@dynamic-labs-wallet/browser 1.1.56 → 1.1.58

package/index.cjs

@@ -661,6 +661,12 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
         }
         return resolved;
     }
+    /**
+   * Replaces a session whose single-use nonce was already spent. Keeps `spent` when no
+   * reverse channel can mint one, so legacy hosts behave as before.
+   */ async renew(spent) {
+        return this.canRefresh && this.supportsReverseChannel() ? this.resolve() : spent;
+    }
     /** Whether the configured SDK version requires a signed session ID. */ isRequired() {
         return this.required;
     }
@@ -3857,7 +3863,9 @@ const validateOfflineRecoveryParams = ({ accountAddress, cloudProviderAccessToke
             ],
             offlineRecovery: true,
             mfaToken,
-            recoveryEncryptionPublicKey: params.recoveryEncryptionPublicKey
+            recoveryEncryptionPublicKey: params.recoveryEncryptionPublicKey,
+            approvalQuorum: params.approvalQuorum,
+            proposalId: params.proposalId
         }, providerReshareArgs));
         core.Logger.info('offlineRecovery completed', {
             operation: 'offlineRecovery',
@@ -3987,6 +3995,25 @@ const BACKUP_OPERATION = {
  * path so normal signing stays quiet, well below the 20s queue timeout so a
  * stall is still captured while it is stalling.
  */ const SLOW_SIGN_PREFLIGHT_MS = 1000;
+// The server derives the gated operation from reshareKind, so a backup is
+// marked on every call, governed or not: unmarked, it reads as a plain reshare
+// and the backup's policy gate never runs.
+const reshareKindOf = ({ offlineRecovery, cloudBackup })=>{
+    if (offlineRecovery) return 'offlineRecovery';
+    return cloudBackup ? 'cloudBackup' : undefined;
+};
+/**
+ * The reshare call resolves with an action-required body instead of a room
+ * when a governed request is answered before the stream opens (a 422
+ * `intent_required`). redcoast's reshare route answers on the stream today,
+ * but a body with no room must never reach the ceremony: it would fail there
+ * and roll back local shares that are intact.
+ */ const assertReshareRoomOpened = (data)=>{
+    if (core.isBusinessAccountActionRequired(data)) {
+        throw new core.SigningConsentRequiredError(data);
+    }
+    return data;
+};
 /** A secure-storage key share read slower than this is logged on its own, so reads before the sign queue are visible too. */ const SLOW_KEY_SHARE_READ_MS = 1000;
 const KNOWN_SHARE_SET_TYPES = new Set([
     'rootUser',
@@ -6719,7 +6746,10 @@ class DynamicWalletClient {
             existingClientKeyShares
         };
     }
-    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, initialSignerRules, recoveryEncryptionPublicKey }) {
+    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, initialSignerRules, recoveryEncryptionPublicKey, approvalQuorum, proposalId, cloudBackup = false }) {
+        if (cloudBackup && (offlineRecovery || delegateToProjectEnvironment)) {
+            throw new Error('reshare: cloudBackup excludes offlineRecovery and delegateToProjectEnvironment');
+        }
         if (delegateToProjectEnvironment && offlineRecovery) {
             throw new Error('reshare: delegateToProjectEnvironment and offlineRecovery are mutually exclusive');
         }
@@ -6755,7 +6785,10 @@ class DynamicWalletClient {
                 googleDriveAccessToken,
                 googleDriveTokenSource,
                 initialSignerRules,
-                recoveryEncryptionPublicKey
+                recoveryEncryptionPublicKey,
+                approvalQuorum,
+                proposalId,
+                cloudBackup
             }));
     }
     /** Reshare into a new 2/2 share set for the target signer; seed it to CKS
@@ -7094,6 +7127,7 @@ class DynamicWalletClient {
                     completePromise,
                     errorGate.promise
                 ]),
+            failed: errorGate.promise,
             get fired () {
                 return fired;
             }
@@ -7278,7 +7312,9 @@ class DynamicWalletClient {
    *   {@link recordReshareThresholdScheme} guard on the success path. Wiping
    *   here would strand a wallet whose local keys are still valid.
    */ async rollbackFailedReshareLocalState({ accountAddress, oldThresholdSignatureScheme, offlineRecovery, error }) {
-        if (offlineRecovery || isPublicKeyMismatchError(error) || isStaleClientSharesError(error)) return;
+        if (offlineRecovery || isPublicKeyMismatchError(error) || isStaleClientSharesError(error) || // Consent refusals happen before any ceremony starts — the local shares
+        // are still good and must not be rolled back.
