@dynamic-labs-wallet/browser 1.0.98 → 1.0.99

package/index.esm.js

@@ -1,4 +1,4 @@
-import { BitcoinAddressType, MPC_RELAY_PROD_API_URL, DEFAULT_ED25519_VARIANT, getMPCChainConfig, parseNamespacedVersion, WalletApiError, BackupLocation, ENCRYPTED_SHARES_STORAGE_SUFFIX, Logger, NETWORK_ERROR_STATUS, handleAxiosError, WalletOperation, WalletReadyState, classifyForwardMpcError, isRecoveredForwardMpcConnectionChurn, FEATURE_FLAGS, ThresholdSignatureScheme, getClientThreshold, MPC_CONFIG, getTSSConfig, serializeMessageForForwardMPC, isEvmCompatibleChain, serializeError, getReshareConfig, getRequiredExternalKeyShareId, verifiedCredentialNameToChainEnum, AuthMode, NoopLogger, DynamicApiClient, BusinessAccountClient, getEnvironmentFromUrl, IFRAME_DOMAIN_MAP } from '@dynamic-labs-wallet/core';
+import { BitcoinAddressType, MPC_RELAY_PROD_API_URL, DEFAULT_ED25519_VARIANT, getMPCChainConfig, parseNamespacedVersion, WalletApiError, BackupLocation, ENCRYPTED_SHARES_STORAGE_SUFFIX, Logger, NETWORK_ERROR_STATUS, handleAxiosError, WalletOperation, ThresholdSignatureScheme, WalletReadyState, classifyForwardMpcError, isRecoveredForwardMpcConnectionChurn, FEATURE_FLAGS, getClientThreshold, MPC_CONFIG, getTSSConfig, serializeMessageForForwardMPC, isEvmCompatibleChain, serializeError, getReshareConfig, getRequiredExternalKeyShareId, verifiedCredentialNameToChainEnum, AuthMode, NoopLogger, DynamicApiClient, BusinessAccountClient, getEnvironmentFromUrl, IFRAME_DOMAIN_MAP } from '@dynamic-labs-wallet/core';
 export * from '@dynamic-labs-wallet/core';
 export { Logger } from '@dynamic-labs-wallet/core';
 import { EdBls12377, BIP340, Ed25519, ExportableEd25519, Ecdsa, MessageHash, EcdsaSignature, EcdsaKeygenResult, ExportableEd25519KeygenResult, Ed25519KeygenResult, BIP340KeygenResult } from '#internal/web';
@@ -1275,6 +1275,19 @@ const downloadFileFromGoogleDrive = async ({ accessToken, fileName })=>{
     }
 };
 
+function _object_without_properties_loose(source, excluded) {
+    if (source == null) return {};
+    var target = {};
+    var sourceKeys = Object.keys(source);
+    var key, i;
+    for(i = 0; i < sourceKeys.length; i++){
+        key = sourceKeys[i];
+        if (excluded.indexOf(key) >= 0) continue;
+        target[key] = source[key];
+    }
+    return target;
+}
+
 /**
  * Normalizes an address to lowercase for consistent map key lookups.
  * This ensures that addresses with different casing (e.g., EIP-55 checksummed vs lowercase)
@@ -1302,9 +1315,17 @@ const isBrowser = ()=>globalThis.window !== undefined;
     }
     return actualPubkey;
 };
-const getClientKeyShareExportFileName = ({ thresholdSignatureScheme, accountAddress, isGoogleDrive = false })=>{
-    const suffix = isGoogleDrive ? '-google-drive' : '';
-    return `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${thresholdSignatureScheme}-${accountAddress}${suffix}.json`;
+/**
+ * Keeps a variant's Drive file from colliding with — and so shadowing — the
+ * wallet's own (rootUser) backup, which can carry the same
+ * `thresholdSignatureScheme` and address.
+ */ const getExportFileNameSuffix = ({ isGoogleDrive = false, isOfflineRecovery = false })=>`${isGoogleDrive ? '-google-drive' : ''}${isOfflineRecovery ? '-offline-recovery' : ''}`;
+const getClientKeyShareExportFileName = (_param)=>{
+    var { thresholdSignatureScheme, accountAddress } = _param, variant = _object_without_properties_loose(_param, [
+        "thresholdSignatureScheme",
+        "accountAddress"
+    ]);
+    return `${CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX}-${thresholdSignatureScheme}-${accountAddress}${getExportFileNameSuffix(variant)}.json`;
 };
 const getClientKeyShareBackupInfo = (params)=>{
     var _params_walletProperties, _params_walletProperties_keyShares_;
@@ -1339,6 +1360,25 @@ const getClientKeyShareBackupInfo = (params)=>{
         passwordEncrypted
     };
 };
+/**
+ * Records the just-activated offlineRecovery share set against the wallet's
+ * own (rootUser) backup info, which it must leave otherwise untouched — the
+ * exported set is a separate share set, not rootUser's.
+ *
+ * Only the `offlineRecovery` location is taken from `activated`. The exported
+ * share is deliberately also reported under `googleDrive` so the server can
+ * activate it, but folding that tag in here would make the wallet look like
+ * rootUser itself is backed up to Drive — see `getActiveCloudProviders`, whose
+ * result drives later reshare/delegation decisions. The location is replaced
+ * rather than appended so repeated offline recoveries stay idempotent.
