@dynamic-labs-wallet/browser 1.1.56 → 1.1.58

package/index.esm.js

@@ -1,4 +1,4 @@
-import { BitcoinAddressType, MPC_RELAY_PROD_API_URL, DEFAULT_ED25519_VARIANT, getMPCChainConfig, parseNamespacedVersion, WalletApiError, NETWORK_ERROR_STATUS, formatRawMessageForSigning, BackupLocation, ENCRYPTED_SHARES_STORAGE_SUFFIX, Logger, createRejectablePromise, handleAxiosError, extractServerErrorCode, WalletOperation, ThresholdSignatureScheme, WalletReadyState, classifyForwardMpcError, isRecoveredForwardMpcConnectionChurn, FEATURE_FLAGS, getClientThreshold, MPC_CONFIG, forwardMpcMayHaveJoinedRoom, normalizeAndValidatePrivateKey, getTSSConfig, toJsonSafeContext, serializeMessageForForwardMPC, isEvmCompatibleChain, serializeError, withTraceId, attachRequestIds, getReshareConfig, isBusinessAccountActionRequired, createExportIntent, getRequiredExternalKeyShareId, verifiedCredentialNameToChainEnum, AuthMode, NoopLogger, DynamicApiClient, BusinessAccountClient, getEnvironmentFromUrl, IFRAME_DOMAIN_MAP } from '@dynamic-labs-wallet/core';
+import { BitcoinAddressType, MPC_RELAY_PROD_API_URL, DEFAULT_ED25519_VARIANT, getMPCChainConfig, parseNamespacedVersion, WalletApiError, NETWORK_ERROR_STATUS, formatRawMessageForSigning, BackupLocation, ENCRYPTED_SHARES_STORAGE_SUFFIX, Logger, createRejectablePromise, handleAxiosError, extractServerErrorCode, WalletOperation, ThresholdSignatureScheme, WalletReadyState, classifyForwardMpcError, isRecoveredForwardMpcConnectionChurn, FEATURE_FLAGS, getClientThreshold, MPC_CONFIG, forwardMpcMayHaveJoinedRoom, normalizeAndValidatePrivateKey, getTSSConfig, toJsonSafeContext, serializeMessageForForwardMPC, isEvmCompatibleChain, serializeError, withTraceId, attachRequestIds, getReshareConfig, isBusinessAccountActionRequired, SigningConsentRequiredError, createExportIntent, createReshareIntent, getRequiredExternalKeyShareId, verifiedCredentialNameToChainEnum, AuthMode, NoopLogger, DynamicApiClient, BusinessAccountClient, getEnvironmentFromUrl, IFRAME_DOMAIN_MAP } from '@dynamic-labs-wallet/core';
 export * from '@dynamic-labs-wallet/core';
 export { Logger } from '@dynamic-labs-wallet/core';
 import { EdBls12377, BIP340, Ed25519, ExportableEd25519, Ecdsa, MessageHash, EcdsaSignature, EcdsaKeygenResult, ExportableEd25519KeygenResult, Ed25519KeygenResult, BIP340KeygenResult } from '#internal/web';
@@ -662,6 +662,12 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
         }
         return resolved;
     }
+    /**
+   * Replaces a session whose single-use nonce was already spent. Keeps `spent` when no
+   * reverse channel can mint one, so legacy hosts behave as before.
+   */ async renew(spent) {
+        return this.canRefresh && this.supportsReverseChannel() ? this.resolve() : spent;
+    }
     /** Whether the configured SDK version requires a signed session ID. */ isRequired() {
         return this.required;
     }
@@ -3858,7 +3864,9 @@ const validateOfflineRecoveryParams = ({ accountAddress, cloudProviderAccessToke
             ],
             offlineRecovery: true,
             mfaToken,
-            recoveryEncryptionPublicKey: params.recoveryEncryptionPublicKey
+            recoveryEncryptionPublicKey: params.recoveryEncryptionPublicKey,
+            approvalQuorum: params.approvalQuorum,
+            proposalId: params.proposalId
         }, providerReshareArgs));
         Logger.info('offlineRecovery completed', {
             operation: 'offlineRecovery',
@@ -3988,6 +3996,25 @@ const BACKUP_OPERATION = {
  * path so normal signing stays quiet, well below the 20s queue timeout so a
  * stall is still captured while it is stalling.