+        error instanceof core.SigningConsentRequiredError) return;
         this.updateWalletMap(accountAddress, {
             thresholdSignatureScheme: oldThresholdSignatureScheme
         });
@@ -7315,7 +7351,7 @@ class DynamicWalletClient {
             clientKeySharesBackupInfo: updatedBackupInfo
         } : {}));
     }
-    async internalReshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, staleShareRetry = false, initialSignerRules, recoveryEncryptionPublicKey }) {
+    async internalReshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, staleShareRetry = false, initialSignerRules, recoveryEncryptionPublicKey, approvalQuorum, proposalId, cloudBackup = false }) {
         const dynamicRequestId = uuid.v4();
         // Password validation - wrapped in try-catch for consistent error handling
         // This path should NOT wipe key shares on failure (shares remain valid)
@@ -7430,7 +7466,11 @@ class DynamicWalletClient {
                     dynamicRequestId
                 }
             });
-            const data = await this.apiClient.reshare(_extends({
+            const reshareKind = reshareKindOf({
+                offlineRecovery,
+                cloudBackup
+            });
+            const data = assertReshareRoomOpened(await this.apiClient.reshare(_extends({
                 walletId: wallet.walletId,
                 shareSetId: wallet.shareSetId,
                 clientKeygenIds: clientKeygenIds,
@@ -7442,17 +7482,19 @@ class DynamicWalletClient {
                 elevatedAccessToken,
                 revokeDelegation,
                 initialSignerRules
-            }, offlineRecovery ? {
-                reshareKind: 'offlineRecovery'
+            }, reshareKind ? {
+                reshareKind
             } : {}, recoveryEncryptionPublicKey ? {
                 offlineRecoveryEncryptionKey: {
                     alg: 'HYBRID-RSA-AES-256',
                     publicKeyPemB64: recoveryEncryptionPublicKey
                 }
             } : {}, {
+                approvalQuorum,
+                proposalId,
                 onError: ceremonyGate.onError,
                 onCeremonyComplete: ceremonyGate.onCeremonyComplete
-            }));
+            })));
             this.logger.info('[WaasReshare] room_created received, starting local MPC', {
                 context: {
                     walletId: wallet.walletId,
@@ -7497,49 +7539,23 @@ class DynamicWalletClient {
             let existingReshareResults;
             let newReshareResults;
             try {
-                const [existingSettled, newSettled] = await Promise.all([
-                    Promise.allSettled(existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newMpcConfig.threshold, keyShare, allPartyKeygenIds))),
-                    Promise.allSettled(newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldMpcConfig.threshold, newMpcConfig.threshold, keygenResult, allPartyKeygenIds)))
-                ]);
-                const collectRejections = (results, keygenIds, role)=>results.reduce((acc, r, i)=>{
-                        if (r.status === 'rejected') {
-                            acc.push({
-                                role,
-                                partyIndex: i,
-                                keygenId: keygenIds[i],
-                                error: r.reason
-                            });
-                        }
-                        return acc;
-                    }, []);
-                const failures = [
-                    ...collectRejections(existingSettled, existingClientKeygenIds, 'existingParty'),
-                    ...collectRejections(newSettled, newClientKeygenIds, 'newParty')
-                ];
-                if (failures.length > 0) {
-                    const firstError = failures[0].error;
-                    const error = firstError instanceof Error ? firstError : new Error(String(firstError));
-                    logError({
-                        message: 'Reshare MPC ceremony party failures',
-                        error,
-                        context: {
-                            dynamicRequestId,
-                            roomId,
-                            failures: failures.map((f)=>({
-                                    role: f.role,
-                                    partyIndex: f.partyIndex,
-                                    keygenId: f.keygenId,
-                                    error: f.error instanceof Error ? f.error.message : String(f.error)
-                                })),
-                            existingSuccessCount: existingSettled.filter((r)=>r.status === 'fulfilled').length,
-                            newSuccessCount: newSettled.filter((r)=>r.status === 'fulfilled').length
-                        }
-                    });
-                    throw error;
-                }
-                existingReshareResults = existingSettled.map((r)=>r.value);
-                newReshareResults = newSettled.map((r)=>r.value);
+                ({ existingReshareResults, newReshareResults } = await this.runReshareParties({
+                    mpcSigner,
+                    roomId,
+                    oldThreshold: oldMpcConfig.threshold,
+                    newThreshold: newMpcConfig.threshold,
+                    allPartyKeygenIds,
+                    existingClientKeyShares,
+                    existingClientKeygenIds,
+                    newClientInitKeygenResults,
+                    newClientKeygenIds,
+                    refused: ceremonyGate.failed,
+                    dynamicRequestId
+                }));
             } catch (reshareError) {
+                // A consent refusal never started the ceremony: the local shares are
+                // intact, so there is nothing to heal.
