@embarkai/ui-kit 0.4.128 → 0.6.9

package/dist/iframe/main.js

@@ -22,14 +22,20 @@ __export(crypto_utils_exports, {
   bytesToBase64: () => bytesToBase64,
   bytesToHex: () => bytesToHex,
   decryptKeyshare: () => decryptKeyshare,
+  decryptShareWithDek: () => decryptShareWithDek,
   deriveBackupPasswordFromPasskey: () => deriveBackupPasswordFromPasskey,
   deriveKEKFromPasskey: () => deriveKEKFromPasskey,
   deriveKeyFromPassword: () => deriveKeyFromPassword,
   encryptKeyshare: () => encryptKeyshare,
   envelopeDecryptKeyshare: () => envelopeDecryptKeyshare,
+  envelopeDecryptKeyshareWithDek: () => envelopeDecryptKeyshareWithDek,
+  envelopeDecryptKeyshareWithKek: () => envelopeDecryptKeyshareWithKek,
   envelopeDecryptKeyshareWithPassword: () => envelopeDecryptKeyshareWithPassword,
   envelopeEncryptKeyshare: () => envelopeEncryptKeyshare,
-  envelopeEncryptKeyshareWithPassword: () => envelopeEncryptKeyshareWithPassword
+  envelopeEncryptKeyshareBasic: () => envelopeEncryptKeyshareBasic,
+  envelopeEncryptKeyshareWithPasskeyKek: () => envelopeEncryptKeyshareWithPasskeyKek,
+  envelopeEncryptKeyshareWithPassword: () => envelopeEncryptKeyshareWithPassword,
+  unwrapDek: () => unwrapDek
 });
 function base64ToBytes(base64) {
   const binaryString = atob(base64);
@@ -413,6 +419,125 @@ async function decryptKeyshare(encryptedBackup, password) {
     throw new Error(`Failed to decrypt backup: ${message}`);
   }
 }
+function concatBytes(...parts) {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+async function importAesKey(raw, usage) {
+  return crypto.subtle.importKey("raw", raw, "AES-GCM", false, usage);
+}
+async function sealWith(key, plaintext, aadBytes) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: aadBytes }, key, plaintext);
+  return concatBytes(iv, new Uint8Array(ct));
+}
+function aadCandidatesOf(envelope) {
+  return envelope.aad?.version >= 2 ? [serializeAad(envelope.aad), serializeAadWithKeyOrder(envelope.aad, LEGACY_V2_KEY_ORDER)] : [void 0];
+}
+async function unwrapDek(envelope, unlock) {
+  const wrapped = base64ToBytes(envelope.wrapped_dek);
+  let key;
+  let iv;
+  let ct;
+  if (unlock.kind === "password") {
+    const salt = wrapped.slice(0, 16);
+    iv = wrapped.slice(16, 28);
+    ct = wrapped.slice(28);
+    key = await deriveKeyFromPassword(unlock.password, salt);
+  } else {
+    iv = wrapped.slice(0, 12);
+    ct = wrapped.slice(12);
+    key = await importAesKey(unlock.kek, ["decrypt"]);
+  }
+  let lastError;
+  for (const aadBytes of aadCandidatesOf(envelope)) {
+    try {
+      const dek = await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv, ...aadBytes && { additionalData: aadBytes } },
+        key,
+        ct
+      );
+      return { dek: new Uint8Array(dek), aadBytes };
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw new Error("Failed to unwrap backup key: " + (lastError instanceof Error ? lastError.message : String(lastError)));
+}
+async function decryptShareWithDek(envelope, dek, aadBytes) {
+  const data = base64ToBytes(envelope.ciphertext_share);
+  const key = await importAesKey(dek, ["decrypt"]);
+  const plaintext = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: data.slice(0, 12), ...aadBytes && { additionalData: aadBytes } },
+    key,
+    data.slice(12)
+  );
+  return JSON.parse(new TextDecoder().decode(plaintext));
+}
+async function envelopeEncryptKeyshareBasic(data, wrap) {
+  const aad = { userId: data.userId, version: 2, deviceId: "embarkai-ui-kit" };
+  const aadBytes = serializeAad(aad);
+  const dek = crypto.getRandomValues(new Uint8Array(32));
+  const ciphertext = await sealWith(await importAesKey(dek, ["encrypt"]), new TextEncoder().encode(JSON.stringify(data)), aadBytes);
+  let wrapped;
+  try {
+    wrapped = await wrap(dek);
+  } catch (error) {
+    dek.fill(0);
+    throw error;
+  }
+  return {
+    envelope: {
+      ciphertext_share: bytesToBase64(ciphertext),
+      wrapped_dek: wrapped.wrappedDek,
+      kdf: { prf: wrapped.kdf.prf, hkdf: wrapped.kdf.hkdf, info: wrapped.kdf.info },
+      alg: { data: "aes-256-gcm", wrap: wrapped.kdf.hkdf },
+      aad,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      expiresAt: null,
+      encryptionMethod: "server-managed"
+    },
+    dek
+  };
+}
+async function envelopeDecryptKeyshareWithDek(envelope, dek) {
+  let lastError;
+  for (const aadBytes of aadCandidatesOf(envelope)) {
+    try {
+      return await decryptShareWithDek(envelope, dek, aadBytes);
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw new Error("Failed to decrypt backup: " + (lastError instanceof Error ? lastError.message : String(lastError)));
+}
+async function envelopeEncryptKeyshareWithPasskeyKek(data, kek, credentialId) {
+  const aad = { userId: data.userId, version: 2, deviceId: "embarkai-ui-kit" };
+  const aadBytes = serializeAad(aad);
+  const dek = crypto.getRandomValues(new Uint8Array(32));
+  const ciphertext = await sealWith(await importAesKey(dek, ["encrypt"]), new TextEncoder().encode(JSON.stringify(data)), aadBytes);
+  const wrappedDek = await sealWith(await importAesKey(kek, ["encrypt"]), dek, aadBytes);
+  return {
+    ciphertext_share: bytesToBase64(ciphertext),
+    wrapped_dek: bytesToBase64(wrappedDek),
+    kdf: { prf: "webauthn-prf", hkdf: "hkdf-sha256", info: "client-share" },
+    alg: { data: "aes-256-gcm", wrap: "aes-256-gcm" },
+    aad,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    expiresAt: null,
+    encryptionMethod: "passkey",
+    credentialId: credentialId || void 0
+  };
+}
+async function envelopeDecryptKeyshareWithKek(envelope, kek) {
+  const { dek, aadBytes } = await unwrapDek(envelope, { kind: "kek", kek });
+  return decryptShareWithDek(envelope, dek, aadBytes);
+}
 var LEGACY_V2_KEY_ORDER;
 var init_crypto_utils = __esm({
   "src/iframe/lib/backup/crypto-utils.ts"() {
@@ -484,10 +609,34 @@ var init_local_backup = __esm({
 // src/iframe/lib/backup/server-backup.ts
 var server_backup_exports = {};
 __export(server_backup_exports, {
+  BASIC_BACKUP_NEEDS_NEWER_APP: () => BASIC_BACKUP_NEEDS_NEWER_APP,
+  BasicRecoveryError: () => BasicRecoveryError,
+  IFRAME_SESSION_REQUIRED: () => IFRAME_SESSION_REQUIRED,
+  RECOVERY_KEK_UNAVAILABLE: () => RECOVERY_KEK_UNAVAILABLE,
+  VaultError: () => VaultError,
+  WALLET_MISMATCH: () => WALLET_MISMATCH,
+  WalletMismatchError: () => WalletMismatchError,
   backupToServer: () => backupToServer,
-  restoreFromServer: () => restoreFromServer
+  backupToServerWithPasskeyKek: () => backupToServerWithPasskeyKek,
+  encryptionMethodOfStats: () => encryptionMethodOfStats,
+  ensureServerManagedBackup: () => ensureServerManagedBackup,
+  getServerBackupMethod: () => getServerBackupMethod,
+  restoreErrorForParent: () => restoreErrorForParent,
+  restoreFromServer: () => restoreFromServer,
+  unwrapRecoveryDek: () => unwrapRecoveryDek,
+  upgradeServerManagedBackup: () => upgradeServerManagedBackup,
+  wrapRecoveryDek: () => wrapRecoveryDek
 });
-async function getShareVaultToken(tokenClient, scopes, accessToken) {
+function shareUrl(path, owner) {
+  return `${SHARE_VAULT_URL}/v1/shares/me${path}${owner ? `?owner=${encodeURIComponent(owner.toLowerCase())}` : ""}`;
+}
+function sameOwner(a, b) {
+  return !!a && !!b && a.toLowerCase() === b.toLowerCase();
+}
+function withOwner(envelope, data) {
+  return data.ownerAddress ? { ...envelope, ownerAddress: data.ownerAddress } : envelope;
+}
+async function getShareVaultToken(tokenClient, scopes, accessToken, projectId) {
   const data = await tokenClient.apiCall(
     "POST",
     "/api/auth/token/exchange",
@@ -497,7 +646,7 @@ async function getShareVaultToken(tokenClient, scopes, accessToken) {
       // TODO: embarkai audience ?
       ttl: 300
     },
-    void 0,
+    projectId,
     accessToken
   );
   if (!data?.resourceToken) {
@@ -505,40 +654,48 @@ async function getShareVaultToken(tokenClient, scopes, accessToken) {
   }
   return data.resourceToken;
 }
-async function uploadShareToVault(tokenClient, encryptedShare, accessToken) {
-  const token = await getShareVaultToken(tokenClient, ["share:put"], accessToken);
-  const idempotencyKey = crypto.randomUUID ? crypto.randomUUID() : `backup-${Date.now()}`;
-  const response = await fetch(`${SHARE_VAULT_URL}/v1/shares/me`, {
+async function uploadShareToVault(tokenClient, encryptedShare, accessToken, projectId, ifMatch) {
+  const token = await getShareVaultToken(tokenClient, ["share:put"], accessToken, projectId);
+  const idempotencyKey2 = crypto.randomUUID ? crypto.randomUUID() : `backup-${Date.now()}`;
+  const response = await fetch(shareUrl("", encryptedShare.ownerAddress), {
     method: "PUT",
     headers: {
       "Content-Type": "application/json",
       "Authorization": `Bearer ${token}`,
-      "Idempotency-Key": idempotencyKey
+      "Idempotency-Key": idempotencyKey2,
+      ...ifMatch ? { "If-Match": ifMatch } : {}
     },
     body: JSON.stringify(encryptedShare)
   });
+  if (response.status === 412 && ifMatch) throw new VaultError(412, "The backup changed meanwhile, please try again");
   if (!response.ok) {
     const errorText = await response.text();
     throw new Error(`Failed to upload share: ${response.status} ${response.statusText} - ${errorText}`);
   }
 }
-async function backupToServer(data, tokenClient, password, accessToken) {
+async function backupToServer(data, tokenClient, password, accessToken, projectId, ifMatch) {
   let encryptedShare;
   if (password) {
     encryptedShare = await envelopeEncryptKeyshareWithPassword(data, password);
   } else {
     encryptedShare = await envelopeEncryptKeyshare(data, data.userId);
   }
-  await uploadShareToVault(tokenClient, encryptedShare, accessToken);
+  await uploadShareToVault(tokenClient, withOwner(encryptedShare, data), accessToken, projectId, ifMatch);
+}
+async function backupToServerWithPasskeyKek(data, kek, credentialId, tokenClient, accessToken, projectId, ifMatch) {
+  const envelope = await envelopeEncryptKeyshareWithPasskeyKek(data, kek, credentialId);
+  await uploadShareToVault(tokenClient, withOwner(envelope, data), accessToken, projectId, ifMatch);
 }
-async function downloadShareFromVault(tokenClient, accessToken) {
-  const token = await getShareVaultToken(tokenClient, ["share:get"], accessToken);
-  const response = await fetch(`${SHARE_VAULT_URL}/v1/shares/me`, {
+async function downloadShareFromVault(tokenClient, accessToken, projectId, purpose, owner) {
+  const token = await getShareVaultToken(tokenClient, ["share:get"], accessToken, projectId);
+  const response = await fetch(shareUrl("", owner), {
     method: "GET",
     headers: {
       "Authorization": `Bearer ${token}`,
       "X-Client-Device-Id": "lumia-ui-kit",
-      "X-Client-Device-Name": "Lumia UI Kit"
+      "X-Client-Device-Name": "Lumia UI Kit",
+      // a read for an upgrade is still counted by the vault, only labelled so it does not look like a restore
+      ...purpose ? { "X-Share-Read-Purpose": purpose } : {}
     }
   });
   if (!response.ok) {
@@ -554,25 +711,427 @@ async function downloadShareFromVault(tokenClient, accessToken) {
   }
   return envelope;
 }
-async function restoreFromServer(userId, tokenClient, password, accessToken) {
+async function restoreFromServer(userId, tokenClient, password, accessToken, projectId, basicAllowed = false, expectedOwner) {
   console.log("[iframe][restoreFromServer] Starting restore for userId:", userId);
   console.log("[iframe][restoreFromServer] Using password:", !!password);
   console.log("[iframe][restoreFromServer] Downloading share from vault...");
-  const envelope = await downloadShareFromVault(tokenClient, accessToken);
+  let envelope;
+  try {
+    envelope = await downloadShareFromVault(tokenClient, accessToken, projectId, void 0, expectedOwner);
+  } catch (error) {
+    if (String(error?.message).includes(IFRAME_SESSION_REQUIRED)) throw basicNeedsIframeSession();
+    throw error;
+  }
+  if (envelope.encryptionMethod === "server-managed" && !basicAllowed && !password) throw basicNeedsIframeSession();
   console.log("[iframe][restoreFromServer] Envelope encryption method:", envelope.encryptionMethod);
   const { envelopeDecryptKeyshare: envelopeDecryptKeyshare2, envelopeDecryptKeyshareWithPassword: envelopeDecryptKeyshareWithPassword2 } = await Promise.resolve().then(() => (init_crypto_utils(), crypto_utils_exports));
-  const backupData = password ? await envelopeDecryptKeyshareWithPassword2(envelope, password) : await envelopeDecryptKeyshare2(envelope, userId);
+  let backupData;
+  if (password) {
+    backupData = await envelopeDecryptKeyshareWithPassword2(envelope, password);
+  } else if (envelope.encryptionMethod === "server-managed") {
+    const opened = await openBasicEnvelope(tokenClient, envelope, accessToken, projectId);
+    backupData = opened.data;
+    if (opened.rewrappedDek && backupData.userId === userId) {
+      await storeRewrappedDek(tokenClient, envelope, opened.rewrappedDek, accessToken, projectId, expectedOwner);
+    }
+  } else {
+    backupData = await envelopeDecryptKeyshare2(envelope, userId);
+  }
   if (backupData.userId !== userId) {
     throw new Error("Server backup does not match current user");
   }
+  if (!envelope.ownerAddress) await bindShareToWallet(tokenClient, envelope, backupData.ownerAddress, accessToken, projectId, expectedOwner);
+  if (expectedOwner && !sameOwner(backupData.ownerAddress, expectedOwner)) throw new WalletMismatchError(backupData);
   console.log("[iframe][restoreFromServer] Decryption successful, returning backup data");
   return backupData;
 }
-var SHARE_VAULT_URL;
+async function bindShareToWallet(tokenClient, envelope, ownerAddress, accessToken, projectId, readAs) {
+  if (!ownerAddress || !envelope.etag) return false;
+  try {
+    await rewrapShareInVault(tokenClient, { wrapped_dek: envelope.wrapped_dek, ownerAddress }, envelope.etag, accessToken, projectId, readAs ?? ownerAddress);
+    console.log("[iframe][server-backup] Backup bound to its wallet:", ownerAddress);
+    return true;
+  } catch (error) {
+    console.warn("[iframe][server-backup] Backup not bound to its wallet:", errorMessage(error));
+    return false;
+  }
+}
+function restoreErrorForParent(message, parentSupportsIframeSession) {
+  return !parentSupportsIframeSession && message.includes(IFRAME_SESSION_REQUIRED) ? BASIC_BACKUP_NEEDS_NEWER_APP : message;
+}
+function basicNeedsIframeSession() {
+  return new BasicRecoveryError(true, `${IFRAME_SESSION_REQUIRED}: a Basic backup opens only after signing in again`);
+}
+async function recoveryCall(tokenClient, path, body, accessToken, projectId) {
+  try {
+    return await tokenClient.apiCall("POST", `/api/auth/backup/recovery-dek/${path}`, body, projectId, accessToken);
+  } catch (error) {
+    const status = error?.details?.status ?? error?.status;
+    const disabled = error?.code === "RECOVERY_DISABLED" || error?.code === "ORIGIN_NOT_ALLOWED" || status === 404;
+    throw new BasicRecoveryError(disabled, error?.message || "request failed", typeof status === "number" ? status : void 0);
+  }
+}
+async function wrapRecoveryDek(tokenClient, dek, accessToken, projectId) {
+  const data = await recoveryCall(tokenClient, "wrap", { dek: bytesToBase64(dek) }, accessToken, projectId);
+  if (typeof data?.wrapped_dek !== "string" || !data.wrapped_dek || data?.kdf?.prf !== "server-managed") {
+    throw new BasicRecoveryError(false, "invalid response");
+  }
+  return { wrappedDek: data.wrapped_dek, kdf: { prf: "server-managed", hkdf: data.kdf.hkdf, info: data.kdf.info } };
+}
+async function unwrapRecoveryDek(tokenClient, wrappedDek, accessToken, projectId) {
+  const data = await recoveryCall(tokenClient, "unwrap", { wrapped_dek: wrappedDek }, accessToken, projectId);
+  const dek = typeof data?.dek === "string" ? base64ToBytes(data.dek) : void 0;
+  if (!dek || dek.length !== 32) throw new BasicRecoveryError(false, "invalid response");
+  const rewrapped = data.rewrapped_dek;
+  return { dek, ...typeof rewrapped === "string" && rewrapped && rewrapped !== wrappedDek ? { rewrappedDek: rewrapped } : {} };
+}
+async function rewrapShareInVault(tokenClient, body, etag, accessToken, projectId, owner) {
+  if (!etag) throw new VaultError(428, "A rewrap needs the etag of the share it was computed from");
+  const token = await getShareVaultToken(tokenClient, ["share:rewrap"], accessToken, projectId);
+  const response = await fetch(shareUrl("/rewrap", owner), {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+      "Idempotency-Key": idempotencyKey("rewrap"),
+      "If-Match": etag
+    },
+    body: JSON.stringify(body)
+  });
+  if (response.status === 412) throw new VaultError(412, "The backup changed meanwhile");
+  if (!response.ok) throw new VaultError(response.status, `Failed to rewrap share: ${response.status} ${await response.text()}`);
+  return (await response.json().catch(() => null))?.etag;
+}
+async function storeRewrappedDek(tokenClient, envelope, rewrappedDek, accessToken, projectId, owner) {
+  if (!envelope.etag) return;
+  try {
+    const etag = await rewrapShareInVault(tokenClient, { wrapped_dek: rewrappedDek }, envelope.etag, accessToken, projectId, owner);
+    envelope.wrapped_dek = rewrappedDek;
+    envelope.etag = etag;
+    console.log("[iframe][server-backup] Basic backup: wrapped DEK updated after a key rotation");
+  } catch (error) {
+    console.warn("[iframe][server-backup] Basic backup: wrapped DEK not updated:", errorMessage(error));
+  }
+}
+async function openBasicEnvelope(tokenClient, envelope, accessToken, projectId) {
+  const { dek, rewrappedDek } = await unwrapRecoveryDek(tokenClient, envelope.wrapped_dek, accessToken, projectId);
+  try {
+    return { data: await envelopeDecryptKeyshareWithDek(envelope, dek), ...rewrappedDek ? { rewrappedDek } : {} };
+  } finally {
+    dek.fill(0);
+  }
+}
+async function getVaultRecoveryStats(tokenClient, accessToken, projectId, owner) {
+  const token = await getShareVaultToken(tokenClient, ["share:get"], accessToken, projectId);
+  const response = await fetch(shareUrl("/recovery/stats", owner), {
+    method: "GET",
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  if (response.status === 404) return null;
+  if (!response.ok) throw new VaultError(response.status, `Failed to read recovery stats: ${response.status}`);
+  return await response.json();
+}
+function encryptionMethodOfStats(stats) {
+  if (!stats) return null;
+  const method = stats.created?.encryptionMethod;
+  const userHeld = method === "password" || method === "passkey" ? method : "passkey";
+  if (stats.securityLevel === null) return null;
+  if (stats.securityLevel === "basic") return "server-managed";
+  if (stats.securityLevel === "advanced") return userHeld;
+  if (!stats.created) return null;
+  return method === "server-managed" ? "server-managed" : userHeld;
+}
+async function getServerBackupMethod(tokenClient, accessToken, projectId, owner) {
+  return encryptionMethodOfStats(await getVaultRecoveryStats(tokenClient, accessToken, projectId, owner));
+}
+async function walletOfUnboundBasicShare(data, tokenClient, accessToken, projectId) {
+  try {
+    const envelope = await downloadShareFromVault(tokenClient, accessToken, projectId, "rewrap", data.ownerAddress);
+    if (envelope.encryptionMethod !== "server-managed") return "unknown";
+    if (envelope.ownerAddress) return sameOwner(envelope.ownerAddress, data.ownerAddress) ? "this" : "other";
+    const { data: stored } = await openBasicEnvelope(tokenClient, envelope, accessToken, projectId);
+    if (stored.userId !== data.userId || !stored.ownerAddress) return "unknown";
+    const bound = await bindShareToWallet(tokenClient, envelope, stored.ownerAddress, accessToken, projectId, data.ownerAddress);
+    if (sameOwner(stored.ownerAddress, data.ownerAddress)) return "this";
+    return bound ? "other" : "other-unbound";
+  } catch (error) {
+    console.warn("[iframe][server-backup] Basic backup of unknown wallet not checked:", errorMessage(error));
+    return "unknown";
+  }
+}
+async function ensureServerManagedBackup(data, tokenClient, accessToken, projectId, options = {}) {
+  const owner = data?.ownerAddress ?? options.owner;
+  for (let attempt = 0; ; attempt++) {
+    let stats;
+    try {
+      stats = await getVaultRecoveryStats(tokenClient, accessToken, projectId, owner);
+    } catch (error) {
+      return { status: "failed", reason: "vault_unavailable", error: errorMessage(error) };
+    }
+    const existing = encryptionMethodOfStats(stats);
+    if (!existing) break;
+    const unbound = stats?.ownerAddress === null;
+    if (!unbound || existing !== "server-managed" || options.allowCreate === false || !data) {
+      return { status: "exists", encryptionMethod: existing };
+    }
+    const wallet = await walletOfUnboundBasicShare(data, tokenClient, accessToken, projectId);
+    if (wallet === "other") {
+      console.warn("[iframe][server-backup] The vault backup belongs to another wallet of this user: creating one for", data.ownerAddress);
+      break;
+    }
+    if (wallet === "other-unbound") {
+      if (attempt === 0) continue;
+      return { status: "failed", reason: "vault_unavailable", otherWallet: true, error: "The vault backup belongs to another wallet and could not be bound to it" };
+    }
+    return { status: "exists", encryptionMethod: existing };
+  }
+  if (options.allowCreate === false) {
+    return { status: "failed", reason: "disabled", error: "Basic backups need an iframe session" };
+  }
+  if (!data) return { status: "failed", reason: "no_keyshare" };
+  let built;
+  try {
+    built = await envelopeEncryptKeyshareBasic(data, (dek2) => wrapRecoveryDek(tokenClient, dek2, accessToken, projectId));
+  } catch (error) {
+    const disabled = error instanceof BasicRecoveryError && error.disabled;
+    return { status: "failed", reason: disabled ? "disabled" : "kek_unavailable", error: errorMessage(error) };
+  }
+  const { envelope, dek } = built;
+  try {
+    const roundTrip = await envelopeDecryptKeyshareWithDek(envelope, dek);
+    if (roundTrip.keyshare !== data.keyshare || roundTrip.userId !== data.userId) {
+      return { status: "failed", reason: "unknown", error: "Backup self-check failed" };
+    }
+    let unwrapped;
+    try {
+      unwrapped = await unwrapRecoveryDek(tokenClient, envelope.wrapped_dek, accessToken, projectId);
+    } catch (error) {
+      if (error instanceof BasicRecoveryError && error.status === 400) return { status: "failed", reason: "unknown", error: "The new wrapped DEK does not open" };
+      return { status: "failed", reason: "kek_unavailable", error: errorMessage(error) };
+    }
+    const opens = unwrapped.dek.length === dek.length && unwrapped.dek.every((byte, i) => byte === dek[i]);
+    unwrapped.dek.fill(0);
+    if (!opens) return { status: "failed", reason: "unknown", error: "The new wrapped DEK does not open" };
+    for (let attempt = 0; attempt < 2; attempt++) {
+      if (await uploadShareToVaultCreateOnly(tokenClient, withOwner(envelope, data), accessToken, projectId)) {
+        return { status: "created", encryptionMethod: "server-managed" };
+      }
+      const method = await getServerBackupMethod(tokenClient, accessToken, projectId, data.ownerAddress).catch(() => null);
+      if (method) return { status: "exists", encryptionMethod: method };
+    }
+    return { status: "failed", reason: "vault_unavailable", error: "The vault refused the backup of this wallet" };
+  } catch (error) {
+    if (error instanceof VaultError && error.status === 400) {
+      return { status: "failed", reason: "disabled", error: errorMessage(error) };
+    }
+    return { status: "failed", reason: error instanceof VaultError ? "vault_unavailable" : "unknown", error: errorMessage(error) };
+  } finally {
+    dek.fill(0);
+  }
+}
+async function uploadShareToVaultCreateOnly(tokenClient, envelope, accessToken, projectId) {
+  const token = await getShareVaultToken(tokenClient, ["share:put"], accessToken, projectId);
+  const response = await fetch(shareUrl("", envelope.ownerAddress), {
+    method: "PUT",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+      "Idempotency-Key": idempotencyKey("basic-backup"),
+      "If-None-Match": "*"
+    },
+    body: JSON.stringify(envelope)
+  });
+  if (response.status === 412) return false;
+  if (!response.ok) throw new VaultError(response.status, `Failed to upload share: ${response.status} ${await response.text()}`);
+  return true;
+}
+async function upgradeServerManagedBackup(data, protection, tokenClient, accessToken, projectId) {
+  const envelope = await downloadShareFromVault(tokenClient, accessToken, projectId, "rewrap", data.ownerAddress);
+  if (envelope.encryptionMethod !== "server-managed") return { kind: "not-applicable", reason: "not a basic backup", etag: envelope.etag };
+  let stored;
+  try {
+    ;
+    ({ data: stored } = await openBasicEnvelope(tokenClient, envelope, accessToken, projectId));
+  } catch (error) {
+    if (error instanceof BasicRecoveryError && !error.disabled && error.status !== 400) throw error;
+    return { kind: "not-applicable", reason: `basic backup cannot be opened: ${error?.message ?? error}`, etag: envelope.etag };
+  }
+  if (stored.userId === data.userId && stored.ownerAddress && !sameOwner(stored.ownerAddress, data.ownerAddress)) {
+    if (!envelope.ownerAddress) await bindShareToWallet(tokenClient, envelope, stored.ownerAddress, accessToken, projectId, data.ownerAddress);
+    return { kind: "not-applicable", reason: "vault backup belongs to another wallet" };
+  }
+  if (stored.userId !== data.userId || stored.keyshare !== data.keyshare) {
+    return { kind: "not-applicable", reason: "vault backup does not match the local keyshare", etag: envelope.etag };
+  }
+  const protectedEnvelope = protection.method === "password" ? await envelopeEncryptKeyshareWithPassword(data, protection.password) : await envelopeEncryptKeyshareWithPasskeyKek(data, protection.kek, protection.credentialId);
+  const roundTrip = protection.method === "password" ? await envelopeDecryptKeyshareWithPassword(protectedEnvelope, protection.password) : await envelopeDecryptKeyshareWithKek(protectedEnvelope, protection.kek);
+  if (roundTrip.keyshare !== data.keyshare || roundTrip.userId !== data.userId) throw new Error("Backup self-check failed");
+  await replaceShareInVault(tokenClient, withOwner(protectedEnvelope, data), envelope.etag, accessToken, projectId);
+  return { kind: "upgraded", encryptionMethod: protection.method };
+}
+async function replaceShareInVault(tokenClient, envelope, etag, accessToken, projectId) {
+  const token = await getShareVaultToken(tokenClient, ["share:put"], accessToken, projectId);
+  const response = await fetch(shareUrl("", envelope.ownerAddress), {
+    method: "PUT",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+      "Idempotency-Key": idempotencyKey("upgrade"),
+      ...etag ? { "If-Match": etag } : {}
+    },
+    body: JSON.stringify(envelope)
+  });
+  if (response.status === 412) throw new VaultError(412, "The backup changed meanwhile, please try again");
+  if (!response.ok) throw new VaultError(response.status, `Failed to upload share: ${response.status} ${await response.text()}`);
+}
+function idempotencyKey(prefix) {
+  return crypto.randomUUID ? crypto.randomUUID() : `${prefix}-${Date.now()}-${Math.random()}`;
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var SHARE_VAULT_URL, WalletMismatchError, WALLET_MISMATCH, RECOVERY_KEK_UNAVAILABLE, IFRAME_SESSION_REQUIRED, BASIC_BACKUP_NEEDS_NEWER_APP, BasicRecoveryError, VaultError;
 var init_server_backup = __esm({
   "src/iframe/lib/backup/server-backup.ts"() {
     init_crypto_utils();
     SHARE_VAULT_URL = "https://api.embarkai.io/vault";
+    WalletMismatchError = class extends Error {
+      constructor(backup) {
+        super(`${WALLET_MISMATCH}: the server backup belongs to another wallet (${backup.ownerAddress})`);
+        __publicField(this, "backup", backup);
+        this.name = "WalletMismatchError";
+      }
+    };
+    WALLET_MISMATCH = "WALLET_MISMATCH";
+    RECOVERY_KEK_UNAVAILABLE = "RECOVERY_KEK_UNAVAILABLE";
+    IFRAME_SESSION_REQUIRED = "iframe_session_required";
+    BASIC_BACKUP_NEEDS_NEWER_APP = "This wallet is backed up by embarkAI and can be restored only in apps that use the latest embarkAI wallet. Sign in to such an app, or restore from a backup file.";
+    BasicRecoveryError = class extends Error {
+      constructor(disabled, detail, status) {
+        super(`${RECOVERY_KEK_UNAVAILABLE}: ${detail}`);
+        __publicField(this, "disabled", disabled);
+        __publicField(this, "status", status);
+        this.name = "BasicRecoveryError";
+      }
+    };
+    VaultError = class extends Error {
+      constructor(status, message) {
+        super(message);
+        __publicField(this, "status", status);
+        this.name = "VaultError";
+      }
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/regex.js
+function execTyped(regex, string) {
+  const match = regex.exec(string);
+  return match?.groups;
+}
+var init_regex = __esm({
+  "../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/regex.js"() {
+  }
+});
+
+// ../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/human-readable/formatAbiParameter.js
+function formatAbiParameter(abiParameter) {
+  let type = abiParameter.type;
+  if (tupleRegex.test(abiParameter.type) && "components" in abiParameter) {
+    type = "(";
+    const length = abiParameter.components.length;
+    for (let i = 0; i < length; i++) {
+      const component = abiParameter.components[i];
+      type += formatAbiParameter(component);
+      if (i < length - 1)
+        type += ", ";
+    }
+    const result = execTyped(tupleRegex, abiParameter.type);
+    type += `)${result?.array || ""}`;
+    return formatAbiParameter({
+      ...abiParameter,
+      type
+    });
+  }
+  if ("indexed" in abiParameter && abiParameter.indexed)
+    type = `${type} indexed`;
+  if (abiParameter.name)
+    return `${type} ${abiParameter.name}`;
+  return type;
+}
+var tupleRegex;
+var init_formatAbiParameter = __esm({
+  "../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/human-readable/formatAbiParameter.js"() {
+    init_regex();
+    tupleRegex = /^tuple(?<array>(\[(\d*)\])*)$/;
+  }
+});
+
+// ../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/human-readable/formatAbiParameters.js
+function formatAbiParameters(abiParameters) {
+  let params = "";
+  const length = abiParameters.length;
+  for (let i = 0; i < length; i++) {
+    const abiParameter = abiParameters[i];
+    params += formatAbiParameter(abiParameter);
+    if (i !== length - 1)
+      params += ", ";
+  }
+  return params;
+}
+var init_formatAbiParameters = __esm({
+  "../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/human-readable/formatAbiParameters.js"() {
+    init_formatAbiParameter();
+  }
+});
+
+// ../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/human-readable/formatAbiItem.js
+function formatAbiItem(abiItem) {
+  if (abiItem.type === "function")
+    return `function ${abiItem.name}(${formatAbiParameters(abiItem.inputs)})${abiItem.stateMutability && abiItem.stateMutability !== "nonpayable" ? ` ${abiItem.stateMutability}` : ""}${abiItem.outputs?.length ? ` returns (${formatAbiParameters(abiItem.outputs)})` : ""}`;
+  if (abiItem.type === "event")
+    return `event ${abiItem.name}(${formatAbiParameters(abiItem.inputs)})`;
+  if (abiItem.type === "error")
+    return `error ${abiItem.name}(${formatAbiParameters(abiItem.inputs)})`;
+  if (abiItem.type === "constructor")
+    return `constructor(${formatAbiParameters(abiItem.inputs)})${abiItem.stateMutability === "payable" ? " payable" : ""}`;
+  if (abiItem.type === "fallback")
+    return `fallback() external${abiItem.stateMutability === "payable" ? " payable" : ""}`;
+  return "receive() external payable";
+}
+var init_formatAbiItem = __esm({
+  "../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/human-readable/formatAbiItem.js"() {
+    init_formatAbiParameters();
+  }
+});
+
+// ../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/exports/index.js
+var init_exports = __esm({
+  "../../node_modules/.pnpm/abitype@1.2.3_typescript@6.0.3_zod@4.6.7/node_modules/abitype/dist/esm/exports/index.js"() {
+    init_formatAbiItem();
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/abi/formatAbiItem.js
+function formatAbiItem2(abiItem, { includeName = false } = {}) {
+  if (abiItem.type !== "function" && abiItem.type !== "event" && abiItem.type !== "error")
+    throw new InvalidDefinitionTypeError(abiItem.type);
+  return `${abiItem.name}(${formatAbiParams(abiItem.inputs, { includeName })})`;
+}
+function formatAbiParams(params, { includeName = false } = {}) {
+  if (!params)
+    return "";
+  return params.map((param) => formatAbiParam(param, { includeName })).join(includeName ? ", " : ",");
+}
+function formatAbiParam(param, { includeName }) {
+  if (param.type.startsWith("tuple")) {
+    return `(${formatAbiParams(param.components, { includeName })})${param.type.slice("tuple".length)}`;
+  }
+  return param.type + (includeName && param.name ? ` ${param.name}` : "");
+}
+var init_formatAbiItem2 = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/abi/formatAbiItem.js"() {
+    init_abi();
   }
 });
 
