@dynamic-labs-wallet/browser 0.0.0-preview.57 → 0.0.1-paolo-1

package/index.cjs.js

@@ -1,9 +1,14 @@
 'use strict';
 
 var core = require('@dynamic-labs-wallet/core');
-var web = require('./internal/web');
+var web = require('#internal/web');
+var semver = require('semver');
+var uuid = require('uuid');
 var logger$1 = require('@dynamic-labs/logger');
-var messageTransport = require('@dynamic-labs/message-transport');
+var loadArgon2idWasm = require('argon2id');
+var axios = require('axios');
+var createHttpError = require('http-errors');
+var sdkApiCore = require('@dynamic-labs/sdk-api-core');
 
 function _extends() {
     _extends = Object.assign || function assign(target) {
@@ -21,7 +26,7 @@ const getMPCSignatureScheme = ({ signingAlgorithm, baseRelayUrl = core.MPC_RELAY
         case core.SigningAlgorithm.ECDSA:
             return new web.Ecdsa(baseRelayUrl);
         case core.SigningAlgorithm.ED25519:
-            return new web.Ed25519(baseRelayUrl);
+            return new web.ExportableEd25519(baseRelayUrl);
         case core.SigningAlgorithm.BIP340:
             return new web.BIP340(baseRelayUrl);
         default:
@@ -37,13 +42,118 @@ const getMPCSigner = ({ chainName, baseRelayUrl })=>{
     return signatureScheme;
 };
 
-const DEFAULT_LOG_LEVEL = 'INFO';
-const STORAGE_KEY = 'dynamic-waas-wallet-client';
-const CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX = 'dynamicWalletKeyShareBackup';
+/**
+ * Encryption version identifiers
+ */ var EncryptionVersion = /*#__PURE__*/ function(EncryptionVersion) {
+    EncryptionVersion["V1_LEGACY"] = "v1";
+    EncryptionVersion["V2_PBKDF2"] = "v2";
+    EncryptionVersion["V3_ARGON2"] = "v3";
+    return EncryptionVersion;
+}({});
+/**
+ * Current default version for new encryptions
+ */ const ENCRYPTION_VERSION_CURRENT = "v3";
+/**
+ * Algorithm constants
+ */ const PBKDF2_ALGORITHM = 'PBKDF2';
+const HASH_ALGORITHM = 'SHA-256'; // Generic hash algorithm constant
+const ARGON2_ALGORITHM = 'Argon2id';
+const AES_GCM_ALGORITHM = 'AES-GCM';
+const AES_GCM_LENGTH = 256;
+/**
+ * Argon2 configuration constants, values were chosen based on RFC (https://www.rfc-editor.org/rfc/rfc9106.html#name-parameter-choice)
+ * taking into account that this runs in the client, possibly in smartphones with limited resources
+ */ const ARGON2_MEMORY_SIZE = 65536; // 64 MB in KiB
+const ARGON2_ITERATIONS = 3;
+const ARGON2_PARALLELISM = 2;
+const ARGON2_HASH_LENGTH = 32;
+/**
+ * PBKDF2 configuration constants
+ */ const PBKDF2_ITERATIONS_V1 = 100000;
+const PBKDF2_ITERATIONS_V2 = 1000000;
+
+/**
+ * Derives a key using Argon2id algorithm
+ * @param params - Key derivation parameters
+ * @param encryptionConfig - Encryption configuration
+ * @returns Promise<CryptoKey>
+ */ const deriveArgon2Key = async ({ password, salt }, encryptionConfig)=>{
+    const argon2id = await loadArgon2idWasm();
+    const argon2Config = encryptionConfig;
+    const passwordBytes = new TextEncoder().encode(password);
+    const hash = argon2id({
+        password: passwordBytes,
+        salt: salt,
+        parallelism: argon2Config.parallelism || ARGON2_PARALLELISM,
+        passes: argon2Config.iterations,
+        memorySize: argon2Config.memorySize || ARGON2_MEMORY_SIZE,
+        tagLength: argon2Config.hashLength || ARGON2_HASH_LENGTH
+    });
+    return crypto.subtle.importKey('raw', new Uint8Array(hash), {
+        name: encryptionConfig.algorithm,
+        length: encryptionConfig.algorithmLength
+    }, false, [
+        'encrypt',
+        'decrypt'
+    ]);
+};
 
-const logger = new logger$1.Logger('DynamicWaasWalletClient');
+/**
+ * Encryption configuration for each version
+ */ const ENCRYPTION_VERSIONS = {
+    [EncryptionVersion.V1_LEGACY]: {
+        version: EncryptionVersion.V1_LEGACY,
+        algorithm: AES_GCM_ALGORITHM,
+        keyDerivation: PBKDF2_ALGORITHM,
+        iterations: PBKDF2_ITERATIONS_V1,
+        hashAlgorithm: HASH_ALGORITHM,
+        algorithmLength: AES_GCM_LENGTH
+    },
+    [EncryptionVersion.V2_PBKDF2]: {
+        version: EncryptionVersion.V2_PBKDF2,
+        algorithm: AES_GCM_ALGORITHM,
+        keyDerivation: PBKDF2_ALGORITHM,
+        iterations: PBKDF2_ITERATIONS_V2,
+        hashAlgorithm: HASH_ALGORITHM,
+        algorithmLength: AES_GCM_LENGTH
+    },
+    [EncryptionVersion.V3_ARGON2]: {
+        version: EncryptionVersion.V3_ARGON2,
+        algorithm: AES_GCM_ALGORITHM,
+        keyDerivation: ARGON2_ALGORITHM,
+        iterations: ARGON2_ITERATIONS,
+        hashAlgorithm: ARGON2_ALGORITHM,
+        algorithmLength: AES_GCM_LENGTH,
+        memorySize: ARGON2_MEMORY_SIZE,
+        parallelism: ARGON2_PARALLELISM,
+        hashLength: ARGON2_HASH_LENGTH
+    }
+};
+/**
+ * Helper function to get encryption configuration by version string
+ * @param version - The version string (e.g., 'v1', 'v2', 'v3')
+ * @returns The encryption configuration for the specified version
+ */ const getEncryptionConfig = (version)=>{
+    // If no version specified, use legacy for backward compatibility
+    if (!version) {
+        return ENCRYPTION_VERSIONS[EncryptionVersion.V1_LEGACY];
+    }
+    const config = ENCRYPTION_VERSIONS[version];
+    if (!config) {
+        throw new Error(`Unsupported encryption version: ${version}`);
+    }
+    return config;
+};
+/**
+ * Check if a configuration uses Argon2
+ */ const isArgon2Config = (config)=>{
+    return config.keyDerivation === ARGON2_ALGORITHM;
+};
 
-const bytesToBase64 = (arr)=>{
+/**
+ * Utility functions for encryption operations
+ * These functions are separated to avoid circular dependencies
+ */ const bytesToBase64 = (arr)=>{
     return btoa(Array.from(arr, (b)=>String.fromCharCode(b)).join(''));
 };
 const stringToBytes = (str)=>{
@@ -56,93 +166,13 @@ const base64ToBytes = (base64)=>{
 const ensureBase64Padding = (str)=>{
     return str.padEnd(Math.ceil(str.length / 4) * 4, '=');
 };
-const isBrowser = ()=>typeof window !== 'undefined';
-const isHexString = (str)=>{
-    // Remove 0x prefix if present
-    const hex = str.startsWith('0x') ? str.slice(2) : str;
-    // Check if string contains only hex characters
-    return /^[0-9A-Fa-f]+$/.test(hex);
-};
-const getClientKeyShareExportFileName = ({ thresholdSignatureScheme, accountAddress })=>{
-    return `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${thresholdSignatureScheme}-${accountAddress}.json`;
-};
-const getClientKeyShareBackupInfo = (params)=>{
-    var _params_walletProperties, _params_walletProperties_keyShares_;
-    const backups = {
-        [core.BackupLocation.DYNAMIC]: [],
-        [core.BackupLocation.GOOGLE_DRIVE]: [],
-        [core.BackupLocation.ICLOUD]: [],
-        [core.BackupLocation.USER]: [],
-        [core.BackupLocation.EXTERNAL]: []
-    };
-    if (!(params == null ? void 0 : (_params_walletProperties = params.walletProperties) == null ? void 0 : _params_walletProperties.keyShares)) {
-        return {
-            backups,
-            passwordEncrypted: false
-        };
-    }
-    params.walletProperties.keyShares.forEach((keyShare)=>{
-        if (backups[keyShare.backupLocation]) {
-            backups[keyShare.backupLocation].push(keyShare.id);
-        }
-    });
-    const passwordEncrypted = Boolean((_params_walletProperties_keyShares_ = params.walletProperties.keyShares[0]) == null ? void 0 : _params_walletProperties_keyShares_.passwordEncrypted);
-    return {
-        backups,
-        passwordEncrypted
-    };
-};
-/**
- * Helper function to merge keyshares and remove duplicates based on pubkey and secretShare
- * @param existingKeyShares - Array of existing keyshares
- * @param newKeyShares - Array of new keyshares to merge
- * @returns Array of merged unique keyshares
- */ const mergeUniqueKeyShares = (existingKeyShares, newKeyShares)=>{
-    const uniqueKeyShares = newKeyShares.filter((newShare)=>!existingKeyShares.some((existingShare)=>{
-            if (!(newShare == null ? void 0 : newShare.pubkey) || !(existingShare == null ? void 0 : existingShare.pubkey)) return false;
-            return newShare.pubkey.toString() === existingShare.pubkey.toString() && newShare.secretShare === existingShare.secretShare;
-        }));
-    return [
-        ...existingKeyShares,
-        ...uniqueKeyShares
-    ];
-};
-const timeoutPromise = ({ timeInMs, activity = 'Ceremony' })=>{
-    return new Promise((_, reject)=>setTimeout(()=>reject(new Error(`${activity} did not complete in ${timeInMs}ms`)), timeInMs));
-};
-/**
- * Generic helper function to retry a promise-based operations
- *
- * @param operation - The async operation to retry
- * @param config - Configuration options for retry behavior
- * @returns Promise with the operation result
- * @throws Last error encountered after all retries are exhausted
- */ async function retryPromise(operation, { maxAttempts = 5, retryInterval = 500, operationName = 'operation', logContext = {} } = {}) {
-    let attempts = 0;
-    while(attempts < maxAttempts){
-        try {
-            return await operation();
-        } catch (error) {
-            attempts++;
-            if (attempts === maxAttempts) {
-                logger.error(`Failed to execute ${operationName} after ${maxAttempts} attempts`, _extends({}, logContext, {
-                    error
-                }));
-                throw error;
-            }
-            await new Promise((resolve)=>setTimeout(resolve, retryInterval));
-        }
-    }
-    // TypeScript needs this even though it's unreachable
-    throw new Error('Unreachable code');
-}
 
-const PBKDF2_ALGORITHM = 'PBKDF2';
-const PBKDF2_ITERATIONS = 100000;
-const PBKDF2_HASH_ALGORITHM = 'SHA-256';
-const AES_GCM_ALGORITHM = 'AES-GCM';
-const AES_GCM_LENGTH = 256;
-const getKey = async ({ password, salt })=>{
+/**
+ * Derives a key using PBKDF2 algorithm
+ * @param params - Key derivation parameters
+ * @param encryptionConfig - Encryption configuration
+ * @returns Promise<CryptoKey>
+ */ const derivePBKDF2Key = async ({ password, salt }, encryptionConfig)=>{
     const passwordBytes = stringToBytes(password);
     const initialKey = await crypto.subtle.importKey('raw', passwordBytes, {
         name: 'PBKDF2'
@@ -150,19 +180,34 @@ const getKey = async ({ password, salt })=>{
         'deriveKey'
     ]);
     return crypto.subtle.deriveKey({
-        name: PBKDF2_ALGORITHM,
-        salt,
-        iterations: PBKDF2_ITERATIONS,
-        hash: PBKDF2_HASH_ALGORITHM
+        name: encryptionConfig.keyDerivation,
+        salt: salt,
+        iterations: encryptionConfig.iterations,
+        hash: encryptionConfig.hashAlgorithm
     }, initialKey, {
-        name: AES_GCM_ALGORITHM,
-        length: AES_GCM_LENGTH
+        name: encryptionConfig.algorithm,
+        length: encryptionConfig.algorithmLength
     }, false, [
         'encrypt',
         'decrypt'
     ]);
 };
-const encryptData = async ({ data, password })=>{
+
+/**
+ * Get the appropriate key derivation function based on the encryption config
+ */ const getKey = async (params, encryptionConfig)=>{
+    // Use Argon2 for v3, PBKDF2 for v1 and v2
+    if (encryptionConfig.keyDerivation === ARGON2_ALGORITHM) {
+        return deriveArgon2Key(params, encryptionConfig);
+    } else {
+        return derivePBKDF2Key(params, encryptionConfig);
+    }
+};
+/**
+ * Encrypts data using the specified encryption version.
+ * Always uses the latest encryption configuration for new encryptions by default.
+ */ const encryptData = async ({ data, password, version = ENCRYPTION_VERSION_CURRENT })=>{
+    const encryptionConfig = getEncryptionConfig(version);
     try {
         // Generate a random salt and IV
         const salt = crypto.getRandomValues(new Uint8Array(16));
@@ -170,7 +215,7 @@ const encryptData = async ({ data, password })=>{
         const key = await getKey({
             password,
             salt
-        });
+        }, encryptionConfig);
         // Convert the input string to bytes
         const dataBytes = new TextEncoder().encode(data);
         // Encrypt the data
@@ -182,34 +227,86 @@ const encryptData = async ({ data, password })=>{
         return {
             salt: bytesToBase64(salt),
             iv: bytesToBase64(iv),
-            cipher: bytesToBase64(new Uint8Array(encryptedData))
+            cipher: bytesToBase64(new Uint8Array(encryptedData)),
+            version
         };
     } catch (error) {
-        throw new Error('Error encrypting data');
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        throw new Error(`Error encrypting data: ${errorMessage} (version: ${version})`);
     }
 };
-const decryptData = async ({ data, password })=>{
+/**
+ * Decrypts data with version-based configuration.
+ * Uses the version field from the data to determine encryption parameters.
+ * Falls back to legacy version for backward compatibility if no version is specified.
+ * For v3 (Argon2), retries with parallelism=1 if an OperationError occurs.
+ */ const decryptData = async ({ data, password })=>{
+    const { salt, iv, cipher, version } = data;
+    // Ensure proper base64 padding for all values
+    const paddedSalt = ensureBase64Padding(salt);
+    const paddedIv = ensureBase64Padding(iv);
+    const paddedCipher = ensureBase64Padding(cipher);
+    const saltBytes = base64ToBytes(paddedSalt);
+    const ivBytes = base64ToBytes(paddedIv);
+    const cipherBytes = base64ToBytes(paddedCipher);
+    // Determine which encryption configuration to use
+    const encryptionConfig = getEncryptionConfig(version);
     try {
-        const { salt, iv, cipher } = data;
-        // Ensure proper base64 padding for all values
-        const paddedSalt = ensureBase64Padding(salt);
-        const paddedIv = ensureBase64Padding(iv);
-        const paddedCipher = ensureBase64Padding(cipher);
-        const saltBytes = base64ToBytes(paddedSalt);
-        const ivBytes = base64ToBytes(paddedIv);
-        const cipherBytes = base64ToBytes(paddedCipher);
         const key = await getKey({
             password,
             salt: saltBytes
-        });
+        }, encryptionConfig);
         const decryptedData = await crypto.subtle.decrypt({
             name: AES_GCM_ALGORITHM,
             iv: ivBytes
         }, key, cipherBytes);
         return new TextDecoder().decode(decryptedData);
     } catch (error) {
-        throw new Error('Decryption failed');
+        // For a short period of time we lowered the parallelism for v3 (Argon2) to 1 to try to fix issues
+        // for users with limited resources, however this introduced a new issue that the decryption would fail
+        // for existing users with v3 (Argon2) encryption, this is a fallback for a few users.
+        if (error instanceof Error && error.name === 'OperationError' && version === 'v3' && isArgon2Config(encryptionConfig)) {
+            try {
+                // Create a modified config with parallelism=1
+                const modifiedConfig = _extends({}, encryptionConfig, {
+                    parallelism: 1
+                });
+                const key = await getKey({
+                    password,
+                    salt: saltBytes
+                }, modifiedConfig);
+                const decryptedData = await crypto.subtle.decrypt({
+                    name: AES_GCM_ALGORITHM,
+                    iv: ivBytes
+                }, key, cipherBytes);
+                return new TextDecoder().decode(decryptedData);
+            } catch (retryError) {
+                // If retry also fails, throw the original error with additional context
+                throw new Error(`Decryption failed after retry with parallelism=1: ${retryError}`);
+            }
+        }
+        throw new Error('Decryption failed: ' + error);
+    }
+};
+/**
+ * Gets encryption metadata for a specific version.
+ * Used when we need to include metadata in legacy systems or APIs that require it.
+ */ const getEncryptionMetadataForVersion = (version)=>{
+    const encryptionConfig = getEncryptionConfig(version);
+    const metadata = {
+        algorithm: encryptionConfig.algorithm,
+        keyDerivation: encryptionConfig.keyDerivation,
+        iterations: encryptionConfig.iterations,
+        hashAlgorithm: encryptionConfig.hashAlgorithm,
+        algorithmLength: encryptionConfig.algorithmLength
+    };
+    // Add Argon2-specific metadata if applicable
+    if (isArgon2Config(encryptionConfig)) {
+        metadata.memorySize = encryptionConfig.memorySize;
+        metadata.parallelism = encryptionConfig.parallelism;
+        metadata.hashLength = encryptionConfig.hashLength;
     }
+    return metadata;
 };
 
 const GOOGLE_DRIVE_UPLOAD_API = 'https://www.googleapis.com';
@@ -263,9 +360,9 @@ const uploadFileToGoogleDrive = async ({ accessToken, fileName, jsonData, parent
     const result = await response.json();
     return result; // Return file metadata, including file ID
 };
-const listFilesFromGoogleDrive = async ({ accessToken, name })=>{
+const listFilesFromGoogleDrive = async ({ accessToken, fileName })=>{
     // Step 1: List all files inside `appDataFolder` with the specified backup filename
-    const resp = await fetch(`${GOOGLE_DRIVE_UPLOAD_API}/drive/v3/files?q=${encodeURIComponent(`name='${name}'`)}&spaces=appDataFolder&orderBy=createdTime desc`, {
+    const resp = await fetch(`${GOOGLE_DRIVE_UPLOAD_API}/drive/v3/files?q=${encodeURIComponent(`name='${fileName}'`)}&spaces=appDataFolder&orderBy=createdTime desc`, {
         headers: {
             Authorization: `Bearer ${accessToken}`
         }
@@ -278,10 +375,10 @@ const listFilesFromGoogleDrive = async ({ accessToken, name })=>{
     const files = data.files;
     return files;
 };
-const downloadFileFromGoogleDrive = async ({ accessToken, name })=>{
+const downloadFileFromGoogleDrive = async ({ accessToken, fileName })=>{
     const files = await listFilesFromGoogleDrive({
         accessToken,
-        name
+        fileName
     });
     if (!files || files.length === 0) {
         return null;
@@ -308,382 +405,580 @@ const downloadFileFromGoogleDrive = async ({ accessToken, name })=>{
     }
 };
 
-const localStorageWriteTest = {
-    tested: false,
-    writable: false
-};
-/**
- * Checks whether localStorage is supported on this browser.