+ */ const recordOfflineRecoveryBackupLocations = (existing, activated)=>{
+    var _activated_backups_BackupLocation_OFFLINE_RECOVERY;
+    return _extends({}, existing, {
+        backups: _extends({}, existing.backups, {
+            [BackupLocation.OFFLINE_RECOVERY]: (_activated_backups_BackupLocation_OFFLINE_RECOVERY = activated.backups[BackupLocation.OFFLINE_RECOVERY]) != null ? _activated_backups_BackupLocation_OFFLINE_RECOVERY : []
+        })
+    });
+};
 const timeoutPromise = ({ timeInMs, activity = 'Ceremony' })=>{
     return new Promise((_, reject)=>setTimeout(()=>reject(new Error(`${activity} did not complete in ${timeInMs}ms`)), timeInMs));
 };
@@ -2473,6 +2513,32 @@ class WalletBusyError extends Error {
         this.accountAddress = accountAddress;
     }
 }
+/**
+ * Thrown when a Google Drive operation fails because the user's OAuth access
+ * token has expired or is otherwise unusable. Distinct from a generic error so
+ * the caller can prompt the user to re-link Google before retrying.
+ */ class ExpiredGoogleDriveTokenError extends Error {
+    constructor(message, options){
+        super(message, (options == null ? void 0 : options.cause) !== undefined ? {
+            cause: options.cause
+        } : undefined);
+        this.name = 'ExpiredGoogleDriveTokenError';
+        this.accountAddress = options == null ? void 0 : options.accountAddress;
+    }
+}
+/**
+ * Thrown when a Google Drive backup preflight blocks for a reason OTHER than
+ * an expired/scope-insufficient token (e.g. storage quota, rate limit,
+ * network). Distinct from {@link ExpiredGoogleDriveTokenError} so callers
+ * don't prompt a Google re-link for a problem re-linking can't fix.
+ */ class GoogleDriveBackupBlockedError extends Error {
+    constructor(message, errorReason, options){
+        super(message);
+        this.name = 'GoogleDriveBackupBlockedError';
+        this.errorReason = errorReason;
+        this.accountAddress = options == null ? void 0 : options.accountAddress;
+    }
+}
 /**
  * Creates distribution where shares go to specified cloud providers
  * Last share goes to cloud providers, rest to Dynamic backend
@@ -2555,6 +2621,22 @@ const createDynamicOnlyDistribution = ({ allShares })=>({
         clientShares: allShares,
         cloudProviderShares: {}
     });
+/**
+ * Offline recovery's exported set is minted via the same same-parties 2/2
+ * reshare as delegation. The client only ever sees its own reshared share —
+ * upload it to Google Drive (mandatory, no device-export variant). The
+ * server's own reshared share is delivered to the developer's webhook
+ * entirely server-side (see redcoast); the browser SDK never touches it.
+ * clientShares: [] skips the local-storage rewrite — root_user is untouched.
+ */ const createOfflineRecoveryDistribution = ({ exportedClientShare })=>({
+        clientShares: [],
+        cloudProviderShares: {
+            [BackupLocation.GOOGLE_DRIVE]: [
+                exportedClientShare
+            ]
+        },
+        isOfflineRecovery: true
+    });
 /**
  * Returns the share set of the given `shareSetType` from a wallet's
  * `otherShareSets` array, if one exists.
@@ -2864,7 +2946,10 @@ const collectDynamicKeyShareIds = (locations)=>{
 // ShareDistribution that storage/publish should follow. Lives outside the
 // client class so it's straightforward to reason about and unit-test
 // without spinning up DynamicWalletClient.
-const selectReshareDistribution = ({ resolvedDelegation, resolvedCloudProviders, existingReshareResults, newReshareResults })=>{
+const selectReshareDistribution = ({ resolvedDelegation, resolvedOfflineRecovery = false, resolvedCloudProviders, existingReshareResults, newReshareResults })=>{
+    if (resolvedDelegation && resolvedOfflineRecovery) {
+        throw new Error('selectReshareDistribution: resolvedDelegation and resolvedOfflineRecovery are mutually exclusive on a single reshare');
+    }
     const allClientShares = [
         ...existingReshareResults,
         ...newReshareResults
@@ -2893,6 +2978,19 @@ const selectReshareDistribution = ({ resolvedDelegation, resolvedCloudProviders,
             delegatedShare: newReshareResults[0]
         });
     }
+    // Offline recovery mints its exported share set via the same same-parties
+    // reshare signal as delegation (1 existing, 0 new). The client's reshared
+    // share routes to Google Drive (mandatory — no device-export variant); the
+    // server's own reshared share is delivered to the developer entirely
+    // server-side (redcoast) and never appears here.