@@ -701,11 +1260,93 @@ var init_base = __esm({
   }
 });
 
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/errors/abi.js
+var AbiDecodingDataSizeTooSmallError, AbiDecodingZeroDataError, AbiFunctionSignatureNotFoundError, InvalidAbiDecodingTypeError, InvalidDefinitionTypeError;
+var init_abi = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/errors/abi.js"() {
+    init_formatAbiItem2();
+    init_base();
+    AbiDecodingDataSizeTooSmallError = class extends BaseError {
+      constructor({ data, params, size: size2 }) {
+        super([`Data size of ${size2} bytes is too small for given parameters.`].join("\n"), {
+          metaMessages: [
+            `Params: (${formatAbiParams(params, { includeName: true })})`,
+            `Data:   ${data} (${size2} bytes)`
+          ],
+          name: "AbiDecodingDataSizeTooSmallError"
+        });
+        Object.defineProperty(this, "data", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        Object.defineProperty(this, "params", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        Object.defineProperty(this, "size", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        this.data = data;
+        this.params = params;
+        this.size = size2;
+      }
+    };
+    AbiDecodingZeroDataError = class extends BaseError {
+      constructor({ cause } = {}) {
+        super('Cannot decode zero data ("0x") with ABI parameters.', {
+          name: "AbiDecodingZeroDataError",
+          cause
+        });
+      }
+    };
+    AbiFunctionSignatureNotFoundError = class extends BaseError {
+      constructor(signature, { docsPath }) {
+        super([
+          `Encoded function signature "${signature}" not found on ABI.`,
+          "Make sure you are using the correct ABI and that the function exists on it.",
+          `You can look up the signature here: https://4byte.sourcify.dev/?q=${signature}.`
+        ].join("\n"), {
+          docsPath,
+          name: "AbiFunctionSignatureNotFoundError"
+        });
+      }
+    };
+    InvalidAbiDecodingTypeError = class extends BaseError {
+      constructor(type, { docsPath }) {
+        super([
+          `Type "${type}" is not a valid decoding type.`,
+          "Please provide a valid ABI type."
+        ].join("\n"), { docsPath, name: "InvalidAbiDecodingType" });
+      }
+    };
+    InvalidDefinitionTypeError = class extends BaseError {
+      constructor(type) {
+        super([
+          `"${type}" is not a valid definition type.`,
+          'Valid types: "function", "event", "error"'
+        ].join("\n"), { name: "InvalidDefinitionTypeError" });
+      }
+    };
+  }
+});
+
 // ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/errors/data.js
-var SizeExceedsPaddingSizeError;
+var SliceOffsetOutOfBoundsError, SizeExceedsPaddingSizeError;
 var init_data = __esm({
   "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/errors/data.js"() {
     init_base();
+    SliceOffsetOutOfBoundsError = class extends BaseError {
+      constructor({ offset, position, size: size2 }) {
+        super(`Slice ${position === "start" ? "starting" : "ending"} at offset "${offset}" is out-of-bounds (size: ${size2}).`, { name: "SliceOffsetOutOfBoundsError" });
+      }
+    };
     SizeExceedsPaddingSizeError = class extends BaseError {
       constructor({ size: size2, targetSize, type }) {
         super(`${type.charAt(0).toUpperCase()}${type.slice(1).toLowerCase()} size (${size2}) exceeds padding size (${targetSize}).`, { name: "SizeExceedsPaddingSizeError" });
@@ -755,7 +1396,7 @@ var init_pad = __esm({
 });
 
 // ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/errors/encoding.js
-var IntegerOutOfRangeError, SizeOverflowError;
+var IntegerOutOfRangeError, InvalidBytesBooleanError, SizeOverflowError;
 var init_encoding = __esm({
   "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/errors/encoding.js"() {
     init_base();
@@ -764,6 +1405,13 @@ var init_encoding = __esm({
         super(`Number "${value}" is not in safe ${size2 ? `${size2 * 8}-bit ${signed ? "signed" : "unsigned"} ` : ""}integer range ${max ? `(${min} to ${max})` : `(above ${min})`}`, { name: "IntegerOutOfRangeError" });
       }
     };
+    InvalidBytesBooleanError = class extends BaseError {
+      constructor(bytes) {
+        super(`Bytes value "${bytes}" is not a valid boolean. The bytes array must contain a single byte of either a 0 or 1 value.`, {
+          name: "InvalidBytesBooleanError"
+        });
+      }
+    };
     SizeOverflowError = class extends BaseError {
       constructor({ givenSize, maxSize }) {
         super(`Size cannot exceed ${maxSize} bytes. Given size: ${givenSize} bytes.`, { name: "SizeOverflowError" });
@@ -772,6 +1420,29 @@ var init_encoding = __esm({
   }
 });
 
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/data/trim.js
+function trim(hexOrBytes, { dir = "left" } = {}) {
+  let data = typeof hexOrBytes === "string" ? hexOrBytes.replace("0x", "") : hexOrBytes;
+  let sliceLength = 0;
+  for (let i = 0; i < data.length - 1; i++) {
+    if (data[dir === "left" ? i : data.length - i - 1].toString() === "0")
+      sliceLength++;
+    else
+      break;
+  }
+  data = dir === "left" ? data.slice(sliceLength) : data.slice(0, data.length - sliceLength);
+  if (typeof hexOrBytes === "string") {
+    if (data.length === 1 && dir === "right")
+      data = `${data}0`;
+    return `0x${data.length % 2 === 1 ? `0${data}` : data}`;
+  }
+  return data;
+}
+var init_trim = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/data/trim.js"() {
+  }
+});
+
 // ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/encoding/fromHex.js
 function assertSize(hexOrBytes, { size: size2 }) {
   if (size(hexOrBytes) > size2)
@@ -780,6 +1451,32 @@ function assertSize(hexOrBytes, { size: size2 }) {
       maxSize: size2
     });
 }
+function hexToBigInt(hex, opts = {}) {
+  const { signed } = opts;
+  if (opts.size)
+    assertSize(hex, { size: opts.size });
+  const value = BigInt(hex);
+  if (!signed)
+    return value;
+  const size2 = Math.ceil((hex.length - 2) / 2);
+  const max = (1n << BigInt(size2) * 8n - 1n) - 1n;
+  if (value <= max)
+    return value;
+  return value - BigInt(`0x${"f".padStart(size2 * 2, "f")}`) - 1n;
+}
+function hexToNumber(hex, opts = {}) {
+  const value = hexToBigInt(hex, opts);
+  const number = Number(value);
+  if (!Number.isSafeInteger(number))
+    throw new IntegerOutOfRangeError({
+      max: `${Number.MAX_SAFE_INTEGER}`,
+      min: `${Number.MIN_SAFE_INTEGER}`,
+      signed: opts.signed,
+      size: opts.size,
+      value: `${value}n`
+    });
+  return number;
+}
 var init_fromHex = __esm({
   "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/encoding/fromHex.js"() {
     init_encoding();
@@ -1248,26 +1945,1116 @@ var init_keccak256 = __esm({
   }
 });
 
-// ../../node_modules/.pnpm/lodash-es@4.18.1/node_modules/lodash-es/_freeGlobal.js
-var freeGlobal = typeof global == "object" && global && global.Object === Object && global;
-var freeGlobal_default = freeGlobal;
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/hashSignature.js
+function hashSignature(sig) {
+  return hash(sig);
+}
+var hash;
+var init_hashSignature = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/hashSignature.js"() {
+    init_toBytes();
+    init_keccak256();
+    hash = (value) => keccak256(toBytes(value));
+  }
+});
 
-// ../../node_modules/.pnpm/lodash-es@4.18.1/node_modules/lodash-es/_root.js
-var freeSelf = typeof self == "object" && self && self.Object === Object && self;
-var root = freeGlobal_default || freeSelf || Function("return this")();
-var root_default = root;
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/normalizeSignature.js
+function normalizeSignature(signature) {
+  let active = true;
+  let current = "";
+  let level = 0;
+  let result = "";
+  let valid = false;
+  for (let i = 0; i < signature.length; i++) {
+    const char = signature[i];
+    if (["(", ")", ","].includes(char))
+      active = true;
+    if (char === "(")
+      level++;
+    if (char === ")")
+      level--;
+    if (!active)
+      continue;
+    if (level === 0) {
+      if (char === " " && ["event", "function", "error", ""].includes(result))
+        result = "";
+      else {
+        result += char;
+        if (char === ")") {
+          valid = true;
+          break;
+        }
+      }
+      continue;
+    }
+    if (char === " ") {
+      if (!current.endsWith(",") && !current.endsWith("(")) {
+        current = "";
+        active = false;
+      }
+      continue;
+    }
+    result += char;
+    current += char;
+  }
+  if (!valid)
+    throw new BaseError("Unable to normalize signature.");
+  return result;
+}
+var init_normalizeSignature = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/normalizeSignature.js"() {
+    init_base();
+  }
+});
 
-// ../../node_modules/.pnpm/lodash-es@4.18.1/node_modules/lodash-es/_Symbol.js
-var Symbol2 = root_default.Symbol;
-var Symbol_default = Symbol2;
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/toSignature.js
+var toSignature;
+var init_toSignature = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/toSignature.js"() {
+    init_exports();
+    init_normalizeSignature();
+    toSignature = (def) => {
+      const def_ = (() => {
+        if (typeof def === "string")
+          return def;
+        return formatAbiItem(def);
+      })();
+      return normalizeSignature(def_);
+    };
+  }
+});
 