- */ const supportsLocalStorage = ()=>{
-    if (!isBrowser()) {
-        return false;
-    }
-    try {
-        if (typeof globalThis.localStorage !== 'object') {
-            return false;
-        }
-    } catch (e) {
-        // DOM exception when accessing `localStorage`
-        return false;
-    }
-    if (localStorageWriteTest.tested) {
-        return localStorageWriteTest.writable;
-    }
-    const randomKey = `lswt-${Math.random()}${Math.random()}`;
-    try {
-        globalThis.localStorage.setItem(randomKey, randomKey);
-        globalThis.localStorage.removeItem(randomKey);
-        localStorageWriteTest.tested = true;
-        localStorageWriteTest.writable = true;
-    } catch (e) {
-        // localStorage can't be written to
-        localStorageWriteTest.tested = true;
-        localStorageWriteTest.writable = false;
-    }
-    return localStorageWriteTest.writable;
-};
-/**
- * Provides safe access to the globalThis.localStorage property.
- */ const localStorageAdapter = {
-    getItem: (key)=>{
-        if (!supportsLocalStorage()) {
-            return null;
-        }
-        return globalThis.localStorage.getItem(key);
-    },
-    removeItem: (key)=>{
-        if (!supportsLocalStorage()) {
-            return;
-        }
-        globalThis.localStorage.removeItem(key);
-    },
-    setItem: (key, value)=>{
-        if (!supportsLocalStorage()) {
-            return;
-        }
-        globalThis.localStorage.setItem(key, value);
+const handleAxiosError = (error, message, context)=>{
+    var _error_response, _error_response1, _error_response2;
+    logger.error('[DynamicWaasWalletClient] Axios error: ', {
+        message,
+        error: (_error_response = error.response) == null ? void 0 : _error_response.data,
+        status: (_error_response1 = error.response) == null ? void 0 : _error_response1.status,
+        context
+    });
+    switch((_error_response2 = error.response) == null ? void 0 : _error_response2.status){
+        case 400:
+            throw createHttpError(400, 'Invalid request');
+        case 401:
+            throw createHttpError(401, 'Authorization header or cookie is required');
+        case 403:
+            throw createHttpError(403, 'Forbidden');
+        case 422:
+            throw createHttpError(422, 'Unprocessable content');
+        case 500:
+            throw createHttpError(500, 'Internal server error');
+        default:
+            throw createHttpError(500, 'Internal server error');
     }
 };
-/**
- * Returns a localStorage-like object that stores the key-value pairs in
- * memory.
- */ const memoryLocalStorageAdapter = (store = {})=>({
-        getItem: (key)=>store[key] || null,
-        removeItem: (key)=>{
-            delete store[key];
-        },
-        setItem: (key, value)=>{
-            store[key] = value;
-        }
-    });
 
-/**
- * StorageRequestChannelAdapter.getItem() sends a message within host domain
- * the bridge on host will capture this request and forwards it to the iframe via contentWindow.postMessage()
- */ class StorageRequestChannelAdapter {
-    async getItem(key) {
-        const item = await this.requestChannel.request('getItem', {
-            source: 'localStorage',
-            key
-        });
-        return item ? JSON.parse(item) : null;
-    }
-    async setItem(key, value) {
-        const stringifiedValue = typeof value === 'object' ? JSON.stringify(value) : value;
-        return this.requestChannel.request('setItem', {
-            source: 'localStorage',
-            key,
-            data: stringifiedValue
-        });
-    }
-    async removeItem(key) {
-        return this.requestChannel.request('deleteItem', {
-            source: 'localStorage',
-            key
+const logger = new logger$1.Logger('DynamicWaasWalletClient', logger$1.LogLevel.DEBUG);
+const setLoggerContext = ({ environmentId, authMode = core.AuthMode.HEADER, sessionId = undefined, userId = undefined })=>{
+    try {
+        logger$1.Logger.setEnvironmentId(environmentId);
+        logger$1.Logger.globalMetaData.set('sid', sessionId);
+        logger$1.Logger.globalMetaData.set('user_id', userId);
+        logger$1.Logger.globalMetaData.set('auth_mode', authMode);
+    } catch (error) {
+        logError({
+            message: '[DynamicWaasWalletClient] Error setting logger context',
+            error: error,
+            context: {}
         });
     }
-    constructor(messageTransport$1){
-        this.requestChannel = messageTransport.createRequestChannel(messageTransport$1);
+};
+const logError = ({ message, error, context })=>{
+    if (error instanceof axios.AxiosError) {
+        handleAxiosError(error, message, context);
     }
-}
-
-const setupMessageTransportBridge = (messageTransport$1, iframe, iframeOrigin)=>{
-    if (!(iframe == null ? void 0 : iframe.contentWindow)) {
-        throw new Error('Iframe or contentWindow not available');
-    }
-    const logger = new logger$1.Logger('debug');
-    messageTransport$1.on((message)=>{
-        // Forward the message to webview via postMessage
-        if (message.origin === 'host') {
-            var _iframe_contentWindow;
-            logger.debug(`[host bridge] host --> bridge --> iframe`, message);
-            iframe == null ? void 0 : (_iframe_contentWindow = iframe.contentWindow) == null ? void 0 : _iframe_contentWindow.postMessage(message, iframeOrigin);
-        }
+    logger.error('[DynamicWaasWalletClient] Error in browser client', {
+        error: error instanceof Error ? error.message : String(error),
+        context
     });
-    const handleIncomingMessage = (message)=>{
-        const { data } = message;
-        if (!data) return;
-        if ((data == null ? void 0 : data.origin) !== 'webview') {
-            logger.debug(`skipped message: ${JSON.stringify(data)}: origin is not host`);
-            return;
-        }
-        if (typeof data !== 'object') {
-            logger.debug(`skipped message: ${JSON.stringify(data)}: data is not an object`);
-            return;
-        }
-        try {
-            const message = messageTransport.parseMessageTransportData(data);
-            logger.debug(`[host bridge] iframe --> bridge --> host`, message);
-            messageTransport$1.emit(message);
-        } catch (error) {
-            if (!(error instanceof SyntaxError)) {
-                logger.error('Error handling incoming message:', error);
-            }
-        }
-    };
-    /**
-   * Handle incoming message from android client
-   */ // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-    // @ts-ignore
-    document.addEventListener('message', handleIncomingMessage);
-    /**
-   * Handle incoming message from iOS client
-   */ window.addEventListener('message', handleIncomingMessage);
 };
 
-class IframeDisplayChannelAdapter {
-    async displayClientShares(accountAddress) {
-        await this.requestChannel.request('displayClientShares', accountAddress);
-    }
-    async displayPrivateKey(accountAddress, privateKey) {
-        await this.requestChannel.request('displayPrivateKey', accountAddress, privateKey);
-    }
-    constructor(messageTransport$1){
-        this.requestChannel = messageTransport.createRequestChannel(messageTransport$1);
-    }
-}
+const DEFAULT_LOG_LEVEL = logger$1.LogLevel.DEBUG; //todo: change back to info when done debugging
+const STORAGE_KEY = 'dynamic-waas-wallet-client';
+const CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX = 'dynamicWalletKeyShareBackup';
+const SIGNED_SESSION_ID_MIN_VERSION = '4.25.4';
+// Namespace-specific version requirements
+const SIGNED_SESSION_ID_MIN_VERSION_BY_NAMESPACE = {
+    WalletKit: '4.25.4',
+    ClientSDK: '0.1.0-alpha.0'
+};
 
-class DynamicWalletClient {
-    async initialize() {
-        if (this.initializePromise) {
-            return await this.initializePromise;
-        }
-        this.logger.debug('Initializing Dynamic Waas Wallet SDK');
-        this.initializePromise = this._initialize();
-        const result = await this.initializePromise;
-        this.logger.debug('Dynamic Waas Wallet SDK initialized');
-        return result;
+const isBrowser = ()=>typeof window !== 'undefined';
+const getClientKeyShareExportFileName = ({ thresholdSignatureScheme, accountAddress, isGoogleDrive = false })=>{
+    const suffix = isGoogleDrive ? '-google-drive' : '';
+    return `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${thresholdSignatureScheme}-${accountAddress}${suffix}.json`;
+};
+const getClientKeyShareBackupInfo = (params)=>{
+    var _params_walletProperties, _params_walletProperties_keyShares_;
+    const backups = {
+        [core.BackupLocation.DYNAMIC]: [],
+        [core.BackupLocation.GOOGLE_DRIVE]: [],
+        [core.BackupLocation.ICLOUD]: [],
+        [core.BackupLocation.USER]: [],
+        [core.BackupLocation.EXTERNAL]: [],
+        [core.BackupLocation.DELEGATED]: []
+    };
+    if (!(params == null ? void 0 : (_params_walletProperties = params.walletProperties) == null ? void 0 : _params_walletProperties.keyShares)) {
+        return {
+            backups,
+            passwordEncrypted: false
+        };
     }
-    /**
-   * Initializes the iframe display for a specific container.
-   *
-   * @param {HTMLElement} container - The container to which the iframe will be attached.
-   * @returns {Promise<{
-   *   iframe: HTMLIFrameElement;
-   *   iframeDisplay: IframeDisplayChannelAdapter;
-   *   cleanup: () => void;
-   * }>} A promise that resolves when the iframe is loaded.
-   */ async initializeIframeDisplayForContainer({ container }) {
-        try {
-            const iframe = await this.loadIframeForContainer(container);
-            const transport = messageTransport.applyDefaultMessageOrigin({
-                defaultOrigin: 'host',
-                messageTransport: messageTransport.createMessageTransport()
+    params.walletProperties.keyShares.forEach((keyShare)=>{
+        if (backups[keyShare.backupLocation]) {
+            backups[keyShare.backupLocation].push({
+                location: keyShare.backupLocation,
+                keyShareId: keyShare.id,
+                externalKeyShareId: keyShare == null ? void 0 : keyShare.externalKeyShareId
             });
-            setupMessageTransportBridge(transport, iframe, this.iframeDomain);
-            const iframeDisplay = new IframeDisplayChannelAdapter(transport);
-            return {
-                iframe,
-                iframeDisplay,
-                cleanup: ()=>{
-                    container.removeChild(iframe);
-                }
-            };
-        } catch (error) {
-            this.logger.error('Error initializing iframe:', error);
-            throw error;
-        }
-    }
-    /**
-   * this is called on class construction time
-   * @returns {Promise<void>} that resolves when the iframe is loaded and the message transport and iframe storage are initialized
-   */ initializeIframeCommunication() {
-        if (!this.iframeLoadPromise) {
-            this.iframeLoadPromise = this.doInitializeIframeCommunication();
-        }
-        return this.iframeLoadPromise;
-    }
-    /**
-   * initialize the iframe communication by awaiting the iframe load promise
-   * and initializing the message transport and iframe storage after iframe is successfully loaded
-   */ async doInitializeIframeCommunication() {
-        try {
-            await this.loadIframe();
-            this.initializeMessageTransport();
-            this.initializeIframeStorage();
-        } catch (error) {
-            this.logger.error('Error initializing iframe:', error);
-            throw error;
+        }
+    });
+    const passwordEncrypted = Boolean((_params_walletProperties_keyShares_ = params.walletProperties.keyShares[0]) == null ? void 0 : _params_walletProperties_keyShares_.passwordEncrypted);
+    return {
+        backups,
+        passwordEncrypted
+    };
+};
+/**
+ * Helper function to merge keyshares and remove duplicates based on pubkey and secretShare
+ * @param existingKeyShares - Array of existing keyshares
+ * @param newKeyShares - Array of new keyshares to merge
+ * @returns Array of merged unique keyshares
+ */ const mergeUniqueKeyShares = (existingKeyShares, newKeyShares)=>{
+    const uniqueKeyShares = newKeyShares.filter((newShare)=>!existingKeyShares.some((existingShare)=>{
+            if (!(newShare == null ? void 0 : newShare.pubkey) || !(existingShare == null ? void 0 : existingShare.pubkey)) return false;
+            return newShare.pubkey.toString() === existingShare.pubkey.toString() && newShare.secretShare === existingShare.secretShare;
+        }));
+    return [
+        ...existingKeyShares,
+        ...uniqueKeyShares
+    ];
+};
+const timeoutPromise = ({ timeInMs, activity = 'Ceremony' })=>{
+    return new Promise((_, reject)=>setTimeout(()=>reject(new Error(`${activity} did not complete in ${timeInMs}ms`)), timeInMs));
+};
+/**
+ * Generic helper function to retry a promise-based operations
+ *
+ * @param operation - The async operation to retry
+ * @param config - Configuration options for retry behavior
+ * @returns Promise with the operation result
+ * @throws Last error encountered after all retries are exhausted
+ */ async function retryPromise(operation, { maxAttempts = 5, retryInterval = 500, operationName = 'operation', logContext = {} } = {}) {
+    let attempts = 0;
+    while(attempts < maxAttempts){
+        try {
+            return await operation();
+        } catch (error) {
+            var _error_response;
+            attempts++;
+            logger.warn(`Failed to execute ${operationName} on attempt ${attempts}`, _extends({}, logContext, {
+                error: error instanceof Error ? error.message : 'Unknown error',
+                axiosError: error instanceof axios.AxiosError ? (_error_response = error.response) == null ? void 0 : _error_response.data : undefined
+            }));
+            if (attempts === maxAttempts) {
+                var _error_response1;
+                logger.error(`Failed to execute ${operationName} after ${maxAttempts} attempts`, _extends({}, logContext, {
+                    error: error instanceof Error ? error.message : 'Unknown error',
+                    axiosError: error instanceof axios.AxiosError ? (_error_response1 = error.response) == null ? void 0 : _error_response1.data : undefined
+                }));
+                throw error;
+            }
+            // Calculate exponential backoff delay
+            const exponentialDelay = retryInterval * 2 ** (attempts - 1);
+            await new Promise((resolve)=>setTimeout(resolve, exponentialDelay));
         }
     }
-    /**
-   * create a promise to load an iframe
-   * @returns {Promise<void>} that resolves when the iframe is loaded
-   */ loadIframe() {
-        return new Promise((resolve, reject)=>{
-            const iframe = document.createElement('iframe');
-            const iframeTimeoutId = setTimeout(()=>{
-                reject(new Error('Iframe load timeout'));
-            }, 10000);
-            iframe.style.display = 'none';
-            iframe.setAttribute('title', 'Dynamic Wallet Iframe');
-            iframe.style.position = 'fixed';
-            iframe.style.top = '0';
-            iframe.style.left = '0';
-            iframe.style.width = '0';
-            iframe.style.height = '0';
-            iframe.style.border = 'none';
-            iframe.style.pointerEvents = 'none';
-            const params = new URLSearchParams({
-                instanceId: this.instanceId,
-                hostOrigin: window.location.origin
-            });
-            iframe.src = `${this.iframeDomain}/waas/${this.environmentId}?${params.toString()}`;
-            this.logger.debug('Creating iframe with src:', iframe.src);
-            document.body.appendChild(iframe);
-            iframe.onload = ()=>{
-                clearTimeout(iframeTimeoutId);
-                this.logger.debug('Iframe loaded successfully');
-                this.iframe = iframe;
-                resolve();
-            };
-            iframe.onerror = (error)=>{
-                clearTimeout(iframeTimeoutId);
-                this.logger.error('Iframe failed to load:', error);
-                reject(new Error('Failed to load iframe'));
-            };
-        });
+    // TypeScript needs this even though it's unreachable
+    throw new Error('Unreachable code');
+}
+const formatEvmMessage = (message)=>{
+    if (typeof message === 'string' && message.startsWith('0x')) {
+        const serializedTxBytes = Uint8Array.from(Buffer.from(message.slice(2), 'hex'));
+        return web.MessageHash.keccak256(serializedTxBytes);
     }
-    /**
-   * Load an iframe for a specific container
-   * @param {HTMLElement} container - The container to which the iframe will be attached
-   * @returns {Promise<HTMLIFrameElement>} that resolves when the iframe is loaded
-   */ loadIframeForContainer(container) {
-        return new Promise((resolve, reject)=>{
-            const iframe = document.createElement('iframe');
-            const iframeTimeoutId = setTimeout(()=>{
-                reject(new Error('Iframe load timeout'));
-            }, 10000);
-            iframe.style.display = 'block';
-            iframe.style.width = '100%';
-            iframe.style.height = '100%';
-            iframe.setAttribute('title', 'Dynamic Wallet Storage');
-            iframe.setAttribute('sandbox', 'allow-scripts allow-same-origin');
-            const params = new URLSearchParams({
-                instanceId: this.instanceId,
-                hostOrigin: window.location.origin
-            });
-            iframe.src = `${this.iframeDomain}/waas/${this.environmentId}?${params.toString()}`;
-            this.logger.debug('Creating iframe with src:', iframe.src);
-            // Add iframe to the provided container
-            container.appendChild(iframe);
-            iframe.onload = ()=>{
-                clearTimeout(iframeTimeoutId);
-                this.logger.debug('Iframe loaded successfully');
-                this.iframe = iframe;
-                resolve(iframe);
-            };
-            iframe.onerror = (error)=>{
-                clearTimeout(iframeTimeoutId);
-                this.logger.error('Iframe failed to load:', error);
-                reject(new Error('Failed to load iframe'));
-            };
+    return web.MessageHash.keccak256(message);
+};
+const isHexString = (str)=>{
+    // Remove 0x prefix if present
+    const hex = str.startsWith('0x') ? str.slice(2) : str;
+    // Check if string contains only hex characters
+    return /^[0-9A-Fa-f]+$/.test(hex);
+};
+const formatSolanaMessage = (message)=>{
+    if (typeof message === 'string') {
+        if (!isHexString(message)) {
+            return Buffer.from(message).toString('hex');
+        } else {
+            return new Uint8Array(Buffer.from(message, 'hex'));
+        }
+    } else {
+        return message;
+    }
+};
+const formatMessage = (chainName, message)=>{
+    switch(chainName){
+        case 'EVM':
+            return formatEvmMessage(message);
+        case 'SVM':
+            return formatSolanaMessage(message);
+        case 'SUI':
+            return message;
+        default:
+            throw new Error('Unsupported chain name');
+    }
+};
+const getGoogleOAuthAccountId = (verifiedCredentials)=>{
+    const googleVerifiedCredential = verifiedCredentials == null ? void 0 : verifiedCredentials.find((credential)=>credential.oauthProvider === sdkApiCore.ProviderEnum.Google);
+    return googleVerifiedCredential == null ? void 0 : googleVerifiedCredential.id;
+};
+const createBackupData = ({ encryptedKeyShares, accountAddress, thresholdSignatureScheme, hasPassword = true })=>{
+    return {
+        keyShares: encryptedKeyShares,
+        metadata: {
+            createdAt: new Date().toISOString(),
+            accountAddress,
+            thresholdSignatureScheme,
+            hasPassword,
+            encryption: getEncryptionMetadataForVersion(ENCRYPTION_VERSION_CURRENT),
+            encryptionVersion: ENCRYPTION_VERSION_CURRENT,
+            shareCount: encryptedKeyShares.length
+        }
+    };
+};
+const downloadStringAsFile = ({ filename, content, mimeType = 'application/json' })=>{
+    const blob = new Blob([
+        content
+    ], {
+        type: mimeType
+    });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = filename;
+    a.click();
+    URL.revokeObjectURL(url);
+};
+
+/**
+ * Uploads a backup to Google Drive App
+ * @param accessToken - The access token for the Google Drive API
+ * @param fileName - The name of the file to upload
+ * @param backupData - The data to upload
+ * @param accountAddress - The account address associated with the backup
+ */ const uploadBackupToGoogleDrive = async ({ accessToken, fileName, backupData, accountAddress })=>{
+    const uploadPromises = [
+        retryPromise(()=>uploadFileToGoogleDriveAppStorage({
+                accessToken,
+                fileName,
+                jsonData: backupData
+            })),
+        retryPromise(()=>uploadFileToGoogleDrivePersonal({
+                accessToken,
+                fileName,
+                jsonData: backupData
+            }))
+    ];
+    const results = await Promise.allSettled(uploadPromises);
+    const errors = [];
+    // Check App Storage result
+    if (results[0].status === 'rejected') {
+        const error = results[0].reason;
+        logger.error('[DynamicWaasWalletClient] Failed to upload keyshares to Google Drive App Storage', {
+            accountAddress,
+            error
         });
+        errors.push(`Failed to backup keyshares to Google Drive App Storage: ${error instanceof Error ? error.message : String(error)}`);
     }
-    /**
-   * initialize the message transport after iframe is successfully loaded
-   */ initializeMessageTransport() {
-        const transport = messageTransport.applyDefaultMessageOrigin({
-            defaultOrigin: 'host',
-            messageTransport: messageTransport.createMessageTransport()
+    // Check Personal Drive result
+    if (results[1].status === 'rejected') {
+        const error = results[1].reason;
+        logger.error('[DynamicWaasWalletClient] Failed to upload keyshares to Google Drive Personal', {
+            accountAddress,
+            error
         });
-        this.messageTransport = transport;
-        if (!this.iframe) {
-            throw new Error('Iframe not available');
+        errors.push(`Failed to backup keyshares to Google Drive Personal: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    // Throw if any uploads failed
+    if (errors.length > 0) {
+        throw new Error(`[DynamicWaasWalletClient] ${errors.join('; ')}`);
+    }
+};
+
+const ALG_LABEL_RSA = 'HYBRID-RSA-AES-256';
+/**
+ * Convert base64 to base64url encoding
+ */ const toBase64Url = (buffer)=>{
+    const base64 = Buffer.from(buffer).toString('base64');
+    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+};
+/**
+ * Convert ArrayBuffer to base64url
+ */ const arrayBufferToBase64Url = (buffer)=>{
+    return toBase64Url(buffer);
+};
+/**
+ * Import RSA public key from PEM format
+ */ const importRSAPublicKey = async (publicKeyPem)=>{
+    // Remove PEM headers and decode base64
+    const pemHeader = '-----BEGIN PUBLIC KEY-----';
+    const pemFooter = '-----END PUBLIC KEY-----';
+    const pemContents = publicKeyPem.replace(pemHeader, '').replace(pemFooter, '').replace(/\s/g, '');
+    const binaryDer = Buffer.from(pemContents, 'base64').toString('binary');
+    const keyData = new Uint8Array(binaryDer.length);
+    for(let i = 0; i < binaryDer.length; i++){
+        keyData[i] = binaryDer.charCodeAt(i);
+    }
+    return await crypto.subtle.importKey('spki', keyData, {
+        name: 'RSA-OAEP',
+        hash: 'SHA-256'
+    }, false, [
+        'encrypt'
+    ]);
+};
+// encodedEnvelopeBytes intentionally omitted; alg/ct/ek/iv/tag/kid is sufficient
+/**
+ * Encrypts data using HYBRID-RSA-AES-256 encryption scheme with Web Crypto API.