+    if (resolvedOfflineRecovery && newReshareResults.length === 0 && existingReshareResults.length === 1) {
+        if (!resolvedCloudProviders.includes(BackupLocation.GOOGLE_DRIVE)) {
+            throw new Error('selectReshareDistribution: offline recovery requires Google Drive');
+        }
+        return createOfflineRecoveryDistribution({
+            exportedClientShare: existingReshareResults[0]
+        });
+    }
     if (resolvedCloudProviders.length > 0) {
         return createCloudProviderDistribution({
             providers: resolvedCloudProviders,
@@ -3060,6 +3158,123 @@ const readEnvironmentSettings = ()=>{
         }
     });
 
+const DEFAULT_OFFLINE_RECOVERY_CLOUD_PROVIDER = BackupLocation.GOOGLE_DRIVE;
+/**
+ * Resolve a usable Google Drive access token. Unlike an opportunistic
+ * multi-provider reshare (which silently drops Drive on failure), Drive is
+ * mandatory here — resolution/preflight failures throw before the ceremony
+ * starts. Only an actual token/scope problem throws `ExpiredGoogleDriveTokenError`;
+ * quota, rate-limit, and network blocks throw `GoogleDriveBackupBlockedError`
+ * instead, since re-linking Google fixes none of those.
+ */ const resolveGoogleDriveAccessToken = async (client, accountAddress, googleDriveAccessToken)=>{
+    let token;
+    try {
+        token = googleDriveAccessToken != null ? googleDriveAccessToken : await client.fetchGoogleDriveAccessToken(accountAddress);
+    } catch (error) {
+        throw new ExpiredGoogleDriveTokenError('Offline recovery requires a valid Google Drive access token', {
+            cause: error,
+            accountAddress
+        });
+    }
+    const { blocking } = await runGoogleDriveBackupPreflight(token);
+    if (!blocking) return token;
+    if (blocking.errorReason === 'auth_denied') {
+        throw new ExpiredGoogleDriveTokenError('Offline recovery requires a valid Google Drive access token', {
+            accountAddress
+        });
+    }
+    throw new GoogleDriveBackupBlockedError(blocking.message, blocking.errorReason, {
+        accountAddress
+    });
+};
+const googleDriveStrategy = {
+    location: BackupLocation.GOOGLE_DRIVE,
+    prepareReshareArgs: async (client, params)=>({
+            googleDriveAccessToken: await resolveGoogleDriveAccessToken(client, params.accountAddress, params.cloudProviderAccessToken)
+        })
+};
+// Registry of supported providers. iCloud and other third-party clouds slot in
+// here (each supplying its own readiness check in `prepareReshareArgs`) without
+// changing `performOfflineRecoveryOperation`. Requesting an unregistered
+// provider throws below.
+const CLOUD_PROVIDER_STRATEGIES = {
+    [BackupLocation.GOOGLE_DRIVE]: googleDriveStrategy
+};
+const getCloudProviderStrategy = (provider)=>{
+    const strategy = CLOUD_PROVIDER_STRATEGIES[provider];
+    if (!strategy) {
+        throw new Error(`Offline recovery is not supported for cloud provider "${provider}"`);
+    }
+    return strategy;
+};
+// Generous upper bound on an OAuth bearer token — not chain-address validation
+// (accountAddress spans EVM/BTC/SVM/TON/SUI formats, so no shared regex fits).
+const MAX_CLOUD_PROVIDER_ACCESS_TOKEN_LENGTH = 4096;
+const validateOfflineRecoveryParams = ({ accountAddress, cloudProviderAccessToken })=>{
+    if (typeof accountAddress !== 'string' || accountAddress.length === 0) {
+        throw new Error('offlineRecovery requires a non-empty accountAddress');
+    }
+    if (cloudProviderAccessToken !== undefined && (typeof cloudProviderAccessToken !== 'string' || cloudProviderAccessToken.length === 0 || cloudProviderAccessToken.length > MAX_CLOUD_PROVIDER_ACCESS_TOKEN_LENGTH)) {
+        throw new Error('offlineRecovery: cloudProviderAccessToken must be a non-empty string');
+    }
+};
+/**
+ * Mints the dedicated 2/2 `offlineRecovery` share set: the same
+ * same-parties reshare mechanism delegation uses, routed to the chosen cloud
+ * provider instead of the delegation webhook (see `selectReshareDistribution`).
+ * The server's own reshared share is delivered to the developer entirely
+ * server-side — this flow never touches it.
+ */ const performOfflineRecoveryOperation = async (client, params)=>{
+    validateOfflineRecoveryParams(params);
+    const { accountAddress, password, signedSessionId, sessionPublicKey, mfaToken } = params;
+    var _params_cloudProvider;
+    const provider = (_params_cloudProvider = params.cloudProvider) != null ? _params_cloudProvider : DEFAULT_OFFLINE_RECOVERY_CLOUD_PROVIDER;
+    try {
+        const wallet = await client.getWallet({
+            accountAddress,
+            walletOperation: WalletOperation.REACH_ALL_PARTIES,
+            password,
+            signedSessionId
+        });
+        if (wallet.chainName === 'SUI') {
+            throw new Error('Offline recovery is not allowed for SUI');
+        }
+        const strategy = getCloudProviderStrategy(provider);
+        const providerReshareArgs = await strategy.prepareReshareArgs(client, params);
+        const walletData = client.getWalletFromMap(accountAddress);
+        if (!walletData) {
+            throw new Error(`Wallet not found for address: ${accountAddress}`);
+        }
+        await client.reshare(_extends({
+            chainName: walletData.chainName,
+            accountAddress,
+            oldThresholdSignatureScheme: walletData.thresholdSignatureScheme,
+            // Pinning 2/2 (the exported set's real shape) is what makes getReshareConfig
+            // yield 1 existing / 0 new — the same-parties shape selectReshareDistribution's
+            // offline-recovery branch requires. The wallet's own scheme would break
+            // 2-of-3 wallets: 1/1, missing the branch, falling through to a plain reshare.