-// ../../node_modules/.pnpm/lodash-es@4.18.1/node_modules/lodash-es/_getRawTag.js
-var objectProto = Object.prototype;
-var hasOwnProperty = objectProto.hasOwnProperty;
-var nativeObjectToString = objectProto.toString;
-var symToStringTag = Symbol_default ? Symbol_default.toStringTag : void 0;
-function getRawTag(value) {
-  var isOwn = hasOwnProperty.call(value, symToStringTag), tag = value[symToStringTag];
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/toSignatureHash.js
+function toSignatureHash(fn) {
+  return hashSignature(toSignature(fn));
+}
+var init_toSignatureHash = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/toSignatureHash.js"() {
+    init_hashSignature();
+    init_toSignature();
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/lru.js
+var LruMap;
+var init_lru = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/lru.js"() {
+    LruMap = class extends Map {
+      constructor(size2) {
+        super();
+        Object.defineProperty(this, "maxSize", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        this.maxSize = size2;
+      }
+      get(key) {
+        const value = super.get(key);
+        if (super.has(key)) {
+          super.delete(key);
+          super.set(key, value);
+        }
+        return value;
+      }
+      set(key, value) {
+        if (super.has(key))
+          super.delete(key);
+        super.set(key, value);
+        if (this.maxSize && this.size > this.maxSize) {
+          const firstKey = super.keys().next().value;
+          if (firstKey !== void 0)
+            super.delete(firstKey);
+        }
+        return this;
+      }
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/address/getAddress.js
+function checksumAddress(address_, chainId) {
+  if (checksumAddressCache.has(`${address_}.${chainId}`))
+    return checksumAddressCache.get(`${address_}.${chainId}`);
+  const hexAddress = chainId ? `${chainId}${address_.toLowerCase()}` : address_.substring(2).toLowerCase();
+  const hash2 = keccak256(stringToBytes(hexAddress), "bytes");
+  const address = (chainId ? hexAddress.substring(`${chainId}0x`.length) : hexAddress).split("");
+  for (let i = 0; i < 40; i += 2) {
+    if (hash2[i >> 1] >> 4 >= 8 && address[i]) {
+      address[i] = address[i].toUpperCase();
+    }
+    if ((hash2[i >> 1] & 15) >= 8 && address[i + 1]) {
+      address[i + 1] = address[i + 1].toUpperCase();
+    }
+  }
+  const result = `0x${address.join("")}`;
+  checksumAddressCache.set(`${address_}.${chainId}`, result);
+  return result;
+}
+var checksumAddressCache;
+var init_getAddress = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/address/getAddress.js"() {
+    init_toBytes();
+    init_keccak256();
+    init_lru();
+    checksumAddressCache = /* @__PURE__ */ new LruMap(8192);
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/data/slice.js
+function slice(value, start, end, { strict } = {}) {
+  if (isHex(value, { strict: false }))
+    return sliceHex(value, start, end, {
+      strict
+    });
+  return sliceBytes(value, start, end, {
+    strict
+  });
+}
+function assertStartOffset(value, start) {
+  if (typeof start === "number" && start > 0 && start > size(value) - 1)
+    throw new SliceOffsetOutOfBoundsError({
+      offset: start,
+      position: "start",
+      size: size(value)
+    });
+}
+function assertEndOffset(value, start, end) {
+  if (typeof start === "number" && typeof end === "number" && size(value) !== end - start) {
+    throw new SliceOffsetOutOfBoundsError({
+      offset: end,
+      position: "end",
+      size: size(value)
+    });
+  }
+}
+function sliceBytes(value_, start, end, { strict } = {}) {
+  assertStartOffset(value_, start);
+  const value = value_.slice(start, end);
+  if (strict)
+    assertEndOffset(value, start, end);
+  return value;
+}
+function sliceHex(value_, start, end, { strict } = {}) {
+  assertStartOffset(value_, start);
+  const value = `0x${value_.replace("0x", "").slice((start ?? 0) * 2, (end ?? value_.length) * 2)}`;
+  if (strict)
+    assertEndOffset(value, start, end);
+  return value;
+}
+var init_slice = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/data/slice.js"() {
+    init_data();
+    init_isHex();
+    init_size();
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/abi/encodeAbiParameters.js
+function getArrayComponents(type) {
+  const matches = type.match(/^(.*)\[(\d+)?\]$/);
+  return matches ? (
+    // Return `null` if the array is dynamic.
+    [matches[2] ? Number(matches[2]) : null, matches[1]]
+  ) : void 0;
+}
+var init_encodeAbiParameters = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/abi/encodeAbiParameters.js"() {
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/toFunctionSelector.js
+var toFunctionSelector;
+var init_toFunctionSelector = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/hash/toFunctionSelector.js"() {
+    init_slice();
+    init_toSignatureHash();
+    toFunctionSelector = (fn) => slice(toSignatureHash(fn), 0, 4);
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/errors/cursor.js
+var NegativeOffsetError, PositionOutOfBoundsError, RecursiveReadLimitExceededError;
+var init_cursor = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/errors/cursor.js"() {
+    init_base();
+    NegativeOffsetError = class extends BaseError {
+      constructor({ offset }) {
+        super(`Offset \`${offset}\` cannot be negative.`, {
+          name: "NegativeOffsetError"
+        });
+      }
+    };
+    PositionOutOfBoundsError = class extends BaseError {
+      constructor({ length, position }) {
+        super(`Position \`${position}\` is out of bounds (\`0 < position < ${length}\`).`, { name: "PositionOutOfBoundsError" });
+      }
+    };
+    RecursiveReadLimitExceededError = class extends BaseError {
+      constructor({ count, limit }) {
+        super(`Recursive read limit of \`${limit}\` exceeded (recursive read count: \`${count}\`).`, { name: "RecursiveReadLimitExceededError" });
+      }
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/cursor.js
+function createCursor(bytes, { recursiveReadLimit = 8192 } = {}) {
+  const cursor = Object.create(staticCursor);
+  cursor.bytes = bytes;
+  cursor.dataView = new DataView(bytes.buffer ?? bytes, bytes.byteOffset, bytes.byteLength);
+  cursor.positionReadCount = /* @__PURE__ */ new Map();
+  cursor.recursiveReadLimit = recursiveReadLimit;
+  return cursor;
+}
+var staticCursor;
+var init_cursor2 = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/cursor.js"() {
+    init_cursor();
+    staticCursor = {
+      bytes: new Uint8Array(),
+      dataView: new DataView(new ArrayBuffer(0)),
+      position: 0,
+      positionReadCount: /* @__PURE__ */ new Map(),
+      recursiveReadCount: 0,
+      recursiveReadLimit: Number.POSITIVE_INFINITY,
+      assertReadLimit() {
+        if (this.recursiveReadCount >= this.recursiveReadLimit)
+          throw new RecursiveReadLimitExceededError({
+            count: this.recursiveReadCount + 1,
+            limit: this.recursiveReadLimit
+          });
+      },
+      assertPosition(position) {
+        if (position < 0 || position > this.bytes.length - 1)
+          throw new PositionOutOfBoundsError({
+            length: this.bytes.length,
+            position
+          });
+      },
+      decrementPosition(offset) {
+        if (offset < 0)
+          throw new NegativeOffsetError({ offset });
+        const position = this.position - offset;
+        this.assertPosition(position);
+        this.position = position;
+      },
+      getReadCount(position) {
+        return this.positionReadCount.get(position || this.position) || 0;
+      },
+      incrementPosition(offset) {
+        if (offset < 0)
+          throw new NegativeOffsetError({ offset });
+        const position = this.position + offset;
+        this.assertPosition(position);
+        this.position = position;
+      },
+      inspectByte(position_) {
+        const position = position_ ?? this.position;
+        this.assertPosition(position);
+        return this.bytes[position];
+      },
+      inspectBytes(length, position_) {
+        const position = position_ ?? this.position;
+        this.assertPosition(position + length - 1);
+        return this.bytes.subarray(position, position + length);
+      },
+      inspectUint8(position_) {
+        const position = position_ ?? this.position;
+        this.assertPosition(position);
+        return this.bytes[position];
+      },
+      inspectUint16(position_) {
+        const position = position_ ?? this.position;
+        this.assertPosition(position + 1);
+        return this.dataView.getUint16(position);
+      },
+      inspectUint24(position_) {
+        const position = position_ ?? this.position;
+        this.assertPosition(position + 2);
+        return (this.dataView.getUint16(position) << 8) + this.dataView.getUint8(position + 2);
+      },
+      inspectUint32(position_) {
+        const position = position_ ?? this.position;
+        this.assertPosition(position + 3);
+        return this.dataView.getUint32(position);
+      },
+      pushByte(byte) {
+        this.assertPosition(this.position);
+        this.bytes[this.position] = byte;
+        this.position++;
+      },
+      pushBytes(bytes) {
+        this.assertPosition(this.position + bytes.length - 1);
+        this.bytes.set(bytes, this.position);
+        this.position += bytes.length;
+      },
+      pushUint8(value) {
+        this.assertPosition(this.position);
+        this.bytes[this.position] = value;
+        this.position++;
+      },
+      pushUint16(value) {
+        this.assertPosition(this.position + 1);
+        this.dataView.setUint16(this.position, value);
+        this.position += 2;
+      },
+      pushUint24(value) {
+        this.assertPosition(this.position + 2);
+        this.dataView.setUint16(this.position, value >> 8);
+        this.dataView.setUint8(this.position + 2, value & ~4294967040);
+        this.position += 3;
+      },
+      pushUint32(value) {
+        this.assertPosition(this.position + 3);
+        this.dataView.setUint32(this.position, value);
+        this.position += 4;
+      },
+      readByte() {
+        this.assertReadLimit();
+        this._touch();
+        const value = this.inspectByte();
+        this.position++;
+        return value;
+      },
+      readBytes(length, size2) {
+        this.assertReadLimit();
+        this._touch();
+        const value = this.inspectBytes(length);
+        this.position += size2 ?? length;
+        return value;
+      },
+      readUint8() {
+        this.assertReadLimit();
+        this._touch();
+        const value = this.inspectUint8();
+        this.position += 1;
+        return value;
+      },
+      readUint16() {
+        this.assertReadLimit();
+        this._touch();
+        const value = this.inspectUint16();
+        this.position += 2;
+        return value;
+      },
+      readUint24() {
+        this.assertReadLimit();
+        this._touch();
+        const value = this.inspectUint24();
+        this.position += 3;
+        return value;
+      },
+      readUint32() {
+        this.assertReadLimit();
+        this._touch();
+        const value = this.inspectUint32();
+        this.position += 4;
+        return value;
+      },
+      get remaining() {
+        return this.bytes.length - this.position;
+      },
+      setPosition(position) {
+        const oldPosition = this.position;
+        this.assertPosition(position);
+        this.position = position;
+        return () => this.position = oldPosition;
+      },
+      _touch() {
+        if (this.recursiveReadLimit === Number.POSITIVE_INFINITY)
+          return;
+        const count = this.getReadCount();
+        this.positionReadCount.set(this.position, count + 1);
+        if (count > 0)
+          this.recursiveReadCount++;
+      }
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/encoding/fromBytes.js
+function bytesToBigInt(bytes, opts = {}) {
+  if (typeof opts.size !== "undefined")
+    assertSize(bytes, { size: opts.size });
+  const hex = bytesToHex2(bytes);
+  return hexToBigInt(hex, opts);
+}
+function bytesToBool(bytes_, opts = {}) {
+  let bytes = bytes_;
+  if (typeof opts.size !== "undefined") {
+    assertSize(bytes, { size: opts.size });
+    bytes = trim(bytes);
+  }
+  if (bytes.length > 1 || bytes[0] > 1)
+    throw new InvalidBytesBooleanError(bytes);
+  return Boolean(bytes[0]);
+}
+function bytesToNumber(bytes, opts = {}) {
+  if (typeof opts.size !== "undefined")
+    assertSize(bytes, { size: opts.size });
+  const hex = bytesToHex2(bytes);
+  return hexToNumber(hex, opts);
+}
+function bytesToString(bytes_, opts = {}) {
+  let bytes = bytes_;
+  if (typeof opts.size !== "undefined") {
+    assertSize(bytes, { size: opts.size });
+    bytes = trim(bytes, { dir: "right" });
+  }
+  return new TextDecoder().decode(bytes);
+}
+var init_fromBytes = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/encoding/fromBytes.js"() {
+    init_encoding();
+    init_trim();
+    init_fromHex();
+    init_toHex();
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/abi/decodeAbiParameters.js
+function decodeAbiParameters(params, data) {
+  const bytes = typeof data === "string" ? hexToBytes(data) : data;
+  const cursor = createCursor(bytes);
+  if (size(bytes) === 0 && params.length > 0)
+    throw new AbiDecodingZeroDataError();
+  if (size(data) && size(data) < 32)
+    throw new AbiDecodingDataSizeTooSmallError({
+      data: typeof data === "string" ? data : bytesToHex2(data),
+      params,
+      size: size(data)
+    });
+  let consumed = 0;
+  const values = [];
+  for (let i = 0; i < params.length; ++i) {
+    const param = params[i];
+    if (consumed < bytes.length)
+      cursor.setPosition(consumed);
+    const [data2, consumed_] = decodeParameter(cursor, param, {
+      staticPosition: 0
+    });
+    consumed += consumed_;
+    values.push(data2);
+  }
+  return values;
+}
+function decodeParameter(cursor, param, { staticPosition }) {
+  const arrayComponents = getArrayComponents(param.type);
+  if (arrayComponents) {
+    const [length, type] = arrayComponents;
+    return decodeArray(cursor, { ...param, type }, { length, staticPosition });
+  }
+  if (param.type === "tuple")
+    return decodeTuple(cursor, param, { staticPosition });
+  if (param.type === "address")
+    return decodeAddress(cursor);
+  if (param.type === "bool")
+    return decodeBool(cursor);
+  if (param.type.startsWith("bytes"))
+    return decodeBytes(cursor, param, { staticPosition });
+  if (param.type.startsWith("uint") || param.type.startsWith("int"))
+    return decodeNumber(cursor, param);
+  if (param.type === "string")
+    return decodeString(cursor, { staticPosition });
+  throw new InvalidAbiDecodingTypeError(param.type, {
+    docsPath: "/docs/contract/decodeAbiParameters"
+  });
+}
+function decodeAddress(cursor) {
+  const value = cursor.readBytes(32);
+  return [checksumAddress(bytesToHex2(sliceBytes(value, -20))), 32];
+}
+function decodeArray(cursor, param, { length, staticPosition }) {
+  if (length === null) {
+    const offset = bytesToNumber(cursor.readBytes(sizeOfOffset));
+    const start = staticPosition + offset;
+    const startOfData = start + sizeOfLength;
+    cursor.setPosition(start);
+    const length2 = bytesToNumber(cursor.readBytes(sizeOfLength));
+    const dynamicChild = hasDynamicChild(param);
+    let consumed2 = 0;
+    const value2 = [];
+    for (let i = 0; i < length2; ++i) {
+      cursor.setPosition(startOfData + (dynamicChild ? i * 32 : consumed2));
+      const [data, consumed_] = decodeParameter(cursor, param, {
+        staticPosition: startOfData
+      });
+      consumed2 += consumed_;
+      value2.push(data);
+      if (consumed_ === 0) {
+        cursor.assertReadLimit();
+        cursor._touch();
+      }
+    }
+    cursor.setPosition(staticPosition + 32);
+    return [value2, 32];
+  }
+  if (hasDynamicChild(param)) {
+    const offset = bytesToNumber(cursor.readBytes(sizeOfOffset));
+    const start = staticPosition + offset;
+    const value2 = [];
+    for (let i = 0; i < length; ++i) {
+      cursor.setPosition(start + i * 32);
+      const [data] = decodeParameter(cursor, param, {
+        staticPosition: start
+      });
+      value2.push(data);
+    }
+    cursor.setPosition(staticPosition + 32);
+    return [value2, 32];
+  }
+  let consumed = 0;
+  const value = [];
+  for (let i = 0; i < length; ++i) {
+    const [data, consumed_] = decodeParameter(cursor, param, {
+      staticPosition: staticPosition + consumed
+    });
+    consumed += consumed_;
+    value.push(data);
+    if (consumed_ === 0) {
+      cursor.assertReadLimit();
+      cursor._touch();
+    }
+  }
+  return [value, consumed];
+}
+function decodeBool(cursor) {
+  return [bytesToBool(cursor.readBytes(32), { size: 32 }), 32];
+}
+function decodeBytes(cursor, param, { staticPosition }) {
+  const [_, size2] = param.type.split("bytes");
+  if (!size2) {
+    const offset = bytesToNumber(cursor.readBytes(32));
+    cursor.setPosition(staticPosition + offset);
+    const length = bytesToNumber(cursor.readBytes(32));
+    if (length === 0) {
+      cursor.setPosition(staticPosition + 32);
+      return ["0x", 32];
+    }
+    const data = cursor.readBytes(length);
+    cursor.setPosition(staticPosition + 32);
+    return [bytesToHex2(data), 32];
+  }
+  const value = bytesToHex2(cursor.readBytes(Number.parseInt(size2, 10), 32));
+  return [value, 32];
+}
+function decodeNumber(cursor, param) {
+  const signed = param.type.startsWith("int");
+  const size2 = Number.parseInt(param.type.split("int")[1] || "256", 10);
+  const value = cursor.readBytes(32);
+  return [
+    size2 > 48 ? bytesToBigInt(value, { signed }) : bytesToNumber(value, { signed }),
+    32
+  ];
+}
+function decodeTuple(cursor, param, { staticPosition }) {
+  const hasUnnamedChild = param.components.length === 0 || param.components.some(({ name }) => !name);
+  const value = hasUnnamedChild ? [] : {};
+  let consumed = 0;
+  if (hasDynamicChild(param)) {
+    const offset = bytesToNumber(cursor.readBytes(sizeOfOffset));
+    const start = staticPosition + offset;
+    for (let i = 0; i < param.components.length; ++i) {
+      const component = param.components[i];
+      cursor.setPosition(start + consumed);
+      const [data, consumed_] = decodeParameter(cursor, component, {
+        staticPosition: start
+      });
+      consumed += consumed_;
+      value[hasUnnamedChild ? i : component?.name] = data;
+    }
+    cursor.setPosition(staticPosition + 32);
+    return [value, 32];
+  }
+  for (let i = 0; i < param.components.length; ++i) {
+    const component = param.components[i];
+    const [data, consumed_] = decodeParameter(cursor, component, {
+      staticPosition
+    });
+    value[hasUnnamedChild ? i : component?.name] = data;
+    consumed += consumed_;
+  }
+  return [value, consumed];
+}
+function decodeString(cursor, { staticPosition }) {
+  const offset = bytesToNumber(cursor.readBytes(32));
+  const start = staticPosition + offset;
+  cursor.setPosition(start);
+  const length = bytesToNumber(cursor.readBytes(32));
+  if (length === 0) {
+    cursor.setPosition(staticPosition + 32);
+    return ["", 32];
+  }
+  const data = cursor.readBytes(length, 32);
+  const value = bytesToString(data);
+  cursor.setPosition(staticPosition + 32);
+  return [value, 32];
+}
+function hasDynamicChild(param) {
+  const { type } = param;
+  if (type === "string")
+    return true;
+  if (type === "bytes")
+    return true;
+  if (type.endsWith("[]"))
+    return true;
+  if (type === "tuple")
+    return param.components?.some(hasDynamicChild);
+  const arrayComponents = getArrayComponents(param.type);
+  if (arrayComponents && hasDynamicChild({ ...param, type: arrayComponents[1] }))
+    return true;
+  return false;
+}
+var sizeOfLength, sizeOfOffset;
+var init_decodeAbiParameters = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/abi/decodeAbiParameters.js"() {
+    init_abi();
+    init_getAddress();
+    init_cursor2();
+    init_size();
+    init_slice();
+    init_fromBytes();
+    init_toBytes();
+    init_toHex();
+    init_encodeAbiParameters();
+    sizeOfLength = 32;
+    sizeOfOffset = 32;
+  }
+});
+
+// ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/abi/decodeFunctionData.js
+function decodeFunctionData(parameters) {
+  const { abi, data } = parameters;
+  const signature = slice(data, 0, 4);
+  const description = abi.find((x) => x.type === "function" && signature === toFunctionSelector(formatAbiItem2(x)));
+  if (!description)
+    throw new AbiFunctionSignatureNotFoundError(signature, {
+      docsPath: "/docs/contract/decodeFunctionData"
+    });
+  return {
+    functionName: description.name,
+    args: "inputs" in description && description.inputs && description.inputs.length > 0 ? decodeAbiParameters(description.inputs, slice(data, 4)) : void 0
+  };
+}
+var init_decodeFunctionData = __esm({
+  "../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/utils/abi/decodeFunctionData.js"() {
+    init_abi();
+    init_slice();
+    init_toFunctionSelector();
+    init_decodeAbiParameters();
+    init_formatAbiItem2();
+  }
+});
+
+// src/lib/account-routes.ts
+var UNLINKABLE = "passkey|email|telegram|google|apple|discord|x|wallet";
+var ACCOUNT_ROUTES = [
+  { method: "PATCH", path: /^\/api\/auth\/profile$/ },
+  { method: "PUT", path: /^\/api\/auth\/nickname$/ },
+  { method: "POST", path: /^\/api\/auth\/devices\/link$/ },
+  { method: "DELETE", path: /^\/api\/auth\/devices\/[A-Za-z0-9_-]{1,128}$/ },
+  { method: "POST", path: /^\/api\/tss\/wallet\/smart-account\/chain$/ },
+  // linking and unlinking providers (brief 4)
+  { method: "POST", path: /^\/api\/auth\/link\/wallet$/ },
+  { method: "POST", path: /^\/api\/auth\/link\/telegram$/ },
+  { method: "POST", path: /^\/api\/auth\/link\/email\/(send-code|verify-code)$/ },
+  { method: "POST", path: /^\/api\/auth\/link\/passkey\/(begin|complete)$/ },
+  { method: "POST", path: /^\/api\/auth\/link\/(x|discord)\/start$/ },
+  { method: "DELETE", path: /^\/api\/auth\/unlink\/wallet$/, query: ["address"] },
+  { method: "DELETE", path: new RegExp(`^/api/auth/unlink/(${UNLINKABLE})$`), query: ["externalId"] }
+];
+function parseAccountRoute(method, pathWithQuery) {
+  if (typeof pathWithQuery !== "string" || !pathWithQuery.startsWith("/")) return null;
+  const [path, search = ""] = pathWithQuery.split("?", 2);
+  const query = new URLSearchParams(search);
+  const route = ACCOUNT_ROUTES.find((r) => r.method === method && r.path.test(path));
+  if (!route) return null;
+  for (const key of query.keys()) if (!route.query?.includes(key)) return null;
+  return { path, query };
+}
+function isLinkRoute(path) {
+  return path.startsWith("/api/auth/link/");
+}
+
+// src/lib/errors.ts
+var AccountAbstractionError = class _AccountAbstractionError extends Error {
+  constructor(message, code, details = {}) {
+    super(message);
+    /** Machine-readable error code for programmatic handling */
+    __publicField(this, "code");
+    __publicField(this, "details");
+    this.code = code;
+    this.details = details;
+    this.name = "LumiaPassportError";
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _AccountAbstractionError);
+    }
+  }
+};
+var _UserRejectedError = class _UserRejectedError extends AccountAbstractionError {
+  constructor(message = "User rejected transaction") {
+    super(message, _UserRejectedError.CODE);
+    this.name = "UserRejectedError";
+  }
+};
+__publicField(_UserRejectedError, "CODE", "USER_REJECTED");
+var UserRejectedError = _UserRejectedError;
+var _SessionExpiredError = class _SessionExpiredError extends AccountAbstractionError {
+  constructor(message = "Session expired, please log in again") {
+    super(message, _SessionExpiredError.CODE);
+    this.name = "SessionExpiredError";
+  }
+};
+__publicField(_SessionExpiredError, "CODE", "SESSION_EXPIRED");
+var SessionExpiredError = _SessionExpiredError;
+var _PolicyViolationError = class _PolicyViolationError extends AccountAbstractionError {
+  constructor(message, details = {}) {
+    super(message, _PolicyViolationError.CODE, details);
+    __publicField(this, "policyId");
+    __publicField(this, "rule");
+    __publicField(this, "reason");
+    this.name = "PolicyViolationError";
+    this.policyId = typeof details.policyId === "string" ? details.policyId : "";
+    this.rule = typeof details.rule === "string" ? details.rule : "";
+    this.reason = typeof details.reason === "string" ? details.reason : "";
+  }
+};
+__publicField(_PolicyViolationError, "CODE", "POLICY_VIOLATION");
+var PolicyViolationError = _PolicyViolationError;
+var ErrorCodes = {
+  MPC_SIGNING_ERROR: "MPC_SIGNING_ERROR",
+  USER_REJECTED: UserRejectedError.CODE,
+  SESSION_EXPIRED: SessionExpiredError.CODE,
+  POLICY_VIOLATION: PolicyViolationError.CODE,
+  POLICY_UNAVAILABLE: "POLICY_UNAVAILABLE",
+  WALLET_REVOKED: "WALLET_REVOKED",
+  DIGEST_MISMATCH: "DIGEST_MISMATCH",
+  MISSING_OPERATION: "MISSING_OPERATION",
+  UNSUPPORTED_CALLDATA: "UNSUPPORTED_CALLDATA",
+  TSS_REQUEST_FAILED: "TSS_REQUEST_FAILED"
+};
+function tssErrorFromBody(status, body) {
+  const tssCode = body.error ?? body.code;
+  const code = tssCode ? tssCode.toUpperCase() : ErrorCodes.TSS_REQUEST_FAILED;
+  const message = body.message ?? body.error ?? `API call failed (${status})`;
+  const details = { status };
+  if (body.policyId !== void 0) details.policyId = body.policyId;
+  if (body.rule !== void 0) details.rule = body.rule;
+  if (body.reason !== void 0) details.reason = body.reason;
+  if (body.existingOwnerAddress) details.existingOwnerAddress = body.existingOwnerAddress;
+  return createAccountAbstractionError({ message, code, details });
+}
+function createAccountAbstractionError(params) {
+  const { message, code, details = {} } = params;
+  if (!code) {
+    return new Error(message);
+  }
+  switch (code) {
+    case UserRejectedError.CODE:
+      return new UserRejectedError(message);
+    case SessionExpiredError.CODE:
+      return new SessionExpiredError(message);
+    case PolicyViolationError.CODE:
+      return new PolicyViolationError(message, details);
+    default:
+      return new AccountAbstractionError(message, code, details);
+  }
+}
+
+// src/iframe/lib/sdk-version.ts
+var SDK_VERSION_HEADER = "X-Embark-SDK-Version";
+var IFRAME_SDK_VERSION = `iframe-${"0.6.9"}`;
+function sdkVersionHeaders() {
+  return { [SDK_VERSION_HEADER]: IFRAME_SDK_VERSION };
+}
+
+// src/iframe/lib/iframe-session.ts
+var IFRAME_SESSION_STORAGE_KEY = "embark-iframe-session";
+var REFRESH_MARGIN_MS = 60 * 1e3;
+var UNCONFIRMED_TTL_MS = 10 * 60 * 1e3;
+function defaultTssUrl() {
+  return "https://api.embarkai.io/tss";
+}
+var IframeSession = class {
+  constructor(tssUrl2 = defaultTssUrl, storage = () => typeof localStorage !== "undefined" ? localStorage : void 0) {
+    __publicField(this, "tssUrl", tssUrl2);
+    __publicField(this, "storage", storage);
+    __publicField(this, "refreshing", null);
+  }
+  /** The confirmed session (the user passed the consent step), or null */
+  get() {
+    const session = this.getIncludingUnconfirmed();
+    return session && session.confirmed !== false ? session : null;
+  }
+  /**
+   * The stored session, confirmed or not: for the consent step itself and for the session's own upkeep
+   * (refresh, sign-out). A stale unconfirmed session is revoked and forgotten.
+   */
+  getIncludingUnconfirmed() {
+    const session = this.read();
+    if (session && session.confirmed === false && Date.now() - (session.savedAt ?? 0) > UNCONFIRMED_TTL_MS) {
+      void this.discard(session);
+      return null;
+    }
+    return session;
+  }
+  has() {
+    return !!this.get();
+  }
+  getUserId() {
+    return this.get()?.userId ?? null;
+  }
+  /** Whether `token` is (or was, before a refresh) this session's access token */
+  owns(token) {
+    return !!token && this.read()?.accessToken === token;
+  }
+  /** @param options.confirmed false at the end of a sign-in: the session waits for the consent step */
+  save(tokens, projectId, options = {}) {
+    if (!tokens.refreshToken) throw new Error("Sign-in response has no refresh token");
+    const session = {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      userId: tokens.userId,
+      expiresAt: Date.now() + tokens.expiresIn * 1e3,
+      projectId,
+      displayName: tokens.displayName ?? null,
+      avatar: tokens.avatar ?? null,
+      providers: tokens.providers ?? [],
+      hasKeyshare: tokens.hasKeyshare,
+      confirmed: options.confirmed !== false,
+      savedAt: Date.now()
+    };
+    this.write(session);
+    return session;
+  }
+  /**
+   * The user passed the consent step for `userId`: the session becomes usable.
+   * @returns whether a session of that user was confirmed
+   */
+  confirm(userId) {
+    const session = this.getIncludingUnconfirmed();
+    if (!session || !userId || session.userId !== userId) return false;
+    if (session.confirmed === false) this.write({ ...session, confirmed: true });
+    return true;
+  }
+  update(patch) {
+    const session = this.read();
+    if (session) this.write({ ...session, ...patch });
+  }
+  clear() {
+    try {
+      this.storage()?.removeItem(IFRAME_SESSION_STORAGE_KEY);
+    } catch {
+    }
+  }
+  info() {
+    const session = this.get();
+    if (!session) return { signedIn: false };
+    return {
+      signedIn: true,
+      userId: session.userId,
+      displayName: session.displayName ?? null,
+      avatar: session.avatar ?? null,
+      providers: session.providers ?? [],
+      hasKeyshare: session.hasKeyshare
+    };
+  }
+  /**
+   * A usable access token: refreshed first when it is about to expire.
+   * @throws SessionExpiredError when there is no session or it cannot be refreshed any more
+   */
+  async getAccessToken() {
+    const session = this.getIncludingUnconfirmed();
+    if (!session) throw new SessionExpiredError("No iframe session, please sign in");
+    if (session.expiresAt - REFRESH_MARGIN_MS > Date.now()) return session.accessToken;
+    const result = await this.refresh();
+    if (result.token) return result.token;
+    if (result.sessionDead) throw new SessionExpiredError();
+    return session.accessToken;
+  }
+  /** Refresh with the session's refresh token (rotation). A 401 ends the session. */
+  refresh() {
+    if (this.refreshing) return this.refreshing;
+    this.refreshing = this.doRefresh().finally(() => {
+      this.refreshing = null;
+    });
+    return this.refreshing;
+  }
+  async doRefresh() {
+    const session = this.getIncludingUnconfirmed();
+    if (!session) return { token: null, sessionDead: true };
+    let response;
+    try {
+      response = await fetch(this.url("/api/auth/refresh", session.projectId), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...sdkVersionHeaders() },
+        body: JSON.stringify({ refreshToken: session.refreshToken })
+      });
+    } catch {
+      return { token: null, sessionDead: false };
+    }
+    if (response.status === 401) {
+      const body = await response.json().catch(() => null);
+      if (body) {
+        this.clear();
+        return { token: null, sessionDead: true };
+      }
+      return { token: null, sessionDead: false };
+    }
+    if (!response.ok) return { token: null, sessionDead: false };
+    const data = await response.json();
+    const current = this.read();
+    if (!current || current.refreshToken !== session.refreshToken) {
+      return current ? { token: current.accessToken } : { token: null, sessionDead: true };
+    }
+    this.write({
+      ...current,
+      accessToken: data.accessToken,
+      refreshToken: data.refreshToken || current.refreshToken,
+      expiresAt: Date.now() + data.expiresIn * 1e3,
+      providers: data.providers ?? current.providers
+    });
+    return { token: data.accessToken };
+  }
+  /** Mint a dApp pair for the parent page of `projectId` */
+  async mintDappTokens(projectId) {
+    const call = (token) => fetch(this.url("/api/auth/dapp-token", projectId), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}`, ...sdkVersionHeaders() },
+      body: JSON.stringify({ projectId })
+    });
+    let response = await call(await this.getAccessToken());
+    if (response.status === 401) {
+      const refreshed = await this.refresh();
+      if (!refreshed.token) {
+        if (refreshed.sessionDead) throw new SessionExpiredError();
+        throw new Error("Token refresh temporarily unavailable, please retry");
+      }
+      response = await call(refreshed.token);
+    }
+    if (!response.ok) {
+      const body = await response.json().catch(() => ({}));
+      throw Object.assign(new Error(body?.message || `dApp token request failed (${response.status})`), {
+        status: response.status,
+        code: body?.error
+      });
+    }
+    return await response.json();
+  }
+  /** Revoke the session at TSS (the dApp pair shares its sessionId, so it ends too) and forget it */
+  async signOut() {
+    const session = this.read();
+    if (!session) return;
+    const token = await this.getAccessToken().catch(() => session.accessToken);
+    this.clear();
+    try {
+      await fetch(this.url("/api/auth/logout", session.projectId), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}`, ...sdkVersionHeaders() }
+      });
+    } catch (error) {
+      console.warn("[iframe][Session] Logout request failed:", error);
+    }
+  }
+  /** A stale unconfirmed session: forget it and revoke it at TSS (best effort) */
+  async discard(session) {
+    if (this.read()?.refreshToken !== session.refreshToken) return;
+    this.clear();
+    try {
+      await fetch(this.url("/api/auth/logout", session.projectId), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${session.accessToken}`, ...sdkVersionHeaders() }
+      });
+    } catch {
+    }
+  }
+  read() {
+    try {
+      const raw = this.storage()?.getItem(IFRAME_SESSION_STORAGE_KEY);
+      if (!raw) return null;
+      const parsed = JSON.parse(raw);
+      return parsed?.accessToken && parsed?.refreshToken && parsed?.userId ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+  url(path, projectId) {
+    const url = `${this.tssUrl()}${path}`;
+    return projectId ? `${url}${url.includes("?") ? "&" : "?"}projectId=${encodeURIComponent(projectId)}` : url;
+  }
+  write(session) {
+    this.storage()?.setItem(IFRAME_SESSION_STORAGE_KEY, JSON.stringify(session));
+  }
+};
+var iframeSession = new IframeSession();
+
+// src/iframe/lib/account-requests.ts
+function defaultTssUrl2() {
+  return "https://api.embarkai.io/tss";
+}
+var PARENT_ORIGIN_ROUTES = /* @__PURE__ */ new Set(["/api/auth/link/passkey/begin", "/api/auth/link/x/start"]);
+async function sendAccountRequest(request, projectId, session = iframeSession, tssUrl2 = defaultTssUrl2, parentOrigin) {
+  const method = typeof request?.method === "string" ? request.method.toUpperCase() : "";
+  const route = parseAccountRoute(method, typeof request?.path === "string" ? request.path : "");
+  if (!route) {
+    throw new AccountAbstractionError(`Not an account request: ${method} ${String(request?.path)}`, "INVALID_REQUEST");
+  }
+  if (!session.has()) throw new SessionExpiredError("No iframe session, please sign in");
+  let body = request.body;
+  if (PARENT_ORIGIN_ROUTES.has(route.path) && parentOrigin) {
+    body = { ...body && typeof body === "object" ? body : {}, parent_origin: parentOrigin };
+  }
+  const query = new URLSearchParams(route.query);
+  query.set("projectId", projectId);
+  const url = `${tssUrl2()}${route.path}?${query.toString()}`;
+  const send = (token) => fetch(url, {
+    method,
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}`, ...sdkVersionHeaders() },
+    ...body !== void 0 && method !== "DELETE" ? { body: JSON.stringify(body) } : {}
+  });
+  let response = await send(await session.getAccessToken());
+  if (response.status === 401) {
+    const refreshed = await session.refresh();
+    if (!refreshed.token) {
+      if (refreshed.sessionDead) throw new SessionExpiredError();
+      throw new Error("Token refresh temporarily unavailable, please retry");
+    }
+    response = await send(refreshed.token);
+  }
+  let data = await response.json().catch(() => null);
+  if (response.ok && data && typeof data === "object" && isLinkRoute(route.path)) {
+    data = keepLinkTokens(data, session);
+  }
+  return { ok: response.ok, status: response.status, data };
+}
+function keepLinkTokens(data, session) {
+  const { accessToken: _accessToken, refreshToken: _refreshToken, expiresIn: _expiresIn, ...rest } = data;
+  if (Array.isArray(rest.providers)) session.update({ providers: rest.providers });
+  return rest;
+}
+
+// ../../node_modules/.pnpm/lodash-es@4.18.1/node_modules/lodash-es/_freeGlobal.js
+var freeGlobal = typeof global == "object" && global && global.Object === Object && global;
+var freeGlobal_default = freeGlobal;
+
+// ../../node_modules/.pnpm/lodash-es@4.18.1/node_modules/lodash-es/_root.js
+var freeSelf = typeof self == "object" && self && self.Object === Object && self;
+var root = freeGlobal_default || freeSelf || Function("return this")();
+var root_default = root;
+
+// ../../node_modules/.pnpm/lodash-es@4.18.1/node_modules/lodash-es/_Symbol.js
+var Symbol2 = root_default.Symbol;
+var Symbol_default = Symbol2;
+
+// ../../node_modules/.pnpm/lodash-es@4.18.1/node_modules/lodash-es/_getRawTag.js
+var objectProto = Object.prototype;
+var hasOwnProperty = objectProto.hasOwnProperty;
+var nativeObjectToString = objectProto.toString;
+var symToStringTag = Symbol_default ? Symbol_default.toStringTag : void 0;
+function getRawTag(value) {
+  var isOwn = hasOwnProperty.call(value, symToStringTag), tag = value[symToStringTag];
   try {
     value[symToStringTag] = void 0;
     var unmasked = true;
@@ -2102,12 +3889,12 @@ function memoize(func, resolver) {
     throw new TypeError(FUNC_ERROR_TEXT);
   }
   var memoized = function() {
-    var args = arguments, key = resolver ? resolver.apply(this, args) : args[0], cache = memoized.cache;
-    if (cache.has(key)) {
-      return cache.get(key);
+    var args = arguments, key = resolver ? resolver.apply(this, args) : args[0], cache2 = memoized.cache;
+    if (cache2.has(key)) {
+      return cache2.get(key);
     }
     var result = func.apply(this, args);
-    memoized.cache = cache.set(key, result) || cache;
+    memoized.cache = cache2.set(key, result) || cache2;
     return result;
   };
   memoized.cache = new (memoize.Cache || MapCache_default)();
@@ -2120,12 +3907,12 @@ var memoize_default = memoize;
 var MAX_MEMOIZE_SIZE = 500;
 function memoizeCapped(func) {
   var result = memoize_default(func, function(key) {
-    if (cache.size === MAX_MEMOIZE_SIZE) {
-      cache.clear();
+    if (cache2.size === MAX_MEMOIZE_SIZE) {
+      cache2.clear();
     }
     return key;
   });
-  var cache = result.cache;
+  var cache2 = result.cache;
   return result;
 }
 var memoizeCapped_default = memoizeCapped;
@@ -2869,136 +4656,63 @@ var ActivityLoggingAPI = class {
     if (!response.ok) {
       throw new Error(`Failed to get audit token: ${await readErrorMessage(response)}`);
     }
-    const data = await response.json();
-    if (!data?.resourceToken) {
-      throw new Error("Invalid audit token response");
-    }
-    return data.resourceToken;
-  }
-  async getUserActivityLog(payload, project_id, accessToken) {
-    const auditToken = await this.getAuditToken(project_id, accessToken);
-    const url = new URL(`${DWH_URL}/wallet/events`);
-    const queriesSet = { ...payload, project_id };
-    toPairs_default(queriesSet).forEach(([key, value]) => {
-      if (value !== void 0 && value !== null) url.searchParams.append(key, String(value));
-    });
-    const response = await fetch(url.toString(), {
-      method: "GET",
-      headers: { "Content-Type": "application/json", "Authorization": `Bearer ${auditToken}` }
-    });
-    if (!response.ok) {
-      throw new Error(`Failed to get user activity log: ${await readErrorMessage(response)}`);
-    }
-    return await response.json();
-  }
-  // IFRAME MESSAGING
-  async handleMessage(message, origin) {
-    const { type, messageId, projectId, data } = message;
-    const { accessToken, payload } = data;
-    console.info("[ USER_ACTIVITY_LOG_API Received message ]", type, projectId, payload);
-    switch (type) {
-      case "USER_ACTIVITY_LOG_GET": {
-        const activityLog = await this.getUserActivityLog(payload, projectId, accessToken);
-        this.sendResponseFn(messageId, activityLog, origin);
-        break;
-      }
-      default:
-        throw new Error(`[USER_ACTIVITY_LOG_API]: Unknown message type: ${type}`);
-    }
-  }
-};
-
-// src/iframe/lib/assets-policies-api.ts
-var API_URL = window?.__EMBARK_SERVICES__?.tssUrl || "https://api.embarkai.io/tss";
-async function readErrorMessage2(response) {
-  try {
-    const body = await response.json();
-    return body?.message || body?.error || response.statusText;
-  } catch {
-    return response.statusText;
-  }
-}
-var AssetsPoliciesAPI = class {
-  constructor(sendResponseFn) {
-    __publicField(this, "sendResponseFn");
-    this.sendResponseFn = sendResponseFn;
-  }
-  // API METHODS
-  async getUserPolicy(userId, projectId, chainId, accessToken) {
-    const url = `${API_URL}/api/tss/${userId}/policy?projectId=${encodeURIComponent(projectId)}&chainId=${chainId}`;
-    const response = await fetch(url, {
-      method: "GET",
-      headers: { Authorization: `Bearer ${accessToken}` }
-    });
-    if (!response.ok) {
-      throw new Error(`Failed to fetch user policy: ${await readErrorMessage2(response)}`);
-    }
-    return await response.json();
-  }
-  async putUserPolicy(userId, projectId, chainId, rules, accessToken) {
-    const url = `${API_URL}/api/tss/${userId}/policy?projectId=${encodeURIComponent(projectId)}`;
-    const response = await fetch(url, {
-      method: "PUT",
-      body: JSON.stringify({ chainId, rules }),
-      headers: { "Content-Type": "application/json", "Authorization": `Bearer ${accessToken}` }
-    });
-    if (!response.ok) {
-      throw new Error(`Failed to update user policy: ${await readErrorMessage2(response)}`);
+    const data = await response.json();
+    if (!data?.resourceToken) {
+      throw new Error("Invalid audit token response");
     }
-    return await response.json();
+    return data.resourceToken;
   }
-  async cancelPendingUserPolicy(userId, projectId, chainId, accessToken) {
-    const url = `${API_URL}/api/tss/${userId}/policy/cancel-pending?projectId=${encodeURIComponent(projectId)}`;
-    const response = await fetch(url, {
-      method: "POST",
-      body: JSON.stringify({ chainId }),
-      headers: { "Content-Type": "application/json", "Authorization": `Bearer ${accessToken}` }
+  async getUserActivityLog(payload, project_id, accessToken) {
+    const auditToken = await this.getAuditToken(project_id, accessToken);
+    const url = new URL(`${DWH_URL}/external/wallet/events`);
+    const queriesSet = { ...payload, project_id };
+    toPairs_default(queriesSet).forEach(([key, value]) => {
+      if (value !== void 0 && value !== null) url.searchParams.append(key, String(value));
+    });
+    const response = await fetch(url.toString(), {
+      method: "GET",
+      headers: { "Content-Type": "application/json", "Authorization": `Bearer ${auditToken}` }
     });
     if (!response.ok) {
-      throw new Error(`Failed to cancel pending policy change: ${await readErrorMessage2(response)}`);
+      throw new Error(`Failed to get user activity log: ${await readErrorMessage(response)}`);
     }
     return await response.json();
   }
-  async deleteUserPolicy(userId, projectId, chainId, accessToken) {
-    const url = `${API_URL}/api/tss/${userId}/policy/delete?projectId=${encodeURIComponent(projectId)}`;
-    const response = await fetch(url, {
-      method: "POST",
-      body: JSON.stringify({ chainId }),
-      headers: { "Content-Type": "application/json", "Authorization": `Bearer ${accessToken}` }
+  async getUserSecurityActivity(payload, project_id, accessToken) {
+    const auditToken = await this.getAuditToken(project_id, accessToken);
+    const url = new URL(`${DWH_URL}/external/activity`);
+    toPairs_default(payload).forEach(([key, value]) => {
+      if (value === void 0 || value === null) return;
+      if (Array.isArray(value)) value.forEach((item) => url.searchParams.append(key, String(item)));
+      else url.searchParams.append(key, String(value));
+    });
+    const response = await fetch(url.toString(), {
+      method: "GET",
+      headers: { "Content-Type": "application/json", "Authorization": `Bearer ${auditToken}` }
     });
     if (!response.ok) {
-      throw new Error(`Failed to delete user policy: ${await readErrorMessage2(response)}`);
+      throw new Error(`Failed to get user security activity: ${await readErrorMessage(response)}`);
     }
     return await response.json();
   }
   // IFRAME MESSAGING
   async handleMessage(message, origin) {
     const { type, messageId, projectId, data } = message;
-    const { userId, accessToken, chainId, rules } = data;
-    console.info("[ USER_ASSETS_POLICY_API Received message ]", type, { userId, chainId });
+    const { accessToken, payload } = data;
+    console.info("[ USER_ACTIVITY_LOG_API Received message ]", type, projectId, payload);
     switch (type) {
-      case "USER_ASSETS_POLICY_GET": {
-        const policyView = await this.getUserPolicy(userId, projectId, chainId, accessToken);
-        this.sendResponseFn(messageId, policyView, origin);
-        break;
-      }
-      case "USER_ASSETS_POLICY_PUT": {
-        const policyView = await this.putUserPolicy(userId, projectId, chainId, rules, accessToken);
-        this.sendResponseFn(messageId, policyView, origin);
-        break;
-      }
-      case "USER_ASSETS_POLICY_CANCEL_PENDING": {
-        const policyView = await this.cancelPendingUserPolicy(userId, projectId, chainId, accessToken);
-        this.sendResponseFn(messageId, policyView, origin);
+      case "USER_ACTIVITY_LOG_GET": {
+        const activityLog = await this.getUserActivityLog(payload, projectId, accessToken);
+        this.sendResponseFn(messageId, activityLog, origin);
         break;
       }
-      case "USER_ASSETS_POLICY_DELETE": {
-        const policyView = await this.deleteUserPolicy(userId, projectId, chainId, accessToken);
-        this.sendResponseFn(messageId, policyView, origin);
+      case "USER_ACTIVITY_LOG_SECURITY_GET": {
+        const activity = await this.getUserSecurityActivity(payload, projectId, accessToken);
+        this.sendResponseFn(messageId, activity, origin);
         break;
       }
       default:
-        throw new Error(`[USER_ASSETS_POLICY_API]: Unknown message type: ${type}`);
+        throw new Error(`[USER_ACTIVITY_LOG_API]: Unknown message type: ${type}`);
     }
   }
 };
@@ -3052,13 +4766,13 @@ var TemplateEngine = class {
 };
 