  */ const SLOW_SIGN_PREFLIGHT_MS = 1000;
+// The server derives the gated operation from reshareKind, so a backup is
+// marked on every call, governed or not: unmarked, it reads as a plain reshare
+// and the backup's policy gate never runs.
+const reshareKindOf = ({ offlineRecovery, cloudBackup })=>{
+    if (offlineRecovery) return 'offlineRecovery';
+    return cloudBackup ? 'cloudBackup' : undefined;
+};
+/**
+ * The reshare call resolves with an action-required body instead of a room
+ * when a governed request is answered before the stream opens (a 422
+ * `intent_required`). redcoast's reshare route answers on the stream today,
+ * but a body with no room must never reach the ceremony: it would fail there
+ * and roll back local shares that are intact.
+ */ const assertReshareRoomOpened = (data)=>{
+    if (isBusinessAccountActionRequired(data)) {
+        throw new SigningConsentRequiredError(data);
+    }
+    return data;
+};
 /** A secure-storage key share read slower than this is logged on its own, so reads before the sign queue are visible too. */ const SLOW_KEY_SHARE_READ_MS = 1000;
 const KNOWN_SHARE_SET_TYPES = new Set([
     'rootUser',
@@ -6720,7 +6747,10 @@ class DynamicWalletClient {
             existingClientKeyShares
         };
     }
-    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, initialSignerRules, recoveryEncryptionPublicKey }) {
+    async reshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, initialSignerRules, recoveryEncryptionPublicKey, approvalQuorum, proposalId, cloudBackup = false }) {
+        if (cloudBackup && (offlineRecovery || delegateToProjectEnvironment)) {
+            throw new Error('reshare: cloudBackup excludes offlineRecovery and delegateToProjectEnvironment');
+        }
         if (delegateToProjectEnvironment && offlineRecovery) {
             throw new Error('reshare: delegateToProjectEnvironment and offlineRecovery are mutually exclusive');
         }
@@ -6756,7 +6786,10 @@ class DynamicWalletClient {
                 googleDriveAccessToken,
                 googleDriveTokenSource,
                 initialSignerRules,
-                recoveryEncryptionPublicKey
+                recoveryEncryptionPublicKey,
+                approvalQuorum,
+                proposalId,
+                cloudBackup
             }));
     }
     /** Reshare into a new 2/2 share set for the target signer; seed it to CKS
@@ -7095,6 +7128,7 @@ class DynamicWalletClient {
                     completePromise,
                     errorGate.promise
                 ]),
+            failed: errorGate.promise,
             get fired () {
                 return fired;
             }
@@ -7279,7 +7313,9 @@ class DynamicWalletClient {
    *   {@link recordReshareThresholdScheme} guard on the success path. Wiping
    *   here would strand a wallet whose local keys are still valid.
    */ async rollbackFailedReshareLocalState({ accountAddress, oldThresholdSignatureScheme, offlineRecovery, error }) {
-        if (offlineRecovery || isPublicKeyMismatchError(error) || isStaleClientSharesError(error)) return;
+        if (offlineRecovery || isPublicKeyMismatchError(error) || isStaleClientSharesError(error) || // Consent refusals happen before any ceremony starts — the local shares
+        // are still good and must not be rolled back.