+            newThresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_TWO,
+            password,
+            signedSessionId,
+            sessionPublicKey,
+            cloudProviders: [
+                strategy.location
+            ],
+            offlineRecovery: true,
+            mfaToken
+        }, providerReshareArgs));
+    } catch (error) {
+        logError({
+            message: 'Error in offlineRecovery',
+            error: error,
+            context: {
+                accountAddress
+            }
+        });
+        throw error;
+    }
+};
+
 /**
  * Determines the recovery state of a wallet based on backup info and local shares.
  *
@@ -3192,7 +3407,9 @@ class DynamicWalletClient {
     /**
    * Get wallet properties from the wallet map using normalized address.
    * Normalizes the address to lowercase for consistent lookups regardless of input casing.
-   */ getWalletFromMap(accountAddress) {
+   */ // Public (was protected) so the extracted offlineRecovery flow can read
+    // wallet state off the client instance — see ./offlineRecovery.ts.
+    getWalletFromMap(accountAddress) {
         return this.walletMap[normalizeAddress(accountAddress)];
     }
     /**
@@ -5103,7 +5320,10 @@ class DynamicWalletClient {
             existingClientKeyShares
         };
     }
-    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, initialSignerRules }) {
+    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, initialSignerRules }) {
+        if (delegateToProjectEnvironment && offlineRecovery) {
+            throw new Error('reshare: delegateToProjectEnvironment and offlineRecovery are mutually exclusive');
+        }
         // Fail-closed choke point: rules are only mintable on a share-set delegation
         // reshare, never on the legacy 2/2 -> 2/3 path or revoke.
         if (initialSignerRules && initialSignerRules.length > 0) {
@@ -5123,6 +5343,7 @@ class DynamicWalletClient {
                 sessionPublicKey,
                 cloudProviders,
                 delegateToProjectEnvironment,
+                offlineRecovery,
                 mfaToken,
                 elevatedAccessToken,
                 revokeDelegation,
@@ -5517,6 +5738,19 @@ class DynamicWalletClient {
             });
             return;
         }
+        if (shareSetType === 'offlineRecovery' && newThresholdSignatureScheme) {
+            // offlineRecovery activates its own share set, not rootUser: rootUser
+            // stays the wallet's primary identity, so walletMap.shareSetId is never
+            // touched here (unlike the rootUser branch below).
+            this.recordOtherShareSet({
+                accountAddress,
+                wallet,
+                newShareSetId: shareSetId,
+                newThresholdSignatureScheme,
+                shareSetType: 'offlineRecovery'
+            });
+            return;
+        }
         if (shareSetType !== 'rootUser') {
             // 'delegated' (no newThresholdSignatureScheme, e.g. refresh) → SDK doesn't
             // own the otherShareSets[] write from refresh.
@@ -5590,6 +5824,39 @@ class DynamicWalletClient {
             shareSetType: 'delegated'
         });
     }
+    /**
+   * Advances the wallet's recorded scheme after a reshare. Offline recovery
+   * mints a separate 2/2 set and leaves rootUser alone, so it must not write
+   * here — same invariant {@link rotateRootUserShareSetIdIfChanged} applies to
+   * `shareSetId`.
+   */ recordReshareThresholdScheme({ accountAddress, newThresholdSignatureScheme, offlineRecovery }) {
+        if (offlineRecovery) return;
+        this.updateWalletMap(accountAddress, {
+            thresholdSignatureScheme: newThresholdSignatureScheme
+        });
+    }
+    /**
+   * Reverts the local state a failed reshare may have half-written: the
+   * walletMap scheme bump, and the local client shares (wiped so the next
+   * operation refetches a consistent set from backup).
+   *
+   * Skipped whenever the failed ceremony left rootUser's local state alone:
+   * - public-key mismatch / 409 stale-shares preflight: `healStaleShares` just
+   *   restored these shares, and undoing that would break the caller's retry.
+   * - offlineRecovery: mints a separate share set (`clientShares: []`) and
+   *   never rotates rootUser's shares or scheme — the mirror image of the
+   *   {@link recordReshareThresholdScheme} guard on the success path. Wiping
+   *   here would strand a wallet whose local keys are still valid.
+   */ async rollbackFailedReshareLocalState({ accountAddress, oldThresholdSignatureScheme, offlineRecovery, error }) {
+        if (offlineRecovery || isPublicKeyMismatchError(error) || isStaleClientSharesError(error)) return;
+        this.updateWalletMap(accountAddress, {
+            thresholdSignatureScheme: oldThresholdSignatureScheme
+        });
+        await this.setClientKeySharesToStorage({
+            accountAddress,
+            clientKeyShares: []
+        });
+    }
     // Inverse of `recordDelegatedShareSet`. The next delegateKeyShares no-op
     // guard reads `otherShareSets`, so we have to clear it locally — `getWallet`
     // short-circuits on cache hit and won't refresh from the server.
