshare, refresh, and manual backup requests.
+   *
+   * **Backup Distribution Strategy:**
+   * - **Single share wallets**: All shares stored on Dynamic's backend only
+   * - **Multi-share wallets (2+)**: When backing up to Google Drive, N-1 shares on Dynamic's backend, 1 share on Google Drive
+   * - **Multi-share wallets (2+)**: When not backing up to Google Drive, all shares on Dynamic's backend
+   *
+   * **Process Flow:**
+   * 1. Encrypts all client key shares with the provided password (or environment ID if no password)
+   * 2. For multi-share wallets (2+): conditionally distributes N-1 to backend, 1 to Google Drive
+   * 3. For other configurations: stores all shares on Dynamic's backend
+   * 4. Updates backup metadata and synchronizes wallet state
+   * 5. Persists the updated wallet map to local storage
+   *
+   * **Delegated Key Shares:**
+   * - When delegatedKeyshare is provided, the method will not store the delegated key share but it will mark the delegated share as backed up on Dynamic's backend
+   * - and encrypt the delegated key share to publish it to the webhook
+   *
+   * @param params - The backup operation parameters
+   * @param params.accountAddress - The account address of the wallet to backup
+   * @param params.clientKeyShares - Optional specific key shares to backup (uses localStorage if not provided)
+   * @param params.password - Optional password for encryption (uses environment ID if not provided)
+   * @param params.signedSessionId - Optional signed session ID for authentication
+   * @param params.backupToGoogleDrive - Whether to backup to Google Drive (defaults to false)
+   * @returns Promise with backup metadata including share locations and IDs
+   */ async storeEncryptedBackupByWallet({ accountAddress, clientKeyShares = undefined, password = undefined, signedSessionId, backupToGoogleDrive = false, delegatedKeyshare = undefined }) {
+        var _this_walletMap_accountAddress, _this_walletMap_accountAddress1;
+        const keySharesToBackup = clientKeyShares != null ? clientKeyShares : await this.getClientKeySharesFromLocalStorage({
+            accountAddress
+        });
+        const shouldBackupToGoogleDrive = backupToGoogleDrive || hasGoogleDriveBackup((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.clientKeySharesBackupInfo);
+        const hasExistingDelegation = hasDelegatedBackup((_this_walletMap_accountAddress1 = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress1.clientKeySharesBackupInfo);
+        let distribution;
+        let preserveDelegatedLocation = false;
+        if (delegatedKeyshare && shouldBackupToGoogleDrive) {
+            // NEW delegation + Google Drive: Client's shares back up to both Dynamic and Google Drive.
+            // The delegated share goes to the webhook.
+            distribution = createDelegationWithGoogleDriveDistribution({
+                existingShares: keySharesToBackup,
+                delegatedShare: delegatedKeyshare
+            });
+        } else if (delegatedKeyshare) {
+            // NEW delegation only: Client's shares back up to Dynamic.
+            // The delegated share goes to the webhook. No Google Drive backup.
+            distribution = createDelegationOnlyDistribution({
+                existingShares: keySharesToBackup,
+                delegatedShare: delegatedKeyshare
+            });
+        } else if (hasExistingDelegation && shouldBackupToGoogleDrive) {
+            // ADD Google Drive to EXISTING delegation: Client's share backs up to both Dynamic and GD.
+            // Don't re-publish delegated share, just preserve the location.
+            distribution = createAddGoogleDriveToExistingDelegationDistribution({
+                clientShares: keySharesToBackup
+            });
+            preserveDelegatedLocation = true;
+        } else if (shouldBackupToGoogleDrive && keySharesToBackup.length >= 2) {
+            // Google Drive only (no delegation): Split shares between Dynamic (N-1) and Google Drive (1).
+            distribution = createGoogleDriveOnlyDistribution({
+                allShares: keySharesToBackup
             });
-            await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
-            return data;
-        } catch (error) {
-            logError({
-                message: 'Error in storeEncryptedBackupByDelegatedWallet',
-                error: error,
-                context: {
-                    accountAddress,
-                    dynamicRequestId
-                }
+        } else {
+            // No delegation, no Google Drive: All shares go to Dynamic backend only.