 // src/iframe/templates/html/authorization.html
-var authorization_default = '<div\n  style="\n    position: fixed;\n    top: 0;\n    left: 0;\n    right: 0;\n    bottom: 0;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    z-index: 10000;\n    background: #000000;\n  "\n>\n  <div\n    style="\n      display: flex;\n      flex-direction: column;\n      gap: var(--iframe-gap);\n      align-items: center;\n      background: var(--iframe-modal-bg);\n      border-radius: 20px;\n      padding: 20px;\n      max-width: 320px;\n      width: calc(100% - 40px);\n      max-height: 90vh;\n      overflow-y: auto;\n    "\n  >\n    <div style="display: flex; align-items: center; gap: 0; justify-content: center">\n      <!-- 10px overlap -->\n      <div style="width: 38px; height: 48px; z-index: 10; overflow: visible">\n        {{#if userAvatar}}\n        <img\n          src="{{userAvatar}}"\n          alt="{{userName}}"\n          style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n        />\n        {{else}}\n        <span\n          style="\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            width: 48px;\n            height: 48px;\n            border-radius: 24px;\n            background-color: var(--iframe-button-bg);\n            color: var(--iframe-button-text);\n            font-size: 14px;\n            font-weight: 600;\n          "\n          >U</span\n        >\n        {{/if}}\n      </div>\n\n      <!-- ------------------------------------------------------------ -->\n\n      <div style="width: 38px; height: 48px; z-index: 5; overflow: visible">\n        {{#if displayLogo}}\n        <img\n          src="{{displayLogo}}"\n          alt="{{displayName}}"\n          style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n        />\n        {{else}}\n        <span\n          style="\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            width: 48px;\n            height: 48px;\n            border-radius: 24px;\n            background-color: var(--iframe-button-bg);\n            color: var(--iframe-button-text);\n            font-size: 14px;\n            font-weight: 600;\n          "\n          >A</span\n        >\n        {{/if}}\n      </div>\n    </div>\n\n    <div style="display: flex; align-items: center; gap: var(--iframe-gap); justify-content: center">\n      <span\n        style="\n          width: fit-content;\n          font-size: var(--iframe-h2-fz);\n          font-weight: var(--iframe-heading-fw);\n          line-height: 150%;\n          text-align: center;\n        "\n        >{{displayName}}</span\n      >\n    </div>\n\n    <div class="domain-info {{domainStatusClass}}">\n      <span style="display: block; width: 100%; font-size: 12px; text-align: center; font-family: monospace"\n        >{{domainStatusIcon}} {{origin}}</span\n      >\n    </div>\n\n    <!-- Permissions box -->\n    <div\n      id="data-auth-permissions-block"\n      aria-expanded="false"\n      style="display: flex; flex-direction: column; width: 100%"\n    >\n      <div\n        id="data-auth-permissions-toggler"\n        style="\n          cursor: pointer;\n          text-align: center;\n          list-style: none;\n          padding: 0 var(--iframe-pd);\n          user-select: none;\n          font-size: 12px;\n          line-height: 20px;\n        "\n      >\n        Show Permissions \u25BC\n      </div>\n\n      <div\n        id="data-auth-permissions-content"\n        style="width: 100%; height: var(--iframe-permissions-h, 0); overflow: hidden; transition: height 300ms ease"\n      >\n        <div\n          style="\n            width: 100%;\n            padding: var(--iframe-gap);\n            border-radius: var(--iframe-el-bdrs);\n            background: var(--iframe-info);\n            font-size: 10px;\n          "\n        >\n          <div style="margin-bottom: var(--iframe-gap)">\n            <strong>{{displayName}}</strong> by <span class="project-owner">{{displayName}}</span> wants to access your\n            <strong>EmbarkAI</strong> account\n          </div>\n\n          <div style="margin-bottom: var(--iframe-gap)">\n            <strong style="margin-bottom: var(--iframe-gap)">Personal user data</strong>\n            <ul style="list-style: none">\n              <li style="padding-left: var(--iframe-pd)">Wallet address (read-only)</li>\n              <li style="padding-left: var(--iframe-pd)">Public transaction history (read-only)</li>\n            </ul>\n          </div>\n\n          <div style="width: 100%">\n            <strong style="margin-bottom: var(--iframe-gap)">Permissions</strong>\n            <ul style="list-style: none">\n              <li style="padding-left: var(--iframe-pd)">Request transaction signatures</li>\n              <li style="padding-left: var(--iframe-pd)">Initiate blockchain operations</li>\n            </ul>\n          </div>\n        </div>\n      </div>\n    </div>\n\n    {{#if showSecurityWarning}}\n    <div class="security-warning">\n      <strong>\u26A0\uFE0F Warning:</strong> This domain is not verified for {{displayName}}\n      <div>Expected: {{expectedDomains}}</div>\n      <div>Actual: {{origin}}</div>\n    </div>\n    {{else}}\n    <span style="display: block; text-align: center; font-size: 10px; color: var(--iframe-text-secondary)"\n      >By continuing you allow the app to use these permissions, you can revoke access at any time.</span\n    >\n    {{/if}}\n\n    <!-- Action buttons -->\n    <div style="display: flex; gap: var(--iframe-gap); width: 100%; align-items: center">\n      <button class="cancel-btn">Cancel</button>\n      <button class="authorize-btn" {{authorizeButtonState}}>Continue</button>\n    </div>\n  </div>\n</div>\n';
+var authorization_default = '<div\n  style="\n    position: fixed;\n    top: 0;\n    left: 0;\n    right: 0;\n    bottom: 0;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    z-index: 10000;\n    background: #000000;\n  "\n>\n  <div\n    style="\n      display: flex;\n      flex-direction: column;\n      gap: var(--iframe-gap);\n      align-items: center;\n      background: var(--iframe-modal-bg);\n      border-radius: 20px;\n      padding: 20px;\n      max-width: 320px;\n      width: calc(100% - 40px);\n      max-height: 90vh;\n      overflow-y: auto;\n    "\n  >\n    <div style="display: flex; align-items: center; gap: 0; justify-content: center">\n      <!-- 10px overlap -->\n      <div style="width: 38px; height: 48px; z-index: 10; overflow: visible">\n        {{#if userAvatar}}\n        <img\n          src="{{userAvatar}}"\n          alt="{{userName}}"\n          style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n        />\n        {{else}}\n        <span\n          style="\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            width: 48px;\n            height: 48px;\n            border-radius: 24px;\n            background-color: var(--iframe-button-bg);\n            color: var(--iframe-button-text);\n            font-size: 14px;\n            font-weight: 600;\n          "\n          >U</span\n        >\n        {{/if}}\n      </div>\n\n      <!-- ------------------------------------------------------------ -->\n\n      <div style="width: 38px; height: 48px; z-index: 5; overflow: visible">\n        {{#if displayLogo}}\n        <img\n          src="{{displayLogo}}"\n          alt="{{displayName}}"\n          style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n        />\n        {{else}}\n        <span\n          style="\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            width: 48px;\n            height: 48px;\n            border-radius: 24px;\n            background-color: var(--iframe-button-bg);\n            color: var(--iframe-button-text);\n            font-size: 14px;\n            font-weight: 600;\n          "\n          >A</span\n        >\n        {{/if}}\n      </div>\n    </div>\n\n    <div style="display: flex; align-items: center; gap: var(--iframe-gap); justify-content: center">\n      <span\n        style="\n          width: fit-content;\n          font-size: var(--iframe-h2-fz);\n          font-weight: var(--iframe-heading-fw);\n          line-height: 150%;\n          text-align: center;\n        "\n        >{{displayName}}</span\n      >\n    </div>\n\n    <div class="domain-info {{domainStatusClass}}">\n      <span style="display: block; width: 100%; font-size: 12px; text-align: center; font-family: monospace"\n        >{{domainStatusIcon}} {{origin}}</span\n      >\n    </div>\n\n    <!-- Permissions box -->\n    <div\n      id="data-auth-permissions-block"\n      aria-expanded="false"\n      style="display: flex; flex-direction: column; width: 100%"\n    >\n      <div\n        id="data-auth-permissions-toggler"\n        style="\n          cursor: pointer;\n          text-align: center;\n          list-style: none;\n          padding: 0 var(--iframe-pd);\n          user-select: none;\n          font-size: 12px;\n          line-height: 20px;\n        "\n      >\n        Show Permissions \u25BC\n      </div>\n\n      <div\n        id="data-auth-permissions-content"\n        style="width: 100%; height: var(--iframe-permissions-h, 0); overflow: hidden; transition: height 300ms ease"\n      >\n        <div\n          style="\n            width: 100%;\n            padding: var(--iframe-gap);\n            border-radius: var(--iframe-el-bdrs);\n            background: var(--iframe-info);\n            font-size: 10px;\n          "\n        >\n          <div style="margin-bottom: var(--iframe-gap)">\n            <strong>{{displayName}}</strong> by <span class="project-owner">{{displayName}}</span> wants to access your\n            <strong>embarkAI</strong> account\n          </div>\n\n          <div style="margin-bottom: var(--iframe-gap)">\n            <strong style="margin-bottom: var(--iframe-gap)">Personal user data</strong>\n            <ul style="list-style: none">\n              <li style="padding-left: var(--iframe-pd)">Wallet address (read-only)</li>\n              <li style="padding-left: var(--iframe-pd)">Public transaction history (read-only)</li>\n            </ul>\n          </div>\n\n          <div style="width: 100%">\n            <strong style="margin-bottom: var(--iframe-gap)">Permissions</strong>\n            <ul style="list-style: none">\n              <li style="padding-left: var(--iframe-pd)">Request transaction signatures</li>\n              <li style="padding-left: var(--iframe-pd)">Initiate blockchain operations</li>\n            </ul>\n          </div>\n        </div>\n      </div>\n    </div>\n\n    {{#if showSecurityWarning}}\n    <div class="security-warning">\n      <strong>\u26A0\uFE0F Warning:</strong> This domain is not verified for {{displayName}}\n      <div>Expected: {{expectedDomains}}</div>\n      <div>Actual: {{origin}}</div>\n    </div>\n    {{else}}\n    <span style="display: block; text-align: center; font-size: 10px; color: var(--iframe-text-secondary)"\n      >By continuing you allow the app to use these permissions, you can revoke access at any time.</span\n    >\n    {{/if}}\n\n    <!-- Action buttons -->\n    <div style="display: flex; gap: var(--iframe-gap); width: 100%; align-items: center">\n      <button class="cancel-btn">Cancel</button>\n      <button class="authorize-btn" {{authorizeButtonState}}>Continue</button>\n    </div>\n  </div>\n</div>\n';
 