+ * 1. Generate random AES-256 key
+ * 2. Encrypt AES key with RSA public key
+ * 3. Encrypt data with AES-256-GCM
+ */ const encryptDelegatedKeyShare = async (data, publicKeyPem, keyId)=>{
+    try {
+        // Step 1: Generate a random AES-256 key and 16-byte IV
+        const aesKey = await crypto.subtle.generateKey({
+            name: 'AES-GCM',
+            length: 256
+        }, true, [
+            'encrypt'
+        ]);
+        const iv = crypto.getRandomValues(new Uint8Array(16)); // 128-bit IV for GCM
+        // Step 2: Encrypt the data with AES-256-GCM
+        const plaintext = new TextEncoder().encode(data);
+        const encryptedData = await crypto.subtle.encrypt({
+            name: 'AES-GCM',
+            iv: iv
+        }, aesKey, plaintext);
+        // Extract the auth tag from the encrypted data (last 16 bytes)
+        const encryptedDataArray = new Uint8Array(encryptedData);
+        const authTag = encryptedDataArray.slice(-16);
+        const ciphertext = encryptedDataArray.slice(0, -16);
+        // Step 3: Encrypt the AES key with RSA public key
+        const rsaPublicKey = await importRSAPublicKey(publicKeyPem);
+        // Export the AES key to encrypt it
+        const aesKeyData = await crypto.subtle.exportKey('raw', aesKey);
+        const encryptedAesKey = await crypto.subtle.encrypt({
+            name: 'RSA-OAEP'
+        }, rsaPublicKey, aesKeyData);
+        return _extends({
+            alg: ALG_LABEL_RSA,
+            iv: arrayBufferToBase64Url(iv.buffer),
+            ct: arrayBufferToBase64Url(ciphertext.buffer),
+            tag: arrayBufferToBase64Url(authTag.buffer),
+            ek: arrayBufferToBase64Url(encryptedAesKey)
+        }, keyId ? {
+            kid: keyId
+        } : {});
+    } catch (error) {
+        throw new Error(`Encryption failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+};
+
+const localStorageWriteTest = {
+    tested: false,
+    writable: false
+};
+/**
+ * Checks whether localStorage is supported on this browser.
+ */ const supportsLocalStorage = ()=>{
+    if (!isBrowser()) {
+        return false;
+    }
+    try {
+        if (typeof globalThis.localStorage !== 'object') {
+            return false;
         }
-        setupMessageTransportBridge(this.messageTransport, this.iframe, this.iframeDomain);
+    } catch (e) {
+        // DOM exception when accessing `localStorage`
+        return false;
     }
-    /**
-   * initialize the iframe storage after iframe is successfully loaded
-   */ initializeIframeStorage() {
-        if (!this.messageTransport) {
-            throw new Error('Message transport not initialized');
+    if (localStorageWriteTest.tested) {
+        return localStorageWriteTest.writable;
+    }
+    const randomKey = `lswt-${Math.random()}${Math.random()}`;
+    try {
+        globalThis.localStorage.setItem(randomKey, randomKey);
+        globalThis.localStorage.removeItem(randomKey);
+        localStorageWriteTest.tested = true;
+        localStorageWriteTest.writable = true;
+    } catch (e) {
+        // localStorage can't be written to
+        localStorageWriteTest.tested = true;
+        localStorageWriteTest.writable = false;
+    }
+    return localStorageWriteTest.writable;
+};
+/**
+ * Provides safe access to the globalThis.localStorage property.
+ */ const localStorageAdapter = {
+    getItem: (key)=>{
+        if (!supportsLocalStorage()) {
+            return null;
+        }
+        return globalThis.localStorage.getItem(key);
+    },
+    removeItem: (key)=>{
+        if (!supportsLocalStorage()) {
+            return;
+        }
+        globalThis.localStorage.removeItem(key);
+    },
+    setItem: (key, value)=>{
+        if (!supportsLocalStorage()) {
+            return;
+        }
+        globalThis.localStorage.setItem(key, value);
+    }
+};
+/**
+ * Returns a localStorage-like object that stores the key-value pairs in
+ * memory.
+ */ const memoryLocalStorageAdapter = (store = {})=>({
+        getItem: (key)=>store[key] || null,
+        removeItem: (key)=>{
+            delete store[key];
+        },
+        setItem: (key, value)=>{
+            store[key] = value;
+        }
+    });
+
+const createDelegationWithGoogleDriveDistribution = ({ existingShares, delegatedShare })=>({
+        dynamicBackendShares: existingShares,
+        googleDriveShares: existingShares,
+        delegatedShare
+    });
+const createDelegationOnlyDistribution = ({ existingShares, delegatedShare })=>({
+        dynamicBackendShares: existingShares,
+        googleDriveShares: [],
+        delegatedShare
+    });
+const createGoogleDriveOnlyDistribution = ({ allShares })=>({
+        dynamicBackendShares: allShares.slice(0, -1),
+        googleDriveShares: allShares.slice(-1)
+    });
+const createDynamicOnlyDistribution = ({ allShares })=>({
+        dynamicBackendShares: allShares,
+        googleDriveShares: []
+    });
+const hasGoogleDriveBackup = (backupInfo)=>{
+    var _backupInfo_backups_BackupLocation_GOOGLE_DRIVE, _backupInfo_backups;
+    var _backupInfo_backups_BackupLocation_GOOGLE_DRIVE_length;
+    return ((_backupInfo_backups_BackupLocation_GOOGLE_DRIVE_length = backupInfo == null ? void 0 : (_backupInfo_backups = backupInfo.backups) == null ? void 0 : (_backupInfo_backups_BackupLocation_GOOGLE_DRIVE = _backupInfo_backups[core.BackupLocation.GOOGLE_DRIVE]) == null ? void 0 : _backupInfo_backups_BackupLocation_GOOGLE_DRIVE.length) != null ? _backupInfo_backups_BackupLocation_GOOGLE_DRIVE_length : 0) > 0;
+};
+const hasDelegatedBackup = (backupInfo)=>{
+    var _backupInfo_backups_BackupLocation_DELEGATED, _backupInfo_backups;
+    var _backupInfo_backups_BackupLocation_DELEGATED_length;
+    return ((_backupInfo_backups_BackupLocation_DELEGATED_length = backupInfo == null ? void 0 : (_backupInfo_backups = backupInfo.backups) == null ? void 0 : (_backupInfo_backups_BackupLocation_DELEGATED = _backupInfo_backups[core.BackupLocation.DELEGATED]) == null ? void 0 : _backupInfo_backups_BackupLocation_DELEGATED.length) != null ? _backupInfo_backups_BackupLocation_DELEGATED_length : 0) > 0;
+};
+/**
+ * Distribution for adding Google Drive backup to an existing delegation.
+ * Client's shares go to both Dynamic and Google Drive.
+ * delegatedShare is undefined - we don't re-publish, but preserve the location.
+ */ const createAddGoogleDriveToExistingDelegationDistribution = ({ clientShares })=>({
+        dynamicBackendShares: clientShares,
+        googleDriveShares: clientShares
+    });
+
+class DynamicWalletClient {
+    async initializeForwardMPCClient() {
+        try {
+            await this.apiClient.forwardMPCClient.connect();
+            this.logger.info('Connected to ForwardMPC enclave websocket. Instance: ' + this.instanceId);
+            try {
+                await this.apiClient.forwardMPCClient.handshake();
+                this.logger.debug('Handshaked with ForwardMPC enclave websocket. Instance: ' + this.instanceId);
+            } catch (error) {
+                this.logger.error('Error handshaking with ForwardMPC enclave websocket. Instance: ' + this.instanceId, error);
+            }
+        } catch (error) {
+            this.logger.error('Error connecting to ForwardMPC enclave websocket. Instance: ' + this.instanceId, {
+                error,
+                environmentId: this.environmentId
+            });
         }
-        this.iframeStorage = new StorageRequestChannelAdapter(this.messageTransport);
+    }
+    getAuthMode() {
+        return this.authMode;
     }
     /**
-   * Gets the initialized iframe instance. This method ensures the iframe is properly loaded and configured.
-   * The first call will initialize and await the iframe loading process.
-   * Subsequent calls will return the same iframe instance immediately.
-   *
-   * @throws {Error} If iframe initialization fails
-   * @throws {Error} If message transport initialization fails
-   * @throws {Error} If iframe storage initialization fails
-   * @returns {Promise<HTMLIFrameElement>} The initialized iframe element
-   */ async getIframe() {
-        await this.initializeIframeCommunication();
-        if (!this.iframe) {
-            throw new Error('Failed to initialize iframe');
+   * Check if the SDK version meets the requirement for signed session ID
+   * Uses namespace-specific version requirements when available
+   * @returns boolean indicating if requireSignedSessionId should be set to true
+   */ requiresSignedSessionId() {
+        if (!this.sdkVersion) {
+            return false;
+        }
+        try {
+            const parsedVersion = core.parseNamespacedVersion(this.sdkVersion);
+            if (!parsedVersion) {
+                return false;
+            }
+            const { namespace, version } = parsedVersion;
+            // Check if we have a namespace-specific version requirement
+            const namespaceMinVersion = SIGNED_SESSION_ID_MIN_VERSION_BY_NAMESPACE[namespace];
+            if (namespaceMinVersion) {
+                return semver.gte(version, namespaceMinVersion);
+            }
+            // Fall back to default version requirement
+            return semver.gte(version, SIGNED_SESSION_ID_MIN_VERSION);
+        } catch (error) {
+            logger.warn(`[DynamicWaasWalletClient] Error checking if requiresSignedSessionId should be set to true for version ${this.sdkVersion}`, error);
+            return false;
         }
-        if (!this.messageTransport) {
-            throw new Error('Failed to initialize message transport');
+    }
+    async initLoggerContext(authToken) {
+        // only decode jwt token in header auth mode
+        if (this.authMode === 'cookie') {
+            setLoggerContext({
+                environmentId: this.environmentId,
+                authMode: this.authMode
+            });
+            return;
         }
-        if (!this.iframeStorage) {
-            throw new Error('Failed to initialize iframe storage');
+        try {
+            // Split the JWT token into its parts (header.payload.signature)
+            const parts = authToken.split('.');
+            if (parts.length !== 3) {
+                logger.debug('[DynamicWaasWalletClient] Invalid JWT token when initializing logger context');
+                return;
+            }
+            // Decode the payload (second part)
+            const base64Payload = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+            const jsonPayload = decodeURIComponent(Buffer.from(base64Payload, 'base64').toString('utf-8'));
+            const payload = JSON.parse(jsonPayload);
+            if (!payload || typeof payload !== 'object') {
+                logger.debug('[DynamicWaasWalletClient] Invalid JWT payload when initializing logger context');
+                return;
+            }
+            const userId = payload['sub'] || 'unknown';
+            const sessionId = payload['sid'] || 'unknown';
+            setLoggerContext({
+                environmentId: this.environmentId,
+                authMode: this.authMode,
+                sessionId,
+                userId
+            });
+            this.sessionId = sessionId;
+        } catch (error) {
+            logError({
+                message: 'Error initializing logger context',
+                error: error,
+                context: {}
+            });
+            throw error;
         }
-        return this.iframe;
     }
-    /**
-   * Gets the initialized iframe storage instance. This method ensures the iframe storage is properly configured.
-   * The first call will initialize and await the iframe communication process.
-   * Subsequent calls will return the same storage instance immediately.