@@ -5618,7 +5885,7 @@ class DynamicWalletClient {
             clientKeySharesBackupInfo: updatedBackupInfo
         } : {}));
     }
-    async internalReshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, staleShareRetry = false, initialSignerRules }) {
+    async internalReshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, staleShareRetry = false, initialSignerRules }) {
         const dynamicRequestId = v4();
         // Password validation - wrapped in try-catch for consistent error handling
         // This path should NOT wipe key shares on failure (shares remain valid)
@@ -5733,7 +6000,7 @@ class DynamicWalletClient {
                     dynamicRequestId
                 }
             });
-            const data = await this.apiClient.reshare({
+            const data = await this.apiClient.reshare(_extends({
                 walletId: wallet.walletId,
                 shareSetId: wallet.shareSetId,
                 clientKeygenIds: clientKeygenIds,
@@ -5744,10 +6011,13 @@ class DynamicWalletClient {
                 mfaToken,
                 elevatedAccessToken,
                 revokeDelegation,
-                initialSignerRules,
+                initialSignerRules
+            }, offlineRecovery ? {
+                reshareKind: 'offlineRecovery'
+            } : {}, {
                 onError: ceremonyGate.onError,
                 onCeremonyComplete: ceremonyGate.onCeremonyComplete
-            });
+            }));
             this.logger.info('[WaasReshare] room_created received, starting local MPC', {
                 context: {
                     walletId: wallet.walletId,
@@ -5852,12 +6122,15 @@ class DynamicWalletClient {
             }
             const distribution = selectReshareDistribution({
                 resolvedDelegation,
+                resolvedOfflineRecovery: offlineRecovery,
                 resolvedCloudProviders,
                 existingReshareResults,
                 newReshareResults
             });
-            this.updateWalletMap(accountAddress, {
-                thresholdSignatureScheme: newThresholdSignatureScheme
+            this.recordReshareThresholdScheme({
+                accountAddress,
+                newThresholdSignatureScheme,
+                offlineRecovery
             });
             this.logger.info('[WaasReshare] local MPC done, awaiting ceremony_complete before backup', {
                 context: {
@@ -5952,6 +6225,7 @@ class DynamicWalletClient {
                     sessionPublicKey,
                     cloudProviders,
                     delegateToProjectEnvironment,
+                    offlineRecovery,
                     mfaToken,
                     elevatedAccessToken,
                     revokeDelegation,
@@ -5975,20 +6249,12 @@ class DynamicWalletClient {
                     dynamicRequestId
                 }
             });
-            // Skip the wipe on mismatch — healStaleShares just restored these
-            // shares from backup, undoing that would break the caller's retry.
-            // Same for a 409 stale-shares preflight (only reachable here on the
-            // retried attempt): the request was rejected before any ceremony, so
-            // local shares are consistent — wiping would strand the user.
-            if (!isPublicKeyMismatchError(error) && !isStaleClientSharesError(error)) {
-                this.updateWalletMap(accountAddress, {
-                    thresholdSignatureScheme: oldThresholdSignatureScheme
-                });
-                await this.setClientKeySharesToStorage({
-                    accountAddress,
-                    clientKeyShares: []
-                });
-            }
+            await this.rollbackFailedReshareLocalState({
+                accountAddress,
+                oldThresholdSignatureScheme,
+                offlineRecovery,
+                error
+            });
             throw error;
         }
     }
@@ -6144,6 +6410,27 @@ class DynamicWalletClient {
             operationName: 'revokeDelegation'
         });
     }
+    /**
+   * Mints the dedicated 2/2 `offlineRecovery` share set. The
+   * operation logic lives in `./offlineRecovery.ts` (cloud-provider-agnostic,
+   * so iCloud / other providers slot in there); this method just drives it
+   * with the client instance and returns the exported set's own backups.
+   */ async offlineRecovery({ accountAddress, password = undefined, signedSessionId, sessionPublicKey, mfaToken, cloudProvider = DEFAULT_OFFLINE_RECOVERY_CLOUD_PROVIDER, cloudProviderAccessToken }) {
+        await performOfflineRecoveryOperation(this, {
+            accountAddress,
+            password,
+            signedSessionId,
+            sessionPublicKey,
+            mfaToken,
+            cloudProvider,
+            cloudProviderAccessToken
+        });
+        // The exported set's own locations. Not `backups[cloudProvider]`: that is
+        // rootUser's record for the provider, which this operation never writes.
+        const backupInfo = this.getRequiredWalletFromMap(accountAddress).clientKeySharesBackupInfo;
+        var _backupInfo_backups_BackupLocation_OFFLINE_RECOVERY;
+        return (_backupInfo_backups_BackupLocation_OFFLINE_RECOVERY = backupInfo.backups[BackupLocation.OFFLINE_RECOVERY]) != null ? _backupInfo_backups_BackupLocation_OFFLINE_RECOVERY : [];
+    }
     createKeygenResult(mpcSigner, extractedPubkey, secretShare) {
         if (mpcSigner instanceof Ecdsa) {
             return new EcdsaKeygenResult(extractedPubkey, secretShare);
@@ -6800,7 +7087,7 @@ class DynamicWalletClient {
             ]);
         }));
     }
-    async backupToCloudProvider({ provider, shares, accountAddress, password, chainName, bitcoinConfig, isPasswordEncrypted, preEncryptedShares, googleDriveAccessToken, googleDriveTokenSource, encryptionVersion }) {
+    async backupToCloudProvider({ provider, shares, accountAddress, password, chainName, bitcoinConfig, isPasswordEncrypted, preEncryptedShares, googleDriveAccessToken, googleDriveTokenSource, encryptionVersion, isOfflineRecovery }) {
         const encryptedCloudShares = preEncryptedShares != null ? preEncryptedShares : await Promise.all(shares.map((keyShare)=>this.encryptKeyShare({
                 keyShare,
                 password,
@@ -6810,7 +7097,8 @@ class DynamicWalletClient {
             provider,
             accountAddress,
             encryptedKeyShares: encryptedCloudShares,
-            googleDriveAccessToken
+            googleDriveAccessToken,
+            isOfflineRecovery
         });
         const keygenId = await this.computeBackupKeygenId({
             chainName,
@@ -6993,7 +7281,8 @@ class DynamicWalletClient {
                     preEncryptedShares: encrypted,
                     googleDriveAccessToken,
                     googleDriveTokenSource,
-                    encryptionVersion
+                    encryptionVersion,
+                    isOfflineRecovery: distribution.isOfflineRecovery
                 }));
             }
             // When this ceremony minted a separate `delegated` share set (FF=on
@@ -7008,8 +7297,12 @@ class DynamicWalletClient {
             // when `walletData` was captured at the top of this method and now.