 // src/iframe/templates/html/confirm-tx.html
-var confirm_tx_default = '<div\n  style="\n    position: fixed;\n    top: 0;\n    left: 0;\n    right: 0;\n    bottom: 0;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    z-index: 10000;\n    background: #000000;\n  "\n>\n  <div\n    style="\n      display: flex;\n      flex-direction: column;\n      gap: var(--iframe-gap);\n      align-items: center;\n      background: var(--iframe-modal-bg);\n      border-radius: 20px;\n      padding: 20px;\n      max-width: 320px;\n      width: calc(100% - 40px);\n      max-height: 90vh;\n      overflow-y: auto;\n    "\n  >\n    <!-- Header with logos -->\n    <div style="display: flex; align-items: center; gap: 0; justify-content: center">\n      <div style="width: 38px; height: 48px; z-index: 10; overflow: visible">\n        {{#if displayLogo}}\n        <img\n          src="{{displayLogo}}"\n          alt="{{displayName}}"\n          style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n        />\n        {{else}}\n        <span\n          style="\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            width: 48px;\n            height: 48px;\n            border-radius: 24px;\n            background-color: var(--iframe-button-bg);\n            color: var(--iframe-button-text);\n            font-size: 14px;\n            font-weight: 600;\n          "\n          >A</span\n        >\n        {{/if}}\n      </div>\n\n      <!-- ------------------------------------------------------------ -->\n\n      <div style="width: 38px; height: 48px; z-index: 5; overflow: visible">\n        {{#if userAvatar}}\n        <img\n          src="{{userAvatar}}"\n          alt="{{userName}}"\n          style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n        />\n        {{else}}\n        <span\n          style="\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            width: 48px;\n            height: 48px;\n            border-radius: 24px;\n            background-color: var(--iframe-button-bg);\n            color: var(--iframe-button-text);\n            font-size: 14px;\n            font-weight: 600;\n          "\n          >U</span\n        >\n        {{/if}}\n      </div>\n    </div>\n\n    <!-- Transaction title -->\n\n    <div style="display: flex; align-items: center; gap: var(--iframe-gap); justify-content: center">\n      <span\n        style="\n          width: fit-content;\n          font-size: var(--iframe-h1-fz);\n          font-weight: var(--iframe-heading-fw);\n          line-height: 150%;\n          text-align: center;\n        "\n        >Confirm Transaction</span\n      >\n    </div>\n\n    <!-- Application info -->\n    <div class="domain-info {{domainStatusClass}}">\n      <span style="display: block; width: 100%; font-size: 12px; text-align: center; font-family: monospace"\n        >{{domainStatusText}} {{origin}}</span\n      >\n    </div>\n\n    <!-- Transaction details box -->\n    <div\n      id="confirm-transaction-details-block"\n      aria-expanded="false"\n      style="display: flex; flex-direction: column; width: 100%"\n    >\n      <div\n        id="confirm-transaction-details-toggler"\n        style="\n          cursor: pointer;\n          text-align: center;\n          list-style: none;\n          padding: 0 var(--iframe-pd);\n          user-select: none;\n          font-size: 12px;\n          line-height: 20px;\n        "\n      >\n        Show Transaction Details \u25BC\n      </div>\n\n      <div\n        id="confirm-transaction-details-content"\n        style="\n          display: flex;\n          flex-direction: column;\n          gap: var(--iframe-gap);\n          width: 100%;\n          max-height: var(--confirm-transaction-details-h, 0px);\n          overflow: hidden;\n          transition: max-height 300ms ease;\n        "\n      >\n        <div\n          style="\n            display: flex;\n            flex-direction: column;\n            gap: var(--iframe-gap);\n            width: 100%;\n            padding: var(--iframe-gap);\n            border-radius: var(--iframe-el-bdrs);\n            background: var(--iframe-info);\n            font-size: 10px;\n          "\n        >\n          {{#if fromAddress}}\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">From:</strong>\n            <a\n              href="{{fromAddressExplorerUrl}}"\n              target="_blank"\n              rel="noopener noreferrer"\n              style="word-break: break-all; display: block; color: #3b82f6; text-decoration: none"\n              title="{{fromAddressFull}}"\n            >\n              <code>{{fromAddress}}</code>\n            </a>\n          </div>\n          {{/if}}\n\n          <!-- ------------------------------------------------------------ -->\n\n          {{#if toAddress}}\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">To:</strong>\n            <a\n              href="{{toAddressExplorerUrl}}"\n              target="_blank"\n              rel="noopener noreferrer"\n              style="word-break: break-all; display: block; color: #3b82f6; text-decoration: none"\n              title="{{toAddressFull}}"\n            >\n              <code>{{toAddress}}</code>\n            </a>\n          </div>\n          {{/if}}\n\n          <!-- ------------------------------------------------------------ -->\n\n          {{#if hasValue}}\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">Amount:</strong>\n            <code style="word-break: break-all; display: block">{{formattedValue}}</code>\n          </div>\n          {{/if}}\n\n          <!-- ------------------------------------------------------------ -->\n\n          {{#if showContractInteraction}}\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">Action:</strong>\n            <code style="word-break: break-all; display: block">{{actionDescription}}</code>\n          </div>\n          {{/if}}\n\n          <!-- ------------------------------------------------------------ -->\n\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">Estimated Cost:</strong>\n            <code style="word-break: break-all; display: block; color: #10b981">{{estimatedCost}}</code>\n          </div>\n\n          <!-- ------------------------------------------------------------ -->\n\n          {{#if isSponsored}}\n          <div\n            style="\n              display: flex;\n              justify-content: space-between;\n              background: var(--iframe-success);\n              border-radius: var(--iframe-el-bdrs);\n              padding: var(--iframe-gap);\n            "\n          >\n            <span>Gas fees will be paid by the application (no cost to you)</span>\n          </div>\n          {{/if}}\n        </div>\n      </div>\n    </div>\n\n    <!-- ------------------------------------------------------------ -->\n\n    {{#if showHighRisk}}\n    <div class="security-warning">\n      <strong>\u26A0\uFE0F {{riskLevel}} RISK</strong>\n      {{riskReasons}}\n    </div>\n    {{else}}\n    <div class="security-warning">Please verify this transaction carefully before confirming.</div>\n    {{/if}}\n\n    <!-- ------------------------------------------------------------ -->\n\n    <div class="trust-app-section">\n      <label class="trust-app-label">\n        <input type="checkbox" class="trust-app-checkbox" />\n        <span>Add this application to trusted list and skip confirmation for future transactions</span>\n      </label>\n    </div>\n\n    <!-- Action buttons -->\n    <div style="display: flex; gap: var(--iframe-gap); width: 100%; align-items: center">\n      <button class="cancel-btn">Reject</button>\n      <button class="confirm-btn">Confirm</button>\n    </div>\n\n    <!-- Footer notice -->\n    <span\n      style="\n        display: block;\n        padding: var(--iframe-gap);\n        text-align: center;\n        font-size: 10px;\n        color: var(--iframe-text-secondary);\n      "\n    >\n      You can manage trusted applications in your EmbarkAI settings.\n    </span>\n  </div>\n</div>\n';
+var confirm_tx_default = '<div\n  style="\n    position: fixed;\n    top: 0;\n    left: 0;\n    right: 0;\n    bottom: 0;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    z-index: 10000;\n    background: #000000;\n  "\n>\n  <div\n    style="\n      display: flex;\n      flex-direction: column;\n      gap: var(--iframe-gap);\n      align-items: center;\n      background: var(--iframe-modal-bg);\n      border-radius: 20px;\n      padding: 20px;\n      max-width: 320px;\n      width: calc(100% - 40px);\n      max-height: 90vh;\n      overflow-y: auto;\n    "\n  >\n    <!-- Header with logos -->\n    <div style="display: flex; align-items: center; gap: 0; justify-content: center">\n      <div style="width: 38px; height: 48px; z-index: 10; overflow: visible">\n        {{#if displayLogo}}\n        <img\n          src="{{displayLogo}}"\n          alt="{{displayName}}"\n          style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n        />\n        {{else}}\n        <span\n          style="\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            width: 48px;\n            height: 48px;\n            border-radius: 24px;\n            background-color: var(--iframe-button-bg);\n            color: var(--iframe-button-text);\n            font-size: 14px;\n            font-weight: 600;\n          "\n          >A</span\n        >\n        {{/if}}\n      </div>\n\n      <!-- ------------------------------------------------------------ -->\n\n      <div style="width: 38px; height: 48px; z-index: 5; overflow: visible">\n        {{#if userAvatar}}\n        <img\n          src="{{userAvatar}}"\n          alt="{{userName}}"\n          style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n        />\n        {{else}}\n        <span\n          style="\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            width: 48px;\n            height: 48px;\n            border-radius: 24px;\n            background-color: var(--iframe-button-bg);\n            color: var(--iframe-button-text);\n            font-size: 14px;\n            font-weight: 600;\n          "\n          >U</span\n        >\n        {{/if}}\n      </div>\n    </div>\n\n    <!-- Transaction title -->\n\n    <div style="display: flex; align-items: center; gap: var(--iframe-gap); justify-content: center">\n      <span\n        style="\n          width: fit-content;\n          font-size: var(--iframe-h1-fz);\n          font-weight: var(--iframe-heading-fw);\n          line-height: 150%;\n          text-align: center;\n        "\n        >Confirm Transaction</span\n      >\n    </div>\n\n    <!-- Application info -->\n    <div class="domain-info {{domainStatusClass}}">\n      <span style="display: block; width: 100%; font-size: 12px; text-align: center; font-family: monospace"\n        >{{domainStatusText}} {{origin}}</span\n      >\n    </div>\n\n    <!-- Transaction details box -->\n    <div\n      id="confirm-transaction-details-block"\n      aria-expanded="false"\n      style="display: flex; flex-direction: column; width: 100%"\n    >\n      <div\n        id="confirm-transaction-details-toggler"\n        style="\n          cursor: pointer;\n          text-align: center;\n          list-style: none;\n          padding: 0 var(--iframe-pd);\n          user-select: none;\n          font-size: 12px;\n          line-height: 20px;\n        "\n      >\n        Show Transaction Details \u25BC\n      </div>\n\n      <div\n        id="confirm-transaction-details-content"\n        style="\n          display: flex;\n          flex-direction: column;\n          gap: var(--iframe-gap);\n          width: 100%;\n          max-height: var(--confirm-transaction-details-h, 0px);\n          overflow: hidden;\n          transition: max-height 300ms ease;\n        "\n      >\n        <div\n          style="\n            display: flex;\n            flex-direction: column;\n            gap: var(--iframe-gap);\n            width: 100%;\n            padding: var(--iframe-gap);\n            border-radius: var(--iframe-el-bdrs);\n            background: var(--iframe-info);\n            font-size: 10px;\n          "\n        >\n          {{#if fromAddress}}\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">From:</strong>\n            <a\n              href="{{fromAddressExplorerUrl}}"\n              target="_blank"\n              rel="noopener noreferrer"\n              style="word-break: break-all; display: block; color: #3b82f6; text-decoration: none"\n              title="{{fromAddressFull}}"\n            >\n              <code>{{fromAddress}}</code>\n            </a>\n          </div>\n          {{/if}}\n\n          <!-- ------------------------------------------------------------ -->\n\n          {{#if toAddress}}\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">To:</strong>\n            <a\n              href="{{toAddressExplorerUrl}}"\n              target="_blank"\n              rel="noopener noreferrer"\n              style="word-break: break-all; display: block; color: #3b82f6; text-decoration: none"\n              title="{{toAddressFull}}"\n            >\n              <code>{{toAddress}}</code>\n            </a>\n          </div>\n          {{/if}}\n\n          <!-- ------------------------------------------------------------ -->\n\n          {{#if hasValue}}\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">Amount:</strong>\n            <code style="word-break: break-all; display: block">{{formattedValue}}</code>\n          </div>\n          {{/if}}\n\n          <!-- ------------------------------------------------------------ -->\n\n          {{#if showContractInteraction}}\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">Action:</strong>\n            <code style="word-break: break-all; display: block">{{actionDescription}}</code>\n          </div>\n          {{/if}}\n\n          <!-- ------------------------------------------------------------ -->\n\n          <div style="display: flex; justify-content: space-between">\n            <strong style="color: var(--iframe-text-secondary); display: block">Estimated Cost:</strong>\n            <code style="word-break: break-all; display: block; color: #10b981">{{estimatedCost}}</code>\n          </div>\n\n          <!-- ------------------------------------------------------------ -->\n\n          {{#if isSponsored}}\n          <div\n            style="\n              display: flex;\n              justify-content: space-between;\n              background: var(--iframe-success);\n              border-radius: var(--iframe-el-bdrs);\n              padding: var(--iframe-gap);\n            "\n          >\n            <span>Gas fees will be paid by the application (no cost to you)</span>\n          </div>\n          {{/if}}\n        </div>\n      </div>\n    </div>\n\n    <!-- ------------------------------------------------------------ -->\n\n    {{#if showHighRisk}}\n    <div class="security-warning">\n      <strong>\u26A0\uFE0F {{riskLevel}} RISK</strong>\n      {{riskReasons}}\n    </div>\n    {{else}}\n    <div class="security-warning">Please verify this transaction carefully before confirming.</div>\n    {{/if}}\n\n    <!-- ------------------------------------------------------------ -->\n\n    <div class="trust-app-section">\n      <label class="trust-app-label">\n        <input type="checkbox" class="trust-app-checkbox" />\n        <span>Add this application to trusted list and skip confirmation for future transactions</span>\n      </label>\n    </div>\n\n    <!-- Action buttons -->\n    <div style="display: flex; gap: var(--iframe-gap); width: 100%; align-items: center">\n      <button class="cancel-btn">Reject</button>\n      <button class="confirm-btn">Confirm</button>\n    </div>\n\n    <!-- Footer notice -->\n    <span\n      style="\n        display: block;\n        padding: var(--iframe-gap);\n        text-align: center;\n        font-size: 10px;\n        color: var(--iframe-text-secondary);\n      "\n    >\n      You can manage trusted applications in your embarkAI settings.\n    </span>\n  </div>\n</div>\n';
 