-   *
-   * @throws {Error} If iframe storage initialization fails
-   * @returns {Promise<SupportedStorage>} The initialized iframe storage instance
-   */ async getIframeStorage() {
-        await this.initializeIframeCommunication();
-        if (!this.iframeStorage) {
-            throw new Error('Failed to initialize iframe storage');
+    async initialize(traceContext) {
+        if (this.initializePromise) {
+            return await this.initializePromise;
         }
-        return this.iframeStorage;
+        this.logger.debug('[DynamicWaasWalletClient] Initializing Dynamic Waas Wallet SDK');
+        this.initializePromise = this._initialize(traceContext);
+        const result = await this.initializePromise;
+        this.logger.debug('[DynamicWaasWalletClient] Dynamic Waas Wallet SDK initialized');
+        return result;
     }
     /**
    * Client initialization logic
-   */ async _initialize() {
+   */ async _initialize(traceContext) {
         try {
             const initializePromises = [
-                this.restoreWallets(),
-                this.initializeIframeCommunication()
+                this.restoreWallets()
             ];
             await Promise.all(initializePromises);
             return {
-                error: null
+                error: null,
+                traceContext
             };
         } catch (error) {
             return {
-                error
+                error,
+                traceContext
             };
         }
     }
-    async serverInitializeKeyGen({ chainName, clientKeygenIds, thresholdSignatureScheme, onError, onCeremonyComplete }) {
+    async serverInitializeKeyGen({ chainName, clientKeygenIds, dynamicRequestId, thresholdSignatureScheme, onError, onCeremonyComplete }) {
         // Initialize keygen, create room, and create the wallet account on the server
         const data = await this.apiClient.createWalletAccount({
             chainName,
             clientKeygenIds,
+            dynamicRequestId,
             thresholdSignatureScheme,
             onError,
             onCeremonyComplete
         });
+        this.logger.debug(`[DynamicWaasWalletClient] Initialized client key generation with IDs: ${clientKeygenIds.join(', ')} for chain: ${chainName} using scheme: ${thresholdSignatureScheme}`);
         return data;
     }
     async clientInitializeKeyGen({ chainName, thresholdSignatureScheme }) {
@@ -704,8 +999,8 @@ class DynamicWalletClient {
         let publicKey;
         if (mpcSigner instanceof web.Ecdsa) {
             publicKey = await mpcSigner.derivePubkey(keyShare, derivationPath);
-        } else if (mpcSigner instanceof web.Ed25519) {
-            publicKey = await mpcSigner.derivePubkey(keyShare, derivationPath);
+        } else if (mpcSigner instanceof web.ExportableEd25519) {
+            publicKey = await mpcSigner.getPubkey(keyShare);
         }
         return publicKey;
     }
@@ -726,7 +1021,13 @@ class DynamicWalletClient {
                 ...serverKeygenIds,
                 ...otherClientKeygenIds
             ];
-            return mpcSigner.keygen(roomId, mpcConfig.numberOfParties, mpcConfig.threshold, currentInit, allOtherKeygenIds);
+            if (!(mpcSigner instanceof web.ExportableEd25519)) {
+                return mpcSigner.keygen(roomId, mpcConfig.numberOfParties, mpcConfig.threshold, currentInit, allOtherKeygenIds);
+            } else {
+                // One party joins the keygen room using acting as the sampler: (wallet-service)
+                // The remaining parties join the key sampling ceremony using: (browser)
+                return mpcSigner.receiveKey(roomId, mpcConfig.numberOfParties, mpcConfig.threshold, currentInit, allOtherKeygenIds);
+            }
         }));
         // only need one client keygen result to derive the public key
         const [clientKeygenResult] = clientKeygenResults;
@@ -742,19 +1043,35 @@ class DynamicWalletClient {
             clientKeygenResults
         };
     }
-    async keyGen({ chainName, thresholdSignatureScheme, onError, onCeremonyComplete }) {
+    async keyGen({ chainName, thresholdSignatureScheme, onError, onCeremonyComplete, traceContext }) {
+        const dynamicRequestId = uuid.v4();
         try {
             const clientKeygenInitResults = await this.clientInitializeKeyGen({
                 chainName,
                 thresholdSignatureScheme
             });
             const clientKeygenIds = clientKeygenInitResults.map((result)=>result.keygenId);
+            this.instrument('[DynamicWaasWalletClient] Initialized client key generation', _extends({
+                clientKeygenIds: clientKeygenIds.join(', '),
+                chainName,
+                thresholdSignatureScheme,
+                key: 'keyGen'
+            }, this.getTraceContext(traceContext)));
             const { roomId, serverKeygenIds } = await this.serverInitializeKeyGen({
                 chainName,
                 clientKeygenIds,
+                dynamicRequestId,
                 thresholdSignatureScheme,
                 onCeremonyComplete
             });
+            this.instrument('[DynamicWaasWalletClient] Server key generation initialized', _extends({
+                roomId,
+                clientKeygenIds: clientKeygenIds.join(', '),
+                serverKeygenIds: serverKeygenIds.join(', '),
+                chainName,
+                key: 'keyGen',
+                operation: 'serverKeyGen'
+            }, this.getTraceContext(traceContext)));
             const { rawPublicKey, clientKeygenResults: clientKeyShares } = await this.clientKeyGen({
                 chainName,
                 roomId,
@@ -762,172 +1079,351 @@ class DynamicWalletClient {
                 clientKeygenInitResults,
                 thresholdSignatureScheme
             });
+            this.instrument('[DynamicWaasWalletClient] Client key generation completed', _extends({
+                roomId,
+                serverKeygenIds: serverKeygenIds.join(', '),
+                clientKeygenIds: clientKeygenIds.join(', '),
+                chainName,
+                thresholdSignatureScheme,
+                rawPublicKey,
+                clientKeySharesCount: clientKeyShares.length,
+                key: 'keyGen',
+                operation: 'clientKeyGen'
+            }, this.getTraceContext(traceContext)));
             return {
                 rawPublicKey,
                 clientKeyShares
             };
         } catch (error) {
-            this.logger.error('Error creating wallet account', error);
-            throw new Error('Error creating wallet account');
+            logError({
+                message: 'Error in keyGen',
+                error: error,
+                context: _extends({
+                    chainName,
+                    thresholdSignatureScheme,
+                    dynamicRequestId
+                }, this.getTraceContext(traceContext))
+            });
+            throw error;
         }
     }
-    async importRawPrivateKey({ chainName, privateKey, thresholdSignatureScheme, onError, onCeremonyComplete }) {
-        const mpcSigner = getMPCSigner({
-            chainName,
-            baseRelayUrl: this.baseMPCRelayApiUrl
-        });
-        const clientKeygenInitResults = await this.clientInitializeKeyGen({
-            chainName,
-            thresholdSignatureScheme
-        });
-        const clientKeygenIds = clientKeygenInitResults.map((result)=>result.keygenId);
-        const { roomId, serverKeygenIds } = await this.apiClient.importPrivateKey({
-            chainName,
-            clientKeygenIds,
-            thresholdSignatureScheme,
-            onError,
-            onCeremonyComplete
-        });
-        const { threshold } = core.getTSSConfig(thresholdSignatureScheme);
-        const clientKeygenResults = await Promise.all(clientKeygenInitResults.map(async (currentInit, index)=>{
-            const otherClientKeygenIds = clientKeygenInitResults.filter((init)=>init.keygenId !== currentInit.keygenId).map((init)=>init.keygenId);
-            if (index === 0) {
-                const otherKeyGenIds = [
-                    ...serverKeygenIds,
-                    ...otherClientKeygenIds
-                ];
-                const importerKeygenResult = await mpcSigner.importPrivateKeyImporter(roomId, threshold, privateKey, currentInit, otherKeyGenIds);
-                return importerKeygenResult;
-            } else {
-                const recipientKeygenResult = await mpcSigner.importPrivateKeyRecipient(roomId, threshold, currentInit, [
-                    ...serverKeygenIds,
-                    ...otherClientKeygenIds
-                ]);
-                return recipientKeygenResult;
-            }
-        }));
-        const [clientKeygenResult] = clientKeygenResults;
-        const rawPublicKey = await this.derivePublicKey({
-            chainName,
-            keyShare: clientKeygenResult,
-            derivationPath: undefined
-        });
-        return {
-            rawPublicKey,
-            clientKeyShares: clientKeygenResults
-        };
+    async importRawPrivateKey({ chainName, privateKey, thresholdSignatureScheme, onError, onCeremonyComplete, traceContext }) {
+        const dynamicRequestId = uuid.v4();
+        try {
+            const mpcSigner = getMPCSigner({
+                chainName,
+                baseRelayUrl: this.baseMPCRelayApiUrl
+            });
+            const clientKeygenInitResults = await this.clientInitializeKeyGen({
+                chainName,
+                thresholdSignatureScheme
+            });
+            const clientKeygenIds = clientKeygenInitResults.map((result)=>result.keygenId);
+            this.instrument('[DynamicWaasWalletClient] Client key generation initialized', _extends({
+                clientKeygenIds: clientKeygenIds.join(', '),
+                chainName,
+                thresholdSignatureScheme,
+                key: 'importRawPrivateKey',
+                operation: 'clientKeyGen'
+            }, this.getTraceContext(traceContext)));
+            const { roomId, serverKeygenIds } = await this.apiClient.importPrivateKey({
+                chainName,
+                clientKeygenIds,
+                dynamicRequestId,
+                thresholdSignatureScheme,
+                onError,
+                onCeremonyComplete
+            });
+            this.instrument('[DynamicWaasWalletClient] Server key generation initialized', _extends({
+                roomId,
+                clientKeygenIds: clientKeygenIds.join(', '),
+                serverKeygenIds: serverKeygenIds.join(', '),
+                chainName,
+                key: 'importRawPrivateKey',
+                operation: 'serverImportPrivateKey'
+            }, this.getTraceContext(traceContext)));
+            const { threshold } = core.getTSSConfig(thresholdSignatureScheme);
+            const clientKeygenResults = await Promise.all(clientKeygenInitResults.map(async (currentInit, index)=>{
+                const otherClientKeygenIds = clientKeygenInitResults.filter((init)=>init.keygenId !== currentInit.keygenId).map((init)=>init.keygenId);
+                if (index === 0) {
+                    const otherKeyGenIds = [
+                        ...serverKeygenIds,
+                        ...otherClientKeygenIds
+                    ];
+                    const importerKeygenResult = await mpcSigner.importPrivateKeyImporter(roomId, threshold, privateKey, currentInit, otherKeyGenIds);
+                    return importerKeygenResult;
+                } else {
+                    const recipientKeygenResult = await mpcSigner.importPrivateKeyRecipient(roomId, threshold, currentInit, [
+                        ...serverKeygenIds,
+                        ...otherClientKeygenIds
+                    ]);
+                    return recipientKeygenResult;
+                }
+            }));
+            const [clientKeygenResult] = clientKeygenResults;
+            const rawPublicKey = await this.derivePublicKey({
+                chainName,
+                keyShare: clientKeygenResult,
+                derivationPath: undefined
+            });
+            this.instrument('[DynamicWaasWalletClient] Completed import of raw private key', _extends({
+                rawPublicKey,
+                chainName,
+                thresholdSignatureScheme,
+                roomId,
+                serverKeygenIds: serverKeygenIds.join(', '),
+                clientKeygenIds: clientKeygenIds.join(', '),
+                key: 'importRawPrivateKey',
+                operation: 'importRawPrivateKey'
+            }, this.getTraceContext(traceContext)));
+            return {
+                rawPublicKey,
+                clientKeyShares: clientKeygenResults
+            };
+        } catch (error) {
+            logError({
+                message: 'Error in importRawPrivateKey',
+                error: error,
+                context: _extends({
+                    chainName,
+                    thresholdSignatureScheme,
+                    dynamicRequestId
+                }, this.getTraceContext(traceContext))
+            });
+            throw error;
+        }
     }
-    async serverSign({ walletId, message }) {
+    async serverSign({ walletId, message, isFormatted, mfaToken, context, onError, dynamicRequestId, traceContext }) {
         // Create the room and sign the message
         if (typeof message !== 'string') {
-            message = '0x' + Buffer.from(message).toString('hex');
+            message = `0x${Buffer.from(message).toString('hex')}`;
         }
         const data = await this.apiClient.signMessage({
             walletId,
-            message
+            message,
+            isFormatted,
+            dynamicRequestId,
+            mfaToken,
+            context: context ? JSON.parse(JSON.stringify(context, (_key, value)=>typeof value === 'bigint' ? value.toString() : value)) : undefined,
+            onError,
+            forwardMPCClientEnabled: this.forwardMPCEnabled,
+            traceContext
         });
         return data;
     }
-    async clientSign({ chainName, message, roomId, keyShare, derivationPath }) {
+    async forwardMPCClientSign({ chainName, message, roomId, keyShare, derivationPath, formattedMessage, dynamicRequestId, isFormatted, traceContext }) {
+        try {
+            if (!this.apiClient.forwardMPCClient.connected) {
+                await this.initializeForwardMPCClient();
+            }
+            const messageForForwardMPC = core.serializeMessageForForwardMPC({
+                message,
+                isFormatted,
+                chainName
+            });
+            this.logger.info('Forward MPC enabled, signing message with forward MPC', this.getTraceContext(traceContext));
+            const signature = await this.apiClient.forwardMPCClient.signMessage({
+                keyshare: keyShare,
+                message: chainName === 'SVM' ? formattedMessage : messageForForwardMPC,
+                relayDomain: this.baseMPCRelayApiUrl || '',
+                signingAlgo: chainName === 'EVM' ? 'ECDSA' : 'ED25519',
+                hashAlgo: chainName === 'EVM' && !isFormatted ? 'keccak256' : undefined,
+                derivationPath: derivationPath,
+                roomUuid: roomId
+            });
+            const signatureBytes = signature.data.signature;
+            if (!(signatureBytes instanceof Uint8Array)) {
+                throw new TypeError(`Invalid signature format: expected Uint8Array, got ${typeof signatureBytes}`);
+            }
+            // Convert to EcdsaSignature
+            if (chainName === 'EVM') {
+                const ecdsaSignature = web.EcdsaSignature.fromBuffer(signatureBytes);
+                return ecdsaSignature;
+            } else {
+                return signatureBytes;
+            }
+        } catch (error) {
+            this.logger.error('Error signing message with forward MPC client', {
+                error,
+                environmentId: this.environmentId,
+                userId: this.userId,
+                dynamicRequestId
+            });
+            throw error;
+        }
+    }
+    async clientSign({ chainName, message, roomId, keyShare, derivationPath, isFormatted, dynamicRequestId, traceContext }) {
         try {
             const mpcSigner = getMPCSigner({
                 chainName,
                 baseRelayUrl: this.baseMPCRelayApiUrl
             });
-            let formattedMessage;
-            //note: Ecdsa can also be used by bitcoin, but only keccak256 is used by ethereum
-            if (mpcSigner instanceof web.Ecdsa) {
-                formattedMessage = web.MessageHash.keccak256(message);
-            } else if (mpcSigner instanceof web.Ed25519) {
-                if (typeof message === 'string') {
-                    if (!isHexString(message)) {
-                        formattedMessage = Buffer.from(message).toString('hex');
-                    } else {
-                        formattedMessage = Buffer.from(message, 'hex');
-                    }
-                } else {
-                    formattedMessage = message;
-                }
-            } else if (mpcSigner instanceof web.BIP340 && typeof message === 'string') {
-                formattedMessage = new TextEncoder().encode(message);
-            } else {
-                throw new Error('Unsupported signer type');
+            const formattedMessage = isFormatted ? new web.MessageHash(message) : formatMessage(chainName, message);
+            this.logger.debug('[DynamicWaasWalletClient] Starting client sign', _extends({
+                chainName,
+                message,
+                roomId,
+                derivationPath,
+                isFormatted
+            }, this.getTraceContext(traceContext)));
+            if (this.forwardMPCEnabled) {
+                return this.forwardMPCClientSign({
+                    chainName,
+                    message,
+                    roomId,
+                    keyShare,
+                    derivationPath,
+                    formattedMessage,
+                    dynamicRequestId,
+                    isFormatted,
+                    traceContext
+                });
             }
             const signature = await mpcSigner.sign(roomId, keyShare, formattedMessage, derivationPath);
             return signature;
         } catch (error) {
-            this.logger.error('Error in clientSign:', error);
+            logError({
+                message: 'Error in clientSign',
+                error: error,
+                context: _extends({
+                    chainName,
+                    roomId,
+                    derivationPath,
+                    isFormatted,
+                    dynamicRequestId
+                }, this.getTraceContext(traceContext))
+            });
             throw error;
         }
     }
     //todo: need to modify with imported flag
-    async sign({ accountAddress, message, chainName, password = undefined }) {
-        await this.verifyPassword({
-            accountAddress,
-            password,
-            walletOperation: core.WalletOperation.SIGN_MESSAGE
-        });
-        const wallet = await this.getWallet({
-            accountAddress,
-            password,
-            walletOperation: core.WalletOperation.SIGN_MESSAGE
-        });
-        // Perform the server sign
-        const data = await this.serverSign({
-            walletId: wallet.walletId,
-            message
-        });
-        const derivationPath = wallet.derivationPath && wallet.derivationPath != '' ? new Uint32Array(Object.values(JSON.parse(wallet.derivationPath))) : undefined;
-        // Perform the client sign and return the signature
-        const clientKeyShares = await this.getClientKeySharesFromLocalStorage({
-            accountAddress
-        });
-        const signature = await this.clientSign({
-            chainName,
-            message,
-            roomId: data.roomId,
-            keyShare: clientKeyShares[0],
-            derivationPath
-        });
-        return signature;
+    async sign({ accountAddress, message, chainName, password = undefined, isFormatted = false, signedSessionId, mfaToken, context, onError, traceContext }) {
+        const dynamicRequestId = uuid.v4();
+        try {
+            await this.verifyPassword({
+                accountAddress,
+                password,
+                walletOperation: core.WalletOperation.SIGN_MESSAGE,
+                signedSessionId
+            });
+            const wallet = await this.getWallet({
+                accountAddress,
+                password,
+                walletOperation: core.WalletOperation.SIGN_MESSAGE,
+                signedSessionId
+            });
+            // Perform the server sign
+            const data = await this.serverSign({
+                walletId: wallet.walletId,
+                message,
+                isFormatted,
+                mfaToken,
+                context,
+                onError,
+                dynamicRequestId,
+                traceContext
+            });
+            this.instrument('[DynamicWaasWalletClient] Server sign completed', _extends({
+                message,
+                accountAddress,
+                walletId: wallet.walletId,
+                roomId: data.roomId,
+                dynamicRequestId,
+                key: 'sign',
+                operation: 'serverSign'
+            }, this.getTraceContext(traceContext)));
+            const derivationPath = wallet.derivationPath && wallet.derivationPath != '' ? new Uint32Array(Object.values(JSON.parse(wallet.derivationPath))) : undefined;
+            // Perform the client sign and return the signature
+            const clientKeyShares = await this.getClientKeySharesFromLocalStorage({
+                accountAddress
+            });
+            const signature = await this.clientSign({
+                chainName,
+                message,
+                roomId: data.roomId,