+                if (reshareError instanceof core.SigningConsentRequiredError) throw reshareError;
                 // Heal stale local shares before rethrowing so a retry succeeds.
                 await this.healStaleShares({
                     accountAddress,
@@ -7669,7 +7685,10 @@ class DynamicWalletClient {
                     googleDriveTokenSource,
                     staleShareRetry: true,
                     initialSignerRules,
-                    recoveryEncryptionPublicKey
+                    recoveryEncryptionPublicKey,
+                    approvalQuorum,
+                    proposalId,
+                    cloudBackup
                 });
             }
             logError({
@@ -7695,7 +7714,67 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async performDelegationOperation({ accountAddress, password, signedSessionId, sessionPublicKey, mfaToken, newThresholdSignatureScheme, revokeDelegation = false, useShareSetReshare = false, operationName, initialSignerRules }) {
+    /**
+   * Runs the client's MPC parties for a reshare until they finish or the
+   * server refuses the reshare on the stream, whichever comes first.
+   */ async runReshareParties({ mpcSigner, roomId, oldThreshold, newThreshold, allPartyKeygenIds, existingClientKeyShares, existingClientKeygenIds, newClientInitKeygenResults, newClientKeygenIds, refused, dynamicRequestId }) {
+        // redcoast answers room_created before wallet-service has accepted the
+        // reshare, so a refusal (consent_required, policy violation) lands on
+        // the stream while the local parties wait for a server that never
+        // joins. Race them against it, as export does, so the refusal surfaces
+        // now rather than as a relay timeout.
+        const mpcPartiesPromise = Promise.all([
+            Promise.allSettled(existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newThreshold, keyShare, allPartyKeygenIds))),
+            Promise.allSettled(newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldThreshold, newThreshold, keygenResult, allPartyKeygenIds)))
+        ]);
+        // eslint-disable-next-line @typescript-eslint/no-empty-function
+        mpcPartiesPromise.catch(()=>{});
+        const [existingSettled, newSettled] = await Promise.race([
+            mpcPartiesPromise,
+            refused
+        ]);
+        const collectRejections = (results, keygenIds, role)=>results.reduce((acc, r, i)=>{
+                if (r.status === 'rejected') {
+                    acc.push({
+                        role,
+                        partyIndex: i,
+                        keygenId: keygenIds[i],
+                        error: r.reason
+                    });
+                }
+                return acc;
+            }, []);
+        const failures = [
+            ...collectRejections(existingSettled, existingClientKeygenIds, 'existingParty'),
+            ...collectRejections(newSettled, newClientKeygenIds, 'newParty')
+        ];
+        if (failures.length > 0) {
+            const firstError = failures[0].error;
+            const error = firstError instanceof Error ? firstError : new Error(String(firstError));
+            logError({
+                message: 'Reshare MPC ceremony party failures',
+                error,
+                context: {
+                    dynamicRequestId,
+                    roomId,
+                    failures: failures.map((f)=>({
+                            role: f.role,
+                            partyIndex: f.partyIndex,
+                            keygenId: f.keygenId,
+                            error: f.error instanceof Error ? f.error.message : String(f.error)
+                        })),
+                    existingSuccessCount: existingSettled.filter((r)=>r.status === 'fulfilled').length,
+                    newSuccessCount: newSettled.filter((r)=>r.status === 'fulfilled').length
+                }
+            });
+            throw error;
+        }
+        return {
+            existingReshareResults: existingSettled.map((r)=>r.value),
+            newReshareResults: newSettled.map((r)=>r.value)
+        };
+    }
+    async performDelegationOperation({ accountAddress, password, signedSessionId, sessionPublicKey, mfaToken, newThresholdSignatureScheme, revokeDelegation = false, useShareSetReshare = false, operationName, initialSignerRules, approvalQuorum, proposalId }) {
         try {
             const delegateToProjectEnvironment = this.featureFlags && this.featureFlags[core.FEATURE_FLAGS.ENABLE_DELEGATED_KEY_SHARES_FLAG] === true;
             if (!delegateToProjectEnvironment) {
@@ -7732,7 +7811,9 @@ class DynamicWalletClient {
                 mfaToken,
                 revokeDelegation,
                 // Do not attach rules on the revoke path.