             const freshOtherShareSets = (_this_getWalletFromMap = this.getWalletFromMap(accountAddress)) == null ? void 0 : _this_getWalletFromMap.otherShareSets;
             const delegatedShareSet = distribution.delegatedShare ? getDelegatedShareSet(freshOtherShareSets) : undefined;
-            var _delegatedShareSet_shareSetId;
-            const targetShareSetId = (_delegatedShareSet_shareSetId = delegatedShareSet == null ? void 0 : delegatedShareSet.shareSetId) != null ? _delegatedShareSet_shareSetId : walletData.shareSetId;
+            // Offline recovery activates its own share set, not rootUser: the
+            // pending set must be the backup target or it is never activated and
+            // the Drive location lands on rootUser instead.
+            const offlineRecoveryShareSet = distribution.isOfflineRecovery ? getOfflineRecoveryShareSet(freshOtherShareSets) : undefined;
+            var _delegatedShareSet_shareSetId, _ref;
+            const targetShareSetId = (_ref = (_delegatedShareSet_shareSetId = delegatedShareSet == null ? void 0 : delegatedShareSet.shareSetId) != null ? _delegatedShareSet_shareSetId : offlineRecoveryShareSet == null ? void 0 : offlineRecoveryShareSet.shareSetId) != null ? _ref : walletData.shareSetId;
             if (distribution.delegatedShare) {
                 uploadPromises.push(retryPromise(()=>this.publishDelegatedShare({
                         walletId: walletData.walletId,
@@ -7027,6 +7320,17 @@ class DynamicWalletClient {
             }
             const uploadResults = await Promise.all(uploadPromises);
             const locations = uploadResults.filter((loc)=>loc !== undefined);
+            // One physical Drive share, reported under two tags: `googleDrive` for
+            // legacy backup-info reads and `offlineRecovery` for redcoast's
+            // exported-set activation. Same keygenId/externalKeyShareId.
+            if (distribution.isOfflineRecovery) {
+                const googleDriveLocation = locations.find((location)=>location.location === BackupLocation.GOOGLE_DRIVE);
+                if (googleDriveLocation) {
+                    locations.push(_extends({}, googleDriveLocation, {
+                        location: BackupLocation.OFFLINE_RECOVERY
+                    }));
+                }
+            }
             this.logger.info('[backupSharesWithDistribution] Uploads complete, activating shares on server', _extends({}, logContext, {
                 locationCount: locations.length,
                 locations: locations.map((l)=>l.location)
@@ -7110,7 +7414,7 @@ class DynamicWalletClient {
                 });
             }
             var _backupData_locationsWithKeyShares2;
-            const updatedBackupInfo = getClientKeyShareBackupInfo({
+            const activatedBackupInfo = getClientKeyShareBackupInfo({
                 walletProperties: {
                     derivationPath: walletData.derivationPath,
                     keyShares: ((_backupData_locationsWithKeyShares2 = backupData.locationsWithKeyShares) != null ? _backupData_locationsWithKeyShares2 : []).map((ks)=>({
@@ -7123,8 +7427,10 @@ class DynamicWalletClient {
                     thresholdSignatureScheme: walletData.thresholdSignatureScheme
                 }
             });
+            // offlineRecovery activates a separate share set, not rootUser's — record
+            // it alongside rootUser's own backup info instead of replacing it.
             this.updateWalletMap(accountAddress, {
-                clientKeySharesBackupInfo: updatedBackupInfo
+                clientKeySharesBackupInfo: distribution.isOfflineRecovery ? recordOfflineRecoveryBackupLocations(walletData.clientKeySharesBackupInfo, activatedBackupInfo) : activatedBackupInfo
             });
             await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
             var _backupData_locationsWithKeyShares_length, _backupData_locationsWithKeyShares_map;
@@ -7716,6 +8022,8 @@ class DynamicWalletClient {
             throw error;
         }
     }
+    // Public (was private) so the extracted offlineRecovery flow can resolve a
+    // Google Drive token off the client instance — see ./offlineRecovery.ts.