+            distribution = createDynamicOnlyDistribution({
+                allShares: keySharesToBackup
             });
-            throw error;
         }
+        const backupData = await this.backupSharesWithDistribution({
+            accountAddress,
+            password,
+            signedSessionId,
+            distribution,
+            preserveDelegatedLocation
+        });
+        return _extends({}, backupData, {
+            keyShareIds: backupData.locationsWithKeyShares.map((ks)=>ks.keyShareId)
+        });
     }
     async storeEncryptedBackupByWalletWithRetry({ accountAddress, clientKeyShares, password, signedSessionId }) {
         await retryPromise(()=>this.storeEncryptedBackupByWallet({
@@ -2018,14 +2254,18 @@ class DynamicWalletClient {
                     return (_ks_externalKeyShareId = ks.externalKeyShareId) != null ? _ks_externalKeyShareId : '';
                 });
             } else {
-                // Already 2-of-3, only call backup
-                const data = await this.storeEncryptedBackupByWallet({
+                await this.storeEncryptedBackupByWallet({
                     accountAddress,
                     password,
                     signedSessionId,
                     backupToGoogleDrive: true
                 });
-                return data.keyShareIds;
+                const backupInfo = this.walletMap[accountAddress].clientKeySharesBackupInfo;
+                const googleDriveShares = backupInfo.backups[BackupLocation.GOOGLE_DRIVE] || [];
+                return googleDriveShares.map((ks)=>{
+                    var _ks_externalKeyShareId;
+                    return (_ks_externalKeyShareId = ks.externalKeyShareId) != null ? _ks_externalKeyShareId : '';
+                });
             }
         } catch (error) {
             logError({
@@ -2061,7 +2301,8 @@ class DynamicWalletClient {
             const thresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
             const fileName = getClientKeyShareExportFileName({
                 thresholdSignatureScheme,
-                accountAddress
+                accountAddress,
+                isGoogleDrive: true
             });
             const backupData = createBackupData({
                 encryptedKeyShares,
@@ -2086,7 +2327,7 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async restoreBackupFromGoogleDrive({ accountAddress, password, signedSessionId }) {
+    async exportClientKeysharesFromGoogleDrive({ accountAddress, password, signedSessionId }) {
         try {
             await this.getWallet({
                 accountAddress,
@@ -2097,15 +2338,16 @@ class DynamicWalletClient {
                 oauthAccountId
             });
             const thresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
-            const fileName = getClientKeyShareExportFileName({
+            const backupFileName = getClientKeyShareExportFileName({
                 thresholdSignatureScheme,
-                accountAddress
+                accountAddress,
+                isGoogleDrive: true
             });
             let backupData = null;
             try {
                 backupData = await retryPromise(()=>downloadFileFromGoogleDrive({
                         accessToken,
-                        fileName
+                        fileName: backupFileName
                     }));
             } catch (error) {
                 logError({
@@ -2113,7 +2355,7 @@ class DynamicWalletClient {
                     error: error,
                     context: {
                         accountAddress,
-                        fileName
+                        fileName: backupFileName
                     }
                 });
                 throw error;
@@ -2125,7 +2367,7 @@ class DynamicWalletClient {
                     error: new Error('No backup file found'),
                     context: {
                         accountAddress,
-                        fileName
+                        fileName: backupFileName
                     }
                 });
                 throw error;
@@ -2138,7 +2380,7 @@ class DynamicWalletClient {
                     error,
                     context: {
                         accountAddress,
-                        fileName
+                        fileName: backupFileName
                     }
                 });
                 throw error;
@@ -2148,15 +2390,20 @@ class DynamicWalletClient {
                     keyShare,
                     password
                 })));