+                keyShare: clientKeyShares[0],
+                derivationPath,
+                isFormatted,
+                dynamicRequestId,
+                traceContext
+            });
+            this.instrument('[DynamicWaasWalletClient] Client sign completed', _extends({
+                accountAddress,
+                chainName,
+                message,
+                roomId: data.roomId,
+                derivationPath,
+                isFormatted,
+                key: 'sign',
+                operation: 'clientSign'
+            }, this.getTraceContext(traceContext)));
+            return signature;
+        } catch (error) {
+            logError({
+                message: 'Error in sign',
+                error: error,
+                context: _extends({
+                    accountAddress,
+                    chainName,
+                    isFormatted: isFormatted ? 'true' : 'false',
+                    dynamicRequestId
+                }, this.getTraceContext(traceContext))
+            });
+            throw error;
+        }
     }
-    async refreshWalletAccountShares({ accountAddress, chainName, password = undefined }) {
-        await this.verifyPassword({
-            accountAddress,
-            password,
-            walletOperation: core.WalletOperation.REFRESH
-        });
-        const wallet = await this.getWallet({
-            accountAddress,
-            walletOperation: core.WalletOperation.NO_OPERATION,
-            password
-        });
-        const mpcSigner = getMPCSigner({
-            chainName,
-            baseRelayUrl: this.baseMPCRelayApiUrl
-        });
-        // Create the room and refresh the shares
-        const data = await this.apiClient.refreshWalletAccountShares({
-            walletId: wallet.walletId
-        });
-        const roomId = data.roomId;
-        const clientKeyShares = await this.getClientKeySharesFromLocalStorage({
-            accountAddress
-        });
-        const refreshResults = await Promise.all(clientKeyShares.map((clientKeyShare)=>mpcSigner.refresh(roomId, clientKeyShare)));
-        this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
-            clientKeySharesBackupInfo: getClientKeyShareBackupInfo()
-        });
-        await this.setClientKeySharesToLocalStorage({
-            accountAddress,
-            clientKeyShares: refreshResults,
-            overwriteOrMerge: 'overwrite'
-        });
-        await this.storeEncryptedBackupByWallet({
-            accountAddress,
-            password: password != null ? password : this.environmentId
-        });
-        return refreshResults;
+    async refreshWalletAccountShares({ accountAddress, chainName, password = undefined, signedSessionId, mfaToken, traceContext }) {
+        const dynamicRequestId = uuid.v4();
+        try {
+            await this.verifyPassword({
+                accountAddress,
+                password,
+                walletOperation: core.WalletOperation.REFRESH,
+                signedSessionId
+            });
+            const wallet = await this.getWallet({
+                accountAddress,
+                walletOperation: core.WalletOperation.NO_OPERATION,
+                password,
+                signedSessionId
+            });
+            const mpcSigner = getMPCSigner({
+                chainName,
+                baseRelayUrl: this.baseMPCRelayApiUrl
+            });
+            // Create the room and refresh the shares
+            const data = await this.apiClient.refreshWalletAccountShares({
+                dynamicRequestId,
+                walletId: wallet.walletId,
+                mfaToken
+            });
+            const roomId = data.roomId;
+            const clientKeyShares = await this.getClientKeySharesFromLocalStorage({
+                accountAddress
+            });
+            const refreshResults = await Promise.all(clientKeyShares.map((clientKeyShare)=>mpcSigner.refresh(roomId, clientKeyShare)));
+            await this.setClientKeySharesToLocalStorage({
+                accountAddress,
+                clientKeyShares: refreshResults,
+                overwriteOrMerge: 'overwrite'
+            });
+            await this.storeEncryptedBackupByWallet({
+                accountAddress,
+                password: password != null ? password : this.environmentId,
+                signedSessionId
+            });
+        } catch (error) {
+            logError({
+                message: 'Error in refreshWalletAccountShares',
+                error: error,
+                context: _extends({
+                    accountAddress,
+                    chainName,
+                    dynamicRequestId
+                }, this.getTraceContext(traceContext))
+            });
+            throw error;
+        }
     }
     async getExportId({ chainName, clientKeyShare }) {
         const mpcSigner = getMPCSigner({
@@ -980,105 +1476,277 @@ class DynamicWalletClient {
             existingClientKeyShares
         };
     }
-    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined }) {
-        await this.verifyPassword({
+    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, backupToGoogleDrive = false, delegateToProjectEnvironment = false, mfaToken, revokeDelegation = false }) {
+        const dynamicRequestId = uuid.v4();
+        try {
+            await this.verifyPassword({
+                accountAddress,
+                password,
+                walletOperation: core.WalletOperation.RESHARE,
+                signedSessionId
+            });
+            const { existingClientShareCount } = core.getReshareConfig({
+                oldThresholdSignatureScheme,
+                newThresholdSignatureScheme
+            });
+            const wallet = await this.getWallet({
+                accountAddress,
+                walletOperation: core.WalletOperation.NO_OPERATION,
+                shareCount: existingClientShareCount,
+                password,
+                signedSessionId
+            });
+            const { newClientInitKeygenResults, newClientKeygenIds, existingClientKeygenIds, existingClientKeyShares } = await this.reshareStrategy({
+                chainName,
+                accountAddress,
+                wallet,
+                oldThresholdSignatureScheme,
+                newThresholdSignatureScheme
+            });
+            const clientKeygenIds = [
+                ...newClientKeygenIds,
+                ...existingClientKeygenIds
+            ];
+            // Server to create the room and complete the server reshare logics
+            const data = await this.apiClient.reshare({
+                walletId: wallet.walletId,
+                clientKeygenIds: clientKeygenIds,
+                oldThresholdSignatureScheme,
+                newThresholdSignatureScheme,
+                dynamicRequestId,
+                delegateToProjectEnvironment,
+                mfaToken,
+                revokeDelegation
+            });
+            const { roomId, serverKeygenIds, newServerKeygenIds = [] } = data;
+            // Get the MPC config for the threshold signature scheme
+            const oldMpcConfig = core.MPC_CONFIG[oldThresholdSignatureScheme];
+            const newMpcConfig = core.MPC_CONFIG[newThresholdSignatureScheme];
+            const allPartyKeygenIds = [
+                ...clientKeygenIds,
+                ...serverKeygenIds,
+                ...newServerKeygenIds
+            ];
+            const mpcSigner = getMPCSigner({
+                chainName,
+                baseRelayUrl: this.baseMPCRelayApiUrl
+            });
+            const existingResharePromises = existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newMpcConfig.threshold, keyShare, allPartyKeygenIds));
+            const newResharePromises = newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldMpcConfig.threshold, newMpcConfig.threshold, keygenResult, allPartyKeygenIds));
+            // Run both share parties in parallel by group
+            const [existingReshareResults, newReshareResults] = await Promise.all([
+                Promise.all(existingResharePromises),
+                Promise.all(newResharePromises)
+            ]);
+            const clientKeysharesToLocalStorage = delegateToProjectEnvironment ? [
+                ...existingReshareResults
+            ] : [
+                ...existingReshareResults,
+                ...newReshareResults
+            ];
+            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+                thresholdSignatureScheme: newThresholdSignatureScheme
+            });
+            // store client key shares to localStorage
+            await this.setClientKeySharesToLocalStorage({
+                accountAddress,
+                clientKeyShares: clientKeysharesToLocalStorage,
+                overwriteOrMerge: 'overwrite'
+            });
+            const allClientShares = [
+                ...existingReshareResults,
+                ...newReshareResults
+            ];
+            let distribution;
+            if (delegateToProjectEnvironment && backupToGoogleDrive) {
+                // Delegation + Google Drive: Client's existing share backs up to both Dynamic and Google Drive.
+                // The new share goes to the webhook for delegation.
+                distribution = createDelegationWithGoogleDriveDistribution({
+                    existingShares: existingReshareResults,
+                    delegatedShare: newReshareResults[0]
+                });
+            } else if (delegateToProjectEnvironment) {
+                // Delegation only: Client's existing share backs up to Dynamic.
+                // The new share goes to the webhook for delegation. No Google Drive backup.
+                distribution = createDelegationOnlyDistribution({
+                    existingShares: existingReshareResults,
+                    delegatedShare: newReshareResults[0]
+                });
+            } else if (backupToGoogleDrive) {
+                // Google Drive only: Split shares between Dynamic (N-1) and Google Drive (1).
+                // The last share (new share) goes to Google Drive.
+                distribution = createGoogleDriveOnlyDistribution({
+                    allShares: allClientShares
+                });
+            } else {
+                // No delegation, no Google Drive: All shares go to Dynamic backend only.
+                distribution = createDynamicOnlyDistribution({
+                    allShares: allClientShares
+                });
+            }
+            await this.backupSharesWithDistribution({
+                accountAddress,
+                password,
+                signedSessionId,
+                distribution
+            });
+        } catch (error) {
+            logError({
+                message: 'Error in reshare, resetting wallet to previous state',
+                error: error,
+                context: {
+                    accountAddress,
+                    chainName,
+                    oldThresholdSignatureScheme,
+                    newThresholdSignatureScheme,
+                    backupToGoogleDrive,
+                    dynamicRequestId
+                }
+            });
+            // reset user wallet when reshare fails, this would allow the client to recover wallets from an active state
+            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+                thresholdSignatureScheme: oldThresholdSignatureScheme
+            });
+            await this.setClientKeySharesToLocalStorage({
+                accountAddress,
+                clientKeyShares: [],
+                overwriteOrMerge: 'overwrite'
+            });
+            throw error;
+        }
+    }
+    async performDelegationOperation({ accountAddress, password, signedSessionId, mfaToken, newThresholdSignatureScheme, revokeDelegation = false, operationName }) {
+        try {
+            var _this_walletMap_accountAddress;
+            const delegateToProjectEnvironment = this.featureFlags && this.featureFlags[core.FEATURE_FLAGS.ENABLE_DELEGATED_KEY_SHARES_FLAG] === true;
+            if (!delegateToProjectEnvironment) {
+                throw new Error('Delegation is not allowed for this project environment');
+            }
+            const wallet = await this.getWallet({
+                accountAddress,
+                walletOperation: core.WalletOperation.REACH_ALL_PARTIES,
+                password,
+                signedSessionId
+            });
+            if (wallet.chainName === 'SUI') {
+                throw new Error('Delegation is not allowed for SUI');
+            }
+            const currentThresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
+            await this.reshare({
+                chainName: this.walletMap[accountAddress].chainName,
+                accountAddress,
+                oldThresholdSignatureScheme: currentThresholdSignatureScheme,
+                newThresholdSignatureScheme,
+                password,
+                signedSessionId,
+                backupToGoogleDrive: hasGoogleDriveBackup((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.clientKeySharesBackupInfo),
+                delegateToProjectEnvironment: true,
+                mfaToken,
+                revokeDelegation
+            });
+        } catch (error) {
+            logError({
+                message: `Error in ${operationName}`,
+                error: error,
+                context: {
+                    accountAddress
+                }
+            });
+            throw error;
+        }
+    }
+    async delegateKeyShares({ accountAddress, password = undefined, signedSessionId, mfaToken }) {
+        await this.performDelegationOperation({
             accountAddress,
             password,
-            walletOperation: core.WalletOperation.RESHARE
-        });
-        const { existingClientShareCount } = core.getReshareConfig({
-            oldThresholdSignatureScheme,
-            newThresholdSignatureScheme
-        });
-        const wallet = await this.getWallet({
-            accountAddress,
-            walletOperation: core.WalletOperation.NO_OPERATION,
-            shareCount: existingClientShareCount,
-            password
-        });
-        const { newClientInitKeygenResults, newClientKeygenIds, existingClientKeygenIds, existingClientKeyShares } = await this.reshareStrategy({
-            chainName,
-            accountAddress,
-            wallet,
-            oldThresholdSignatureScheme,
-            newThresholdSignatureScheme
-        });
-        const clientKeygenIds = [
-            ...newClientKeygenIds,
-            ...existingClientKeygenIds
-        ];
-        // Server to create the room and complete the server reshare logics
-        const data = await this.apiClient.reshare({
-            walletId: wallet.walletId,
-            clientKeygenIds: clientKeygenIds,
-            oldThresholdSignatureScheme,
-            newThresholdSignatureScheme
-        });
-        const { roomId, serverKeygenIds, newServerKeygenIds = [] } = data;
-        // Get the MPC config for the threshold signature scheme
-        const oldMpcConfig = core.MPC_CONFIG[oldThresholdSignatureScheme];
-        const newMpcConfig = core.MPC_CONFIG[newThresholdSignatureScheme];
-        const allPartyKeygenIds = [
-            ...clientKeygenIds,
-            ...serverKeygenIds,
-            ...newServerKeygenIds
-        ];
-        const mpcSigner = getMPCSigner({
-            chainName,
-            baseRelayUrl: this.baseMPCRelayApiUrl
-        });
-        const reshareResults = await Promise.all([
-            ...newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldMpcConfig.threshold, newMpcConfig.threshold, keygenResult, allPartyKeygenIds)),
-            ...existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newMpcConfig.threshold, keyShare, allPartyKeygenIds))
-        ]);
-        await this.setClientKeySharesToLocalStorage({
-            accountAddress,
-            clientKeyShares: reshareResults,
-            overwriteOrMerge: 'overwrite'
+            signedSessionId,
+            mfaToken,
+            newThresholdSignatureScheme: core.ThresholdSignatureScheme.TWO_OF_THREE,
+            operationName: 'delegateKeyShares'
         });
-        await this.storeEncryptedBackupByWallet({
-            accountAddress,
-            password
-        });
-        return reshareResults;
+        const backupInfo = this.walletMap[accountAddress].clientKeySharesBackupInfo;
+        const delegatedKeyShares = backupInfo.backups[core.BackupLocation.DELEGATED] || [];
+        return delegatedKeyShares;
     }
-    async exportKey({ accountAddress, displayContainer, chainName, password = undefined }) {
-        const wallet = await this.getWallet({
+    async revokeDelegation({ accountAddress, password = undefined, signedSessionId, mfaToken }) {
+        await this.performDelegationOperation({
             accountAddress,
             password,
-            walletOperation: core.WalletOperation.EXPORT_PRIVATE_KEY
-        });
-        const mpcSigner = getMPCSigner({
-            chainName,
-            baseRelayUrl: this.baseMPCRelayApiUrl
-        });
-        const clientKeyShares = await this.getClientKeySharesFromLocalStorage({
-            accountAddress
+            signedSessionId,
+            mfaToken,
+            newThresholdSignatureScheme: core.ThresholdSignatureScheme.TWO_OF_TWO,
+            revokeDelegation: true,
+            operationName: 'revokeDelegation'
         });
-        const exportId = await this.getExportId({
-            chainName,
-            clientKeyShare: clientKeyShares[0]
-        });
-        const data = await this.apiClient.exportKey({
-            walletId: wallet.walletId,
-            exportId
-        });
-        const keyExportRaw = await mpcSigner.exportFullPrivateKey(data.roomId, clientKeyShares[0], exportId);
-        if (!keyExportRaw) {
-            throw new Error('Error exporting private key');
-        }
-        const derivationPath = wallet.derivationPath && wallet.derivationPath != '' ? new Uint32Array(Object.values(JSON.parse(wallet.derivationPath))) : undefined;
-        let derivedPrivateKey;
-        if (mpcSigner instanceof web.Ecdsa) {
-            derivedPrivateKey = await mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, derivationPath);
-        } else if (mpcSigner instanceof web.Ed25519) {
-            derivedPrivateKey = keyExportRaw;
-        } else if (mpcSigner instanceof web.BIP340) {
-            derivedPrivateKey = await mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, derivationPath);
+    }
+    async exportKey({ accountAddress, chainName, password = undefined, signedSessionId, mfaToken, traceContext }) {
+        const dynamicRequestId = uuid.v4();
+        try {
+            const wallet = await this.getWallet({
+                accountAddress,
+                password,
+                walletOperation: core.WalletOperation.EXPORT_PRIVATE_KEY,
+                signedSessionId
+            });
+            const mpcSigner = getMPCSigner({
+                chainName,
+                baseRelayUrl: this.baseMPCRelayApiUrl
+            });
+            const clientKeyShares = await this.getClientKeySharesFromLocalStorage({
+                accountAddress
+            });
+            const exportId = await this.getExportId({
+                chainName,
+                clientKeyShare: clientKeyShares[0]
+            });
+            const data = await this.apiClient.exportKey({
+                walletId: wallet.walletId,
+                exportId,
+                dynamicRequestId,
+                mfaToken
+            });
+            this.logger.debug('[DynamicWaasWalletClient] Starting export of private key', _extends({
+                accountAddress,
+                chainName,
+                walletId: wallet.walletId,
+                exportId,
+                roomId: data.roomId
+            }, this.getTraceContext(traceContext)));
+            const keyExportRaw = await mpcSigner.exportFullPrivateKey(data.roomId, clientKeyShares[0], exportId);
+            if (!keyExportRaw) {
+                throw new Error('Error exporting private key');
+            }
+            this.logger.debug('[DynamicWaasWalletClient] Completed export of private key', _extends({
+                accountAddress,
+                chainName,
+                walletId: wallet.walletId,
+                exportId,
+                roomId: data.roomId
+            }, this.getTraceContext(traceContext)));
+            const derivationPath = wallet.derivationPath && wallet.derivationPath != '' ? new Uint32Array(Object.values(JSON.parse(wallet.derivationPath))) : undefined;
+            let derivedPrivateKey;
+            if (mpcSigner instanceof web.Ecdsa) {
+                derivedPrivateKey = await mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, derivationPath);
+            } else if (mpcSigner instanceof web.ExportableEd25519) {
+                derivedPrivateKey = keyExportRaw;
+            } else if (mpcSigner instanceof web.BIP340) {
+                derivedPrivateKey = await mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, derivationPath);
+            }
+            return {
+                derivedPrivateKey
+            };
+        } catch (error) {
+            logError({
+                message: 'Error in exportKey',
+                error: error,
+                context: _extends({
+                    accountAddress,
+                    chainName,
+                    dynamicRequestId
+                }, this.getTraceContext(traceContext))
+            });
+            throw error;
         }
-        return {
-            derivedPrivateKey
-        };
     }
     async offlineExportKey({ chainName, keyShares, derivationPath }) {
         try {
@@ -1090,7 +1758,7 @@ class DynamicWalletClient {
                 baseRelayUrl: this.baseMPCRelayApiUrl
             });