     async fetchGoogleDriveAccessToken(accountAddress) {
         const oauthAccountId = await this.getGoogleOauthAccountIdOrThrow(accountAddress);
         return this.apiClient.getAccessToken({
@@ -8200,13 +8508,14 @@ class DynamicWalletClient {
    * @param encryptedKeyShares - Already encrypted key shares to upload
    * @param googleDriveAccessToken - Optional Google OAuth access token used when provider is GOOGLE_DRIVE
    * @returns Promise<void>
-   */ async uploadToCloudProvider({ provider, accountAddress, encryptedKeyShares, googleDriveAccessToken }) {
+   */ async uploadToCloudProvider({ provider, accountAddress, encryptedKeyShares, googleDriveAccessToken, isOfflineRecovery }) {
         switch(provider){
             case BackupLocation.GOOGLE_DRIVE:
                 return this.uploadKeySharesToGoogleDrive({
                     accountAddress,
                     encryptedKeyShares,
-                    googleDriveAccessToken
+                    googleDriveAccessToken,
+                    isOfflineRecovery
                 });
             case BackupLocation.ICLOUD:
                 return this.uploadKeySharesToICloud({
@@ -8229,7 +8538,7 @@ class DynamicWalletClient {
    * @param params.encryptedKeyShares - The specific key shares to upload to Google Drive
    * @param params.googleDriveAccessToken - Google OAuth access token. Required; resolved upstream by `backupKeySharesToGoogleDrive` so the preflight can run on it.
    * @returns Promise<string[]> - Array of Google Drive key share IDs that were uploaded
-   */ async uploadKeySharesToGoogleDrive({ accountAddress, encryptedKeyShares, googleDriveAccessToken }) {
+   */ async uploadKeySharesToGoogleDrive({ accountAddress, encryptedKeyShares, googleDriveAccessToken, isOfflineRecovery }) {
         try {
             if (encryptedKeyShares.length === 0) {
                 throw new Error('No key shares found');
@@ -8237,12 +8546,13 @@ class DynamicWalletClient {
             if (!googleDriveAccessToken) {
                 throw new Error('googleDriveAccessToken is required for Google Drive upload');
             }
-            const walletData = this.getWalletFromMap(accountAddress);
+            const walletData = this.getRequiredWalletFromMap(accountAddress);
             const thresholdSignatureScheme = walletData.thresholdSignatureScheme;
             const fileName = getClientKeyShareExportFileName({
                 thresholdSignatureScheme,
                 accountAddress,
-                isGoogleDrive: true
+                isGoogleDrive: true,
+                isOfflineRecovery
             });
             const backupData = createBackupData({
                 encryptedKeyShares,
@@ -8254,9 +8564,9 @@ class DynamicWalletClient {
                 fileName,
                 backupData,
                 accountAddress,
-                walletId: walletData == null ? void 0 : walletData.walletId,
+                walletId: walletData.walletId,
                 environmentId: this.environmentId,
-                chainName: walletData == null ? void 0 : walletData.chainName,
+                chainName: walletData.chainName,
                 logger: this.logger
             });
             return;
@@ -9555,4 +9865,4 @@ DynamicWalletClient.roomsGeneration = 0;
     return ed25519.ExtendedPoint.BASE.multiply(reduced).toRawBytes();
 };
 
-export { BACKUP_FILENAME, CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX, DynamicWalletClient, ENVIRONMENT_SETTINGS_STORAGE_KEY, ERROR_ACCOUNT_ADDRESS_REQUIRED, ERROR_CREATE_WALLET_ACCOUNT, ERROR_EXPORT_PRIVATE_KEY, ERROR_IMPORT_PRIVATE_KEY, ERROR_INCORRECT_PASSWORD, ERROR_KEYGEN_FAILED, ERROR_MULTIPLE_WALLETS_PER_CHAIN, ERROR_NO_KEY_SHARES_BACKED_UP, ERROR_PASSWORD_MISMATCH, ERROR_PASSWORD_REQUIRED, ERROR_PASSWORD_REQUIRED_FOR_ENCRYPTED_WALLET, ERROR_PUBLIC_KEY_MISMATCH, ERROR_REFRESH_NOT_SUPPORTED_FOR_TWO_OF_THREE, ERROR_SIGN_MESSAGE, ERROR_SIGN_TYPED_DATA, ERROR_VERIFY_MESSAGE_SIGNATURE, ERROR_VERIFY_TRANSACTION_SIGNATURE, HEAVY_QUEUE_OPERATIONS, OperationSource, RECOVER_QUEUE_OPERATIONS, ROOM_CACHE_COUNT, ROOM_EXPIRATION_TIME, SIGNED_SESSION_ID_MIN_VERSION, SIGNED_SESSION_ID_MIN_VERSION_BY_NAMESPACE, SIGNED_SESSION_REVERSE_CHANNEL_MIN_VERSION, SIGNED_SESSION_REVERSE_CHANNEL_MIN_VERSION_BY_