-            await this.setClientKeySharesToLocalStorage({
+            const text = JSON.stringify(decryptedKeyShares, null, 2);
+            const exportFileName = getClientKeyShareExportFileName({
+                thresholdSignatureScheme,
                 accountAddress,
-                clientKeyShares: decryptedKeyShares,
-                overwriteOrMerge: 'merge'
+                isGoogleDrive: true
+            });
+            downloadStringAsFile({
+                filename: exportFileName,
+                content: text,
+                mimeType: 'application/json'
             });
-            return decryptedKeyShares;
         } catch (error) {
             logError({
-                message: 'Error in restoreBackupFromGoogleDrive',
+                message: 'Error in exportClientKeysharesFromGoogleDrive',
                 error: error,
                 context: {
                     accountAddress
@@ -2183,16 +2430,11 @@ class DynamicWalletClient {
             keyShares: clientKeyShares,
             derivationPath
         });
-        const blob = new Blob([
-            text
-        ], {
-            type: 'text/plain'
+        downloadStringAsFile({
+            filename: `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${accountAddress}.txt`,
+            content: text,
+            mimeType: 'text/plain'
         });
-        const url = URL.createObjectURL(blob);
-        const a = document.createElement('a');
-        a.href = url;
-        a.download = `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${accountAddress}.txt`;
-        a.click();
     }
     async getClientKeyShares({ accountAddress, password, signedSessionId }) {
         await this.getWallet({
@@ -2492,29 +2734,115 @@ class DynamicWalletClient {
         }
         this.apiClient.syncAuthToken(authToken);
     }
+    async createRooms({ roomType, thresholdSignatureScheme, roomCount = 5 }) {
+        try {
+            var _rooms_roomIds;
+            if (DynamicWalletClient.roomsInitializing) {
+                return;
+            }
+            DynamicWalletClient.roomsInitializing = true;
+            const restoredRooms = await this.restoreRooms();
+            if (restoredRooms && restoredRooms.length > 0) {
+                return;
+            }
+            const rooms = await this.apiClient.createRoomsWithoutWalletId({
+                roomType,
+                roomCount,
+                thresholdSignatureScheme
+            });
+            const newRooms = rooms == null ? void 0 : (_rooms_roomIds = rooms.roomIds) == null ? void 0 : _rooms_roomIds.map((roomId)=>({
+                    roomId,
+                    createdAt: Date.now(),
+                    expiresAt: Date.now() + 1000 * 60 * 10
+                }));
+            DynamicWalletClient.rooms = [
+                ...newRooms,
+                ...DynamicWalletClient.rooms
+            ];
+            DynamicWalletClient.roomsInitializing = false;
+            await this.storage.setItem(`${this.storageKey}-rooms`, JSON.stringify(DynamicWalletClient.rooms));
+        } catch (error) {
+            this.logger.error('Error creating rooms', error);
+            throw error;
+        }
+    }
+    async restoreRooms() {
+        const roomData = await this.storage.getItem(`${this.storageKey}-rooms`);
+        if (!roomData) {
+            return;
+        }
+        const parsedRoomData = JSON.parse(roomData);
+        const now = Date.now();
+        // Filter out expired rooms
+        const rooms = parsedRoomData.filter((room)=>room.expiresAt > now);
+        if (rooms.length === 0) {
+            return;
+        }
+        DynamicWalletClient.rooms = rooms;
+        return rooms;
+    }
+    async getRooms() {
+        return DynamicWalletClient.rooms;
+    }
+    async getRoom() {
+        const now = Date.now();
+        // Filter out expired rooms
+        DynamicWalletClient.rooms = DynamicWalletClient.rooms.filter((room)=>room.expiresAt > now);
+        if (DynamicWalletClient.rooms.length === 0) {
+            // create rooms if no valid rooms are cached,
+            // dont await the creation of rooms, the room will be created on the server
+            this.createRooms({
+                roomType: RoomTypeEnum.Threshold,
+                thresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_TWO,
+                roomCount: ROOM_CACHE_COUNT
+            });
+            return;
+        }
+        // Return the first non-expired room (and remove it from the array)
+        return DynamicWalletClient.rooms.shift();