             const walletKeyShares = keyShares.map((keyShare)=>{
-                return mpcSigner instanceof web.Ecdsa ? new web.EcdsaKeygenResult(keyShare.pubkey, keyShare.secretShare) : mpcSigner instanceof web.Ed25519 ? new web.Ed25519KeygenResult(keyShare.pubkey, keyShare.secretShare) : new web.BIP340KeygenResult(keyShare.pubkey, keyShare.secretShare);
+                return mpcSigner instanceof web.Ecdsa ? new web.EcdsaKeygenResult(keyShare.pubkey, keyShare.secretShare) : mpcSigner instanceof web.ExportableEd25519 ? new web.ExportableEd25519KeygenResult(keyShare.pubkey, keyShare.secretShare) : new web.BIP340KeygenResult(keyShare.pubkey, keyShare.secretShare);
             });
             const keyExportRaw = await mpcSigner.offlineExportFullPrivateKey(walletKeyShares);
             if (!keyExportRaw) {
@@ -1101,7 +1769,7 @@ class DynamicWalletClient {
             let derivedPrivateKey;
             if (mpcSigner instanceof web.Ecdsa) {
                 derivedPrivateKey = await mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, walletDerivationPath);
-            } else if (mpcSigner instanceof web.Ed25519) {
+            } else if (mpcSigner instanceof web.ExportableEd25519) {
                 derivedPrivateKey = keyExportRaw;
             } else if (mpcSigner instanceof web.BIP340) {
                 derivedPrivateKey = await mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, walletDerivationPath);
@@ -1116,7 +1784,13 @@ class DynamicWalletClient {
                 rawPublicKey
             };
         } catch (error) {
-            this.logger.error('Error in offlineExportKey:', error);
+            logError({
+                message: 'Error in offlineExportKey',
+                error: error,
+                context: {
+                    chainName
+                }
+            });
             throw error;
         }
     }
@@ -1133,117 +1807,265 @@ class DynamicWalletClient {
     /**
    * helper function to store encrypted backup by wallet from iframe local storage
    */ async getClientKeySharesFromLocalStorage({ accountAddress }) {
-        var _this_iframeStorage;
-        await this.initializeIframeCommunication();
-        const walletObject = await ((_this_iframeStorage = this.iframeStorage) == null ? void 0 : _this_iframeStorage.getItem(accountAddress));
+        var _this_storage;
+        const walletObject = await ((_this_storage = this.storage) == null ? void 0 : _this_storage.getItem(accountAddress));
         if (!walletObject) {
-            this.logger.debug(`No item found in iframe local storage for accountAddress: ${accountAddress}`);
+            this.logger.debug(`[DynamicWaasWalletClient] No item found in iframe local storage for accountAddress: ${accountAddress}`);
             return [];
         }
         try {
-            return (walletObject == null ? void 0 : walletObject.clientKeyShares) || [];
+            let parsedWalletObject;
+            if (typeof walletObject === 'string') {
+                parsedWalletObject = JSON.parse(walletObject);
+            } else {
+                parsedWalletObject = walletObject;
+            }
+            return (parsedWalletObject == null ? void 0 : parsedWalletObject.clientKeyShares) || [];
         } catch (error) {
-            this.logger.error(`Error parsing clientKeyShares: ${error} for accountAddress: ${accountAddress}`);
+            logError({
+                message: `Error parsing clientKeyShares: Error for accountAddress:`,
+                error: error,
+                context: {
+                    accountAddress
+                }
+            });
             return [];
         }
     }
     /**
    * helper function to store encrypted backup by wallet from iframe local storage
    */ async setClientKeySharesToLocalStorage({ accountAddress, clientKeyShares, overwriteOrMerge = 'merge' }) {
-        var _this_iframeStorage;
-        await this.initializeIframeCommunication();
-        await ((_this_iframeStorage = this.iframeStorage) == null ? void 0 : _this_iframeStorage.setItem(accountAddress, {
+        var _this_storage;
+        const stringifiedClientKeyShares = JSON.stringify({
             clientKeyShares: overwriteOrMerge === 'overwrite' ? clientKeyShares : mergeUniqueKeyShares(await this.getClientKeySharesFromLocalStorage({
                 accountAddress
             }), clientKeyShares)
-        }));
+        });
+        await ((_this_storage = this.storage) == null ? void 0 : _this_storage.setItem(accountAddress, stringifiedClientKeyShares));
+    }
+    async backupSharesWithDistribution({ accountAddress, password, signedSessionId, distribution, preserveDelegatedLocation = false }) {
+        const dynamicRequestId = uuid.v4();
+        try {
+            var _this_walletMap_accountAddress;
+            if (!((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.walletId)) {
+                const error = new Error(`WalletId not found for accountAddress ${accountAddress}`);
+                logError({
+                    message: 'Error in backupSharesWithDistribution, wallet or walletId not found from the wallet map',
+                    error,
+                    context: {
+                        accountAddress,
+                        walletMap: this.walletMap
+                    }
+                });
+                throw error;
+            }
+            const locations = [];
+            if (distribution.dynamicBackendShares.length > 0) {
+                const encryptedDynamicShares = await Promise.all(distribution.dynamicBackendShares.map((keyShare)=>this.encryptKeyShare({
+                        keyShare,
+                        password
+                    })));
+                const data = await this.apiClient.storeEncryptedBackupByWallet({
+                    walletId: this.walletMap[accountAddress].walletId,
+                    encryptedKeyShares: encryptedDynamicShares,
+                    passwordEncrypted: Boolean(password) && password !== this.environmentId,
+                    encryptionVersion: ENCRYPTION_VERSION_CURRENT,
+                    signedSessionId,
+                    authMode: this.authMode,
+                    requiresSignedSessionId: this.requiresSignedSessionId(),
+                    dynamicRequestId
+                });
+                if (data.keyShareIds.length === 0) {
+                    throw new Error('No key shares were backed up to Dynamic backend');
+                }
+                locations.push({
+                    location: core.BackupLocation.DYNAMIC,
+                    externalKeyShareId: data.keyShareIds[0]
+                });
+            }
+            if (distribution.googleDriveShares.length > 0) {
+                const encryptedGoogleDriveShares = await Promise.all(distribution.googleDriveShares.map((keyShare)=>this.encryptKeyShare({
+                        keyShare,
+                        password
+                    })));
+                await this.uploadKeySharesToGoogleDrive({
+                    accountAddress,
+                    encryptedKeyShares: encryptedGoogleDriveShares
+                });
+                locations.push({
+                    location: core.BackupLocation.GOOGLE_DRIVE
+                });
+            }
+            if (distribution.delegatedShare) {
+                var _publicKey_key, _publicKey_key1, _publicKey_key2;
+                const publicKey = await this.apiClient.getDelegatedEncryptionKey({
+                    environmentId: this.environmentId
+                });
+                if (!(publicKey == null ? void 0 : (_publicKey_key = publicKey.key) == null ? void 0 : _publicKey_key.publicKeyPemB64)) {
+                    throw new Error('Public key not found');
+                }
+                var _publicKey_key_keyId;
+                const encryptedDelegatedKeyShareEnvelope = await encryptDelegatedKeyShare(JSON.stringify(distribution.delegatedShare), publicKey == null ? void 0 : (_publicKey_key1 = publicKey.key) == null ? void 0 : _publicKey_key1.publicKeyPemB64, (_publicKey_key_keyId = publicKey == null ? void 0 : (_publicKey_key2 = publicKey.key) == null ? void 0 : _publicKey_key2.keyId) != null ? _publicKey_key_keyId : publicKey == null ? void 0 : publicKey.keyId);
+                const { status } = await this.apiClient.publishDelegatedKeyShare({
+                    walletId: this.walletMap[accountAddress].walletId,
+                    encryptedKeyShare: encryptedDelegatedKeyShareEnvelope,
+                    signedSessionId,
+                    requiresSignedSessionId: this.requiresSignedSessionId(),
+                    dynamicRequestId
+                });
+                if (status !== 200) {
+                    throw new Error('Failed to publish delegated key share');
+                }
+                locations.push({
+                    location: core.BackupLocation.DELEGATED
+                });
+            }
+            // Preserve existing delegated location without re-publishing
+            if (preserveDelegatedLocation && !distribution.delegatedShare) {
+                locations.push({
+                    location: core.BackupLocation.DELEGATED
+                });
+            }
+            const backupData = await this.apiClient.markKeySharesAsBackedUp({
+                walletId: this.walletMap[accountAddress].walletId,
+                locations,
+                dynamicRequestId
+            });
+            const updatedBackupInfo = getClientKeyShareBackupInfo({
+                walletProperties: {
+                    derivationPath: this.walletMap[accountAddress].derivationPath,
+                    keyShares: backupData.locationsWithKeyShares.map((ks)=>({
+                            id: ks.keyShareId,
+                            backupLocation: ks.location,
+                            externalKeyShareId: ks.externalKeyShareId,
+                            passwordEncrypted: Boolean(password) && password !== this.environmentId
+                        })),
+                    thresholdSignatureScheme: this.walletMap[accountAddress].thresholdSignatureScheme
+                }
+            });
+            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+                clientKeySharesBackupInfo: updatedBackupInfo
+            });
+            await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
+            return backupData;
+        } catch (error) {
+            logError({
+                message: 'Error in backupSharesWithDistribution',
+                error: error,
+                context: {
+                    accountAddress,
+                    dynamicRequestId
+                }
+            });
+            throw error;
+        }
     }
     /**
-   * Encrypts and stores wallet key shares as backups.
+   * Central backup orchestrator that encrypts and stores wallet key shares.
    *
-   * This method encrypts all client key shares for a specific wallet and stores them
-   * in Dynamic's backend. If Google Drive backup is already configured for this wallet,
-   * it will also update the backup in Google Drive.
+   * This method serves as the main backup coordinator, handling the distribution of encrypted
+   * key shares between Dynamic's backend and Google Drive based on the wallet's threshold scheme.
+   * It is used by multiple operations including reshare, refresh, and manual backup requests.
    *
-   * The method performs the following steps:
+   * **Backup Distribution Strategy:**
+   * - **Single share wallets**: All shares stored on Dynamic's backend only
+   * - **Multi-share wallets (2+)**: When backing up to Google Drive, N-1 shares on Dynamic's backend, 1 share on Google Drive
+   * - **Multi-share wallets (2+)**: When not backing up to Google Drive, all shares on Dynamic's backend
+   *
+   * **Process Flow:**
    * 1. Encrypts all client key shares with the provided password (or environment ID if no password)
-   * 2. Stores the encrypted key shares in Dynamic's backend
-   * 3. If Google Drive backup exists, updates the backup there as well
-   * 4. Updates the local wallet map with the new backup information
-   * 5. Persists the updated wallet map to storage
+   * 2. For multi-share wallets (2+): conditionally distributes N-1 to backend, 1 to Google Drive
+   * 3. For other configurations: stores all shares on Dynamic's backend
+   * 4. Updates backup metadata and synchronizes wallet state
+   * 5. Persists the updated wallet map to local storage
+   *
+   * **Delegated Key Shares:**
+   * - When delegatedKeyshare is provided, the method will not store the delegated key share but it will mark the delegated share as backed up on Dynamic's backend
+   * - and encrypt the delegated key share to publish it to the webhook
    *
-   * @param {Object} params - The parameters for the backup operation
-   * @param {string} params.accountAddress - The account address of the wallet to backup
-   * @param {string} [params.password] - Optional password for encrypting the key shares
-   */ async storeEncryptedBackupByWallet({ accountAddress, clientKeyShares = undefined, password = undefined }) {
+   * @param params - The backup operation parameters
+   * @param params.accountAddress - The account address of the wallet to backup
+   * @param params.clientKeyShares - Optional specific key shares to backup (uses localStorage if not provided)
+   * @param params.password - Optional password for encryption (uses environment ID if not provided)
+   * @param params.signedSessionId - Optional signed session ID for authentication
+   * @param params.backupToGoogleDrive - Whether to backup to Google Drive (defaults to false)
+   * @returns Promise with backup metadata including share locations and IDs
+   */ async storeEncryptedBackupByWallet({ accountAddress, clientKeyShares = undefined, password = undefined, signedSessionId, backupToGoogleDrive = false, delegatedKeyshare = undefined }) {
+        var _this_walletMap_accountAddress, _this_walletMap_accountAddress1;
         const keySharesToBackup = clientKeyShares != null ? clientKeyShares : await this.getClientKeySharesFromLocalStorage({
             accountAddress
         });
-        const encryptedKeyShares = await Promise.all(keySharesToBackup.map((keyShare)=>this.encryptKeyShare({
-                keyShare,
-                password
-            })));
-        if (!this.walletMap[accountAddress].walletId) {
-            throw new Error(`WalletId not found for accountAddress: ${accountAddress}`);
-        }
-        const data = await this.apiClient.storeEncryptedBackupByWallet({
-            walletId: this.walletMap[accountAddress].walletId,
-            encryptedKeyShares,
-            passwordEncrypted: Boolean(password) && password !== this.environmentId
-        });
-        const hasGoogleDriveBackup = this.walletMap[accountAddress].clientKeySharesBackupInfo.backups[core.BackupLocation.GOOGLE_DRIVE].length > 0;
-        if (hasGoogleDriveBackup) {
-            var _user_verifiedCredentials_find;
-            const user = await this.apiClient.getUser();
-            const oauthAccountId = user == null ? void 0 : (_user_verifiedCredentials_find = user.verifiedCredentials.find((credential)=>credential.oauthProvider === 'google')) == null ? void 0 : _user_verifiedCredentials_find.id;
-            const googleDriveKeyShareIds = await this.backupKeySharesToGoogleDrive({
-                accountAddress,
-                password,
-                oauthAccountId
+        const shouldBackupToGoogleDrive = backupToGoogleDrive || hasGoogleDriveBackup((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.clientKeySharesBackupInfo);
+        const hasExistingDelegation = hasDelegatedBackup((_this_walletMap_accountAddress1 = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress1.clientKeySharesBackupInfo);
+        let distribution;
+        let preserveDelegatedLocation = false;
+        if (delegatedKeyshare && shouldBackupToGoogleDrive) {
+            // NEW delegation + Google Drive: Client's shares back up to both Dynamic and Google Drive.
+            // The delegated share goes to the webhook.
+            distribution = createDelegationWithGoogleDriveDistribution({
+                existingShares: keySharesToBackup,
+                delegatedShare: delegatedKeyshare
             });
-            data.keyShares.push({
-                backupLocation: core.BackupLocation.GOOGLE_DRIVE,
-                id: googleDriveKeyShareIds
+        } else if (delegatedKeyshare) {
+            // NEW delegation only: Client's shares back up to Dynamic.
+            // The delegated share goes to the webhook. No Google Drive backup.
+            distribution = createDelegationOnlyDistribution({
+                existingShares: keySharesToBackup,
+                delegatedShare: delegatedKeyshare
+            });
+        } else if (hasExistingDelegation && shouldBackupToGoogleDrive) {
+            // ADD Google Drive to EXISTING delegation: Client's share backs up to both Dynamic and GD.
+            // Don't re-publish delegated share, just preserve the location.
+            distribution = createAddGoogleDriveToExistingDelegationDistribution({
+                clientShares: keySharesToBackup
+            });
+            preserveDelegatedLocation = true;
+        } else if (shouldBackupToGoogleDrive && keySharesToBackup.length >= 2) {
+            // Google Drive only (no delegation): Split shares between Dynamic (N-1) and Google Drive (1).
+            distribution = createGoogleDriveOnlyDistribution({
+                allShares: keySharesToBackup
+            });
+        } else {
+            // No delegation, no Google Drive: All shares go to Dynamic backend only.
+            distribution = createDynamicOnlyDistribution({
+                allShares: keySharesToBackup
             });
         }
-        const updatedBackupInfo = getClientKeyShareBackupInfo({
-            walletProperties: {
-                derivationPath: this.walletMap[accountAddress].derivationPath,
-                keyShares: data.keyShares,
-                thresholdSignatureScheme: this.walletMap[accountAddress].thresholdSignatureScheme
-            }
+        const backupData = await this.backupSharesWithDistribution({
+            accountAddress,
+            password,
+            signedSessionId,
+            distribution,
+            preserveDelegatedLocation
         });
-        this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
-            clientKeySharesBackupInfo: updatedBackupInfo
+        return _extends({}, backupData, {
+            keyShareIds: backupData.locationsWithKeyShares.map((ks)=>ks.keyShareId)
         });
-        await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
-        return data;
     }
-    async storeEncryptedBackupByWalletWithRetry({ accountAddress, clientKeyShares, password }) {
+    async storeEncryptedBackupByWalletWithRetry({ accountAddress, clientKeyShares, password, signedSessionId }) {
         await retryPromise(()=>this.storeEncryptedBackupByWallet({
                 accountAddress,
                 clientKeyShares,
-                password
+                password,
+                signedSessionId
             }), {
             operationName: 'store encrypted backup',
             logContext: {
-                walletAddress: accountAddress,
-                keyShares: clientKeyShares == null ? void 0 : clientKeyShares.map((keyShare)=>this.encryptKeyShare({
-                        keyShare,
-                        password
-                    }))
+                walletAddress: accountAddress
             }
         });
     }
-    async updatePassword({ accountAddress, existingPassword, newPassword }) {
+    async updatePassword({ accountAddress, existingPassword, newPassword, signedSessionId }) {
         await this.getWallet({
             accountAddress,
             password: existingPassword,
-            walletOperation: core.WalletOperation.REACH_ALL_PARTIES
+            walletOperation: core.WalletOperation.REACH_ALL_PARTIES,
+            signedSessionId
         });
         await this.storeEncryptedBackupByWallet({
             accountAddress,
-            password: newPassword
+            password: newPassword,
+            signedSessionId
         });
     }
     async decryptKeyShare({ keyShare, password }) {
@@ -1256,6 +2078,41 @@ class DynamicWalletClient {
         return deserializedKeyShare;
     }
     /**
+   * Helper function to get Google OAuth Account ID or throw an error if not found.
+   * @param accountAddress - The account address for logging purposes
+   * @returns The Google OAuth Account ID
+   * @throws Error if no Google OAuth account ID is found
+   */ async getGoogleOauthAccountIdOrThrow(accountAddress) {
+        const dynamicRequestId = uuid.v4();
+        try {
+            const user = await this.apiClient.getUser(dynamicRequestId);
+            const oauthAccountId = getGoogleOAuthAccountId(user == null ? void 0 : user.verifiedCredentials);
+            if (!oauthAccountId) {
+                const error = new Error('No Google OAuth account ID found');
+                logError({
+                    message: 'No Google OAuth account ID found',
+                    error,
+                    context: {
+                        user,
+                        accountAddress
+                    }
+                });
+                throw error;
+            }
+            return oauthAccountId;
+        } catch (error) {
+            logError({
+                message: 'Error in getGoogleOauthAccountIdOrThrow',
+                error: error,
+                context: {
+                    accountAddress,
+                    dynamicRequestId
+                }
+            });
+            throw error;
+        }
+    }
+    /**
    * Helper function to determine keyshare recovery strategy for dynamic shares.
    * For REFRESH operations, retrieves enough shares to meet the client threshold.
    * For all other operations, retrieves just 1 share.