-                initialSignerRules: revokeDelegation ? undefined : initialSignerRules
+                initialSignerRules: revokeDelegation ? undefined : initialSignerRules,
+                approvalQuorum,
+                proposalId
             });
         } catch (error) {
             logError({
@@ -7745,7 +7826,7 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async delegateKeyShares({ accountAddress, password = undefined, signedSessionId, sessionPublicKey, mfaToken, initialSignerRules }) {
+    async delegateKeyShares({ accountAddress, password = undefined, signedSessionId, sessionPublicKey, mfaToken, initialSignerRules, approvalQuorum, proposalId }) {
         var _this_featureFlags;
         const useShareSetReshare = ((_this_featureFlags = this.featureFlags) == null ? void 0 : _this_featureFlags[core.FEATURE_FLAGS.ENABLE_SHARE_SET_RESHARE]) === true;
         if (useShareSetReshare) {
@@ -7780,15 +7861,12 @@ class DynamicWalletClient {
             signedSessionId,
             sessionPublicKey,
             mfaToken,
-            // FF on: reshare to 2/2 — the new delegated share set is always 2/2
-            // (server + delegated webhook). getReshareConfig now has a 2/2 → 2/2
-            // + delegation case that returns newClientShareCount=1 (the share
-            // routed to the webhook) so the ceremony generates it correctly.
-            // FF off: legacy 2/2 → 2/3 reshare that mutates rootUser.
-            newThresholdSignatureScheme: useShareSetReshare ? core.ThresholdSignatureScheme.TWO_OF_TWO : core.ThresholdSignatureScheme.TWO_OF_THREE,
+            newThresholdSignatureScheme: this.delegationThresholdSignatureScheme(useShareSetReshare),
             operationName: 'delegateKeyShares',
             useShareSetReshare,
-            initialSignerRules
+            initialSignerRules,
+            approvalQuorum,
+            proposalId
         });
         const backupInfo = this.getRequiredWalletFromMap(accountAddress).clientKeySharesBackupInfo;
         const delegatedKeyShares = backupInfo.backups[core.BackupLocation.DELEGATED] || [];
@@ -7852,7 +7930,7 @@ class DynamicWalletClient {
    * operation logic lives in `./offlineRecovery.ts` (cloud-provider-agnostic,
    * so iCloud / other providers slot in there); this method just drives it
    * with the client instance and returns the exported set's own backups.
-   */ async offlineRecovery({ accountAddress, password = undefined, signedSessionId, sessionPublicKey, mfaToken, cloudProvider = DEFAULT_OFFLINE_RECOVERY_CLOUD_PROVIDER, cloudProviderAccessToken, recoveryEncryptionPublicKey }) {
+   */ async offlineRecovery({ accountAddress, password = undefined, signedSessionId, sessionPublicKey, mfaToken, cloudProvider = DEFAULT_OFFLINE_RECOVERY_CLOUD_PROVIDER, cloudProviderAccessToken, recoveryEncryptionPublicKey, approvalQuorum, proposalId }) {
         await performOfflineRecoveryOperation(this, {
             accountAddress,
             password,
@@ -7861,7 +7939,9 @@ class DynamicWalletClient {
             mfaToken,
             cloudProvider,
             cloudProviderAccessToken,
-            recoveryEncryptionPublicKey
+            recoveryEncryptionPublicKey,
+            approvalQuorum,
+            proposalId
         });
         // The exported set's own locations. Not `backups[cloudProvider]`: that is
         // rootUser's record for the provider, which this operation never writes.
@@ -7916,6 +7996,73 @@ class DynamicWalletClient {
             initiatorUserId
         });
     }
+    /** The scheme a delegation reshare moves the wallet to: share-set delegation mints its own 2/2 set. */ delegationThresholdSignatureScheme(useShareSetReshare) {
+        // FF on: reshare to 2/2 — the new delegated share set is always 2/2
+        // (server + delegated webhook). getReshareConfig now has a 2/2 → 2/2
+        // + delegation case that returns newClientShareCount=1 (the share
+        // routed to the webhook) so the ceremony generates it correctly.