+        error instanceof SigningConsentRequiredError) return;
         this.updateWalletMap(accountAddress, {
             thresholdSignatureScheme: oldThresholdSignatureScheme
         });
@@ -7316,7 +7352,7 @@ class DynamicWalletClient {
             clientKeySharesBackupInfo: updatedBackupInfo
         } : {}));
     }
-    async internalReshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, staleShareRetry = false, initialSignerRules, recoveryEncryptionPublicKey }) {
+    async internalReshare({ chainName, accountAddress, oldThresholdSignatureScheme, newThresholdSignatureScheme, password = undefined, signedSessionId, sessionPublicKey, cloudProviders = [], delegateToProjectEnvironment = false, offlineRecovery = false, mfaToken, elevatedAccessToken, revokeDelegation = false, googleDriveAccessToken, googleDriveTokenSource, staleShareRetry = false, initialSignerRules, recoveryEncryptionPublicKey, approvalQuorum, proposalId, cloudBackup = false }) {
         const dynamicRequestId = v4();
         // Password validation - wrapped in try-catch for consistent error handling
         // This path should NOT wipe key shares on failure (shares remain valid)
@@ -7431,7 +7467,11 @@ class DynamicWalletClient {
                     dynamicRequestId
                 }
             });
-            const data = await this.apiClient.reshare(_extends({
+            const reshareKind = reshareKindOf({
+                offlineRecovery,
+                cloudBackup
+            });
+            const data = assertReshareRoomOpened(await this.apiClient.reshare(_extends({
                 walletId: wallet.walletId,
                 shareSetId: wallet.shareSetId,
                 clientKeygenIds: clientKeygenIds,
@@ -7443,17 +7483,19 @@ class DynamicWalletClient {
                 elevatedAccessToken,
                 revokeDelegation,
                 initialSignerRules
-            }, offlineRecovery ? {
-                reshareKind: 'offlineRecovery'
+            }, reshareKind ? {
+                reshareKind
             } : {}, recoveryEncryptionPublicKey ? {
                 offlineRecoveryEncryptionKey: {
                     alg: 'HYBRID-RSA-AES-256',
                     publicKeyPemB64: recoveryEncryptionPublicKey
                 }
             } : {}, {
+                approvalQuorum,
+                proposalId,
                 onError: ceremonyGate.onError,
                 onCeremonyComplete: ceremonyGate.onCeremonyComplete
-            }));
+            })));
             this.logger.info('[WaasReshare] room_created received, starting local MPC', {
                 context: {
                     walletId: wallet.walletId,
@@ -7498,49 +7540,23 @@ class DynamicWalletClient {
             let existingReshareResults;
             let newReshareResults;
             try {
-                const [existingSettled, newSettled] = await Promise.all([
-                    Promise.allSettled(existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newMpcConfig.threshold, keyShare, allPartyKeygenIds))),
-                    Promise.allSettled(newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldMpcConfig.threshold, newMpcConfig.threshold, keygenResult, allPartyKeygenIds)))
-                ]);
-                const collectRejections = (results, keygenIds, role)=>results.reduce((acc, r, i)=>{
-                        if (r.status === 'rejected') {
-                            acc.push({
-                                role,
-                                partyIndex: i,
-                                keygenId: keygenIds[i],
-                                error: r.reason
-                            });
-                        }
-                        return acc;
-                    }, []);
-                const failures = [
-                    ...collectRejections(existingSettled, existingClientKeygenIds, 'existingParty'),
-                    ...collectRejections(newSettled, newClientKeygenIds, 'newParty')
-                ];
-                if (failures.length > 0) {
-                    const firstError = failures[0].error;
-                    const error = firstError instanceof Error ? firstError : new Error(String(firstError));
-                    logError({
-                        message: 'Reshare MPC ceremony party failures',
-                        error,
-                        context: {
-                            dynamicRequestId,
-                            roomId,
-                            failures: failures.map((f)=>({
-                                    role: f.role,
-                                    partyIndex: f.partyIndex,
-                                    keygenId: f.keygenId,
-                                    error: f.error instanceof Error ? f.error.message : String(f.error)
-                                })),
-                            existingSuccessCount: existingSettled.filter((r)=>r.status === 'fulfilled').length,
-                            newSuccessCount: newSettled.filter((r)=>r.status === 'fulfilled').length
-                        }
-                    });
-                    throw error;
-                }
-                existingReshareResults = existingSettled.map((r)=>r.value);
-                newReshareResults = newSettled.map((r)=>r.value);
+                ({ existingReshareResults, newReshareResults } = await this.runReshareParties({
+                    mpcSigner,
+                    roomId,
+                    oldThreshold: oldMpcConfig.threshold,
+                    newThreshold: newMpcConfig.threshold,
+                    allPartyKeygenIds,
+                    existingClientKeyShares,
+                    existingClientKeygenIds,
+                    newClientInitKeygenResults,
+                    newClientKeygenIds,
+                    refused: ceremonyGate.failed,
+                    dynamicRequestId
+                }));
             } catch (reshareError) {
+                // A consent refusal never started the ceremony: the local shares are
+                // intact, so there is nothing to heal.