 // src/iframe/templates/html/ready-indicator.html
-var ready_indicator_default = '<div class="ready-indicator">\n  <div class="status-icon">\u2713</div>\n  <h2>Secure Wallet Ready</h2>\n  <p>EmbarkAI is ready for secure operations</p>\n  <div class="info">\n    <div class="info-row">\n      <strong>Origin:</strong>\n      <span>{{origin}}</span>\n    </div>\n    <div class="info-row">\n      <strong>Status:</strong>\n      <span class="status-active">Active</span>\n    </div>\n    <div class="info-row">\n      <strong>Version:</strong>\n      <span>{{iframeVersion}}</span>\n    </div>\n    <div class="info-row">\n      <strong>Documentation:</strong>\n      <a\n        href="https://docs.embarkai.io"\n        target="_blank"\n        rel="noopener noreferrer"\n        style="color: #667eea; text-decoration: none"\n        >docs.embarkai.io</a\n      >\n    </div>\n  </div>\n</div>\n';
+var ready_indicator_default = '<div class="ready-indicator">\n  <div class="status-icon">\u2713</div>\n  <h2>Secure Wallet Ready</h2>\n  <p>embarkAI is ready for secure operations</p>\n  <div class="info">\n    <div class="info-row">\n      <strong>Origin:</strong>\n      <span>{{origin}}</span>\n    </div>\n    <div class="info-row">\n      <strong>Status:</strong>\n      <span class="status-active">Active</span>\n    </div>\n    <div class="info-row">\n      <strong>Version:</strong>\n      <span>{{iframeVersion}}</span>\n    </div>\n    <div class="info-row">\n      <strong>Documentation:</strong>\n      <a\n        href="https://docs.embarkai.io"\n        target="_blank"\n        rel="noopener noreferrer"\n        style="color: #667eea; text-decoration: none"\n        >docs.embarkai.io</a\n      >\n    </div>\n  </div>\n</div>\n';
 
 // src/iframe/templates/html/sign-eip712-tx.html
 var sign_eip712_tx_default = '<div\n  style="\n    position: fixed;\n    top: 0;\n    left: 0;\n    right: 0;\n    bottom: 0;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    z-index: 10000;\n    background: #000000;\n  "\n>\n  <div\n    style="\n      display: flex;\n      flex-direction: column;\n      gap: var(--iframe-gap);\n      align-items: center;\n      background: var(--iframe-modal-bg);\n      border-radius: 20px;\n      padding: 20px;\n      max-width: 320px;\n      width: calc(100% - 40px);\n      max-height: 90vh;\n      overflow-y: auto;\n    "\n  >\n    <!-- Header -->\n    <div style="display: flex; align-items: center; gap: var(--iframe-gap); justify-content: center">\n      {{#if metadataLogo}}\n      <img\n        src="{{metadataLogo}}"\n        alt="{{metadataName}}"\n        style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n      />\n      {{else}}\n      <span\n        style="\n          display: flex;\n          align-items: center;\n          justify-content: center;\n          width: 48px;\n          height: 48px;\n          border-radius: 24px;\n          background-color: var(--iframe-button-bg);\n          color: var(--iframe-button-text);\n          font-size: 14px;\n          font-weight: 600;\n        "\n        >\u{1F510}</span\n      >\n      {{/if}}\n\n      <!-- ------------------------------------------------------------ -->\n      <svg\n        xmlns="http://www.w3.org/2000/svg"\n        width="24"\n        height="24"\n        viewBox="0 0 24 24"\n        fill="none"\n        stroke="var(--iframe-text-secondary)"\n        stroke-width="2"\n        stroke-linecap="round"\n        stroke-linejoin="round"\n      >\n        <path d="M5 12h14" />\n        <path d="m12 5 7 7-7 7" />\n      </svg>\n      <!-- ------------------------------------------------------------ -->\n\n      {{#if userAvatar}}\n      <img\n        src="{{userAvatar}}"\n        alt="{{userName}}"\n        style="width: 48px; height: 48px; border-radius: 24px; object-fit: cover"\n      />\n      {{else}}\n      <span\n        style="\n          display: flex;\n          align-items: center;\n          justify-content: center;\n          width: 48px;\n          height: 48px;\n          border-radius: 24px;\n          background-color: var(--iframe-button-bg);\n          color: var(--iframe-button-text);\n          font-size: 14px;\n          font-weight: 600;\n        "\n        >U</span\n      >\n      {{/if}}\n    </div>\n\n    <div style="display: flex; align-items: center; gap: var(--iframe-gap); justify-content: center">\n      <span\n        style="\n          width: fit-content;\n          font-size: var(--iframe-h2-fz);\n          font-weight: var(--iframe-heading-fw);\n          line-height: 150%;\n          text-align: center;\n        "\n        >Signature Request</span\n      >\n    </div>\n\n    <div class="domain-info verified">\n      <span style="display: block; width: 100%; font-size: 12px; text-align: center; font-family: monospace">\n        {{#if isVerifiedOrigin}}\n        <span>\u2713</span>\n        {{/if}} {{origin}}</span\n      >\n    </div>\n\n    <!-- EIP712 Message Content -->\n    <div class="eip712-content">\n      <details class="eip712-details">\n        <summary>Advanced details</summary>\n\n        <div class="section-title">\u{1F4DD} Message</div>\n        <div class="eip712-section">\n          <div class="section-subtitle">{{primaryType}}</div>\n          {{messageFields}}\n        </div>\n\n        <div class="section-title" style="margin-top: 16px">\u{1F50D} Domain</div>\n        <div class="eip712-section">{{domainFields}}</div>\n\n        <div class="section-title" style="margin-top: 16px">\u{1F4CB} Full Message</div>\n        <pre class="eip712-raw"><code>{{fullMessageJson}}</code></pre>\n      </details>\n    </div>\n\n    <!-- Trust App Option -->\n    <div class="trust-app-section">\n      <label class="trust-app-label">\n        <input type="checkbox" class="trust-app-checkbox" />\n        <span>Trust this application and skip confirmation for future signatures</span>\n      </label>\n    </div>\n\n    <!-- Action Buttons -->\n    <div class="actions">\n      <button class="cancel-btn">Reject</button>\n      <button class="confirm-btn">Sign</button>\n    </div>\n\n    <!-- Footer Notice -->\n    <div class="footer-notice">\n      <p class="footer-note">Only sign messages from applications you trust.</p>\n    </div>\n  </div>\n</div>\n';
@@ -3117,7 +4831,7 @@ function buildAuthorizationTemplateData(project, origin, metadata, userProfile)
   const displayLogo = metadata?.logo || project.logoUrl || "";
   const displayDescription = metadata?.description || "";
   const userAvatar = userProfile?.avatar || "";
-  const userName = userProfile?.displayName || "EmbarkAI Wallet";
+  const userName = userProfile?.displayName || "embarkAI Wallet";
   return {
     // Display
     displayName,
@@ -3153,7 +4867,7 @@ function buildSignTxTemplateData(project, origin, typedData, metadata, userProfi
   const metadataName = metadata?.name || project.name;
   const metadataLogo = metadata?.logo || project.logoUrl || "";
   const userAvatar = userProfile?.avatar || "";
-  const userName = userProfile?.displayName || "EmbarkAI Wallet";
+  const userName = userProfile?.displayName || "embarkAI Wallet";
   const formatFieldValue = (value) => {
     if (Array.isArray(value)) {
       return `[${value.map((v) => formatFieldValue(v)).join(", ")}]`;
@@ -3265,10 +4979,11 @@ function formatApproveAmount(amount) {
 function buildConfirmTxTemplateData(project, origin, transaction, risk, metadata, userProfile, explorerUrl) {
   const isVerifiedOrigin = project.domains.includes(origin);
   const isUserOp = !!transaction.userOpDetails;
+  const isUnknownOperation = transaction.decoded?.kind === "unknown";
   const displayName = metadata?.name || project.name;
   const displayLogo = metadata?.logo || project.logoUrl || "";
   const userAvatar = userProfile?.avatar || "";
-  const userName = userProfile?.displayName || "EmbarkAI Wallet";
+  const userName = userProfile?.displayName || "embarkAI Wallet";
   const domainStatusClass = isVerifiedOrigin ? "verified" : "unverified";
   const domainStatusText = isVerifiedOrigin ? "\u2705" : "\u26A0\uFE0F";
   const batchOperations = transaction.userOpDetails?.operations || [];
@@ -3301,9 +5016,11 @@ function buildConfirmTxTemplateData(project, origin, transaction, risk, metadata
   const innerCallData = extractInnerCallData(callData);
   const effectiveCallData = innerCallData || callData;
   const hasContractCall = !!effectiveCallData && effectiveCallData !== "0x" && effectiveCallData.length > 2;
-  const showContractInteraction = isBatchUserOp || (isUserOp ? hasContractCall : !!callData && callData !== "0x");
+  const showContractInteraction = isUnknownOperation || isBatchUserOp || (isUserOp ? hasContractCall : !!callData && callData !== "0x");
   let actionDescription = "Contract Interaction";
-  if (isBatchUserOp) {
+  if (isUnknownOperation && transaction.decoded?.kind === "unknown") {
+    actionDescription = `Unknown operation (selector ${transaction.decoded.selector})`;
+  } else if (isBatchUserOp) {
     actionDescription = `Batch transaction (${batchOperations.length} operations)`;
   } else if (showContractInteraction) {
     const approveData = parseERC20Approve(callData);
@@ -3347,61 +5064,44 @@ function buildConfirmTxTemplateData(project, origin, transaction, risk, metadata
   };
 }
 
+// src/iframe/lib/project-card.ts
+var CARD_TTL_MS = 36e5;
+function tssUrl() {
+  return typeof window !== "undefined" && window.__EMBARK_SERVICES__?.tssUrl || "https://api.embarkai.io/tss";
+}
+var cache = /* @__PURE__ */ new Map();
+async function fetchProjectCard(projectId, now = Date.now()) {
+  const cached = cache.get(projectId);
+  if (cached && now - cached.fetchedAt < CARD_TTL_MS) {
+    return cached.card;
+  }
+  try {
+    const response = await fetch(`${tssUrl()}/api/tss/project/${encodeURIComponent(projectId)}`);
+    if (!response.ok) {
+      console.warn(`[iframe] Project card unavailable: ${response.status}`);
+      return null;
+    }
+    const card = await response.json();
+    cache.set(projectId, { card, fetchedAt: now });
+    return card;
+  } catch (error) {
+    console.error("[iframe] Project card request failed:", error);
+    return null;
+  }
+}
+
 // src/iframe/lib/authorization-manager.ts
-var DASHBOARD_URL = (
-  // checks for custom service url
-  typeof window.__EMBARK_SERVICES__ !== "undefined" && window.__EMBARK_SERVICES__?.dashboardUrl || "https://dashboard.embarkai.io"
-);
 var AuthorizationManager = class {
   constructor() {
     __publicField(this, "STORAGE_KEY_PREFIX", "auth");
-    // private readonly METADATA_API_URL = 'https://dashboard.embarkai.io/api/public/project'
-    __publicField(this, "METADATA_API_URL", `${DASHBOARD_URL}/api/public/project`);
-    __publicField(this, "METADATA_CACHE_TTL", 36e5);
-    // 1 hour in milliseconds
-    __publicField(this, "metadataCache", /* @__PURE__ */ new Map());
     console.log("[iframe][Auth] Initialized");
   }
-  /**
-   * Check if project is a trusted authorized app (auto-skip auth dialog)
-   */
   async isTrustedAuthorizedApp(projectId) {
-    const metadata = await this.fetchProjectMetadata(projectId);
-    return metadata?.trustedAuthorizedApp === true;
+    const card = await fetchProjectCard(projectId);
+    return card?.trustedAuthorizedApp === true;
   }
-  /**
-   * Get project metadata (name, logo, etc.) - uses cache
-   */
   async getProjectMetadata(projectId) {
-    return this.fetchProjectMetadata(projectId);
-  }
-  /**
-   * Fetch project metadata from public API (with caching)
-   */
-  async fetchProjectMetadata(projectId) {
-    const cached = this.metadataCache.get(projectId);
-    const now = Date.now();
-    if (cached && now - cached.timestamp < this.METADATA_CACHE_TTL) {
-      console.log(`[iframe][Auth] Using cached metadata for project: ${cached.data.name}`);
-      return cached.data;
-    }
-    try {
-      const response = await fetch(`${this.METADATA_API_URL}/${projectId}/metadata`);
-      if (!response.ok) {
-        console.warn(`[iframe][Auth] Failed to fetch project metadata: ${response.status}`);
-        return null;
-      }
-      const metadata = await response.json();
-      console.log(`[iframe][Auth] Fetched metadata for project: ${metadata.name}`);
-      this.metadataCache.set(projectId, {
-        data: metadata,
-        timestamp: now
-      });
-      return metadata;
-    } catch (error) {
-      console.error("[iframe][Auth] Error fetching project metadata:", error);
-      return null;
-    }
+    return fetchProjectCard(projectId);
   }
   /**
    * Check if user has authorized a project
@@ -3470,7 +5170,7 @@ var AuthorizationManager = class {
    */
   async requestAuthorization(project, origin, userProfile) {
     this.showIframe();
-    const metadata = await this.fetchProjectMetadata(project.id);
+    const metadata = await fetchProjectCard(project.id);
     return new Promise((resolve) => {
       const modal = this.createAuthorizationModal(project, origin, metadata, userProfile);
       const authorizeBtn = modal.querySelector(".authorize-btn");
@@ -3834,48 +5534,314 @@ function getCloudProviders() {
 init_local_backup();
 init_server_backup();
 