+        // FF off: legacy 2/2 → 2/3 reshare that mutates rootUser.
+        return useShareSetReshare ? core.ThresholdSignatureScheme.TWO_OF_TWO : core.ThresholdSignatureScheme.TWO_OF_THREE;
+    }
+    /**
+   * Builds the reshare Intent for a governed reshare entry point, to be
+   * signed with the session key and sent as `approvalQuorum` on that same
+   * entry point (`backupKeySharesToGoogleDrive`/`backupKeySharesToICloud`,
+   * `delegateKeyShares` or `offlineRecovery`).
+   *
+   * The Intent echoes the fields that entry point sends, so it is built here
+   * from the same wallet state. An offline recovery's Intent must also echo
+   * the recovery key the server will use: pass the one the `INTENT_REQUIRED`
+   * consent error carried. Makes no API call and starts no ceremony.
+   */ async prepareReshareIntent({ accountAddress, password = undefined, signedSessionId, businessAccountId, initiatorUserId, completeBy, operation, offlineRecoveryEncryptionKey }) {
+        if (operation === 'offlineRecovery' !== !!offlineRecoveryEncryptionKey) {
+            throw new Error('prepareReshareIntent: offlineRecoveryEncryptionKey is required for offlineRecovery, from its INTENT_REQUIRED consent error, and invalid otherwise');
+        }
+        // Refreshed from the server, as the backup entry point does before it
+        // picks its route: a wallet delegated from another device since it was
+        // cached backs up without a reshare, and must not get an intent for one.
+        await this.getWallet({
+            accountAddress,
+            password,
+            signedSessionId,
+            refresh: true
+        });
+        const walletData = this.getRequiredWalletFromMap(accountAddress);
+        const identity = {
+            accountAddress,
+            businessAccountId,
+            completeBy,
+            initiatorUserId
+        };
+        if (operation === 'delegatedAccess') {
+            var _this_featureFlags;
+            const useShareSetReshare = ((_this_featureFlags = this.featureFlags) == null ? void 0 : _this_featureFlags[core.FEATURE_FLAGS.ENABLE_SHARE_SET_RESHARE]) === true;
+            return core.createReshareIntent(_extends({}, identity, {
+                newThresholdSignatureScheme: this.delegationThresholdSignatureScheme(useShareSetReshare),
+                reshareType: 'delegatedAccess'
+            }));
+        }
+        if (operation === 'offlineRecovery') {
+            return core.createReshareIntent(_extends({}, identity, {
+                // performOfflineRecoveryOperation always pins the exported set at 2/2.
+                newThresholdSignatureScheme: core.ThresholdSignatureScheme.TWO_OF_TWO,
+                offlineRecoveryEncryptionKey,
+                reshareType: 'offlineRecovery'
+            }));
+        }
+        // A cloud backup reshares only from 2/2, or from a non-delegated 2/3
+        // (backupKeySharesToCloudProvider); any other wallet backs up without a
+        // reshare, so there is nothing to approve.
+        const scheme = walletData.thresholdSignatureScheme;
+        const reshares = scheme === core.ThresholdSignatureScheme.TWO_OF_TWO || scheme === core.ThresholdSignatureScheme.TWO_OF_THREE && !hasDelegatedBackup(walletData.clientKeySharesBackupInfo, walletData.otherShareSets);
+        if (!reshares) {
+            throw new Error('prepareReshareIntent: this wallet backs up without a reshare, so no approval applies');
+        }
+        return core.createReshareIntent(_extends({}, identity, {
+            newThresholdSignatureScheme: core.ThresholdSignatureScheme.TWO_OF_THREE,
+            reshareType: 'cloudBackup'
+        }));
+    }
     async exportKey({ accountAddress, chainName, bitcoinConfig, password = undefined, signedSessionId, mfaToken, elevatedAccessToken, approvalQuorum, proposalId, traceContext }) {
         // Public entry point delegates to the private implementation. Keeping the
         // `staleShareRetry` flag off the public signature mirrors sign/refresh/
@@ -9540,11 +9687,12 @@ class DynamicWalletClient {
                 passwordUpdateBatchId,
                 dynamicRequestId
             });
+            let spentSignedSession = false;
             if (isWalletPasswordEncrypted(wallet)) {
                 if (!resolvedExistingPassword) {
                     throw new Error(ERROR_EXISTING_PASSWORD_REQUIRED);
                 }
-                await this.validatePasswordAgainstEncryptedShares({
+                spentSignedSession = await this.validatePasswordAgainstEncryptedShares({
                     wallet: wallet,
                     address: accountAddress,
                     password: resolvedExistingPassword,
@@ -9552,21 +9700,24 @@ class DynamicWalletClient {
                     errorMessage: ERROR_INCORRECT_PASSWORD
                 });
             }
-            const backup = ()=>this.storeEncryptedBackupByWallet({
+            // Every relay call burns its session's single-use nonce, so the backup needs a fresh one.