+                if (reshareError instanceof SigningConsentRequiredError) throw reshareError;
                 // Heal stale local shares before rethrowing so a retry succeeds.
                 await this.healStaleShares({
                     accountAddress,
@@ -7670,7 +7686,10 @@ class DynamicWalletClient {
                     googleDriveTokenSource,
                     staleShareRetry: true,
                     initialSignerRules,
-                    recoveryEncryptionPublicKey
+                    recoveryEncryptionPublicKey,
+                    approvalQuorum,
+                    proposalId,
+                    cloudBackup
                 });
             }
             logError({
@@ -7696,7 +7715,67 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async performDelegationOperation({ accountAddress, password, signedSessionId, sessionPublicKey, mfaToken, newThresholdSignatureScheme, revokeDelegation = false, useShareSetReshare = false, operationName, initialSignerRules }) {
+    /**
+   * Runs the client's MPC parties for a reshare until they finish or the
+   * server refuses the reshare on the stream, whichever comes first.
+   */ async runReshareParties({ mpcSigner, roomId, oldThreshold, newThreshold, allPartyKeygenIds, existingClientKeyShares, existingClientKeygenIds, newClientInitKeygenResults, newClientKeygenIds, refused, dynamicRequestId }) {
+        // redcoast answers room_created before wallet-service has accepted the
+        // reshare, so a refusal (consent_required, policy violation) lands on
+        // the stream while the local parties wait for a server that never
+        // joins. Race them against it, as export does, so the refusal surfaces
+        // now rather than as a relay timeout.
+        const mpcPartiesPromise = Promise.all([
+            Promise.allSettled(existingClientKeyShares.map((keyShare)=>mpcSigner.reshareRemainingParty(roomId, newThreshold, keyShare, allPartyKeygenIds))),
+            Promise.allSettled(newClientInitKeygenResults.map((keygenResult)=>mpcSigner.reshareNewParty(roomId, oldThreshold, newThreshold, keygenResult, allPartyKeygenIds)))
+        ]);
+        // eslint-disable-next-line @typescript-eslint/no-empty-function
+        mpcPartiesPromise.catch(()=>{});
+        const [existingSettled, newSettled] = await Promise.race([
+            mpcPartiesPromise,
+            refused
+        ]);
+        const collectRejections = (results, keygenIds, role)=>results.reduce((acc, r, i)=>{
+                if (r.status === 'rejected') {
+                    acc.push({
+                        role,
+                        partyIndex: i,
+                        keygenId: keygenIds[i],
+                        error: r.reason
+                    });
+                }
+                return acc;
+            }, []);
+        const failures = [
+            ...collectRejections(existingSettled, existingClientKeygenIds, 'existingParty'),
+            ...collectRejections(newSettled, newClientKeygenIds, 'newParty')
+        ];
+        if (failures.length > 0) {
+            const firstError = failures[0].error;
+            const error = firstError instanceof Error ? firstError : new Error(String(firstError));
+            logError({
+                message: 'Reshare MPC ceremony party failures',
+                error,
+                context: {
+                    dynamicRequestId,
+                    roomId,
+                    failures: failures.map((f)=>({
+                            role: f.role,
+                            partyIndex: f.partyIndex,
+                            keygenId: f.keygenId,
+                            error: f.error instanceof Error ? f.error.message : String(f.error)
+                        })),
+                    existingSuccessCount: existingSettled.filter((r)=>r.status === 'fulfilled').length,
+                    newSuccessCount: newSettled.filter((r)=>r.status === 'fulfilled').length
+                }
+            });
+            throw error;
+        }
+        return {
+            existingReshareResults: existingSettled.map((r)=>r.value),
+            newReshareResults: newSettled.map((r)=>r.value)
+        };
+    }
+    async performDelegationOperation({ accountAddress, password, signedSessionId, sessionPublicKey, mfaToken, newThresholdSignatureScheme, revokeDelegation = false, useShareSetReshare = false, operationName, initialSignerRules, approvalQuorum, proposalId }) {
         try {
             const delegateToProjectEnvironment = this.featureFlags && this.featureFlags[FEATURE_FLAGS.ENABLE_DELEGATED_KEY_SHARES_FLAG] === true;
             if (!delegateToProjectEnvironment) {
@@ -7733,7 +7812,9 @@ class DynamicWalletClient {
                 mfaToken,
                 revokeDelegation,
                 // Do not attach rules on the revoke path.