@@ -1277,39 +2134,58 @@ class DynamicWalletClient {
         const dynamicShares = backups[core.BackupLocation.DYNAMIC].slice(0, requiredShareCount);
         return {
             shares: {
-                [core.BackupLocation.DYNAMIC]: dynamicShares
+                [core.BackupLocation.DYNAMIC]: dynamicShares.map((ks)=>{
+                    var _ks_externalKeyShareId, _ref;
+                    return (_ref = (_ks_externalKeyShareId = ks.externalKeyShareId) != null ? _ks_externalKeyShareId : ks.keyShareId) != null ? _ref : '';
+                })
             },
             requiredShareCount
         };
     }
-    async recoverEncryptedBackupByWallet({ accountAddress, password, walletOperation, shareCount = undefined, storeRecoveredShares = true }) {
-        const wallet = this.walletMap[accountAddress];
-        this.logger.debug(`recoverEncryptedBackupByWallet wallet: ${walletOperation}`, wallet);
-        const { shares } = this.recoverStrategy({
-            clientKeyShareBackupInfo: wallet.clientKeySharesBackupInfo,
-            thresholdSignatureScheme: wallet.thresholdSignatureScheme,
-            walletOperation,
-            shareCount
-        });
-        const { dynamic: dynamicKeyShareIds } = shares;
-        const data = await this.apiClient.recoverEncryptedBackupByWallet({
-            walletId: wallet.walletId,
-            keyShareIds: dynamicKeyShareIds
-        });
-        const dynamicKeyShares = data.keyShares.filter((keyShare)=>keyShare.encryptedAccountCredential !== null && keyShare.backupLocation === core.BackupLocation.DYNAMIC);
-        const decryptedKeyShares = await Promise.all(dynamicKeyShares.map((keyShare)=>this.decryptKeyShare({
-                keyShare: keyShare.encryptedAccountCredential,
-                password: password != null ? password : this.environmentId
-            })));
-        if (storeRecoveredShares) {
-            await this.setClientKeySharesToLocalStorage({
-                accountAddress,
-                clientKeyShares: decryptedKeyShares,
-                overwriteOrMerge: 'merge'
+    async recoverEncryptedBackupByWallet({ accountAddress, password, walletOperation, signedSessionId, shareCount = undefined, storeRecoveredShares = true, mfaToken }) {
+        try {
+            const wallet = this.walletMap[accountAddress];
+            this.logger.debug(`recoverEncryptedBackupByWallet wallet: ${walletOperation}`, wallet);
+            const { shares } = this.recoverStrategy({
+                clientKeyShareBackupInfo: wallet.clientKeySharesBackupInfo,
+                thresholdSignatureScheme: wallet.thresholdSignatureScheme,
+                walletOperation,
+                shareCount
             });
-            await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
+            const { dynamic: dynamicKeyShareIds } = shares;
+            const data = await this.apiClient.recoverEncryptedBackupByWallet({
+                walletId: wallet.walletId,
+                keyShareIds: dynamicKeyShareIds,
+                signedSessionId,
+                mfaToken,
+                requiresSignedSessionId: this.requiresSignedSessionId()
+            });
+            const dynamicKeyShares = data.keyShares.filter((keyShare)=>keyShare.encryptedAccountCredential !== null && keyShare.backupLocation === core.BackupLocation.DYNAMIC);
+            const decryptedKeyShares = await Promise.all(dynamicKeyShares.map((keyShare)=>this.decryptKeyShare({
+                    keyShare: keyShare.encryptedAccountCredential,
+                    password: password != null ? password : this.environmentId
+                })));
+            if (storeRecoveredShares) {
+                await this.setClientKeySharesToLocalStorage({
+                    accountAddress,
+                    clientKeyShares: decryptedKeyShares,
+                    overwriteOrMerge: 'merge'
+                });
+                await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
+            }
+            return decryptedKeyShares;
+        } catch (error) {
+            logError({
+                message: 'Error in recoverEncryptedBackupByWallet',
+                error: error,
+                context: {
+                    accountAddress,
+                    walletOperation,
+                    shareCount
+                }
+            });
+            throw error;
         }
-        return decryptedKeyShares;
     }
     async restoreWallets() {
         const wallets = await this.storage.getItem(this.storageKey);
@@ -1318,114 +2194,207 @@ class DynamicWalletClient {
         }
         this.walletMap = JSON.parse(wallets);
     }
-    async backupKeySharesToGoogleDrive({ accountAddress, fileName, oauthAccountId, password }) {
-        await this.getWallet({
-            accountAddress,
-            walletOperation: core.WalletOperation.REACH_ALL_PARTIES,
-            password
-        });
-        const clientKeyShares = await this.getClientKeySharesFromLocalStorage({
-            accountAddress
-        });
-        if (clientKeyShares.length === 0) {
-            throw new Error('No key shares found');
-        }
-        const encryptedKeyShares = await Promise.all(clientKeyShares.map((keyShare)=>this.encryptKeyShare({
-                keyShare,
-                password
-            })));
-        const accessToken = await this.apiClient.getAccessToken({
-            oauthAccountId
-        });
-        const thresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
-        const suggestedFileName = getClientKeyShareExportFileName({
-            thresholdSignatureScheme,
-            accountAddress
-        });
-        const backupData = {
-            keyShares: encryptedKeyShares,
-            metadata: {
-                version: '1.0',
-                createdAt: new Date().toISOString(),
+    /**
+   * This method handles the complete flow for ensuring wallet key shares are backed up to Google Drive:
+   * - For 2-of-2 wallets: Automatically reshares to 2-of-3 threshold, then distributes shares (1 to backend, 1 to Google Drive)
+   * - For 2-of-3 wallets: Call storeEncryptedBackupByWallet to backup for backend and Google Drive
+   *
+   * @param params - The backup parameters
+   * @param params.accountAddress - The wallet account address to backup
+   * @param params.password - Optional password for encryption (uses environment ID if not provided)
+   * @param params.signedSessionId - Optional signed session ID for authentication
+   * @returns Promise<string[]> - Array of Google Drive key share IDs that were backed up
+   */ async backupKeySharesToGoogleDrive({ accountAddress, password, signedSessionId }) {
+        try {
+            await this.getWallet({
                 accountAddress,
-                thresholdSignatureScheme,
-                hasPassword: true,
-                encryption: {
-                    algorithm: AES_GCM_ALGORITHM,
-                    keyDerivation: PBKDF2_ALGORITHM,
-                    iterations: PBKDF2_ITERATIONS,
-                    hashAlgorithm: PBKDF2_HASH_ALGORITHM,
-                    algorithmLength: AES_GCM_LENGTH
-                },
-                shareCount: encryptedKeyShares.length
+                walletOperation: core.WalletOperation.REACH_ALL_PARTIES,
+                password,
+                signedSessionId
+            });
+            const currentThresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
+            if (currentThresholdSignatureScheme === core.ThresholdSignatureScheme.TWO_OF_TWO) {
+                // Reshare to 2-of-3, which will automatically handle the backup distribution
+                await this.reshare({
+                    chainName: this.walletMap[accountAddress].chainName,
+                    accountAddress,
+                    oldThresholdSignatureScheme: currentThresholdSignatureScheme,
+                    newThresholdSignatureScheme: core.ThresholdSignatureScheme.TWO_OF_THREE,
+                    password,
+                    signedSessionId,
+                    backupToGoogleDrive: true
+                });
+                const backupInfo = this.walletMap[accountAddress].clientKeySharesBackupInfo;
+                const googleDriveShares = backupInfo.backups[core.BackupLocation.GOOGLE_DRIVE] || [];
+                return googleDriveShares.map((ks)=>{
+                    var _ks_externalKeyShareId;
+                    return (_ks_externalKeyShareId = ks.externalKeyShareId) != null ? _ks_externalKeyShareId : '';
+                });
+            } else {
+                await this.storeEncryptedBackupByWallet({
+                    accountAddress,
+                    password,
+                    signedSessionId,
+                    backupToGoogleDrive: true
+                });
+                const backupInfo = this.walletMap[accountAddress].clientKeySharesBackupInfo;
+                const googleDriveShares = backupInfo.backups[core.BackupLocation.GOOGLE_DRIVE] || [];
+                return googleDriveShares.map((ks)=>{
+                    var _ks_externalKeyShareId;
+                    return (_ks_externalKeyShareId = ks.externalKeyShareId) != null ? _ks_externalKeyShareId : '';
+                });
             }
-        };
-        // TODO: handle errors
-        await Promise.all([
-            uploadFileToGoogleDriveAppStorage({
-                accessToken,
-                fileName: fileName != null ? fileName : suggestedFileName,
-                jsonData: backupData
-            }),
-            uploadFileToGoogleDrivePersonal({
-                accessToken,
-                fileName: fileName != null ? fileName : suggestedFileName,
-                jsonData: backupData
-            })
-        ]);
-        const data = await this.apiClient.markKeySharesAsBackedUpGoogleDrive({
-            walletId: this.walletMap[accountAddress].walletId
-        });
-        const ids = data.keyShares.map((keyShare)=>keyShare.id);
-        this.walletMap[accountAddress].clientKeySharesBackupInfo.backups[core.BackupLocation.GOOGLE_DRIVE] = ids;
-        await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
-        return ids;
+        } catch (error) {
+            logError({
+                message: 'Error in backupKeySharesToGoogleDrive',
+                error: error,
+                context: {
+                    accountAddress
+                }
+            });
+            throw error;
+        }
     }
-    async restoreBackupFromGoogleDrive({ accountAddress, oauthAccountId, name, displayContainer, password }) {
-        await this.getWallet({
-            accountAddress
-        });
-        const accessToken = await this.apiClient.getAccessToken({
-            oauthAccountId
-        });
-        const thresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
-        const suggestedFileName = getClientKeyShareExportFileName({
-            thresholdSignatureScheme,
-            accountAddress
-        });
-        const backupData = await downloadFileFromGoogleDrive({
-            accessToken,
-            name: name != null ? name : suggestedFileName
-        });
-        if (!backupData) {
-            throw new Error('No backup file found');
+    /**
+   * This method handles only the Google Drive upload mechanics without any reshare logic.
+   * It encrypts the provided key shares, uploads them to Google Drive, and updates the
+   * backup metadata. This method is intended for internal use by storeEncryptedBackupByWallet
+   * and should not be called directly from external code.
+   *
+   * @param params - The upload parameters
+   * @param params.accountAddress - The wallet account address
+   * @param params.password - Optional password for encryption (uses environment ID if not provided)
+   * @param params.encryptedKeyShares - The specific key shares to upload to Google Drive
+   * @returns Promise<string[]> - Array of Google Drive key share IDs that were uploaded
+   */ async uploadKeySharesToGoogleDrive({ accountAddress, encryptedKeyShares }) {
+        try {
+            if (encryptedKeyShares.length === 0) {
+                throw new Error('No key shares found');
+            }
+            const oauthAccountId = await this.getGoogleOauthAccountIdOrThrow(accountAddress);
+            const accessToken = await this.apiClient.getAccessToken({
+                oauthAccountId
+            });
+            const thresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
+            const fileName = getClientKeyShareExportFileName({
+                thresholdSignatureScheme,
+                accountAddress,
+                isGoogleDrive: true
+            });
+            const backupData = createBackupData({
+                encryptedKeyShares,
+                accountAddress,
+                thresholdSignatureScheme
+            });
+            await uploadBackupToGoogleDrive({
+                accessToken,
+                fileName,
+                backupData,
+                accountAddress
+            });
+            return;
+        } catch (error) {
+            logError({
+                message: 'Error in backupKeySharesToGoogleDrive',
+                error: error,
+                context: {
+                    accountAddress
+                }
+            });
+            throw error;
         }
-        // Validate the backup data structure
-        if (!backupData.keyShares || !backupData.metadata) {
-            throw new Error('Invalid backup format: missing keyShares or metadata');
+    }
+    async exportClientKeysharesFromGoogleDrive({ accountAddress, password, signedSessionId }) {
+        try {
+            await this.getWallet({
+                accountAddress,
+                signedSessionId
+            });
+            const oauthAccountId = await this.getGoogleOauthAccountIdOrThrow(accountAddress);
+            const accessToken = await this.apiClient.getAccessToken({
+                oauthAccountId
+            });
+            const thresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
+            const backupFileName = getClientKeyShareExportFileName({
+                thresholdSignatureScheme,
+                accountAddress,
+                isGoogleDrive: true
+            });
+            let backupData = null;
+            try {
+                backupData = await retryPromise(()=>downloadFileFromGoogleDrive({
+                        accessToken,
+                        fileName: backupFileName
+                    }));
+            } catch (error) {
+                logError({
+                    message: 'Failed to download backup from Google Drive',
+                    error: error,
+                    context: {
+                        accountAddress,
+                        fileName: backupFileName
+                    }
+                });
+                throw error;
+            }
+            if (!backupData) {
+                const error = new Error('No backup file found');
+                logError({
+                    message: 'No backup file found',
+                    error: new Error('No backup file found'),
+                    context: {
+                        accountAddress,
+                        fileName: backupFileName
+                    }
+                });
+                throw error;
+            }
+            // Validate the backup data structure
+            if (!backupData.keyShares || !backupData.metadata) {
+                const error = new Error('Invalid backup format: missing keyShares or metadata');
+                logError({
+                    message: 'Invalid backup format: missing keyShares or metadata',
+                    error,
+                    context: {
+                        accountAddress,
+                        fileName: backupFileName
+                    }
+                });
+                throw error;
+            }
+            const { keyShares } = backupData;
+            const decryptedKeyShares = await Promise.all(keyShares.map((keyShare)=>this.decryptKeyShare({
+                    keyShare,
+                    password
+                })));
+            const text = JSON.stringify(decryptedKeyShares, null, 2);
+            const exportFileName = getClientKeyShareExportFileName({
+                thresholdSignatureScheme,
+                accountAddress,
+                isGoogleDrive: true
+            });
+            downloadStringAsFile({
+                filename: exportFileName,
+                content: text,
+                mimeType: 'application/json'
+            });
+        } catch (error) {
+            logError({
+                message: 'Error in exportClientKeysharesFromGoogleDrive',
+                error: error,
+                context: {
+                    accountAddress
+                }
+            });
+            throw error;
         }
-        const { keyShares } = backupData;
-        const decryptedKeyShares = await Promise.all(keyShares.map((keyShare)=>this.decryptKeyShare({
-                keyShare,
-                password
-            })));
-        await this.setClientKeySharesToLocalStorage({
-            accountAddress,
-            clientKeyShares: decryptedKeyShares,
-            overwriteOrMerge: 'merge'
-        });
-        // Display the client shares in the container via iframe
-        const { iframeDisplay } = await this.initializeIframeDisplayForContainer({
-            container: displayContainer
-        });
-        iframeDisplay.displayClientShares(accountAddress);
-        return decryptedKeyShares;
     }
-    async exportClientKeyshares({ accountAddress, password }) {
+    async exportClientKeyshares({ accountAddress, password, signedSessionId }) {
         await this.verifyPassword({
             accountAddress,
             password,
-            walletOperation: core.WalletOperation.REACH_ALL_PARTIES
+            walletOperation: core.WalletOperation.REACH_ALL_PARTIES,
+            signedSessionId
         });
         const clientKeyShares = await this.getClientKeySharesFromLocalStorage({
             accountAddress
@@ -1438,22 +2407,18 @@ class DynamicWalletClient {
             keyShares: clientKeyShares,
             derivationPath
         });
-        const blob = new Blob([
-            text
-        ], {
-            type: 'text/plain'
+        downloadStringAsFile({
+            filename: `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${accountAddress}.txt`,
+            content: text,
+            mimeType: 'text/plain'
         });
-        const url = URL.createObjectURL(blob);
-        const a = document.createElement('a');
-        a.href = url;
-        a.download = `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${accountAddress}.txt`;
-        a.click();
     }
-    async getClientKeyShares({ accountAddress, password }) {
+    async getClientKeyShares({ accountAddress, password, signedSessionId }) {
         await this.getWallet({
             accountAddress,
             password,
-            walletOperation: core.WalletOperation.REACH_THRESHOLD
+            walletOperation: core.WalletOperation.REACH_THRESHOLD,
+            signedSessionId
         });
         return this.getClientKeySharesFromLocalStorage({
             accountAddress
@@ -1506,11 +2471,12 @@ class DynamicWalletClient {
    * verifyPassword attempts to recover and decrypt a single client key share using the provided password.
    * If successful, the key share is encrypted with the new password. This method solely performs the recovery
    * and decryption without storing the restored key shares. If unsuccessful, it throws an error.