+            const backupSessionId = spentSignedSession ? await this.signedSession.renew(signedSessionId) : signedSessionId;
+            const backup = (sessionId)=>this.storeEncryptedBackupByWallet({
                     accountAddress,
                     password: newPassword,
                     existingPassword: resolvedExistingPassword,
-                    signedSessionId,
+                    signedSessionId: sessionId,
                     sessionPublicKey,
                     passwordUpdateBatchId,
                     passwordSetByBA: false
                 });
             let backupData;
             try {
-                backupData = await backup();
+                backupData = await backup(backupSessionId);
             } catch (error) {
                 if (!(error instanceof StaleLocalSharesError) || !error.localSharesRefreshed) throw error;
-                backupData = await backup();
+                // The stale-share refresh spent the session the failed attempt carried.
+                backupData = await backup(await this.signedSession.renew(backupSessionId));
             }
             // Not named passwordUpdateStatus: the logger redacts string values of password* keys.
             this.logPasswordOperationSuccess('updatePassword', {
@@ -9705,6 +9856,8 @@ class DynamicWalletClient {
    */ async validatePasswordAgainstEncryptedShares({ wallet, address, password, signedSessionId, errorMessage = ERROR_PASSWORD_MISMATCH }) {
         const storageKey = `${normalizeAddress(address)}${core.ENCRYPTED_SHARES_STORAGE_SUFFIX}`;
         let encryptedData = await this.storage.getItem(storageKey);
+        // Fetching the shares spends the session's single-use nonce; callers must renew it.
+        const spentSignedSession = !encryptedData;
         if (!encryptedData) {
             const { shares } = this.recoverStrategy({
                 clientKeyShareBackupInfo: wallet.clientKeySharesBackupInfo,
@@ -9743,7 +9896,7 @@ class DynamicWalletClient {
         }
         const credential = extractFirstEncryptedCredential(encryptedData);
         if (!credential) {
-            return;
+            return spentSignedSession;
         }
         try {
             await this.decryptKeyShare({
@@ -9756,6 +9909,7 @@ class DynamicWalletClient {
             }
             throw error;
         }
+        return spentSignedSession;
     }
     isPasswordRequired() {
         var _readEnvironmentSettings_sdk_waas, _readEnvironmentSettings_sdk, _readEnvironmentSettings;
@@ -10083,7 +10237,7 @@ class DynamicWalletClient {
    * - For 2-of-2 wallets: Automatically reshares to 2-of-3 threshold, then distributes shares (1 to backend, 1 to cloud)
    * - For non-delegated 2-of-3 wallets: same-scheme reshare to mint a fresh recovery share
    * - For delegated 2-of-3 (and other) wallets: storeEncryptedBackupByWallet backs up to backend and cloud
-   */ async backupKeySharesToCloudProvider({ accountAddress, password, signedSessionId, sessionPublicKey, backupLocation, googleDriveAccessToken, googleDriveTokenSource }) {
+   */ async backupKeySharesToCloudProvider({ accountAddress, password, signedSessionId, sessionPublicKey, backupLocation, googleDriveAccessToken, googleDriveTokenSource, approvalQuorum, proposalId }) {
         try {
             await this.getWallet({
                 accountAddress,
@@ -10107,7 +10261,10 @@ class DynamicWalletClient {
                         backupLocation
                     ],
                     googleDriveAccessToken,
-                    googleDriveTokenSource
+                    googleDriveTokenSource,
+                    cloudBackup: true,
+                    approvalQuorum,
+                    proposalId
                 });
             } else if (currentThresholdSignatureScheme === core.ThresholdSignatureScheme.TWO_OF_THREE && !hasDelegatedBackup(walletData.clientKeySharesBackupInfo, walletData.otherShareSets)) {
                 await this.reshareNonDelegatedTwoOfThree({
@@ -10117,7 +10274,9 @@ class DynamicWalletClient {
                     signedSessionId,
                     sessionPublicKey,
                     googleDriveAccessToken,
-                    googleDriveTokenSource
+                    googleDriveTokenSource,
+                    approvalQuorum,
+                    proposalId
                 });
             } else {
                 await this.storeEncryptedBackupByWallet({
@@ -10149,7 +10308,7 @@ class DynamicWalletClient {
    * reshare that mints a fresh recovery share. The fresh share is redistributed to
    * every provider already holding a backup plus the requested one,
    * restricted to providers the reshare can deliver to.