-// src/lib/errors.ts
-var AccountAbstractionError = class _AccountAbstractionError extends Error {
-  constructor(message, code) {
-    super(message);
-    /** Machine-readable error code for programmatic handling */
-    __publicField(this, "code");
-    this.code = code;
-    this.name = "LumiaPassportError";
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, _AccountAbstractionError);
+// src/iframe/lib/storage-manager.ts
+var StorageManager = class {
+  constructor() {
+    __publicField(this, "storage");
+    if (typeof window === "undefined" || !window.localStorage) {
+      throw new Error("localStorage not available in iframe");
     }
+    this.storage = window.localStorage;
+    console.log("[iframe][Storage] Initialized");
+    console.log("[iframe][Storage] Origin:", window.location.origin);
   }
-};
-var _UserRejectedError = class _UserRejectedError extends AccountAbstractionError {
-  constructor(message = "User rejected transaction") {
-    super(message, _UserRejectedError.CODE);
-    this.name = "UserRejectedError";
+  /**
+   * Save keyshare to IFRAME localStorage
+   * CRITICAL: This is the secure isolated storage
+   */
+  saveKeyshare(userId, data) {
+    try {
+      const keyshareKey = `tss.${userId}.keyshare`;
+      this.storage.setItem(
+        keyshareKey,
+        JSON.stringify({
+          keyshare_b64: data.keyshare_b64
+        })
+      );
+      this.storage.setItem(`tss.${userId}.ownerAddress`, data.ownerAddress);
+      this.storage.setItem(`tss.${userId}.sessionId`, data.sessionId);
+      console.log(`[iframe][Storage] \u2705 Saved keyshare for user: ${userId}`);
+      console.log(`[iframe][Storage] Storage origin: ${window.location.origin}`);
+    } catch (error) {
+      console.error("[iframe][Storage] Failed to save keyshare:", error);
+      throw new Error(`Failed to save keyshare: ${error instanceof Error ? error.message : "Unknown error"}`);
+    }
   }
-};
-__publicField(_UserRejectedError, "CODE", "USER_REJECTED");
-var UserRejectedError = _UserRejectedError;
-var _SessionExpiredError = class _SessionExpiredError extends AccountAbstractionError {
-  constructor(message = "Session expired, please log in again") {
-    super(message, _SessionExpiredError.CODE);
-    this.name = "SessionExpiredError";
+  /**
+   * Load keyshare from IFRAME localStorage
+   */
+  loadKeyshare(userId) {
+    try {
+      const keyshareKey = `tss.${userId}.keyshare`;
+      const keyshareData = this.storage.getItem(keyshareKey);
+      if (!keyshareData) {
+        console.log(`[iframe][Storage] No keyshare found for user: ${userId}`);
+        return null;
+      }
+      const parsed = JSON.parse(keyshareData);
+      const ownerAddress = this.storage.getItem(`tss.${userId}.ownerAddress`);
+      const sessionId = this.storage.getItem(`tss.${userId}.sessionId`);
+      if (!ownerAddress || !sessionId) {
+        console.error("[iframe][Storage] Missing owner address or session ID");
+        return null;
+      }
+      return {
+        keyshare_b64: parsed.keyshare_b64,
+        ownerAddress,
+        sessionId
+      };
+    } catch (error) {
+      console.error("[iframe][Storage] Failed to load keyshare:", error);
+      return null;
+    }
+  }
+  /**
+   * Check if keyshare exists for user
+   */
+  hasKeyshare(userId) {
+    const keyshareKey = `tss.${userId}.keyshare`;
+    const ownerAddressKey = `tss.${userId}.ownerAddress`;
+    const hasKeyshare = this.storage.getItem(keyshareKey) !== null;
+    const hasAddress = this.storage.getItem(ownerAddressKey) !== null;
+    return hasKeyshare && hasAddress;
+  }
+  /**
+   * Get owner address for user
+   */
+  getOwnerAddress(userId) {
+    const address = this.storage.getItem(`tss.${userId}.ownerAddress`);
+    return address ? address : null;
+  }
+  /**
+   * Get session ID for user
+   */
+  getSessionId(userId) {
+    return this.storage.getItem(`tss.${userId}.sessionId`);
+  }
+  /**
+   * Remove keyshare for user
+   */
+  removeKeyshare(userId) {
+    try {
+      this.storage.removeItem(`tss.${userId}.keyshare`);
+      this.storage.removeItem(`tss.${userId}.ownerAddress`);
+      this.storage.removeItem(`tss.${userId}.sessionId`);
+      const allKeys = Object.keys(this.storage);
+      const userKeys = allKeys.filter((key) => key.startsWith(`tss.${userId}.`));
+      userKeys.forEach((key) => this.storage.removeItem(key));
+      console.log(`[iframe][Storage] \u2705 Removed keyshare for user: ${userId}`);
+    } catch (error) {
+      console.error("[iframe][Storage] Failed to remove keyshare:", error);
+      throw new Error(`Failed to remove keyshare: ${error instanceof Error ? error.message : "Unknown error"}`);
+    }
+  }
+  /**
+   * Make the stored keyshare the half of the server's one for the current project.
+   *
+   * A keyshare is only usable with the server keyshare it was generated with, and the server keeps
+   * one per project or ecosystem while this storage keeps one per user. A keyshare that does not
+   * match is moved aside, never deleted: it may be the right one for another project, and
+   * restoreArchivedKeyshare brings it back when the server names its owner address again.
+   *
+   * `server.ownerAddress` undefined means an older TSS that does not report it: only the
+   * unambiguous "server has none" case is acted on then.
+   */
+  reconcileWithServer(userId, server) {
+    const current = this.getOwnerAddress(userId);
+    if (!server.hasKeyshare) {
+      if (current) {
+        console.warn(`[iframe][Storage] Server has no keyshare for this project, setting aside ${current}`);
+        this.archiveKeyshare(userId);
+      }
+      return;
+    }
+    const expected = server.ownerAddress;
+    if (!expected) return;
+    if (current && sameAddress(current, expected)) return;
+    if (this.restoreArchivedKeyshare(userId, expected)) return;
+    if (current) {
+      console.warn(`[iframe][Storage] Keyshare ${current} is not the half of server keyshare ${expected}, setting it aside`);
+      this.archiveKeyshare(userId);
+    }
+  }
+  /**
+   * Move the current keyshare aside under its owner address
+   */
+  archiveKeyshare(userId) {
+    const share = this.storage.getItem(`tss.${userId}.keyshare`);
+    const ownerAddress = this.storage.getItem(`tss.${userId}.ownerAddress`);
+    if (!share || !ownerAddress) return;
+    const sessionId = this.storage.getItem(`tss.${userId}.sessionId`);
+    const prefix = archivePrefix(userId, ownerAddress);
+    this.storage.setItem(`${prefix}.share`, share);
+    this.storage.setItem(`${prefix}.ownerAddress`, ownerAddress);
+    if (sessionId !== null) this.storage.setItem(`${prefix}.sessionId`, sessionId);
+    else this.storage.removeItem(`${prefix}.sessionId`);
+    this.storage.removeItem(`tss.${userId}.keyshare`);
+    this.storage.removeItem(`tss.${userId}.ownerAddress`);
+    this.storage.removeItem(`tss.${userId}.sessionId`);
+  }
+  /**
+   * Make the archived keyshare with this owner address current again; false when there is none
+   */
+  restoreArchivedKeyshare(userId, ownerAddress) {
+    const prefix = archivePrefix(userId, ownerAddress);
+    const share = this.storage.getItem(`${prefix}.share`);
+    if (!share) return false;
+    const storedAddress = this.storage.getItem(`${prefix}.ownerAddress`) ?? ownerAddress;
+    const sessionId = this.storage.getItem(`${prefix}.sessionId`);
+    const current = this.getOwnerAddress(userId);
+    if (current && !sameAddress(current, ownerAddress)) this.archiveKeyshare(userId);
+    this.storage.setItem(`tss.${userId}.keyshare`, share);
+    this.storage.setItem(`tss.${userId}.ownerAddress`, storedAddress);
+    if (sessionId !== null) this.storage.setItem(`tss.${userId}.sessionId`, sessionId);
+    else this.storage.removeItem(`tss.${userId}.sessionId`);
+    this.storage.removeItem(`${prefix}.share`);
+    this.storage.removeItem(`${prefix}.sessionId`);
+    this.storage.removeItem(`${prefix}.ownerAddress`);
+    console.log(`[iframe][Storage] \u2705 Restored keyshare ${ownerAddress} for user: ${userId}`);
+    return true;
+  }
+  /**
+   * Stored keyshare of wallet `ownerAddress`: the current one, or the one set aside under its owner address
+   * (another tab may have made another wallet current). Without `ownerAddress`, the current one.
+   * `share` is the item as stored.
+   */
+  getKeyshareOf(userId, ownerAddress) {
+    const current = this.getOwnerAddress(userId);
+    if (!ownerAddress || current && sameAddress(current, ownerAddress)) {
+      const share2 = this.storage.getItem(`tss.${userId}.keyshare`);
+      return share2 && current ? { share: share2, ownerAddress: current, sessionId: this.getSessionId(userId) } : null;
+    }
+    const prefix = archivePrefix(userId, ownerAddress);
+    const share = this.storage.getItem(`${prefix}.share`);
+    if (!share) return null;
+    return {
+      share,
+      ownerAddress: this.storage.getItem(`${prefix}.ownerAddress`) ?? ownerAddress,
+      sessionId: this.storage.getItem(`${prefix}.sessionId`)
+    };
+  }
+  /**
+   * Keyshare of wallet `ownerAddress` for signing: the current one, or the one set aside under its owner address
+   * (another tab may have made a sibling's keyshare current, #31). Without `ownerAddress`, the current one.
+   */
+  loadKeyshareOf(userId, ownerAddress) {
+    if (!ownerAddress) return this.loadKeyshare(userId);
+    const stored = this.getKeyshareOf(userId, ownerAddress);
+    if (!stored?.sessionId) return null;
+    try {
+      const { keyshare_b64 } = JSON.parse(stored.share);
+      if (typeof keyshare_b64 !== "string") return null;
+      return { keyshare_b64, ownerAddress: stored.ownerAddress, sessionId: stored.sessionId };
+    } catch (error) {
+      console.error("[iframe][Storage] Failed to read keyshare:", error);
+      return null;
+    }
+  }
+  /**
+   * Set a keyshare aside under its owner address, unless this storage already holds one of that wallet
+   * (current or set aside): an existing keyshare is never overwritten
+   */
+  keepAside(userId, data) {
+    if (this.getKeyshareOf(userId, data.ownerAddress)) return;
+    const prefix = archivePrefix(userId, data.ownerAddress);
+    this.storage.setItem(`${prefix}.share`, data.share);
+    this.storage.setItem(`${prefix}.ownerAddress`, data.ownerAddress);
+    if (data.sessionId !== null) this.storage.setItem(`${prefix}.sessionId`, data.sessionId);
+    console.log(`[iframe][Storage] Keyshare of another wallet kept aside: ${data.ownerAddress}`);
+  }
+  /**
+   * Make a restored keyshare the current one. A current keyshare of another wallet is set aside, never
+   * overwritten (it may have no backup); a copy of the same wallet set aside before is replaced.
+   */
+  installKeyshare(userId, data) {
+    const current = this.getOwnerAddress(userId);
+    if (current && !sameAddress(current, data.ownerAddress)) this.archiveKeyshare(userId);
+    const prefix = archivePrefix(userId, data.ownerAddress);
+    this.storage.removeItem(`${prefix}.share`);
+    this.storage.removeItem(`${prefix}.sessionId`);
+    this.storage.removeItem(`${prefix}.ownerAddress`);
+    this.storage.setItem(`tss.${userId}.keyshare`, data.share);
+    if (data.sessionId !== null) this.storage.setItem(`tss.${userId}.sessionId`, data.sessionId);
+    else this.storage.removeItem(`tss.${userId}.sessionId`);
+    this.storage.setItem(`tss.${userId}.ownerAddress`, data.ownerAddress);
+  }
+  /**
+   * List all users with keyshares (for debugging)
+   */
+  listUsers() {
+    const allKeys = Object.keys(this.storage);
+    const keyshareKeys = allKeys.filter((key) => key.endsWith(".keyshare"));
+    return keyshareKeys.map((key) => {
+      const match = key.match(/^tss\.(.+)\.keyshare$/);
+      return match ? match[1] : null;
+    }).filter(Boolean);
+  }
+  /**
+   * Get storage statistics (for debugging)
+   */
+  getStats() {
+    const allKeys = Object.keys(this.storage);
+    const users = this.listUsers();
+    let storageSize = 0;
+    allKeys.forEach((key) => {
+      const value = this.storage.getItem(key);
+      if (value) {
+        storageSize += key.length + value.length;
+      }
+    });
+    return {
+      totalKeys: allKeys.length,
+      users: users.length,
+      storageSize
+    };
   }
 };
-__publicField(_SessionExpiredError, "CODE", "SESSION_EXPIRED");
-var SessionExpiredError = _SessionExpiredError;
-var ErrorCodes = {
-  MPC_SIGNING_ERROR: "MPC_SIGNING_ERROR",
-  USER_REJECTED: UserRejectedError.CODE,
-  SESSION_EXPIRED: SessionExpiredError.CODE
-};
+function sameAddress(a, b) {
+  return a.toLowerCase() === b.toLowerCase();
+}
+function archivePrefix(userId, ownerAddress) {
+  return `tss.${userId}.archive.${ownerAddress.toLowerCase()}`;
+}
 
 // src/iframe/lib/token-refresh-client.ts
+function parseTssErrorBody(text) {
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const body = parsed;
+      if (typeof body.error === "string" || typeof body.code === "string") {
+        return body;
+      }
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
 var TokenRefreshApiClient = class {
   constructor() {
     __publicField(this, "tssUrl");
     __publicField(this, "pendingTokenRefresh", null);
     this.tssUrl = "https://api.embarkai.io/tss";
   }
+  /**
+   * One GET without token refresh or retry, for lookups that may fail quietly: the response body, or null on any
+   * failure (not OK, network, timeout). A 401 here never rotates the session, so the caller's token stays the one
+   * its next calls use.
+   */
+  async peek(path, projectId, accessToken, timeoutMs = 5e3) {
+    const url = projectId ? `${this.tssUrl}${path}${path.includes("?") ? "&" : "?"}projectId=${encodeURIComponent(projectId)}` : `${this.tssUrl}${path}`;
+    const headers = { ...sdkVersionHeaders() };
+    if (accessToken) headers["Authorization"] = `Bearer ${accessToken}`;
+    try {
+      const response = await fetch(url, { method: "GET", headers, credentials: "include", signal: typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(timeoutMs) : void 0 });
+      return response.ok ? await response.json() : null;
+    } catch {
+      return null;
+    }
+  }
   /**
    * Make API call with automatic token refresh on 401
    */
@@ -3886,7 +5852,8 @@ var TokenRefreshApiClient = class {
       url = `${url}${separator}projectId=${encodeURIComponent(projectId)}`;
     }
     const headers = {
-      "Content-Type": "application/json"
+      "Content-Type": "application/json",
+      ...sdkVersionHeaders()
     };
     if (accessToken) {
       headers["Authorization"] = `Bearer ${accessToken}`;
@@ -3914,8 +5881,9 @@ var TokenRefreshApiClient = class {
           throw new SessionExpiredError();
         }
         if (parseFailed || errorData && (errorData.error_code === "TOKEN_EXPIRED" || errorData.action === "REFRESH_TOKEN")) {
-          console.log("[iframe][TokenRefresh] TOKEN_EXPIRED detected, requesting new token from parent...");
-          const refresh = await this.requestNewTokenFromParent();
+          const ownSession = iframeSession.owns(accessToken);
+          console.log(`[iframe][TokenRefresh] TOKEN_EXPIRED detected, refreshing ${ownSession ? "the iframe session" : "via the parent"}...`);
+          const refresh = ownSession ? await iframeSession.refresh() : await this.requestNewTokenFromParent();
           if (!refresh.token) {
             if (refresh.sessionDead === false) {
               console.error("[iframe][TokenRefresh] Token refresh temporarily unavailable");
@@ -3939,7 +5907,13 @@ var TokenRefreshApiClient = class {
           }
           if (!retryResponse.ok) {
             const retryErrorText = await retryResponse.text();
-            throw new Error(`API call failed after token refresh (${retryResponse.status}): ${retryErrorText}`);
+            const retryErrorBody = parseTssErrorBody(retryErrorText);
+            if (retryErrorBody) {
+              throw tssErrorFromBody(retryResponse.status, retryErrorBody);
+            }
+            throw Object.assign(new Error(`API call failed after token refresh (${retryResponse.status}): ${retryErrorText}`), {
+              status: retryResponse.status
+            });
           }
           return await retryResponse.json();
         }
@@ -3947,7 +5921,11 @@ var TokenRefreshApiClient = class {
       }
       if (!response.ok) {
         const errorText = await response.text();
-        throw new Error(`API call failed (${response.status}): ${errorText}`);
+        const errorBody = parseTssErrorBody(errorText);
+        if (errorBody) {
+          throw tssErrorFromBody(response.status, errorBody);
+        }
+        throw Object.assign(new Error(`API call failed (${response.status}): ${errorText}`), { status: response.status });
       }
       return await response.json();
     } catch (error) {
@@ -4012,37 +5990,37 @@ var TokenRefreshApiClient = class {
 // src/iframe/lib/backup-manager.ts
 var LOOCAL_BACKUP_STATUS_KEY = "passport-backup-status";
 var BACKUP_VERSION = "1.0";
+function storedKeyshare(data) {
+  return { share: data.keyshare, ownerAddress: data.ownerAddress, sessionId: data.sessionId };
+}
 var BackupManager = class {
   constructor() {
     __publicField(this, "tokenClient");
+    /** in-flight ensureServerBackup per user and wallet: the post-DKG call and the parent's call share one run */
+    __publicField(this, "ensuring", /* @__PURE__ */ new Map());
+    __publicField(this, "storageManager");
     this.tokenClient = new TokenRefreshApiClient();
     console.log("[iframe][BackupManager] Initialized");
   }
+  get keyshares() {
+    return this.storageManager ?? (this.storageManager = new StorageManager());
+  }
   /**
-   * Get current keyshare data from iframe storage
+   * Keyshare of wallet `walletOwner` from iframe storage: the current one, or one set aside for another
+   * project (another tab may have made another wallet current). Without `walletOwner`, the current one.
    */
-  getCurrentKeyshareBackupData(userId) {
-    console.log("[iframe][BackupManager] Getting keyshare data for userId:", userId);
+  getCurrentKeyshareBackupData(userId, walletOwner) {
     try {
-      const keyshareData = localStorage.getItem(`tss.${userId}.keyshare`);
-      const sessionId = localStorage.getItem(`tss.${userId}.sessionId`);
-      const ownerAddress = localStorage.getItem(`tss.${userId}.ownerAddress`);
-      console.log("[iframe][BackupManager] localStorage keys check:", {
-        hasKeyshare: !!keyshareData,
-        hasSession: !!sessionId,
-        hasOwner: !!ownerAddress,
-        keyshareLength: keyshareData?.length
-      });
-      if (!keyshareData || !sessionId || !ownerAddress) {
-        console.warn("[iframe][BackupManager] Missing keyshare data - cannot create backup");
+      const stored = this.keyshares.getKeyshareOf(userId, walletOwner);
+      if (!stored?.sessionId) {
+        console.warn("[iframe][BackupManager] Missing keyshare data - cannot create backup", { hasKeyshare: !!stored });
         return null;
       }
-      console.log("[iframe][BackupManager] Successfully retrieved all keyshare data");
       return {
         userId,
-        sessionId,
-        keyshare: keyshareData,
-        ownerAddress,
+        sessionId: stored.sessionId,
+        keyshare: stored.share,
+        ownerAddress: stored.ownerAddress,
         createdAt: Date.now(),
         version: BACKUP_VERSION
       };
@@ -4081,9 +6059,13 @@ var BackupManager = class {
   /**
    * Create backup using specified method
    */
-  async createBackup(userId, request, accessToken) {
-    console.log("[iframe][BackupManager] Create backup request:", request);
-    const data = this.getCurrentKeyshareBackupData(userId);
+  /**
+   * @param currentServerMethod what the vault holds, when the caller already looked it up (null = no
+   * share); lets the passkey prompt come right after the user's click
+   */
+  async createBackup(userId, request, accessToken, projectId, currentServerMethod, basicAllowed = false, walletOwner) {
+    console.log("[iframe][BackupManager] Create backup request:", { method: request.method });
+    const data = this.getCurrentKeyshareBackupData(userId, walletOwner);
     if (!data) {
       const error = "No keyshare data found for backup";
       console.error("[iframe][BackupManager]", error);
@@ -4095,9 +6077,10 @@ var BackupManager = class {
       };
     }
     try {
+      let serverOutcome;
       switch (request.method) {
         case "server":
-          await backupToServer(data, this.tokenClient, request.password, accessToken);
+          serverOutcome = await this.createServerBackup(data, request.password, accessToken, projectId, currentServerMethod, basicAllowed);
           break;
         case "local":
           await backupToLocalFile(data, request.password);
@@ -4117,39 +6100,123 @@ var BackupManager = class {
       return {
         success: true,
         method: request.method,
-        timestamp
+        timestamp,
+        ...serverOutcome
       };
     } catch (error) {
-      const errorMessage = error.message || "Backup failed";
-      console.error("[iframe][BackupManager] Backup failed:", errorMessage);
+      const errorMessage2 = error.message || "Backup failed";
+      console.error("[iframe][BackupManager] Backup failed:", errorMessage2);
       this.updateBackupStatus(userId, request.method, {
-        error: errorMessage
+        error: errorMessage2
       });
       return {
         success: false,
         method: request.method,
         timestamp: Date.now(),
-        error: errorMessage
+        error: errorMessage2
       };
     }
   }
+  /**
+   * Server backup with a user-held secret (Advanced).
+   * A Basic backup of this keyshare is replaced under a new DEK (Basic → Advanced); anything else is uploaded as before.
+   */
+  async createServerBackup(data, password, accessToken, projectId, knownMethod, basicAllowed = false) {
+    const current = knownMethod !== void 0 ? knownMethod : await getServerBackupMethod(this.tokenClient, accessToken, projectId, data.ownerAddress).catch(() => null);
+    const wasBasic = current === "server-managed";
+    let protection;
+    if (password) {
+      protection = { method: "password", password };
+    } else {
+      const { deriveKEKFromPasskey: deriveKEKFromPasskey2 } = await Promise.resolve().then(() => (init_crypto_utils(), crypto_utils_exports));
+      const { kek, credentialId } = await deriveKEKFromPasskey2(data.userId);
+      protection = { method: "passkey", kek, credentialId };
+    }
+    let ifMatch;
+    if (wasBasic && basicAllowed) {
+      const outcome = await upgradeServerManagedBackup(data, protection, this.tokenClient, accessToken, projectId);
+      if (outcome.kind === "upgraded") {
+        console.log(`[iframe][BackupManager] Basic backup upgraded to ${outcome.encryptionMethod}`);
+        return { encryptionMethod: outcome.encryptionMethod, upgraded: true };
+      }
+      console.warn(`[iframe][BackupManager] Upgrade not applicable (${outcome.reason}), uploading a new backup`);
+      ifMatch = outcome.etag;
+    }
+    if (protection.method === "password") {
+      await backupToServer(data, this.tokenClient, protection.password, accessToken, projectId, ifMatch);
+    } else {
+      await backupToServerWithPasskeyKek(data, protection.kek, protection.credentialId, this.tokenClient, accessToken, projectId, ifMatch);
+    }
+    return { encryptionMethod: protection.method, upgraded: wasBasic };
+  }
+  /** Encryption method of the vault backup of the wallet, null when there is none or the vault cannot tell */
+  getServerBackupMethod(accessToken, projectId, walletOwner) {
+    return getServerBackupMethod(this.tokenClient, accessToken, projectId, walletOwner).catch(() => null);
+  }
+  /**
+   * Owner address of the wallet a request is about: the server's keyshare for the request's project, as TSS
+   * reports it. Not the current keyshare here (another tab may have made a sibling's current, #31), and not
+   * what the parent names (an older parent names nothing): `hint` is used only when TSS does not answer.
+   * undefined when neither knows; backups then use the current keyshare and restores the user's share, as before.
+   */
+  async resolveWalletOwner(userId, hint, accessToken, projectId) {
+    try {
+      const verified = await this.tokenClient.apiCall("GET", "/api/auth/verify", void 0, projectId, accessToken);
+      return ownerNamedFor(userId, verified) ?? hint;
+    } catch (error) {
+      console.warn("[iframe][BackupManager] TSS did not name the wallet of the project:", error instanceof Error ? error.message : String(error));
+    }
+    return hint;
+  }
+  /**
+   * Owner address of the project's wallet for signing and AUTHENTICATE (#31): one quick lookup that never refreshes
+   * the session (the caller goes on with its own token) and gives up after a few seconds. undefined when TSS does
+   * not name it: the caller then uses the current keyshare, as before.
+   */
+  async walletOwnerForProject(userId, accessToken, projectId) {
+    if (!accessToken) return void 0;
+    return ownerNamedFor(userId, await this.tokenClient.peek("/api/auth/verify", projectId, accessToken));
+  }
+  /**
+   * Make sure the vault holds a backup of the wallet's keyshare, creating a Basic one when there is none.
+   * Never throws and never overwrites an existing backup.
+   */
+  ensureServerBackup(userId, accessToken, projectId, basicAllowed = false, walletOwner) {
+    const owner = walletOwner ?? this.keyshares.getOwnerAddress(userId) ?? void 0;
+    const runKey = `${userId}:${owner?.toLowerCase() ?? ""}`;
+    const inFlight = this.ensuring.get(runKey);
+    if (inFlight) return inFlight;
+    const run = ensureServerManagedBackup(this.getCurrentKeyshareBackupData(userId, owner), this.tokenClient, accessToken, projectId, {
+      allowCreate: basicAllowed,
+      owner
+    }).then(async (result) => {
+      if (result.status !== "failed") this.updateBackupStatus(userId, "server", { lastBackup: Date.now(), error: void 0 });
+      console.log("[iframe][BackupManager] ensureServerBackup:", result.status, result.status === "failed" ? result.reason : result.encryptionMethod);
+      return result;
+    }).catch((error) => ({
+      status: "failed",
+      reason: "unknown",
+      error: error instanceof Error ? error.message : String(error)
+    })).finally(() => this.ensuring.delete(runKey));
+    this.ensuring.set(runKey, run);
+    return run;
+  }
   /**
    * Restore keyshare from server backup
    */
-  async restoreFromServer(userId, password, accessToken) {
+  async restoreFromServer(userId, password, accessToken, projectId, basicAllowed = false, walletOwner) {
     console.log("[iframe][BackupManager] Restore from server request for userId:", userId);
     try {
       const { restoreFromServer: restoreFromServer2 } = await Promise.resolve().then(() => (init_server_backup(), server_backup_exports));
-      const backupData = await restoreFromServer2(userId, this.tokenClient, password, accessToken);
+      const backupData = await restoreFromServer2(userId, this.tokenClient, password, accessToken, projectId, basicAllowed, walletOwner);
       console.log("[iframe][BackupManager] \u2705 Server restore completed");
-      localStorage.setItem(`tss.${userId}.keyshare`, backupData.keyshare);
-      localStorage.setItem(`tss.${userId}.sessionId`, backupData.sessionId);
-      localStorage.setItem(`tss.${userId}.ownerAddress`, backupData.ownerAddress);
+      this.keyshares.installKeyshare(userId, storedKeyshare(backupData));
       console.log("[iframe][BackupManager] Keyshare saved to localStorage");
       return backupData;
     } catch (error) {
-      const errorMessage = error.message || "Restore failed";
-      console.error("[iframe][BackupManager] Restore failed:", errorMessage);
+      if (error instanceof WalletMismatchError) this.keyshares.keepAside(userId, storedKeyshare(error.backup));
+      const errorMessage2 = error.message || "Restore failed";
+      console.error("[iframe][BackupManager] Restore failed:", errorMessage2);
       throw error;
     }
   }
@@ -4157,9 +6224,9 @@ var BackupManager = class {
    * Encrypt backup data without uploading (for cloud/local backups)
    * Returns encrypted data that parent can upload/download
    */
-  async encryptBackupData(userId, password) {
+  async encryptBackupData(userId, password, walletOwner) {
     console.log("[iframe][BackupManager] Encrypting backup data for userId:", userId);
-    const data = this.getCurrentKeyshareBackupData(userId);
+    const data = this.getCurrentKeyshareBackupData(userId, walletOwner);
     if (!data) {
       throw new Error("No keyshare data found for backup");
     }
@@ -4179,8 +6246,8 @@ var BackupManager = class {
    * Encrypt current keyshare as EnvelopeEncryptedShare (server/guardian format).
    * Returns JSON string of the envelope.
    */
-  async encryptEnvelopeData(userId, password) {
-    const data = this.getCurrentKeyshareBackupData(userId);
+  async encryptEnvelopeData(userId, password, walletOwner) {
+    const data = this.getCurrentKeyshareBackupData(userId, walletOwner);
     if (!data) {
       throw new Error("No keyshare found for backup");
     }
@@ -4195,9 +6262,7 @@ var BackupManager = class {
     const { envelopeDecryptKeyshareWithPassword: envelopeDecryptKeyshareWithPassword2 } = await Promise.resolve().then(() => (init_crypto_utils(), crypto_utils_exports));
     const envelope = JSON.parse(envelopeJson);
     const backupData = await envelopeDecryptKeyshareWithPassword2(envelope, password);
-    localStorage.setItem(`tss.${userId}.keyshare`, backupData.keyshare);
-    localStorage.setItem(`tss.${userId}.sessionId`, backupData.sessionId);
-    localStorage.setItem(`tss.${userId}.ownerAddress`, backupData.ownerAddress);
+    this.keyshares.installKeyshare(userId, storedKeyshare(backupData));
   }
   /**
    * Restore keyshare from local file backup
@@ -4208,14 +6273,12 @@ var BackupManager = class {
       const { restoreFromLocalFile: restoreFromLocalFile2 } = await Promise.resolve().then(() => (init_local_backup(), local_backup_exports));
       const backupData = await restoreFromLocalFile2(fileContent, userId, password);
       console.log("[iframe][BackupManager] \u2705 Local file restore completed");
-      localStorage.setItem(`tss.${userId}.keyshare`, backupData.keyshare);
-      localStorage.setItem(`tss.${userId}.sessionId`, backupData.sessionId);
-      localStorage.setItem(`tss.${userId}.ownerAddress`, backupData.ownerAddress);
+      this.keyshares.installKeyshare(userId, storedKeyshare(backupData));
       console.log("[iframe][BackupManager] Keyshare saved to localStorage");
       return backupData;
     } catch (error) {
-      const errorMessage = error.message || "Local file restore failed";
-      console.error("[iframe][BackupManager] Local file restore failed:", errorMessage);
+      const errorMessage2 = error.message || "Local file restore failed";
+      console.error("[iframe][BackupManager] Local file restore failed:", errorMessage2);
       throw error;
     }
   }
@@ -4226,6 +6289,14 @@ var BackupManager = class {
     return getCloudProviders();
   }
 };
+function ownerNamedFor(userId, verified) {
+  if (!verified || verified.userId && verified.userId !== userId) return void 0;
+  const owner = verified.ownerAddress;
+  return typeof owner === "string" && /^0x[0-9a-fA-F]{40}$/.test(owner) ? owner : void 0;
+}
+
+// src/iframe/main.ts
+init_server_backup();
 