+    }
+    /**
+   * Helper method to instrument with automatic properties inclusion
+   */ instrument(message, context) {
+        const defaultContext = {
+            environmentId: context.environmentId || this.environmentId
+        };
+        this.logger.debug(message, _extends({}, defaultContext, context));
+        this.logger.instrument(message, _extends({}, defaultContext, context));
+    }
+    getTraceContext(traceContext) {
+        const now = Date.now();
+        return _extends({
+            now,
+            time: (traceContext == null ? void 0 : traceContext.startTime) ? now - traceContext.startTime : 0
+        }, traceContext);
+    }
     constructor({ environmentId, baseApiUrl, baseMPCRelayApiUrl, storageKey, debug, featureFlags, authMode = AuthMode.HEADER, authToken = undefined, // Represents the version of the client SDK used by developer
-    sdkVersion }){
+    sdkVersion, forwardMPCClient, baseClientKeysharesRelayApiUrl }){
         this.userId = undefined;
         this.sessionId = undefined;
-        this.delegatedAccessEndpoint = undefined;
         this.initializePromise = null;
         this.logger = logger;
         this.walletMap = {} // todo: store in session storage
         ;
         this.memoryStorage = null;
         this.iframe = null;
+        this.forwardMPCEnabled = false;
         this.featureFlags = {};
         this.environmentId = environmentId;
         this.storageKey = `${STORAGE_KEY}-${storageKey != null ? storageKey : environmentId}`;
         this.baseMPCRelayApiUrl = baseMPCRelayApiUrl;
         this.authMode = authMode;
         this.sdkVersion = sdkVersion;
+        this.baseClientKeysharesRelayApiUrl = baseClientKeysharesRelayApiUrl;
         this.apiClient = new DynamicApiClient({
             environmentId,
             authToken,
             baseApiUrl,
             authMode,
-            sdkVersion
+            sdkVersion,
+            forwardMPCClient,
+            baseClientKeysharesRelayApiUrl
         });
         this.debug = Boolean(debug);
         this.logger.setLogLevel(this.debug ? LogLevel.DEBUG : DEFAULT_LOG_LEVEL);
@@ -2534,8 +2862,15 @@ class DynamicWalletClient {
         if (authMode === AuthMode.HEADER && authToken) {
             this.initLoggerContext(authToken);
         }
+        this.forwardMPCEnabled = this.featureFlags && this.featureFlags[FEATURE_FLAGS.ENABLE_FORWARD_MPC_CLIENT_FLAG] === true;
+        // if forwardMPCEnabled is true and forwardMPCClient is not provided, initialize the forwardMPCClient
+        if (this.forwardMPCEnabled && !forwardMPCClient) {
+            this.initializeForwardMPCClient();
+        }
     }
 }
+DynamicWalletClient.rooms = [];
+DynamicWalletClient.roomsInitializing = false;
 
 const ERROR_KEYGEN_FAILED = '[DynamicWaasWalletClient]: Error with keygen';
 const ERROR_CREATE_WALLET_ACCOUNT = '[DynamicWaasWalletClient]: Error creating wallet account';
@@ -2547,4 +2882,4 @@ const ERROR_VERIFY_TRANSACTION_SIGNATURE = '[DynamicWaasWalletClient]: Error ver
 const ERROR_EXPORT_PRIVATE_KEY = '[DynamicWaasWalletClient]: Error exporting private key';
 const ERROR_IMPORT_PRIVATE_KEY = '[DynamicWaasWalletClient]: Error importing private key';
 
-export { DynamicWalletClient, ERROR_ACCOUNT_ADDRESS_REQUIRED, ERROR_CREATE_WALLET_ACCOUNT, ERROR_EXPORT_PRIVATE_KEY, ERROR_IMPORT_PRIVATE_KEY, ERROR_KEYGEN_FAILED, ERROR_SIGN_MESSAGE, ERROR_SIGN_TYPED_DATA, ERROR_VERIFY_MESSAGE_SIGNATURE, ERROR_VERIFY_TRANSACTION_SIGNATURE, createBackupData, formatEvmMessage, formatMessage, getClientKeyShareBackupInfo, getClientKeyShareExportFileName, getGoogleOAuthAccountId, getMPCSignatureScheme, getMPCSigner, isBrowser, isHexString, mergeUniqueKeyShares, retryPromise, timeoutPromise };
+export { DynamicWalletClient, ERROR_ACCOUNT_ADDRESS_REQUIRED, ERROR_CREATE_WALLET_ACCOUNT, ERROR_EXPORT_PRIVATE_KEY, ERROR_IMPORT_PRIVATE_KEY, ERROR_KEYGEN_FAILED, ERROR_SIGN_MESSAGE, ERROR_SIGN_TYPED_DATA, ERROR_VERIFY_MESSAGE_SIGNATURE, ERROR_VERIFY_TRANSACTION_SIGNATURE, createAddGoogleDriveToExistingDelegationDistribution, createBackupData, createDelegationOnlyDistribution, createDelegationWithGoogleDriveDistribution, createDynamicOnlyDistribution, createGoogleDriveOnlyDistribution, downloadStringAsFile, formatEvmMessage, formatMessage, getClientKeyShareBackupInfo, getClientKeyShareExportFileName, getGoogleOAuthAccountId, getMPCSignatureScheme, getMPCSigner, hasDelegatedBackup, hasGoogleDriveBackup, isBrowser, isHexString, mergeUniqueKeyShares, retryPromise, timeoutPromise };