-   */ async reshareNonDelegatedTwoOfThree({ accountAddress, backupLocation, password, signedSessionId, sessionPublicKey, googleDriveAccessToken, googleDriveTokenSource }) {
+   */ async reshareNonDelegatedTwoOfThree({ accountAddress, backupLocation, password, signedSessionId, sessionPublicKey, googleDriveAccessToken, googleDriveTokenSource, approvalQuorum, proposalId }) {
         const walletData = this.getRequiredWalletFromMap(accountAddress);
         const cloudProviders = new Set([
             ...getActiveCloudProviders(walletData.clientKeySharesBackupInfo).filter((provider)=>provider === core.BackupLocation.GOOGLE_DRIVE || provider === core.BackupLocation.ICLOUD),
@@ -10184,7 +10343,10 @@ class DynamicWalletClient {
             sessionPublicKey,
             cloudProviders: Array.from(cloudProviders),
             googleDriveAccessToken: resolvedDrive.googleDriveAccessToken,
-            googleDriveTokenSource: resolvedDrive.googleDriveTokenSource
+            googleDriveTokenSource: resolvedDrive.googleDriveTokenSource,
+            cloudBackup: true,
+            approvalQuorum,
+            proposalId
         });
     }
     /**
@@ -10254,7 +10416,7 @@ class DynamicWalletClient {
    * @param params.signedSessionId - Optional signed session ID for authentication
    * @param params.googleDriveAccessToken - Optional Google OAuth access token. When provided, the SDK uses it directly
    *   instead of looking up the user's linked Google account and exchanging it for a token via the Dynamic backend.
-   */ async backupKeySharesToGoogleDrive({ accountAddress, password, signedSessionId, sessionPublicKey, googleDriveAccessToken }) {
+   */ async backupKeySharesToGoogleDrive({ accountAddress, password, signedSessionId, sessionPublicKey, googleDriveAccessToken, approvalQuorum, proposalId }) {
         // Track whether the Drive token was supplied by the caller (external) or
         // will be resolved from the user's stored OAuth account (stored_oauth), so
         // backups using a token we don't control are auditable. Enum only — the
@@ -10292,7 +10454,9 @@ class DynamicWalletClient {
                 googleDriveAccessToken: resolvedAccessToken,
                 // Persist which token source backed up the Google Drive location for
                 // audit (enum only — never the token value).
-                googleDriveTokenSource: tokenSource
+                googleDriveTokenSource: tokenSource,
+                approvalQuorum,
+                proposalId
             });
             success = true;
         } finally{
@@ -10365,13 +10529,23 @@ class DynamicWalletClient {
    * @param params.accountAddress - The wallet account address to backup
    * @param params.password - Optional password for encryption (uses environment ID if not provided)
    * @param params.signedSessionId - Optional signed session ID for authentication
-   */ async backupKeySharesToICloud({ accountAddress, password, signedSessionId, sessionPublicKey }) {
+   */ async backupKeySharesToICloud({ accountAddress, password, signedSessionId, sessionPublicKey, approvalQuorum, proposalId }) {
+        // Refreshed from the server, as the Google Drive backup and
+        // prepareReshareIntent do: the route (reshare or not) must be picked from
+        // the same wallet state the reshare intent was built from.
+        await this.getWallet({
+            accountAddress,
+            signedSessionId,
+            refresh: true
+        });
         return this.backupKeySharesToCloudProvider({
             accountAddress,
             password,
             signedSessionId,
             sessionPublicKey,
-            backupLocation: core.BackupLocation.ICLOUD
+            backupLocation: core.BackupLocation.ICLOUD,
+            approvalQuorum,
+            proposalId
         });
     }
     /**