-                initialSignerRules: revokeDelegation ? undefined : initialSignerRules
+                initialSignerRules: revokeDelegation ? undefined : initialSignerRules,
+                approvalQuorum,
+                proposalId
             });
         } catch (error) {
             logError({
@@ -7746,7 +7827,7 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async delegateKeyShares({ accountAddress, password = undefined, signedSessionId, sessionPublicKey, mfaToken, initialSignerRules }) {
+    async delegateKeyShares({ accountAddress, password = undefined, signedSessionId, sessionPublicKey, mfaToken, initialSignerRules, approvalQuorum, proposalId }) {
         var _this_featureFlags;
         const useShareSetReshare = ((_this_featureFlags = this.featureFlags) == null ? void 0 : _this_featureFlags[FEATURE_FLAGS.ENABLE_SHARE_SET_RESHARE]) === true;
         if (useShareSetReshare) {
@@ -7781,15 +7862,12 @@ class DynamicWalletClient {
             signedSessionId,
             sessionPublicKey,
             mfaToken,
-            // FF on: reshare to 2/2 — the new delegated share set is always 2/2
-            // (server + delegated webhook). getReshareConfig now has a 2/2 → 2/2
-            // + delegation case that returns newClientShareCount=1 (the share
-            // routed to the webhook) so the ceremony generates it correctly.
-            // FF off: legacy 2/2 → 2/3 reshare that mutates rootUser.
-            newThresholdSignatureScheme: useShareSetReshare ? ThresholdSignatureScheme.TWO_OF_TWO : ThresholdSignatureScheme.TWO_OF_THREE,
+            newThresholdSignatureScheme: this.delegationThresholdSignatureScheme(useShareSetReshare),
             operationName: 'delegateKeyShares',
             useShareSetReshare,
-            initialSignerRules
+            initialSignerRules,
+            approvalQuorum,
+            proposalId
         });
         const backupInfo = this.getRequiredWalletFromMap(accountAddress).clientKeySharesBackupInfo;
         const delegatedKeyShares = backupInfo.backups[BackupLocation.DELEGATED] || [];
@@ -7853,7 +7931,7 @@ class DynamicWalletClient {
    * operation logic lives in `./offlineRecovery.ts` (cloud-provider-agnostic,
    * so iCloud / other providers slot in there); this method just drives it
    * with the client instance and returns the exported set's own backups.
-   */ async offlineRecovery({ accountAddress, password = undefined, signedSessionId, sessionPublicKey, mfaToken, cloudProvider = DEFAULT_OFFLINE_RECOVERY_CLOUD_PROVIDER, cloudProviderAccessToken, recoveryEncryptionPublicKey }) {
+   */ async offlineRecovery({ accountAddress, password = undefined, signedSessionId, sessionPublicKey, mfaToken, cloudProvider = DEFAULT_OFFLINE_RECOVERY_CLOUD_PROVIDER, cloudProviderAccessToken, recoveryEncryptionPublicKey, approvalQuorum, proposalId }) {
         await performOfflineRecoveryOperation(this, {
             accountAddress,
             password,
@@ -7862,7 +7940,9 @@ class DynamicWalletClient {
             mfaToken,
             cloudProvider,
             cloudProviderAccessToken,
-            recoveryEncryptionPublicKey
+            recoveryEncryptionPublicKey,
+            approvalQuorum,
+            proposalId
         });
         // The exported set's own locations. Not `backups[cloudProvider]`: that is
         // rootUser's record for the provider, which this operation never writes.
@@ -7917,6 +7997,73 @@ class DynamicWalletClient {
             initiatorUserId
         });
     }
+    /** The scheme a delegation reshare moves the wallet to: share-set delegation mints its own 2/2 set. */ delegationThresholdSignatureScheme(useShareSetReshare) {
+        // FF on: reshare to 2/2 — the new delegated share set is always 2/2
+        // (server + delegated webhook). getReshareConfig now has a 2/2 → 2/2
+        // + delegation case that returns newClientShareCount=1 (the share
+        // routed to the webhook) so the ceremony generates it correctly.
+        // FF off: legacy 2/2 → 2/3 reshare that mutates rootUser.
+        return useShareSetReshare ? ThresholdSignatureScheme.TWO_OF_TWO : ThresholdSignatureScheme.TWO_OF_THREE;
+    }
+    /**
+   * Builds the reshare Intent for a governed reshare entry point, to be
+   * signed with the session key and sent as `approvalQuorum` on that same
+   * entry point (`backupKeySharesToGoogleDrive`/`backupKeySharesToICloud`,
+   * `delegateKeyShares` or `offlineRecovery`).
+   *
+   * The Intent echoes the fields that entry point sends, so it is built here
+   * from the same wallet state. An offline recovery's Intent must also echo
+   * the recovery key the server will use: pass the one the `INTENT_REQUIRED`
+   * consent error carried. Makes no API call and starts no ceremony.
+   */ async prepareReshareIntent({ accountAddress, password = undefined, signedSessionId, businessAccountId, initiatorUserId, completeBy, operation, offlineRecoveryEncryptionKey }) {
+        if (operation === 'offlineRecovery' !== !!offlineRecoveryEncryptionKey) {
+            throw new Error('prepareReshareIntent: offlineRecoveryEncryptionKey is required for offlineRecovery, from its INTENT_REQUIRED consent error, and invalid otherwise');
+        }
+        // Refreshed from the server, as the backup entry point does before it
+        // picks its route: a wallet delegated from another device since it was
+        // cached backs up without a reshare, and must not get an intent for one.
+        await this.getWallet({
+            accountAddress,
+            password,
+            signedSessionId,
+            refresh: true
+        });
+        const walletData = this.getRequiredWalletFromMap(accountAddress);
+        const identity = {
+            accountAddress,
+            businessAccountId,
+            completeBy,
+            initiatorUserId
+        };
+        if (operation === 'delegatedAccess') {
+            var _this_featureFlags;
+            const useShareSetReshare = ((_this_featureFlags = this.featureFlags) == null ? void 0 : _this_featureFlags[FEATURE_FLAGS.ENABLE_SHARE_SET_RESHARE]) === true;
+            return createReshareIntent(_extends({}, identity, {
+                newThresholdSignatureScheme: this.delegationThresholdSignatureScheme(useShareSetReshare),
+                reshareType: 'delegatedAccess'
+            }));
+        }
+        if (operation === 'offlineRecovery') {
+            return createReshareIntent(_extends({}, identity, {
+                // performOfflineRecoveryOperation always pins the exported set at 2/2.
+                newThresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_TWO,
+                offlineRecoveryEncryptionKey,
+                reshareType: 'offlineRecovery'
+            }));
+        }
+        // A cloud backup reshares only from 2/2, or from a non-delegated 2/3
+        // (backupKeySharesToCloudProvider); any other wallet backs up without a
+        // reshare, so there is nothing to approve.
+        const scheme = walletData.thresholdSignatureScheme;
+        const reshares = scheme === ThresholdSignatureScheme.TWO_OF_TWO || scheme === ThresholdSignatureScheme.TWO_OF_THREE && !hasDelegatedBackup(walletData.clientKeySharesBackupInfo, walletData.otherShareSets);
+        if (!reshares) {
+            throw new Error('prepareReshareIntent: this wallet backs up without a reshare, so no approval applies');
+        }
+        return createReshareIntent(_extends({}, identity, {
+            newThresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_THREE,
+            reshareType: 'cloudBackup'
+        }));
+    }
     async exportKey({ accountAddress, chainName, bitcoinConfig, password = undefined, signedSessionId, mfaToken, elevatedAccessToken, approvalQuorum, proposalId, traceContext }) {
         // Public entry point delegates to the private implementation. Keeping the
         // `staleShareRetry` flag off the public signature mirrors sign/refresh/
@@ -9541,11 +9688,12 @@ class DynamicWalletClient {
                 passwordUpdateBatchId,
                 dynamicRequestId
             });
+            let spentSignedSession = false;
             if (isWalletPasswordEncrypted(wallet)) {
                 if (!resolvedExistingPassword) {
                     throw new Error(ERROR_EXISTING_PASSWORD_REQUIRED);
                 }
-                await this.validatePasswordAgainstEncryptedShares({
+                spentSignedSession = await this.validatePasswordAgainstEncryptedShares({
                     wallet: wallet,
                     address: accountAddress,
                     password: resolvedExistingPassword,
@@ -9553,21 +9701,24 @@ class DynamicWalletClient {
                     errorMessage: ERROR_INCORRECT_PASSWORD
                 });
             }
-            const backup = ()=>this.storeEncryptedBackupByWallet({
+            // Every relay call burns its session's single-use nonce, so the backup needs a fresh one.
+            const backupSessionId = spentSignedSession ? await this.signedSession.renew(signedSessionId) : signedSessionId;
+            const backup = (sessionId)=>this.storeEncryptedBackupByWallet({
                     accountAddress,
                     password: newPassword,
                     existingPassword: resolvedExistingPassword,
-                    signedSessionId,
+                    signedSessionId: sessionId,
                     sessionPublicKey,
                     passwordUpdateBatchId,
                     passwordSetByBA: false
                 });
             let backupData;
             try {
-                backupData = await backup();
+                backupData = await backup(backupSessionId);
             } catch (error) {
                 if (!(error instanceof StaleLocalSharesError) || !error.localSharesRefreshed) throw error;
-                backupData = await backup();
+                // The stale-share refresh spent the session the failed attempt carried.
+                backupData = await backup(await this.signedSession.renew(backupSessionId));
             }
             // Not named passwordUpdateStatus: the logger redacts string values of password* keys.
             this.logPasswordOperationSuccess('updatePassword', {
@@ -9706,6 +9857,8 @@ class DynamicWalletClient {
    */ async validatePasswordAgainstEncryptedShares({ wallet, address, password, signedSessionId, errorMessage = ERROR_PASSWORD_MISMATCH }) {
         const storageKey = `${normalizeAddress(address)}${ENCRYPTED_SHARES_STORAGE_SUFFIX}`;
         let encryptedData = await this.storage.getItem(storageKey);
+        // Fetching the shares spends the session's single-use nonce; callers must renew it.
+        const spentSignedSession = !encryptedData;
         if (!encryptedData) {
             const { shares } = this.recoverStrategy({
                 clientKeyShareBackupInfo: wallet.clientKeySharesBackupInfo,
@@ -9744,7 +9897,7 @@ class DynamicWalletClient {
         }
         const credential = extractFirstEncryptedCredential(encryptedData);
         if (!credential) {
-            return;
+            return spentSignedSession;
         }
         try {
             await this.decryptKeyShare({
@@ -9757,6 +9910,7 @@ class DynamicWalletClient {
             }
             throw error;
         }
+        return spentSignedSession;
     }
     isPasswordRequired() {
         var _readEnvironmentSettings_sdk_waas, _readEnvironmentSettings_sdk, _readEnvironmentSettings;
@@ -10084,7 +10238,7 @@ class DynamicWalletClient {
    * - For 2-of-2 wallets: Automatically reshares to 2-of-3 threshold, then distributes shares (1 to backend, 1 to cloud)
    * - For non-delegated 2-of-3 wallets: same-scheme reshare to mint a fresh recovery share
    * - For delegated 2-of-3 (and other) wallets: storeEncryptedBackupByWallet backs up to backend and cloud
-   */ async backupKeySharesToCloudProvider({ accountAddress, password, signedSessionId, sessionPublicKey, backupLocation, googleDriveAccessToken, googleDriveTokenSource }) {
+   */ async backupKeySharesToCloudProvider({ accountAddress, password, signedSessionId, sessionPublicKey, backupLocation, googleDriveAccessToken, googleDriveTokenSource, approvalQuorum, proposalId }) {
         try {
             await this.getWallet({
                 accountAddress,
@@ -10108,7 +10262,10 @@ class DynamicWalletClient {
                         backupLocation
                     ],
                     googleDriveAccessToken,
-                    googleDriveTokenSource
+                    googleDriveTokenSource,
+                    cloudBackup: true,
+                    approvalQuorum,
+                    proposalId
                 });
             } else if (currentThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && !hasDelegatedBackup(walletData.clientKeySharesBackupInfo, walletData.otherShareSets)) {
                 await this.reshareNonDelegatedTwoOfThree({
@@ -10118,7 +10275,9 @@ class DynamicWalletClient {
                     signedSessionId,
                     sessionPublicKey,
                     googleDriveAccessToken,
-                    googleDriveTokenSource
+                    googleDriveTokenSource,
+                    approvalQuorum,
+                    proposalId
                 });
             } else {
                 await this.storeEncryptedBackupByWallet({
@@ -10150,7 +10309,7 @@ class DynamicWalletClient {
    * reshare that mints a fresh recovery share. The fresh share is redistributed to
    * every provider already holding a backup plus the requested one,
    * restricted to providers the reshare can deliver to.
-   */ async reshareNonDelegatedTwoOfThree({ accountAddress, backupLocation, password, signedSessionId, sessionPublicKey, googleDriveAccessToken, googleDriveTokenSource }) {
+   */ async reshareNonDelegatedTwoOfThree({ accountAddress, backupLocation, password, signedSessionId, sessionPublicKey, googleDriveAccessToken, googleDriveTokenSource, approvalQuorum, proposalId }) {
         const walletData = this.getRequiredWalletFromMap(accountAddress);
         const cloudProviders = new Set([
             ...getActiveCloudProviders(walletData.clientKeySharesBackupInfo).filter((provider)=>provider === BackupLocation.GOOGLE_DRIVE || provider === BackupLocation.ICLOUD),
@@ -10185,7 +10344,10 @@ class DynamicWalletClient {
             sessionPublicKey,
             cloudProviders: Array.from(cloudProviders),
             googleDriveAccessToken: resolvedDrive.googleDriveAccessToken,
-            googleDriveTokenSource: resolvedDrive.googleDriveTokenSource
+            googleDriveTokenSource: resolvedDrive.googleDriveTokenSource,
+            cloudBackup: true,
+            approvalQuorum,
+            proposalId
         });
     }
     /**
@@ -10255,7 +10417,7 @@ class DynamicWalletClient {
    * @param params.signedSessionId - Optional signed session ID for authentication
    * @param params.googleDriveAccessToken - Optional Google OAuth access token. When provided, the SDK uses it directly
    *   instead of looking up the user's linked Google account and exchanging it for a token via the Dynamic backend.
-   */ async backupKeySharesToGoogleDrive({ accountAddress, password, signedSessionId, sessionPublicKey, googleDriveAccessToken }) {
+   */ async backupKeySharesToGoogleDrive({ accountAddress, password, signedSessionId, sessionPublicKey, googleDriveAccessToken, approvalQuorum, proposalId }) {
         // Track whether the Drive token was supplied by the caller (external) or
         // will be resolved from the user's stored OAuth account (stored_oauth), so
         // backups using a token we don't control are auditable. Enum only — the
@@ -10293,7 +10455,9 @@ class DynamicWalletClient {
                 googleDriveAccessToken: resolvedAccessToken,
                 // Persist which token source backed up the Google Drive location for
                 // audit (enum only — never the token value).
-                googleDriveTokenSource: tokenSource
+                googleDriveTokenSource: tokenSource,
+                approvalQuorum,
+                proposalId
             });
             success = true;
         } finally{
@@ -10366,13 +10530,23 @@ class DynamicWalletClient {
    * @param params.accountAddress - The wallet account address to backup
    * @param params.password - Optional password for encryption (uses environment ID if not provided)
    * @param params.signedSessionId - Optional signed session ID for authentication
-   */ async backupKeySharesToICloud({ accountAddress, password, signedSessionId, sessionPublicKey }) {
+   */ async backupKeySharesToICloud({ accountAddress, password, signedSessionId, sessionPublicKey, approvalQuorum, proposalId }) {
+        // Refreshed from the server, as the Google Drive backup and
+        // prepareReshareIntent do: the route (reshare or not) must be picked from
+        // the same wallet state the reshare intent was built from.
+        await this.getWallet({
+            accountAddress,
+            signedSessionId,
+            refresh: true
+        });
         return this.backupKeySharesToCloudProvider({
             accountAddress,
             password,
             signedSessionId,
             sessionPublicKey,
-            backupLocation: BackupLocation.ICLOUD
+            backupLocation: BackupLocation.ICLOUD,
+            approvalQuorum,
+            proposalId
         });
     }
     /**

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dynamic-labs-wallet/browser",
-  "version": "1.1.56",
+  "version": "1.1.58",
   "license": "Licensed under the Dynamic Labs, Inc. Terms Of Service (https://www.dynamic.xyz/terms-conditions)",
   "type": "module",
   "dependencies": {
-    "@dynamic-labs-wallet/core": "1.1.56",
+    "@dynamic-labs-wallet/core": "1.1.58",
     "@dynamic-labs-wallet/forward-mpc-client": "2.0.2",
-    "@dynamic-labs-wallet/primitives": "1.1.56",
+    "@dynamic-labs-wallet/primitives": "1.1.58",
     "@dynamic-labs/redaction": "^1.1.0",
-    "@dynamic-labs/sdk-api-core": "0.115.0",
+    "@dynamic-labs/sdk-api-core": "0.134.0",
     "@noble/curves": "1.8.0",
     "argon2id": "1.0.1",
     "axios": "1.20.0",