-   */ async verifyPassword({ accountAddress, password = undefined, walletOperation = core.WalletOperation.NO_OPERATION }) {
+   */ async verifyPassword({ accountAddress, password = undefined, walletOperation = core.WalletOperation.NO_OPERATION, signedSessionId }) {
         await this.getWallet({
             accountAddress,
             password,
-            walletOperation
+            walletOperation,
+            signedSessionId
         });
         if (await this.requiresPasswordForOperation({
             accountAddress,
@@ -1530,16 +2496,24 @@ class DynamicWalletClient {
             throw new Error('No dynamic key shares found');
         }
         try {
+            // TODO(zfaizal2): throw error if signedSessionId is not provided after service deploy
             await this.recoverEncryptedBackupByWallet({
                 accountAddress,
                 password,
                 walletOperation,
                 shareCount: 1,
-                storeRecoveredShares: false
+                storeRecoveredShares: false,
+                signedSessionId
             });
         } catch (error) {
-            this.logger.error('Error in verifying password', error);
-            throw new Error('Incorrect password');
+            logError({
+                message: 'Error in verifyPassword',
+                error: error,
+                context: {
+                    accountAddress
+                }
+            });
+            throw error;
         }
     }
     async isPasswordEncrypted({ accountAddress }) {
@@ -1585,127 +2559,204 @@ class DynamicWalletClient {
         return true;
     }
     async getWalletClientKeyShareBackupInfo({ accountAddress }) {
-        var _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups, _this_walletMap_accountAddress_clientKeySharesBackupInfo, _this_walletMap_accountAddress, _user_verifiedCredentials;
-        // Return existing backup info if it exists
-        if (((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo = _this_walletMap_accountAddress.clientKeySharesBackupInfo) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups = _this_walletMap_accountAddress_clientKeySharesBackupInfo.backups) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC = _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups[core.BackupLocation.DYNAMIC]) == null ? void 0 : _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC.length) > 0) {
-            return this.walletMap[accountAddress].clientKeySharesBackupInfo;
+        const dynamicRequestId = uuid.v4();
+        try {
+            var _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups, _this_walletMap_accountAddress_clientKeySharesBackupInfo, _this_walletMap_accountAddress, _user_verifiedCredentials;
+            // Return existing backup info if it exists
+            if (((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo = _this_walletMap_accountAddress.clientKeySharesBackupInfo) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups = _this_walletMap_accountAddress_clientKeySharesBackupInfo.backups) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC = _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups[core.BackupLocation.DYNAMIC]) == null ? void 0 : _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC.length) > 0) {
+                return this.walletMap[accountAddress].clientKeySharesBackupInfo;
+            }
+            // Get backup info from server
+            const user = await this.apiClient.getUser(dynamicRequestId);
+            const wallet = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.find((vc)=>vc.address.toLowerCase() === accountAddress.toLowerCase());
+            return getClientKeyShareBackupInfo({
+                walletProperties: wallet == null ? void 0 : wallet.walletProperties
+            });
+        } catch (error) {
+            logError({
+                message: 'Error in getWalletClientKeyShareBackupInfo',
+                error: error,
+                context: {
+                    accountAddress,
+                    dynamicRequestId
+                }
+            });
+            throw error;
         }
-        // Get backup info from server
-        const user = await this.apiClient.getUser();
-        const wallet = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.find((vc)=>vc.address.toLowerCase() === accountAddress.toLowerCase());
-        return getClientKeyShareBackupInfo({
-            walletProperties: wallet == null ? void 0 : wallet.walletProperties
-        });
     }
-    async getWallet({ accountAddress, walletOperation = core.WalletOperation.NO_OPERATION, shareCount = undefined, password = undefined }) {
-        var _user_verifiedCredentials;
-        const existingWalletCheck = await this.checkWalletFields({
-            accountAddress,
-            walletOperation,
-            shareCount
-        });
-        if (existingWalletCheck) {
-            this.logger.debug(`Wallet ${accountAddress} already exists`);
-            return this.walletMap[accountAddress];
-        }
-        // Fetch and restore wallet from server
-        const user = await this.apiClient.getUser();
-        const wallet = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.find((vc)=>vc.address.toLowerCase() === accountAddress.toLowerCase());
-        this.logger.debug('Restoring wallet', wallet);
-        const walletProperties = wallet.walletProperties;
-        this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
-            walletId: wallet.id,
-            chainName: wallet.chainName,
-            accountAddress,
-            thresholdSignatureScheme: walletProperties.thresholdSignatureScheme,
-            derivationPath: walletProperties.derivationPath,
-            clientKeySharesBackupInfo: getClientKeyShareBackupInfo({
-                walletProperties
-            })
-        });
-        if (walletOperation !== core.WalletOperation.NO_OPERATION && await this.requiresRestoreBackupSharesForOperation({
-            accountAddress,
-            walletOperation
-        })) {
-            const decryptedKeyShares = await this.recoverEncryptedBackupByWallet({
+    async getWallet({ accountAddress, walletOperation = core.WalletOperation.NO_OPERATION, shareCount = undefined, password = undefined, signedSessionId }) {
+        const dynamicRequestId = uuid.v4();
+        try {
+            var _user_verifiedCredentials;
+            const existingWalletCheck = await this.checkWalletFields({
                 accountAddress,
-                password: password != null ? password : this.environmentId,
-                walletOperation: walletOperation,
+                walletOperation,
                 shareCount
             });
-            const existingKeyShares = await this.getClientKeySharesFromLocalStorage({
-                accountAddress
+            if (existingWalletCheck) {
+                this.logger.debug(`[DynamicWaasWalletClient] Wallet ${accountAddress} already exists`);
+                return this.walletMap[accountAddress];
+            }
+            // Fetch and restore wallet from server
+            const user = await this.apiClient.getUser(dynamicRequestId);
+            const wallet = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.find((vc)=>vc.address.toLowerCase() === accountAddress.toLowerCase());
+            this.logger.debug('[DynamicWaasWalletClient] Restoring wallet', wallet);
+            const walletProperties = wallet.walletProperties;
+            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+                walletId: wallet.id,
+                chainName: core.verifiedCredentialNameToChainEnum[wallet.chain],
+                accountAddress,
+                thresholdSignatureScheme: walletProperties.thresholdSignatureScheme,
+                derivationPath: walletProperties.derivationPath,
+                clientKeySharesBackupInfo: getClientKeyShareBackupInfo({
+                    walletProperties
+                })
             });
-            await this.setClientKeySharesToLocalStorage({
+            if (walletOperation !== core.WalletOperation.NO_OPERATION && await this.requiresRestoreBackupSharesForOperation({
                 accountAddress,
-                clientKeyShares: mergeUniqueKeyShares(existingKeyShares, decryptedKeyShares)
+                walletOperation
+            })) {
+                // TODO(zfaizal2): throw error if signedSessionId is not provided after service deploy
+                const decryptedKeyShares = await this.recoverEncryptedBackupByWallet({
+                    accountAddress,
+                    password: password != null ? password : this.environmentId,
+                    walletOperation: walletOperation,
+                    signedSessionId,
+                    shareCount
+                });
+                const existingKeyShares = await this.getClientKeySharesFromLocalStorage({
+                    accountAddress
+                });
+                await this.setClientKeySharesToLocalStorage({
+                    accountAddress,
+                    clientKeyShares: mergeUniqueKeyShares(existingKeyShares, decryptedKeyShares)
+                });
+                this.logger.debug('[DynamicWaasWalletClient] Recovered backup', decryptedKeyShares);
+            }
+            const walletCount = Object.keys(this.walletMap).length;
+            if (walletCount === 0) {
+                throw new Error('No wallets found');
+            }
+            // Return the only wallet if there's just one
+            if (walletCount === 1) {
+                return Object.values(this.walletMap)[0];
+            }
+            return this.walletMap[accountAddress];
+        } catch (error) {
+            logError({
+                message: 'Error in getWallet',
+                error: error,
+                context: {
+                    accountAddress,
+                    walletOperation,
+                    shareCount,
+                    dynamicRequestId
+                }
             });
-            this.logger.debug('Recovered backup', decryptedKeyShares);
-        }
-        const walletCount = Object.keys(this.walletMap).length;
-        if (walletCount === 0) {
-            throw new Error('No wallets found');
-        }
-        // Return the only wallet if there's just one
-        if (walletCount === 1) {
-            return Object.values(this.walletMap)[0];
+            throw error;
         }
-        return this.walletMap[accountAddress];
     }
     async getWallets() {
-        var _user_verifiedCredentials;
-        const user = await this.apiClient.getUser();
-        const waasWallets = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.filter((vc)=>vc.walletName === 'dynamicwaas');
-        const wallets = waasWallets.map((vc)=>{
-            var _this_walletMap_vc_address, _vc_walletProperties;
-            var _this_walletMap_vc_address_derivationPath;
-            return {
-                walletId: vc.id,
-                chainName: vc.chain,
-                accountAddress: vc.address,
-                clientKeySharesBackupInfo: getClientKeyShareBackupInfo({
-                    walletProperties: vc.walletProperties || {}
-                }),
-                derivationPath: (_this_walletMap_vc_address_derivationPath = (_this_walletMap_vc_address = this.walletMap[vc.address]) == null ? void 0 : _this_walletMap_vc_address.derivationPath) != null ? _this_walletMap_vc_address_derivationPath : undefined,
-                thresholdSignatureScheme: (_vc_walletProperties = vc.walletProperties) == null ? void 0 : _vc_walletProperties.thresholdSignatureScheme
-            };
-        });
-        this.walletMap = wallets.reduce((acc, wallet)=>{
-            var _acc_accountAddress;
-            const accountAddress = wallet.accountAddress;
-            acc[wallet.accountAddress] = {
-                walletId: wallet.walletId,
-                chainName: wallet.chainName,
-                accountAddress: wallet.accountAddress,
-                clientKeySharesBackupInfo: wallet.clientKeySharesBackupInfo,
-                derivationPath: ((_acc_accountAddress = acc[accountAddress]) == null ? void 0 : _acc_accountAddress.derivationPath) || undefined,
-                thresholdSignatureScheme: wallet.thresholdSignatureScheme
-            };
-            return acc;
-        }, {});
-        return wallets;
+        const dynamicRequestId = uuid.v4();
+        try {
+            var _user_verifiedCredentials;
+            const user = await this.apiClient.getUser(dynamicRequestId);
+            this.userId = user.id;
+            const waasWallets = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.filter((vc)=>vc.walletName === 'dynamicwaas');
+            const wallets = waasWallets.map((vc)=>{
+                var _this_walletMap_vc_address, _vc_walletProperties;
+                var _this_walletMap_vc_address_derivationPath;
+                return {
+                    walletId: vc.id,
+                    chainName: vc.chain,
+                    accountAddress: vc.address,
+                    clientKeySharesBackupInfo: getClientKeyShareBackupInfo({
+                        walletProperties: vc.walletProperties || {}
+                    }),
+                    derivationPath: (_this_walletMap_vc_address_derivationPath = (_this_walletMap_vc_address = this.walletMap[vc.address]) == null ? void 0 : _this_walletMap_vc_address.derivationPath) != null ? _this_walletMap_vc_address_derivationPath : undefined,
+                    thresholdSignatureScheme: (_vc_walletProperties = vc.walletProperties) == null ? void 0 : _vc_walletProperties.thresholdSignatureScheme
+                };
+            });
+            this.walletMap = wallets.reduce((acc, wallet)=>{
+                var _acc_accountAddress;
+                const accountAddress = wallet.accountAddress;
+                acc[wallet.accountAddress] = {
+                    walletId: wallet.walletId,
+                    chainName: wallet.chainName,
+                    accountAddress: wallet.accountAddress,
+                    clientKeySharesBackupInfo: wallet.clientKeySharesBackupInfo,
+                    derivationPath: ((_acc_accountAddress = acc[accountAddress]) == null ? void 0 : _acc_accountAddress.derivationPath) || undefined,
+                    thresholdSignatureScheme: wallet.thresholdSignatureScheme
+                };
+                return acc;
+            }, {});
+            return wallets;
+        } catch (error) {
+            logError({
+                message: 'Error in getWallets',
+                error: error,
+                context: {
+                    dynamicRequestId
+                }
+            });
+            throw error;
+        }
+    }
+    /**
+   * sync auth token with api client
+   * @param authToken - auth token to sync
+   */ syncAuthToken(authToken) {
+        if (this.authMode === core.AuthMode.COOKIE) {
+            return;
+        }
+        this.apiClient.syncAuthToken(authToken);
     }
-    constructor({ environmentId, authToken, baseApiUrl, baseMPCRelayApiUrl, storageKey, debug }){
+    /**
+   * Helper method to instrument with automatic properties inclusion
+   */ instrument(message, context) {
+        const defaultContext = {
+            environmentId: context.environmentId || this.environmentId
+        };
+        this.logger.debug(message, _extends({}, defaultContext, context));
+        this.logger.instrument(message, _extends({}, defaultContext, context));
+    }
+    getTraceContext(traceContext) {
+        const now = Date.now();
+        return _extends({
+            now,
+            time: (traceContext == null ? void 0 : traceContext.startTime) ? now - traceContext.startTime : 0
+        }, traceContext);
+    }
+    constructor({ environmentId, baseApiUrl, baseMPCRelayApiUrl, storageKey, debug, featureFlags, authMode = core.AuthMode.HEADER, authToken = undefined, // Represents the version of the client SDK used by developer
+    sdkVersion, forwardMPCClient, baseClientKeysharesRelayApiUrl }){
+        this.userId = undefined;
+        this.sessionId = undefined;
         this.initializePromise = null;
         this.logger = logger;
         this.walletMap = {} // todo: store in session storage
         ;
-        this.iframeStorage = null;
-        this.iframeDisplay = null;
         this.memoryStorage = null;
-        this.messageTransport = null;
         this.iframe = null;
-        this.iframeLoadPromise = null;
+        this.forwardMPCEnabled = false;
+        this.featureFlags = {};
         this.environmentId = environmentId;
         this.storageKey = `${STORAGE_KEY}-${storageKey != null ? storageKey : environmentId}`;
         this.baseMPCRelayApiUrl = baseMPCRelayApiUrl;
+        this.authMode = authMode;
+        this.sdkVersion = sdkVersion;
+        this.baseClientKeysharesRelayApiUrl = baseClientKeysharesRelayApiUrl;
         this.apiClient = new core.DynamicApiClient({
             environmentId,
             authToken,
-            baseApiUrl
+            baseApiUrl,
+            authMode,
+            sdkVersion,
+            forwardMPCClient,
+            baseClientKeysharesRelayApiUrl
         });
         this.debug = Boolean(debug);
-        this.logger.setLogLevel(this.debug ? 'DEBUG' : DEFAULT_LOG_LEVEL);
+        this.logger.setLogLevel(this.debug ? logger$1.LogLevel.DEBUG : DEFAULT_LOG_LEVEL);
+        this.featureFlags = featureFlags || {};
         // setup storage
         if (supportsLocalStorage()) {
             this.storage = localStorageAdapter;
@@ -1713,15 +2764,32 @@ class DynamicWalletClient {
             this.memoryStorage = {};
             this.storage = memoryLocalStorageAdapter(this.memoryStorage);
         }
-        // TODO: handle prod and preprod iframe domains
-        this.iframeDomain = core.IFRAME_DOMAIN_PREPROD;
+        const environment = core.getEnvironmentFromUrl(baseApiUrl);
+        this.iframeDomain = core.IFRAME_DOMAIN_MAP[environment];
         // Generate unique instanceId when client is created
-        this.instanceId = crypto.randomUUID();
-        // initialize the client
-        this.initialize();
+        this.instanceId = uuid.v4();
+        // initialize logger context
+        if (authMode === core.AuthMode.HEADER && authToken) {
+            this.initLoggerContext(authToken);
+        }
+        this.forwardMPCEnabled = this.featureFlags && this.featureFlags[core.FEATURE_FLAGS.ENABLE_FORWARD_MPC_CLIENT_FLAG] === true;
+        // if forwardMPCEnabled is true and forwardMPCClient is not provided, initialize the forwardMPCClient
+        if (this.forwardMPCEnabled && !forwardMPCClient) {
+            this.initializeForwardMPCClient();
+        }
     }
 }
 
+const ERROR_KEYGEN_FAILED = '[DynamicWaasWalletClient]: Error with keygen';
+const ERROR_CREATE_WALLET_ACCOUNT = '[DynamicWaasWalletClient]: Error creating wallet account';
+const ERROR_SIGN_MESSAGE = '[DynamicWaasWalletClient]: Error signing message';
+const ERROR_SIGN_TYPED_DATA = '[DynamicWaasWalletClient]: Error signing typed data';
+const ERROR_ACCOUNT_ADDRESS_REQUIRED = '[DynamicWaasWalletClient]: Account address is required';
+const ERROR_VERIFY_MESSAGE_SIGNATURE = '[DynamicWaasWalletClient]: Error verifying message signature';
+const ERROR_VERIFY_TRANSACTION_SIGNATURE = '[DynamicWaasWalletClient]: Error verifying transaction signature';
+const ERROR_EXPORT_PRIVATE_KEY = '[DynamicWaasWalletClient]: Error exporting private key';
+const ERROR_IMPORT_PRIVATE_KEY = '[DynamicWaasWalletClient]: Error importing private key';
+
 Object.defineProperty(exports, "BIP340", {
     enumerable: true,
     get: function () { return web.BIP340; }
@@ -1770,19 +2838,40 @@ Object.defineProperty(exports, "MessageHash", {
     enumerable: true,
     get: function () { return web.MessageHash; }
 });
+Object.defineProperty(exports, "Logger", {
+    enumerable: true,
+    get: function () { return logger$1.Logger; }
+});
 exports.DynamicWalletClient = DynamicWalletClient;
-exports.base64ToBytes = base64ToBytes;
-exports.bytesToBase64 = bytesToBase64;
-exports.ensureBase64Padding = ensureBase64Padding;
+exports.ERROR_ACCOUNT_ADDRESS_REQUIRED = ERROR_ACCOUNT_ADDRESS_REQUIRED;
+exports.ERROR_CREATE_WALLET_ACCOUNT = ERROR_CREATE_WALLET_ACCOUNT;
+exports.ERROR_EXPORT_PRIVATE_KEY = ERROR_EXPORT_PRIVATE_KEY;
+exports.ERROR_IMPORT_PRIVATE_KEY = ERROR_IMPORT_PRIVATE_KEY;
+exports.ERROR_KEYGEN_FAILED = ERROR_KEYGEN_FAILED;
+exports.ERROR_SIGN_MESSAGE = ERROR_SIGN_MESSAGE;
+exports.ERROR_SIGN_TYPED_DATA = ERROR_SIGN_TYPED_DATA;
+exports.ERROR_VERIFY_MESSAGE_SIGNATURE = ERROR_VERIFY_MESSAGE_SIGNATURE;
+exports.ERROR_VERIFY_TRANSACTION_SIGNATURE = ERROR_VERIFY_TRANSACTION_SIGNATURE;
+exports.createAddGoogleDriveToExistingDelegationDistribution = createAddGoogleDriveToExistingDelegationDistribution;
+exports.createBackupData = createBackupData;
+exports.createDelegationOnlyDistribution = createDelegationOnlyDistribution;
+exports.createDelegationWithGoogleDriveDistribution = createDelegationWithGoogleDriveDistribution;
+exports.createDynamicOnlyDistribution = createDynamicOnlyDistribution;
+exports.createGoogleDriveOnlyDistribution = createGoogleDriveOnlyDistribution;
+exports.downloadStringAsFile = downloadStringAsFile;
+exports.formatEvmMessage = formatEvmMessage;
+exports.formatMessage = formatMessage;
 exports.getClientKeyShareBackupInfo = getClientKeyShareBackupInfo;
 exports.getClientKeyShareExportFileName = getClientKeyShareExportFileName;
+exports.getGoogleOAuthAccountId = getGoogleOAuthAccountId;
 exports.getMPCSignatureScheme = getMPCSignatureScheme;
 exports.getMPCSigner = getMPCSigner;
+exports.hasDelegatedBackup = hasDelegatedBackup;
+exports.hasGoogleDriveBackup = hasGoogleDriveBackup;
 exports.isBrowser = isBrowser;
 exports.isHexString = isHexString;
 exports.mergeUniqueKeyShares = mergeUniqueKeyShares;
 exports.retryPromise = retryPromise;
-exports.stringToBytes = stringToBytes;
 exports.timeoutPromise = timeoutPromise;
 Object.keys(core).forEach(function (k) {
     if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {