@dynamic-labs-wallet/browser 1.0.92 → 1.0.94

package/index.cjs

@@ -9,6 +9,8 @@ var loadArgon2idWasm = require('argon2id');
 var axios = require('axios');
 var gte = require('semver/functions/gte');
 var PQueue = require('p-queue');
+var ed25519 = require('@noble/curves/ed25519');
+var utils = require('@noble/curves/abstract/utils');
 
 function _extends() {
     _extends = Object.assign || function assign(target) {
@@ -78,12 +80,17 @@ function _extends() {
             return undefined;
     }
 };
-const getMPCSignatureScheme = ({ signingAlgorithm, baseRelayUrl = core.MPC_RELAY_PROD_API_URL })=>{
+const getMPCSignatureScheme = ({ signingAlgorithm, baseRelayUrl = core.MPC_RELAY_PROD_API_URL, variant = core.DEFAULT_ED25519_VARIANT })=>{
     switch(signingAlgorithm){
         case primitives.SigningAlgorithm.ECDSA:
             return new web.Ecdsa(baseRelayUrl);
         case primitives.SigningAlgorithm.ED25519:
-            return new web.ExportableEd25519(baseRelayUrl);
+            // `Ed25519` (non-exportable) and `ExportableEd25519` are distinct protocol
+            // classes with incompatible keyshare formats. Downstream `instanceof`
+            // dispatch (createWalletAccount / importPrivateKey / derive*) always tests
+            // `ExportableEd25519` before `Ed25519` — most-specific-first — so it stays
+            // correct even if `ExportableEd25519` were a subclass of `Ed25519`.
+            return variant === 'ed25519Standard' ? new web.Ed25519(baseRelayUrl) : new web.ExportableEd25519(baseRelayUrl);
         case primitives.SigningAlgorithm.BIP340:
             return new web.BIP340(baseRelayUrl);
         case primitives.SigningAlgorithm.EDBLS12_377:
@@ -92,11 +99,12 @@ const getMPCSignatureScheme = ({ signingAlgorithm, baseRelayUrl = core.MPC_RELAY
             throw new Error(`Unsupported signing algorithm: ${signingAlgorithm}`);
     }
 };
-const getMPCSigner = ({ chainName, baseRelayUrl, bitcoinConfig })=>{
+const getMPCSigner = ({ chainName, baseRelayUrl, bitcoinConfig, variant })=>{
     const chainConfig = core.getMPCChainConfig(chainName, bitcoinConfig);
     const signatureScheme = getMPCSignatureScheme({
         signingAlgorithm: chainConfig.signingAlgorithm,
-        baseRelayUrl
+        baseRelayUrl,
+        variant
     });
     return signatureScheme;
 };
@@ -1486,6 +1494,37 @@ const NON_RETRYABLE_CEREMONY_ERROR_MESSAGES = [
     ERROR_INCORRECT_PASSWORD,
     ERROR_MULTIPLE_WALLETS_PER_CHAIN
 ];
+/**
+ * True when the backend rejected a create because the user already has a wallet
+ * on that chain — an expected business-rule outcome, not a system failure.
+ *
+ * The string never appears on `error.message`: the backend returns it in the 400
+ * response body as `{ existingWalletId, error: '<this string>' }`, so an
+ * `AxiosError` carries axios's own "Request failed with status code 400" message
+ * and `handleAxiosError` maps the status to "Invalid request". `WalletApiError`
+ * does preserve the body value, but on `code` (via `extractServerErrorCode`),
+ * not `message`. A `.message` comparison therefore never matches, which is why
+ * the intended downgrade at the keyGen catch site had never fired in production.
+ *
+ * `WalletApiError` is matched on `name` as well as `instanceof`, for the reason
+ * documented on `getWalletApiErrorStatus` in services/logger.ts: core is inlined
+ * into more than one bundle, so a second copy of the class defeats `instanceof`.
+ * A foreign copy has no `response.data` and the generic "Invalid request"
+ * message, so an instanceof-only check misses every branch below.
+ */ const isMultipleWalletsPerChainRejection = (error)=>{
+    var _error_response;
+    const isWalletApiError = error instanceof core.WalletApiError || error instanceof Error && error.name === 'WalletApiError';
+    if (isWalletApiError && error.code === ERROR_MULTIPLE_WALLETS_PER_CHAIN) return true;
+    // Raw AxiosError: the rejection reaches the keyGen catch before
+    // `handleAxiosError` has converted it, so read the response body directly.
+    const body = error == null ? void 0 : (_error_response = error.response) == null ? void 0 : _error_response.data;
+    if (body && typeof body === 'object' && body['error'] === ERROR_MULTIPLE_WALLETS_PER_CHAIN) {
+        return true;
+    }
+    // SSE transport assigns the body onto a plain Error.
+    if ((error == null ? void 0 : error.error) === ERROR_MULTIPLE_WALLETS_PER_CHAIN) return true;
+    return error instanceof Error && error.message === ERROR_MULTIPLE_WALLETS_PER_CHAIN;
+};
 /**
  * Marks an error as non-retryable in place so `retryPromise` will skip
  * remaining attempts. Used at ceremony retry boundaries.
@@ -2281,14 +2320,33 @@ const classifyOne = (error)=>{
     return fallback;
 };
 const MAX_DESCRIBED_LENGTH = 200;
+/**
+ * Keys safe to echo when a thrown object exposes no recognised message field.
+ * Deliberately an allowlist: the alternative — serialising the whole object —
+ * cannot be made safe, because a thrown MPC signer rejection or API body may
+ * carry key-share material, a raw transaction body or an auth token.
+ */ const SAFE_DETAIL_KEYS = [
+    'status',
+    'statusCode',
+    'code',
+    'error_code',
+    'errorCode',
+    'name',
+    'type'
+];
+const isScalar = (value)=>typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean';
 /**
  * Builds a human-readable message for a thrown value that is not an `Error` —
  * most often an API response body, e.g.
  * `{ existingWalletId, error: 'Multiple wallets per chain not allowed' }`.
  *
  * `String(value)` would collapse that to `[object Object]`, losing the only
- * diagnostic content it had, so prefer a recognisable message field and fall
- * back to bounded JSON.
+ * diagnostic content it had, so a recognised message field is preferred.
+ *
+ * Never serialises an unrecognised object wholesale. Where no message field
+ * exists, only `SAFE_DETAIL_KEYS` scalars are echoed, and failing that a fixed
+ * placeholder — so a value carrying secrets can never reach the logging backend
+ * just because it lacked a `message`.
  */ const describeNonError = (value)=>{
     if (typeof value === 'string') return value.slice(0, MAX_DESCRIBED_LENGTH);
     if (value !== null && typeof value === 'object') {
@@ -2299,11 +2357,8 @@ const MAX_DESCRIBED_LENGTH = 200;
             record['detail']
         ].find((candidate)=>typeof candidate === 'string' && candidate.length > 0);
         if (named) return named.slice(0, MAX_DESCRIBED_LENGTH);
-        try {
-            return JSON.stringify(value).slice(0, MAX_DESCRIBED_LENGTH);
-        } catch (e) {
-        // Circular or non-serialisable — fall through to String().
-        }
+        const safeDetails = SAFE_DETAIL_KEYS.filter((key)=>isScalar(record[key])).map((key)=>`${key}=${String(record[key])}`);
+        return safeDetails.length > 0 ? safeDetails.join(' ').slice(0, MAX_DESCRIBED_LENGTH) : 'Non-Error value thrown with no recognised message field';
     }
     return String(value).slice(0, MAX_DESCRIBED_LENGTH);
 };
@@ -2319,27 +2374,38 @@ const MAX_DESCRIBED_LENGTH = 200;
  * under `operationError` instead, and a real `Error` is synthesised so the log
  * still gets a stack and an `error.kind`.
  *
+ * A non-`Error` is recorded as its bounded `describeNonError` description only,
+ * never the raw value — the same rule `logError` applies when it logs a cause as
+ * `{ name, message }` — while `operationError` remains its own attribute so "the
+ * thrown value was not an Error" stays queryable.
+ *
  * Returned as a plain object so this is unit-testable without constructing a
  * wallet client (which pulls the MPC WASM bundle).
  */ const buildOperationFailureLog = (error)=>{
     // Classify the original value: an Error's `cause` chain carries the severity,
     // and normalising first would discard it.
     const level = resolveLogLevel(error, 'error');
-    return error instanceof Error ? {
+    if (error instanceof Error) return {
         level,
         context: undefined,
         error
-    } : {
+    };
+    const described = describeNonError(error);
+    return {
         level,
         context: {
-            operationError: error
+            operationError: described
         },
-        error: new Error(describeNonError(error))
+        error: new Error(described)
     };
 };
 const logError = ({ message, error, context, level = 'error' })=>{
     if (error instanceof axios.AxiosError) {
-        core.handleAxiosError(error, message, context);
+        // Forward the caller's severity hint. It used to be dropped here, so a call
+        // site that knew its failure was expected still got logged at `error`.
+        core.handleAxiosError(error, message, context, {
+            level
+        });
         return;
     }
     const resolvedLevel = resolveLogLevel(error, level);
@@ -3377,28 +3443,34 @@ class DynamicWalletClient {
         }, this.getTraceContext(traceContext))));
         throw new Error('Timed out waiting for wallet creation ceremony to complete');
     }
-    async clientInitializeKeyGen({ chainName, thresholdSignatureScheme, bitcoinConfig }) {
+    async clientInitializeKeyGen({ chainName, thresholdSignatureScheme, bitcoinConfig, variant }) {
         // Get the mpc signer
         const mpcSigner = getMPCSigner({
             chainName,
             baseRelayUrl: this.baseMPCRelayApiUrl,
-            bitcoinConfig
+            bitcoinConfig,
+            variant
         });
         const clientThreshold = core.getClientThreshold(thresholdSignatureScheme);
         const keygenInitResults = await Promise.all(Array(clientThreshold).fill(null).map(()=>mpcSigner.initKeygen()));
         return keygenInitResults;
     }
-    async derivePublicKey({ chainName, keyShare, derivationPath, bitcoinConfig }) {
+    async derivePublicKey({ chainName, keyShare, derivationPath, bitcoinConfig, variant }) {
         const mpcSigner = getMPCSigner({
             chainName,
             baseRelayUrl: this.baseMPCRelayApiUrl,
-            bitcoinConfig
+            bitcoinConfig,
+            variant
         });
         let publicKey;
         if (mpcSigner instanceof web.Ecdsa) {
             publicKey = await mpcSigner.derivePubkey(keyShare, derivationPath);
         } else if (mpcSigner instanceof web.ExportableEd25519) {
             publicKey = await mpcSigner.getPubkey(keyShare);
+        } else if (mpcSigner instanceof web.Ed25519) {
+            // Non-exportable Ed25519 (raw-scalar-imported wallets). Derivation is not
+            // standardized for ed25519, so the root pubkey is taken with an undefined path.
+            publicKey = await mpcSigner.derivePubkey(keyShare, derivationPath);
         } else if (mpcSigner instanceof web.BIP340) {
             publicKey = await mpcSigner.deriveTweakPubkey(keyShare, derivationPath);
         }
@@ -3727,7 +3799,7 @@ class DynamicWalletClient {
             // rejection (the user already has a wallet for this chain), not a system
             // failure — log it at warn so it doesn't flood error dashboards. All
             // other keygen failures stay at error.
-            const isExpectedRejection = error instanceof Error && error.message === ERROR_MULTIPLE_WALLETS_PER_CHAIN;
+            const isExpectedRejection = isMultipleWalletsPerChainRejection(error);
             // On the HTTP transport, tag the failure with the cross-repo join keys and
             // a stable errorKind so it lines up with the redcoast worker ceremony logs.
             const usedHttpTransport = this.featureFlags[core.FEATURE_FLAGS.ENABLE_HTTP_WAAS_TRANSPORT] === true && !!idempotencyKey;
@@ -3762,7 +3834,7 @@ class DynamicWalletClient {
             shouldRetry: (error)=>!isNonRetryableCeremonyError(error)
         });
     }
-    async runImportRawPrivateKeyAttempt({ chainName, privateKey, thresholdSignatureScheme, bitcoinConfig, onError, onCeremonyComplete, traceContext, legacyWalletId, password, signedSessionId }) {
+    async runImportRawPrivateKeyAttempt({ chainName, privateKey, thresholdSignatureScheme, bitcoinConfig, onError, onCeremonyComplete, traceContext, legacyWalletId, password, signedSessionId, isRawScalarImport }) {
         const dynamicRequestId = uuid.v4();
         try {
             this.assertPasswordRequired(password);
@@ -3770,15 +3842,21 @@ class DynamicWalletClient {
                 password,
                 signedSessionId
             });
+            // A raw-scalar import must run on the non-exportable `Ed25519` protocol for
+            // the whole ceremony (init keygen, import, pubkey derivation) so the produced
+            // key shares are consistent. Non-raw imports keep the default ('ed25519Exportable').
+            const variant = isRawScalarImport ? 'ed25519Standard' : undefined;
             const mpcSigner = getMPCSigner({
                 chainName,
                 baseRelayUrl: this.baseMPCRelayApiUrl,
-                bitcoinConfig
+                bitcoinConfig,
+                variant
             });
             const clientKeygenInitResults = await this.clientInitializeKeyGen({
                 chainName,
                 thresholdSignatureScheme,
-                bitcoinConfig
+                bitcoinConfig,
+                variant
             });
             const clientKeygenIds = clientKeygenInitResults.map((result)=>result.keygenId);
             this.logger.info('[DynamicWaasWalletClient] Client key generation initialized', _extends({
@@ -3796,7 +3874,9 @@ class DynamicWalletClient {
                 bitcoinConfig,
                 onError,
                 onCeremonyComplete,
-                legacyWalletId
+                legacyWalletId,
+                // Persist the protocol variant server-side so later sign/reshare read it back.
+                variant
             });
             this.logger.info('[DynamicWaasWalletClient] Server key generation initialized', _extends({
                 roomId,
@@ -3814,7 +3894,9 @@ class DynamicWalletClient {
                         ...serverKeygenIds,
                         ...otherClientKeygenIds
                     ];
-                    const importerKeygenResult = await mpcSigner.importPrivateKeyImporter(roomId, threshold, privateKey, currentInit, otherKeyGenIds);
+                    const importerKeygenResult = isRawScalarImport ? // uses the 32 bytes directly as the signing scalar instead of
+                    // SHA-512-expanding them as an RFC-8032 seed.
+                    await mpcSigner.importPrivateKeyImporter(roomId, threshold, privateKey, currentInit, otherKeyGenIds, true) : await mpcSigner.importPrivateKeyImporter(roomId, threshold, privateKey, currentInit, otherKeyGenIds);
                     return importerKeygenResult;
                 } else {
                     const recipientKeygenResult = await mpcSigner.importPrivateKeyRecipient(roomId, threshold, currentInit, [
@@ -3831,7 +3913,8 @@ class DynamicWalletClient {
                 chainName,
                 keyShare: clientKeygenResult,
                 derivationPath,
-                bitcoinConfig
+                bitcoinConfig,
+                variant
             });
             this.logger.info('[DynamicWaasWalletClient] Completed import of raw private key', _extends({
                 rawPublicKey,
@@ -3866,6 +3949,8 @@ class DynamicWalletClient {
         if (typeof message !== 'string') {
             message = `0x${Buffer.from(message).toString('hex')}`;
         }
+        // Note: the server signing party (wallet-service) selects the ed25519
+        // protocol variant from its own persisted EAC, so it is NOT threaded here.
         const serializedContext = context ? JSON.parse(JSON.stringify(context, (_key, value)=>typeof value === 'bigint' ? value.toString() : value)) : undefined;
         const useHttpTransport = this.featureFlags[core.FEATURE_FLAGS.ENABLE_HTTP_WAAS_TRANSPORT] === true && this.featureFlags[core.FEATURE_FLAGS.ENABLE_HTTP_WAAS_TRANSPORT_SIGNMESSAGE] === true;
         const params = {
@@ -3929,7 +4014,7 @@ class DynamicWalletClient {
         }
         return signatureBytes;
     }
-    async forwardMPCClientSign({ chainName, message, roomId, keyShare, derivationPath, formattedMessage, dynamicRequestId, isFormatted, traceContext, bitcoinConfig }) {
+    async forwardMPCClientSign({ chainName, message, roomId, keyShare, derivationPath, formattedMessage, dynamicRequestId, isFormatted, traceContext, bitcoinConfig, variant }) {
         try {
             const chainConfig = core.getMPCChainConfig(chainName, bitcoinConfig);
             const signingAlgo = chainConfig.signingAlgorithm;
@@ -3942,7 +4027,7 @@ class DynamicWalletClient {
             });
             const tweak = this.convertTweakForBIP340(bitcoinConfig == null ? void 0 : bitcoinConfig.tweak);
             this.logger.info('Forward MPC enabled, signing message with forward MPC (new)', this.getTraceContext(traceContext));
-            const { signature: signatureBytes } = await this.apiClient.forwardMPCClient.signMessage({
+            const { signature: signatureBytes } = await this.apiClient.forwardMPCClient.signMessage(_extends({
                 keyshare: keyShare,
                 message: messageToSign,
                 relayDomain: this.baseMPCRelayApiUrl || '',
@@ -3954,7 +4039,9 @@ class DynamicWalletClient {
                 traceContext,
                 userId: this.userId,
                 environmentId: this.environmentId
-            });
+            }, variant === 'ed25519Standard' ? {
+                ed25519Variant: 'standard'
+            } : {}));
             if (!(signatureBytes instanceof Uint8Array)) {
                 throw new TypeError(`Invalid signature format: expected Uint8Array, got ${typeof signatureBytes}`);
             }
@@ -3974,15 +4061,22 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async clientSign({ chainName, message, roomId: initialRoomId, keyShare, derivationPath, isFormatted, dynamicRequestId, traceContext, bitcoinConfig, refreshRoom }) {
+    async clientSign({ chainName, message, roomId: initialRoomId, keyShare, derivationPath, isFormatted, dynamicRequestId, traceContext, bitcoinConfig, variant, refreshRoom }) {
         // Reassigned when forward MPC fails and we mint a fresh room for the
         // relay-based fallback below.
         let roomId = initialRoomId;
+        // Non-exportable Ed25519 (raw-scalar import) derives its address at the
+        // root — see derivePrivateKeyFromExport's identical guard. Unlike
+        // ExportableEd25519 (which ignores this arg), Ed25519.sign() *applies* a
+        // non-undefined path, so forwarding the wallet's stored derivation path
+        // here would sign under a derived child key instead of the wallet's own.
+        const effectiveDerivationPath = variant === 'ed25519Standard' ? undefined : derivationPath;
         try {
             const mpcSigner = getMPCSigner({
                 chainName,
                 baseRelayUrl: this.baseMPCRelayApiUrl,
-                bitcoinConfig
+                bitcoinConfig,
+                variant
             });
             const formattedMessage = isFormatted ? new web.MessageHash(message) : formatMessage(chainName, message);
             this.logger.debug('[DynamicWaasWalletClient] Starting client sign', _extends({
@@ -4006,12 +4100,13 @@ class DynamicWalletClient {
                         message,
                         roomId,
                         keyShare,
-                        derivationPath,
+                        derivationPath: effectiveDerivationPath,
                         formattedMessage,
                         dynamicRequestId,
                         isFormatted,
                         traceContext,
-                        bitcoinConfig
+                        bitcoinConfig,
+                        variant
                     });
                 } catch (error) {
                     const errorInfo = core.classifyForwardMpcError(error);
@@ -4055,7 +4150,7 @@ class DynamicWalletClient {
             if (!('sign' in mpcSigner)) {
                 throw new TypeError(`Message signing is not supported for chain ${chainName} — use signTransaction instead`);
             }
-            const signature = await mpcSigner.sign(roomId, keyShare, messageToSign, derivationPath, tweak);
+            const signature = await mpcSigner.sign(roomId, keyShare, messageToSign, effectiveDerivationPath, tweak);
             return signature;
         } catch (error) {
             logError({
@@ -4139,7 +4234,8 @@ class DynamicWalletClient {
                     chainName,
                     localShares,
                     recordedKeygenIds,
-                    bitcoinConfig
+                    bitcoinConfig,
+                    variant: this.ed25519VariantForWallet(accountAddress)
                 });
                 localKeygenIds = comparison.localKeygenIds;
                 staleness = comparison.fresh ? 'fresh' : 'stale';
@@ -4205,11 +4301,14 @@ class DynamicWalletClient {
    * the server recorded for the wallet's Dynamic backups. Shared by the
    * stale-share heal (verifyAndRecoverStaleShare) and the backup preflight
    * (ensureLocalSharesAreFresh).
-   */ async compareShareGenerations({ accountAddress, chainName, localShares, recordedKeygenIds, bitcoinConfig }) {
+   */ async compareShareGenerations({ accountAddress, chainName, localShares, recordedKeygenIds, bitcoinConfig, variant }) {
         const mpcSigner = getMPCSigner({
             chainName,
             baseRelayUrl: this.baseMPCRelayApiUrl,
-            bitcoinConfig: bitcoinConfig != null ? bitcoinConfig : this.getBitcoinConfigForChain(chainName, accountAddress)
+            bitcoinConfig: bitcoinConfig != null ? bitcoinConfig : this.getBitcoinConfigForChain(chainName, accountAddress),
+            // Raw-scalar (non-exportable Ed25519) wallets: build the matching signer so
+            // getKeygenIdForShare deserializes the Ed25519 share (else "Invalid discriminant").
+            variant
         });
         const localKeygenIds = await Promise.all(localShares.map((share)=>this.getKeygenIdForShare(mpcSigner, share)));
         const recordedSet = new Set(recordedKeygenIds);
@@ -4367,6 +4466,7 @@ class DynamicWalletClient {
                     dynamicRequestId,
                     traceContext,
                     bitcoinConfig,
+                    variant: wallet.variant,
                     // On forward-MPC fallback, re-run the server sign with no roomId so a
                     // brand-new server-joined room is created for the relay ceremony.
                     refreshRoom: async ()=>{
@@ -4666,7 +4766,11 @@ class DynamicWalletClient {
             const mpcSigner = getMPCSigner({
                 chainName,
                 baseRelayUrl: this.baseMPCRelayApiUrl,
-                bitcoinConfig
+                bitcoinConfig,
+                // Raw-scalar (non-exportable Ed25519) wallets must refresh on the same
+                // protocol their shares were created with, or the ceremony fails to
+                // deserialize them ("Invalid discriminant").
+                variant: this.ed25519VariantForWallet(accountAddress)
             });
             // Ensure client key shares exist before hitting the API
             const clientKeyShares = await this.ensureClientShare(accountAddress);
@@ -4848,11 +4952,26 @@ class DynamicWalletClient {
         }
         return mpcSigner.exportID(share);
     }
-    async getExportId({ chainName, clientKeyShare, bitcoinConfig }) {
+    /**
+   * The ed25519 protocol variant for an existing wallet, read from the wallet map
+   * (sourced from `walletProperties.settings.variant`, persisted at import).
+   *
+   * It is per-wallet protocol metadata — like `thresholdSignatureScheme` or
+   * `addressType` — and the single source of truth for which signer to build when
+   * operating on a wallet's key shares. Wallets imported from a raw ed25519 scalar
+   * (e.g. Fireblocks Embedded Wallets) are `'ed25519Standard'` (non-exportable `Ed25519`);
+   * everything else is `undefined` → the default exportable protocol. Using the
+   * wrong one fails to deserialize the key share with "Invalid discriminant".
+   */ ed25519VariantForWallet(accountAddress) {
+        var _this_getWalletFromMap;
+        return (_this_getWalletFromMap = this.getWalletFromMap(accountAddress)) == null ? void 0 : _this_getWalletFromMap.variant;
+    }
+    async getExportId({ chainName, clientKeyShare, bitcoinConfig, accountAddress }) {
         const mpcSigner = getMPCSigner({
             chainName,
             baseRelayUrl: this.baseMPCRelayApiUrl,
-            bitcoinConfig
+            bitcoinConfig,
+            variant: accountAddress ? this.ed25519VariantForWallet(accountAddress) : undefined
         });
         try {
             const exportId = await this.getKeygenIdForShare(mpcSigner, clientKeyShare);
@@ -4900,7 +5019,8 @@ class DynamicWalletClient {
         return this.getExportId({
             chainName,
             clientKeyShare,
-            bitcoinConfig
+            bitcoinConfig,
+            accountAddress
         });
     }
     /**
@@ -4941,7 +5061,8 @@ class DynamicWalletClient {
         const existingClientKeygenIds = await Promise.all(existingClientKeyShares.map(async (keyShare)=>await this.getExportId({
                 chainName,
                 clientKeyShare: keyShare,
-                bitcoinConfig
+                bitcoinConfig,
+                accountAddress
             })));
         return {
             newClientInitKeygenResults,
@@ -5010,7 +5131,8 @@ class DynamicWalletClient {
         const existingClientKeygenId = await this.getExportId({
             chainName,
             clientKeyShare: existingClientShare,
-            bitcoinConfig
+            bitcoinConfig,
+            accountAddress
         });
         // Gate matches internalRefresh/Reshare — SSE error rejects awaitTerminal.
         let newShareSetId;
@@ -5619,7 +5741,11 @@ class DynamicWalletClient {
             const mpcSigner = getMPCSigner({
                 chainName,
                 baseRelayUrl: this.baseMPCRelayApiUrl,
-                bitcoinConfig
+                bitcoinConfig,
+                // Raw-scalar (non-exportable Ed25519) wallets must reshare on the same
+                // protocol their shares were created with, or the ceremony fails to
+                // deserialize them ("Invalid discriminant").
+                variant: this.ed25519VariantForWallet(accountAddress)
             });
             let existingReshareResults;
             let newReshareResults;
@@ -5983,6 +6109,9 @@ class DynamicWalletClient {
         if (mpcSigner instanceof web.ExportableEd25519) {
             return new web.ExportableEd25519KeygenResult(extractedPubkey, secretShare);
         }
+        if (mpcSigner instanceof web.Ed25519) {
+            return new web.Ed25519KeygenResult(extractedPubkey, secretShare);
+        }
         return new web.BIP340KeygenResult(extractedPubkey, secretShare);
     }
     async exportKey({ accountAddress, chainName, bitcoinConfig, password = undefined, signedSessionId, mfaToken, elevatedAccessToken, traceContext }) {
@@ -6013,13 +6142,15 @@ class DynamicWalletClient {
             const mpcSigner = getMPCSigner({
                 chainName,
                 baseRelayUrl: this.baseMPCRelayApiUrl,
-                bitcoinConfig
+                bitcoinConfig,
+                variant: wallet.variant
             });
             const reconstructedKeyShare = await this.getReconstructedKeyShare(accountAddress, mpcSigner);
             const exportId = await this.getExportId({
                 chainName,
                 clientKeyShare: reconstructedKeyShare,
-                bitcoinConfig
+                bitcoinConfig,
+                accountAddress: wallet.accountAddress
             });
             const data = await this.apiClient.exportKey({
                 walletId: wallet.walletId,
@@ -6162,20 +6293,35 @@ class DynamicWalletClient {
         if (mpcSigner instanceof web.Ecdsa) {
             return mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, derivationPath);
         } else if (mpcSigner instanceof web.ExportableEd25519) {
+            // ExportableEd25519's exportFullPrivateKey already returns the RFC-8032
+            // form (hex of seed||pubkey); pass it straight through.
             return keyExportRaw;
+        } else if (mpcSigner instanceof web.Ed25519) {
+            // Non-exportable Ed25519's exportFullPrivateKey returns an `spriv`
+            // (extended private key), NOT a raw hex key — it must be parsed to the
+            // actual private scalar. Returning the spriv verbatim makes the chain
+            // client hex-decode it into an empty buffer (blank export field).
+            //
+            // This protocol is only used for raw-scalar import, whose public key is
+            // the ROOT scalar (`A = s·B`, derived at import via derivePubkey(_, undefined)).
+            // The chain-config derivation path stored on the wallet (e.g. Solana's
+            // [44,501,0,0,0]) must NOT be applied here — deriving a child scalar would
+            // export a key that doesn't correspond to the wallet's address.
+            return mpcSigner.derivePrivateKeyFromSpriv(keyExportRaw);
         } else if (mpcSigner instanceof web.BIP340) {
             return mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, derivationPath);
         }
         return undefined;
     }
-    async offlineExportKey({ chainName, keyShares, derivationPath }) {
+    async offlineExportKey({ chainName, keyShares, derivationPath, variant }) {
         try {
             if (!keyShares || keyShares.length < 2) {
                 throw new Error(`Must provide at least min threshold of key shares`);
             }
             const mpcSigner = getMPCSigner({
                 chainName,
-                baseRelayUrl: this.baseMPCRelayApiUrl
+                baseRelayUrl: this.baseMPCRelayApiUrl,
+                variant
             });
             const walletKeyShares = keyShares.map((keyShare)=>{
                 if (!('pubkey' in keyShare)) {
@@ -6194,6 +6340,10 @@ class DynamicWalletClient {
                 derivedPrivateKey = await mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, walletDerivationPath);
             } else if (mpcSigner instanceof web.ExportableEd25519) {
                 derivedPrivateKey = keyExportRaw;
+            } else if (mpcSigner instanceof web.Ed25519) {
+                // Non-exportable Ed25519 (raw-scalar) returns an `spriv`, not raw hex —
+                // parse it to the root scalar (see derivePrivateKeyFromExport).
+                derivedPrivateKey = await mpcSigner.derivePrivateKeyFromSpriv(keyExportRaw);
             } else if (mpcSigner instanceof web.BIP340) {
                 derivedPrivateKey = await mpcSigner.derivePrivateKeyFromXpriv(keyExportRaw, walletDerivationPath);
             }
@@ -6399,7 +6549,7 @@ class DynamicWalletClient {
    * @param thresholdSignatureScheme - The TSS scheme used
    * @param derivationPath - Optional derivation path (will be computed from chainConfig if not provided)
    * @param additionalProps - Any chain-specific additional properties to merge
-   */ initializeWalletMapEntry({ accountAddress, walletId, chainName, thresholdSignatureScheme, derivationPath, shareSetId, shareSetType, otherShareSets, additionalProps = {} }) {
+   */ initializeWalletMapEntry({ accountAddress, walletId, chainName, thresholdSignatureScheme, derivationPath, shareSetId, shareSetType, otherShareSets, variant, additionalProps = {} }) {
         this.updateWalletMap(accountAddress, _extends({
             accountAddress,
             walletId,
@@ -6413,6 +6563,8 @@ class DynamicWalletClient {
             shareSetType
         } : {}, otherShareSets ? {
             otherShareSets
+        } : {}, variant ? {
+            variant
         } : {}, {
             clientKeySharesBackupInfo: getClientKeyShareBackupInfo()
         }, additionalProps));
@@ -6632,7 +6784,7 @@ class DynamicWalletClient {
             tokenSource: googleDriveTokenSource
         } : {});
     }
-    async publishDelegatedShare({ walletId, shareSetId, delegatedShare, signedSessionId, dynamicRequestId, chainName, bitcoinConfig, isPasswordEncrypted }) {
+    async publishDelegatedShare({ walletId, shareSetId, delegatedShare, signedSessionId, dynamicRequestId, chainName, accountAddress, bitcoinConfig, isPasswordEncrypted }) {
         var _publicKey_key, _publicKey_key1, _publicKey_key2;
         const publicKey = await this.apiClient.getDelegatedEncryptionKey({
             environmentId: this.environmentId
@@ -6657,7 +6809,8 @@ class DynamicWalletClient {
             chainName,
             clientKeyShare: delegatedShare,
             bitcoinConfig,
-            walletId
+            walletId,
+            accountAddress
         });
         return {
             location: core.BackupLocation.DELEGATED,
@@ -6823,6 +6976,7 @@ class DynamicWalletClient {
                         signedSessionId: resolvedSignedSessionId,
                         dynamicRequestId,
                         chainName: walletData.chainName,
+                        accountAddress,
                         bitcoinConfig,
                         isPasswordEncrypted
                     }), {
@@ -6991,7 +7145,8 @@ class DynamicWalletClient {
             accountAddress,
             chainName,
             localShares,
-            recordedKeygenIds
+            recordedKeygenIds,
+            variant: walletData.variant
         });
         if (fresh) return;
         this.logger.warn('[storeEncryptedBackupByWallet] Stale local shares detected; refreshing local storage', {
@@ -8416,9 +8571,17 @@ class DynamicWalletClient {
             const user = await this.getUserWithEnvCheck(dynamicRequestId);
             const waasWallets = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.filter((vc)=>vc.walletName === 'dynamicwaas');
             for (const vc of waasWallets != null ? waasWallets : []){
+                var _props_settings, _this_getWalletFromMap;
                 const addr = vc.address;
                 const props = vc.walletProperties;
-                this.updateWalletMap(addr, {
+                var _props_settings_variant, _ref;
+                // Resolve the ed25519 protocol variant: server-surfaced (walletProperties
+                // .settings or top-level) first, then any locally-seeded value (set at raw
+                // import). Required on a fresh session (no local seed) so recover/sign
+                // rebuild the non-exportable Ed25519 signer for raw-scalar wallets instead
+                // of defaulting to exportable → "Invalid discriminant".
+                const resolvedVariant = (_ref = (_props_settings_variant = props == null ? void 0 : (_props_settings = props.settings) == null ? void 0 : _props_settings.variant) != null ? _props_settings_variant : props == null ? void 0 : props.variant) != null ? _ref : (_this_getWalletFromMap = this.getWalletFromMap(addr)) == null ? void 0 : _this_getWalletFromMap.variant;
+                this.updateWalletMap(addr, _extends({
                     walletId: vc.id,
                     chainName: core.verifiedCredentialNameToChainEnum[vc.chain],
                     accountAddress: addr,
@@ -8431,7 +8594,9 @@ class DynamicWalletClient {
                     shareSetId: props == null ? void 0 : props.shareSetId,
                     shareSetType: props == null ? void 0 : props.shareSetType,
                     otherShareSets: props == null ? void 0 : props.otherShareSets
-                });
+                }, resolvedVariant ? {
+                    variant: resolvedVariant
+                } : {}));
             }
             if (walletOperation !== core.WalletOperation.NO_OPERATION && await this.requiresRestoreBackupSharesForOperation({
                 accountAddress,
@@ -8809,8 +8974,8 @@ class DynamicWalletClient {
             this.userId = user.id;
             const waasWallets = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.filter((vc)=>vc.walletName === 'dynamicwaas');
             const wallets = waasWallets.map((vc)=>{
-                var _this_getWalletFromMap, _vc_walletProperties, _vc_walletProperties1, _vc_walletProperties2, _vc_walletProperties3, _vc_walletProperties4, _vc_walletProperties5, _vc_walletProperties6;
-                var _this_getWalletFromMap_derivationPath;
+                var _this_getWalletFromMap, _vc_walletProperties, _vc_walletProperties1, _vc_walletProperties2, _vc_walletProperties3, _vc_walletProperties4, _vc_walletProperties5, _vc_walletProperties6, _vc_walletProperties_settings, _vc_walletProperties7, _vc_walletProperties8, _this_getWalletFromMap1;
+                var _this_getWalletFromMap_derivationPath, _vc_walletProperties_settings_variant, _ref;
                 return {
                     walletId: vc.id,
                     chainName: core.verifiedCredentialNameToChainEnum[vc.chain],
@@ -8828,14 +8993,18 @@ class DynamicWalletClient {
                     // On-sign-on settings (shouldRefreshOnNextSignOn / reshareOnNextSignOn /
                     // revokeOnNextSignOn). Surfaced so the SDK can self-drive the on-sign-on
                     // orchestration instead of the host reading these flags.
-                    settings: (_vc_walletProperties6 = vc.walletProperties) == null ? void 0 : _vc_walletProperties6.settings
+                    settings: (_vc_walletProperties6 = vc.walletProperties) == null ? void 0 : _vc_walletProperties6.settings,
+                    // Prefer the server-persisted variant (surfaced via walletProperties.settings),
+                    // then the locally-known value (set at raw import) so same-session
+                    // import → sign works before the server has surfaced it.
+                    variant: (_ref = (_vc_walletProperties_settings_variant = (_vc_walletProperties7 = vc.walletProperties) == null ? void 0 : (_vc_walletProperties_settings = _vc_walletProperties7.settings) == null ? void 0 : _vc_walletProperties_settings.variant) != null ? _vc_walletProperties_settings_variant : (_vc_walletProperties8 = vc.walletProperties) == null ? void 0 : _vc_walletProperties8.variant) != null ? _ref : (_this_getWalletFromMap1 = this.getWalletFromMap(vc.address)) == null ? void 0 : _this_getWalletFromMap1.variant
                 };
             });
             const existingWalletMap = this.walletMap;
             this.walletMap = wallets.reduce((acc, wallet)=>{
                 const normalizedAddress = normalizeAddress(wallet.accountAddress);
                 const existingWallet = existingWalletMap[normalizedAddress];
-                acc[normalizedAddress] = {
+                acc[normalizedAddress] = _extends({
                     walletId: wallet.walletId,
                     chainName: wallet.chainName,
                     accountAddress: wallet.accountAddress,
@@ -8848,7 +9017,9 @@ class DynamicWalletClient {
                     shareSetType: wallet.shareSetType,
                     businessAccountId: wallet.businessAccountId,
                     otherShareSets: wallet.otherShareSets
-                };
+                }, wallet.variant ? {
+                    variant: wallet.variant
+                } : {});
                 return acc;
             }, {});
             this.logger.info('[walletMap] getWallets: walletMap updated from API', {
@@ -9302,6 +9473,46 @@ DynamicWalletClient.roomsPersistDirty = false;
 // rooms back into the new user's storage (TOCTOU on the create→merge gap).
 DynamicWalletClient.roomsGeneration = 0;
 
+/**
+ * Derive the 32-byte ed25519 public key from a **raw** 32-byte signing scalar
+ * (`A = s·B`).
+ *
+ * This is NOT the same as deriving a public key from an RFC-8032 seed: the
+ * standard ed25519 key-generation step takes a 32-byte seed and SHA-512-expands
+ * it (then clamps) to obtain the scalar. A scalar exported from an external MPC
+ * system (e.g. Fireblocks Embedded Wallets) has no preimage seed, so it must be
+ * used directly as the scalar. Using `Keypair.fromSecretKey` / `keyPairFromSeed`
+ * on such bytes would re-expand them and produce the wrong public key/address.
+ *
+ * @param scalar Raw 32-byte ed25519 scalar, little-endian, as hex (with or
+ *   without a `0x` prefix) or as raw bytes.
+ * @returns The compressed 32-byte ed25519 public key.
+ */ const getEd25519PublicKeyFromRawScalar = (scalar)=>{
+    let bytes;
+    if (typeof scalar === 'string') {
+        const hex = scalar.replace(/^0x/, '');
+        // Validate before hexToBytes so malformed input fails with a clear, own
+        // error rather than an opaque/implementation-specific one from the decoder.
+        if (!/^[0-9a-fA-F]+$/.test(hex)) {
+            throw new Error('Invalid raw ed25519 scalar: expected a hex string');
+        }
+        bytes = utils.hexToBytes(hex);
+    } else {
+        bytes = scalar;
+    }
+    if (bytes.length !== 32) {
+        throw new Error(`Invalid raw ed25519 scalar length: ${bytes.length}, expected 32`);
+    }
+    // Interpret the scalar little-endian and reduce mod the curve order. We do NOT
+    // clamp here: the caller provides the actual signing scalar `s`, and the public
+    // key is exactly `s·B`.
+    const reduced = utils.bytesToNumberLE(bytes) % ed25519.ed25519.CURVE.n;
+    if (reduced === 0n) {
+        throw new Error('Invalid raw ed25519 scalar: reduces to zero mod the curve order');
+    }
+    return ed25519.ed25519.ExtendedPoint.BASE.multiply(reduced).toRawBytes();
+};
+
 Object.defineProperty(exports, "Logger", {
     enumerable: true,
     get: function () { return core.Logger; }
@@ -9416,6 +9627,7 @@ exports.getBitcoinAddressTypeFromDerivationPath = getBitcoinAddressTypeFromDeriv
 exports.getClientKeyShareBackupInfo = getClientKeyShareBackupInfo;
 exports.getClientKeyShareExportFileName = getClientKeyShareExportFileName;
 exports.getDelegatedShareSet = getDelegatedShareSet;
+exports.getEd25519PublicKeyFromRawScalar = getEd25519PublicKeyFromRawScalar;
 exports.getGoogleOAuthAccountId = getGoogleOAuthAccountId;
 exports.getHttpStatus = getHttpStatus;
 exports.getICloudBackup = getICloudBackup;
@@ -9429,6 +9641,7 @@ exports.isBrowser = isBrowser;
 exports.isHeavyQueueOperation = isHeavyQueueOperation;
 exports.isHexString = isHexString;
 exports.isICloudAuthenticated = isICloudAuthenticated;
+exports.isMultipleWalletsPerChainRejection = isMultipleWalletsPerChainRejection;
 exports.isNonRetryableCeremonyError = isNonRetryableCeremonyError;
 exports.isPublicKeyMismatchError = isPublicKeyMismatchError;
 exports.isRecoverQueueOperation = isRecoverQueueOperation;