NAMESPACE, SIGN_QUEUE_OPERATIONS, STORAGE_KEY, StaleLocalSharesError, WalletBusyError, WalletNotReadyError, cancelICloudAuth, createAddCloudProviderToExistingDelegationDistribution, createBackupData, createCloudProviderDistribution, createDelegationOnlyDistribution, createDelegationWithCloudProviderDistribution, createDynamicOnlyDistribution, deleteICloudBackup, downloadStringAsFile, extractPubkey, formatEvmMessage, formatMessage, formatTronMessage, getActiveCloudProviders, getBitcoinAddressTypeFromAddress, getBitcoinAddressTypeFromDerivationPath, getClientKeyShareBackupInfo, getClientKeyShareExportFileName, getDelegatedShareSet, getEd25519PublicKeyFromRawScalar, getGoogleOAuthAccountId, getHttpStatus, getICloudBackup, getMPCSignatureScheme, getMPCSigner, getOfflineRecoveryShareSet, getShareSet, hasCloudProviderBackup, hasDelegatedBackup, hasEncryptedSharesCached, initializeCloudKit, isBrowser, isHeavyQueueOperation, isHexString, isICloudAuthenticated, isMultipleWalletsPerChainRejection, isNonRetryableCeremonyError, isPublicKeyMismatchError, isRecoverQueueOperation, isRoomIdAlreadyUsedError, isSignQueueOperation, isStaleClientSharesError, listICloudBackups, markCeremonyErrorNonRetryable, readEnvironmentSettings, resolveLogLevel, retryPromise, shouldReshareToSameBackups, timeoutPromise };
+export { BACKUP_FILENAME, CLIENT_KEYSHARE_EXPORT_FILENAME_PREFIX, DynamicWalletClient, ENVIRONMENT_SETTINGS_STORAGE_KEY, ERROR_ACCOUNT_ADDRESS_REQUIRED, ERROR_CREATE_WALLET_ACCOUNT, ERROR_EXPORT_PRIVATE_KEY, ERROR_IMPORT_PRIVATE_KEY, ERROR_INCORRECT_PASSWORD, ERROR_KEYGEN_FAILED, ERROR_MULTIPLE_WALLETS_PER_CHAIN, ERROR_NO_KEY_SHARES_BACKED_UP, ERROR_PASSWORD_MISMATCH, ERROR_PASSWORD_REQUIRED, ERROR_PASSWORD_REQUIRED_FOR_ENCRYPTED_WALLET, ERROR_PUBLIC_KEY_MISMATCH, ERROR_REFRESH_NOT_SUPPORTED_FOR_TWO_OF_THREE, ERROR_SIGN_MESSAGE, ERROR_SIGN_TYPED_DATA, ERROR_VERIFY_MESSAGE_SIGNATURE, ERROR_VERIFY_TRANSACTION_SIGNATURE, ExpiredGoogleDriveTokenError, GoogleDriveBackupBlockedError, HEAVY_QUEUE_OPERATIONS, OperationSource, RECOVER_QUEUE_OPERATIONS, ROOM_CACHE_COUNT, ROOM_EXPIRATION_TIME, SIGNED_SESSION_ID_MIN_VERSION, SIGNED_SESSION_ID_MIN_VERSION_BY_NAMESPACE, SIGNED_SESSION_REVERSE_CHANNEL_MIN_VERSION, SIGNED_SESSION_REVERSE_CHANNEL_MIN_VERSION_BY_NAMESPACE, SIGN_QUEUE_OPERATIONS, STORAGE_KEY, StaleLocalSharesError, WalletBusyError, WalletNotReadyError, cancelICloudAuth, createAddCloudProviderToExistingDelegationDistribution, createBackupData, createCloudProviderDistribution, createDelegationOnlyDistribution, createDelegationWithCloudProviderDistribution, createDynamicOnlyDistribution, createOfflineRecoveryDistribution, deleteICloudBackup, downloadStringAsFile, extractPubkey, formatEvmMessage, formatMessage, formatTronMessage, getActiveCloudProviders, getBitcoinAddressTypeFromAddress, getBitcoinAddressTypeFromDerivationPath, getClientKeyShareBackupInfo, getClientKeyShareExportFileName, getDelegatedShareSet, getEd25519PublicKeyFromRawScalar, getGoogleOAuthAccountId, getHttpStatus, getICloudBackup, getMPCSignatureScheme, getMPCSigner, getOfflineRecoveryShareSet, getShareSet, hasCloudProviderBackup, hasDelegatedBackup, hasEncryptedSharesCached, initializeCloudKit, isBrowser, isHeavyQueueOperation, isHexString, isICloudAuthenticated, isMultipleWalletsPerChainRejection, isNonRetryableCeremonyError, isPublicKeyMismatchError, isRecoverQueueOperation, isRoomIdAlreadyUsedError, isSignQueueOperation, isStaleClientSharesError, listICloudBackups, markCeremonyErrorNonRetryable, readEnvironmentSettings, recordOfflineRecoveryBackupLocations, resolveLogLevel, retryPromise, shouldReshareToSameBackups, timeoutPromise };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@dynamic-labs-wallet/browser",
-  "version": "1.0.98",
+  "version": "1.0.99",
   "license": "Licensed under the Dynamic Labs, Inc. Terms Of Service (https://www.dynamic.xyz/terms-conditions)",
   "type": "module",
   "dependencies": {
-    "@dynamic-labs-wallet/core": "1.0.98",
+    "@dynamic-labs-wallet/core": "1.0.99",
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
-    "@dynamic-labs-wallet/primitives": "1.0.98",
+    "@dynamic-labs-wallet/primitives": "1.0.99",
     "@dynamic-labs/sdk-api-core": "^0.0.1093",
     "@noble/curves": "1.8.0",
     "argon2id": "1.0.1",