 // ../../node_modules/.pnpm/dkls23-wasm@0.1.1/node_modules/dkls23-wasm/pkg-web/dkls23_wasm.js
 var dkls23_wasm_exports = {};
@@ -4692,6 +6763,7 @@ async function __wbg_init(module_or_path) {
 var dkls23_wasm_default = __wbg_init;
 
 // ../../node_modules/.pnpm/viem@2.57.12_typescript@6.0.3_zod@4.6.7/node_modules/viem/_esm/index.js
+init_decodeFunctionData();
 init_keccak256();
 
 // src/iframe/lib/dkg-manager.ts
@@ -4824,8 +6896,8 @@ var DKGManager = class extends TokenRefreshApiClient {
     }
     const pubkeyBytes = bytes.slice(1);
     const pubkeyHex = Array.from(pubkeyBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-    const hash = keccak256(`0x${pubkeyHex}`);
-    const addr = hash.slice(-40);
+    const hash2 = keccak256(`0x${pubkeyHex}`);
+    const addr = hash2.slice(-40);
     return this.toChecksumAddress(`0x${addr}`);
   }
   /**
@@ -4835,12 +6907,12 @@ var DKGManager = class extends TokenRefreshApiClient {
     const addr = address.toLowerCase().replace("0x", "");
     const encoder3 = new TextEncoder();
     const addrBytes = encoder3.encode(addr);
-    const hash = keccak256(addrBytes).replace("0x", "");
-    let checksumAddress = "0x";
+    const hash2 = keccak256(addrBytes).replace("0x", "");
+    let checksumAddress2 = "0x";
     for (let i = 0; i < addr.length; i++) {
-      checksumAddress += parseInt(hash[i], 16) >= 8 ? addr[i].toUpperCase() : addr[i];
+      checksumAddress2 += parseInt(hash2[i], 16) >= 8 ? addr[i].toUpperCase() : addr[i];
     }
-    return checksumAddress;
+    return checksumAddress2;
   }
   /**
    * Generate secure domain label for DKG
@@ -4861,7 +6933,7 @@ var DKGManager = class extends TokenRefreshApiClient {
 };
 
 // src/iframe/lib/hyperlane/hyperlane.ts
-var API_URL2 = (
+var API_URL = (
   // checks for custom service url
   typeof window.__EMBARK_SERVICES__ !== "undefined" && window.__EMBARK_SERVICES__?.assetApiUrl || "https://api.embarkai.io/on-ramp/api"
 );
@@ -4874,7 +6946,7 @@ var HyperlaneAPI = class {
   // API METHODS
   /** available warp routes */
   async getHyperlaneWarpRoutes(accessToken) {
-    const result = await fetch(`${API_URL2}/hyperlane/warp-routes`, {
+    const result = await fetch(`${API_URL}/hyperlane/warp-routes`, {
       method: "GET",
       headers: { Authorization: `Bearer ${accessToken}` }
     });
@@ -4883,7 +6955,7 @@ var HyperlaneAPI = class {
   }
   /** bridging quote */
   async estimateHyperlaneQuote(payload, accessToken) {
-    const result = await fetch(`${API_URL2}/hyperlane/estimate-quote`, {
+    const result = await fetch(`${API_URL}/hyperlane/estimate-quote`, {
       method: "POST",
       body: JSON.stringify(payload),
       headers: { "Content-Type": "application/json", "Authorization": `Bearer ${accessToken}` }
@@ -4893,7 +6965,7 @@ var HyperlaneAPI = class {
   }
   /** list of pre-cooked TXs by Hyperlane SDK */
   async bridgeHyperlaneAsset(payload, accessToken) {
-    const result = await fetch(`${API_URL2}/hyperlane/bridge-asset`, {
+    const result = await fetch(`${API_URL}/hyperlane/bridge-asset`, {
       method: "POST",
       body: JSON.stringify(payload),
       headers: { "Content-Type": "application/json", "Authorization": `Bearer ${accessToken}` }
@@ -4904,7 +6976,7 @@ var HyperlaneAPI = class {
   /** bridge history */
   async getHyperlaneBridgeHistory(pagination, accessToken) {
     const { page, pageSize } = pagination;
-    const url = new URL(`${API_URL2}/hyperlane/bridge-history`);
+    const url = new URL(`${API_URL}/hyperlane/bridge-history`);
     if (page) url.searchParams.append("page", page.toString());
     if (pageSize) url.searchParams.append("pageSize", pageSize.toString());
     const result = await fetch(url.toString(), { method: "GET", headers: { Authorization: `Bearer ${accessToken}` } });
@@ -4913,7 +6985,7 @@ var HyperlaneAPI = class {
   }
   /** patch initiated bridge transaction */
   async patchInitiatedBridgeTxStatus(payload, accessToken) {
-    const result = await fetch(`${API_URL2}/hyperlane/patch-bridge-tx-status`, {
+    const result = await fetch(`${API_URL}/hyperlane/patch-bridge-tx-status`, {
       method: "PATCH",
       body: JSON.stringify(payload),
       headers: { "Content-Type": "application/json", "Authorization": `Bearer ${accessToken}` }
@@ -4922,7 +6994,7 @@ var HyperlaneAPI = class {
     return response;
   }
   async patchInitiatedBridgeTxOpHashes(payload, accessToken) {
-    const result = await fetch(`${API_URL2}/hyperlane/patch-bridge-op-hashes`, {
+    const result = await fetch(`${API_URL}/hyperlane/patch-bridge-op-hashes`, {
       method: "PATCH",
       body: JSON.stringify(payload),
       headers: { "Content-Type": "application/json", "Authorization": `Bearer ${accessToken}` }
@@ -4966,8 +7038,249 @@ var HyperlaneAPI = class {
   }
 };
 
+// src/iframe/lib/iframe-sign-in.ts
+var FLOW_TTL_MS = 15 * 60 * 1e3;
+var X_AUTHORIZE_ORIGINS = ["https://x.com", "https://twitter.com"];
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generateFlowSecret() {
+  return base64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+async function flowChallengeOf(flowSecret) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(flowSecret));
+  return base64url(new Uint8Array(digest));
+}
+function isXAuthorizeUrl(value) {
+  try {
+    const url = new URL(value);
+    return X_AUTHORIZE_ORIGINS.includes(url.origin) && url.pathname === "/i/oauth2/authorize";
+  } catch {
+    return false;
+  }
+}
+function telegramFields(payload) {
+  if (!payload || typeof payload.id !== "number" || typeof payload.auth_date !== "number" || typeof payload.hash !== "string") return null;
+  const fields = {
+    id: payload.id,
+    first_name: typeof payload.first_name === "string" ? payload.first_name : "",
+    auth_date: payload.auth_date,
+    hash: payload.hash
+  };
+  for (const key of ["last_name", "username", "photo_url"]) {
+    if (typeof payload[key] === "string" && payload[key]) fields[key] = payload[key];
+  }
+  return fields;
+}
+function defaultTssUrl3() {
+  return "https://api.embarkai.io/tss";
+}
+async function readBody(response) {
+  const text = await response.text().catch(() => "");
+  try {
+    const parsed = JSON.parse(text);
+    return { text, json: parsed && typeof parsed === "object" ? parsed : null };
+  } catch {
+    return { text, json: null };
+  }
+}
+function signInError(message, status, body) {
+  return new AccountAbstractionError(message, typeof body?.error === "string" && body.error || "SIGN_IN_FAILED", {
+    status,
+    ...body?.retryAfter !== void 0 ? { retryAfter: body.retryAfter } : {},
+    ...body?.attemptsRemaining !== void 0 ? { attemptsRemaining: body.attemptsRemaining } : {}
+  });
+}
+var IframeSignIn = class {
+  constructor(session = iframeSession, tssUrl2 = defaultTssUrl3) {
+    __publicField(this, "session", session);
+    __publicField(this, "tssUrl", tssUrl2);
+    /** one pending flow per parent origin: the latest start wins, as at TSS */
+    __publicField(this, "flows", /* @__PURE__ */ new Map());
+  }
+  /** Whether a flow is pending for this origin (tests, diagnostics); never exposes the secret */
+  hasPendingFlow(origin) {
+    return !!this.activeFlow(origin);
+  }
+  async start(request, origin, projectId) {
+    const flowSecret = generateFlowSecret();
+    const flowChallenge = await flowChallengeOf(flowSecret);
+    if (request?.provider === "email") {
+      const email = typeof request.email === "string" ? request.email.trim() : "";
+      if (!email) throw new AccountAbstractionError("email is required", "INVALID_REQUEST");
+      const response = await this.post("/api/auth/email/send-code", projectId, { email, flow_challenge: flowChallenge });
+      const { json } = await readBody(response);
+      if (response.ok) {
+        this.flows.set(origin, { provider: "email", flowSecret, projectId, email, startedAt: Date.now() });
+      }
+      return { provider: "email", ok: response.ok, status: response.status, data: json ?? {} };
+    }
+    if (request?.provider === "passkey") {
+      const mode = request.mode === "register" ? "register" : "login";
+      const path = mode === "register" ? "/api/auth/passkey/register/begin" : "/api/auth/passkey/login/begin";
+      const body = { flow_challenge: flowChallenge, parent_origin: origin };
+      if (typeof request.username === "string" && request.username) body.username = request.username;
+      const response = await this.post(path, projectId, body);
+      const { text, json } = await readBody(response);
+      if (!response.ok || !json) {
+        const prefix = mode === "register" ? "Begin registration failed" : "Begin auth failed";
+        throw signInError(`${prefix}: ${response.status} ${text}`, response.status, json);
+      }
+      this.flows.set(origin, {
+        provider: "passkey",
+        mode,
+        flowSecret,
+        projectId,
+        challengeId: typeof json.challengeId === "string" ? json.challengeId : void 0,
+        startedAt: Date.now()
+      });
+      return { provider: "passkey", mode, options: json };
+    }
+    if (request?.provider === "wallet") {
+      const address = typeof request.address === "string" ? request.address.trim() : "";
+      if (!/^0x[0-9a-fA-F]{40}$/.test(address)) throw new AccountAbstractionError("address is required", "INVALID_REQUEST");
+      const response = await this.post("/api/auth/wallet/nonce", projectId, { address, flow_challenge: flowChallenge });
+      const { text, json } = await readBody(response);
+      if (!response.ok || typeof json?.message !== "string") {
+        throw signInError(`Wallet sign-in start failed: ${response.status} ${json?.message || text}`, response.status, json);
+      }
+      this.flows.set(origin, { provider: "wallet", flowSecret, projectId, address, message: json.message, startedAt: Date.now() });
+      return { provider: "wallet", message: json.message };
+    }
+    if (request?.provider === "telegram") {
+      const response = await this.post("/api/auth/telegram/start", projectId, { flow_challenge: flowChallenge, parent_origin: origin });
+      const { text, json } = await readBody(response);
+      if (!response.ok || typeof json?.flow_id !== "string") {
+        throw signInError(`Telegram sign-in start failed: ${response.status} ${json?.message || text}`, response.status, json);
+      }
+      this.flows.set(origin, { provider: "telegram", flowSecret, projectId, flowId: json.flow_id, startedAt: Date.now() });
+      return { provider: "telegram", parentOrigin: typeof json.parent_origin === "string" ? json.parent_origin : origin };
+    }
+    if (request?.provider === "x") {
+      const response = await this.post("/api/auth/x/start", projectId, { flow_challenge: flowChallenge, parent_origin: origin });
+      const { text, json } = await readBody(response);
+      const url = typeof json?.url === "string" ? json.url : "";
+      if (!response.ok || !url) {
+        throw signInError(`X sign-in start failed: ${response.status} ${json?.message || text}`, response.status, json);
+      }
+      if (!isXAuthorizeUrl(url)) throw new AccountAbstractionError("Unexpected X authorization URL", "SIGN_IN_FAILED");
+      this.flows.set(origin, { provider: "x", flowSecret, projectId, startedAt: Date.now() });
+      return { provider: "x", url };
+    }
+    throw new AccountAbstractionError("Unsupported sign-in provider", "UNSUPPORTED_PROVIDER");
+  }
+  async finish(request, origin, projectId) {
+    const flow = this.activeFlow(origin);
+    if (!flow || flow.provider !== request?.provider || flow.projectId !== projectId) {
+      throw new AccountAbstractionError("No sign-in in progress, please start again", "FLOW_NOT_STARTED");
+    }
+    let response;
+    let failurePrefix;
+    if (request.provider === "email") {
+      const code = typeof request.code === "string" ? request.code.trim() : "";
+      if (!code) throw new AccountAbstractionError("code is required", "INVALID_REQUEST");
+      response = await this.post("/api/auth/email/verify-code", projectId, { email: flow.email, code, flow_secret: flow.flowSecret });
+      failurePrefix = "Email verification failed";
+    } else if (request.provider === "wallet") {
+      const signature = typeof request.signature === "string" ? request.signature : "";
+      if (!signature || typeof request.chainId !== "number") {
+        throw new AccountAbstractionError("signature and chainId are required", "INVALID_REQUEST");
+      }
+      response = await this.post("/api/auth/wallet/login", projectId, {
+        address: flow.address,
+        message: flow.message,
+        signature,
+        chainId: request.chainId,
+        ...typeof request.walletName === "string" ? { walletName: request.walletName } : {},
+        ...typeof request.walletType === "string" ? { walletType: request.walletType } : {},
+        flow_secret: flow.flowSecret
+      });
+      failurePrefix = "Wallet login failed";
+    } else if (request.provider === "telegram") {
+      const payload = telegramFields(request.payload);
+      if (!payload) throw new AccountAbstractionError("Telegram payload is required", "INVALID_REQUEST");
+      response = await this.post("/api/auth/telegram/login", projectId, { ...payload, flow_id: flow.flowId, flow_secret: flow.flowSecret });
+      failurePrefix = "Telegram login failed";
+    } else if (request.provider === "x") {
+      const code = typeof request.code === "string" ? request.code.trim() : "";
+      if (!code) throw new AccountAbstractionError("code is required", "INVALID_REQUEST");
+      response = await this.post("/api/auth/exchange-code", projectId, { code, flow_secret: flow.flowSecret });
+      failurePrefix = "X login failed";
+    } else {
+      if (!flow.challengeId || !request.credential) {
+        throw new AccountAbstractionError("credential is required", "INVALID_REQUEST");
+      }
+      const path = flow.mode === "register" ? "/api/auth/passkey/register/complete" : "/api/auth/passkey/login/complete";
+      response = await this.post(path, projectId, {
+        challengeId: flow.challengeId,
+        credential: request.credential,
+        flow_secret: flow.flowSecret
+      });
+      failurePrefix = flow.mode === "register" ? "Registration failed" : "Complete authentication failed";
+    }
+    const { text, json } = await readBody(response);
+    if (!response.ok || !json) {
+      const detail = request.provider === "passkey" && flow.mode === "login" || request.provider === "wallet" ? json?.message || text : text;
+      const body = request.provider === "x" && json && typeof json.code === "string" ? { ...json, error: json.code } : json;
+      throw signInError(`${failurePrefix}: ${response.status} ${detail}`, response.status, body);
+    }
+    this.flows.delete(origin);
+    const login = json;
+    if (!login.accessToken || !login.refreshToken || !login.userId) {
+      throw new AccountAbstractionError("Sign-in response is missing the session", "SIGN_IN_FAILED");
+    }
+    const previous = this.session.getIncludingUnconfirmed();
+    if (previous && previous.refreshToken !== login.refreshToken) void this.revoke(previous.accessToken, previous.projectId);
+    this.session.save(login, projectId, { confirmed: false });
+    const pair = await this.session.mintDappTokens(projectId);
+    return {
+      accessToken: pair.accessToken,
+      refreshToken: pair.refreshToken,
+      userId: login.userId,
+      expiresIn: pair.expiresIn,
+      hasKeyshare: !!login.hasKeyshare,
+      ...login.isNewUser !== void 0 ? { isNewUser: login.isNewUser } : {},
+      displayName: login.displayName ?? null,
+      avatar: login.avatar ?? null,
+      providers: login.providers ?? []
+    };
+  }
+  /** Forget the pending flow of this origin (sign-out, cancel) */
+  cancel(origin) {
+    this.flows.delete(origin);
+  }
+  activeFlow(origin) {
+    const flow = this.flows.get(origin);
+    if (!flow) return null;
+    if (Date.now() - flow.startedAt > FLOW_TTL_MS) {
+      this.flows.delete(origin);
+      return null;
+    }
+    return flow;
+  }
+  post(path, projectId, body) {
+    return fetch(`${this.tssUrl()}${path}?projectId=${encodeURIComponent(projectId)}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...sdkVersionHeaders() },
+      body: JSON.stringify(body)
+    });
+  }
+  async revoke(accessToken, projectId) {
+    try {
+      const query = projectId ? `?projectId=${encodeURIComponent(projectId)}` : "";
+      await fetch(`${this.tssUrl()}/api/auth/logout${query}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${accessToken}`, ...sdkVersionHeaders() }
+      });
+    } catch {
+    }
+  }
+};
+
 // src/iframe/lib/onramp/binance.ts
-var API_URL3 = (
+var API_URL2 = (
   // checks for custom service url
   typeof window.__EMBARK_SERVICES__ !== "undefined" && window.__EMBARK_SERVICES__?.assetApiUrl || "https://api.embarkai.io/on-ramp/api"
 );
@@ -4983,7 +7296,7 @@ var BinanceOnrampAPI = class {
     this.disconnectSse();
     const controller = new AbortController();
     this.sseAbortController = controller;
-    const url = `${API_URL3}/sse/events?walletAddress=${encodeURIComponent(walletAddress)}`;
+    const url = `${API_URL2}/sse/events?walletAddress=${encodeURIComponent(walletAddress)}`;
     const start = async () => {
       try {
         const response = await fetch(url, {
@@ -5036,7 +7349,7 @@ var BinanceOnrampAPI = class {
   /** https://developers.binance.com/docs/binance_connect/on-ramp-buy-apis/1.get-trading-pairs */
   async getTradingPairsQuery(accessToken) {
     try {
-      const response = await fetch(`${API_URL3}/binance/pairs`, {
+      const response = await fetch(`${API_URL2}/binance/pairs`, {
         method: "POST",
         headers: { "Content-Type": "application/json", ...accessToken && { Authorization: `Bearer ${accessToken}` } }
       });
@@ -5049,7 +7362,7 @@ var BinanceOnrampAPI = class {
   /** https://developers.binance.com/docs/binance_connect/on-ramp-buy-apis/2.get-crypto-networks */
   async getSupportedNetworksQuery(accessToken) {
     try {
-      const response = await fetch(`${API_URL3}/binance/networks`, {
+      const response = await fetch(`${API_URL2}/binance/networks`, {
         method: "POST",
         headers: { "Content-Type": "application/json", ...accessToken && { Authorization: `Bearer ${accessToken}` } }
       });
@@ -5061,7 +7374,7 @@ var BinanceOnrampAPI = class {
   }
   async getPaymentMethodsQuery(payload, accessToken) {
     try {
-      const response = await fetch(`${API_URL3}/binance/modes`, {
+      const response = await fetch(`${API_URL2}/binance/modes`, {
         method: "POST",
         headers: { "Content-Type": "application/json", ...accessToken && { Authorization: `Bearer ${accessToken}` } },
         body: JSON.stringify(payload)
@@ -5074,7 +7387,7 @@ var BinanceOnrampAPI = class {
   }
   async getQuoteQuery(payload, accessToken) {
     try {
-      const response = await fetch(`${API_URL3}/binance/quote`, {
+      const response = await fetch(`${API_URL2}/binance/quote`, {
         method: "POST",
         headers: { "Content-Type": "application/json", ...accessToken && { Authorization: `Bearer ${accessToken}` } },
         body: JSON.stringify(payload)
@@ -5087,7 +7400,7 @@ var BinanceOnrampAPI = class {
   }
   async createPreorderMutation(payload, accessToken) {
     try {
-      const response = await fetch(`${API_URL3}/binance/pre-order`, {
+      const response = await fetch(`${API_URL2}/binance/pre-order`, {
         method: "POST",
         headers: { "Content-Type": "application/json", ...accessToken && { Authorization: `Bearer ${accessToken}` } },
         body: JSON.stringify(payload)
@@ -5101,7 +7414,7 @@ var BinanceOnrampAPI = class {
   async getTransactionList(params, accessToken) {
     try {
       const txStatus = Array.isArray(params.txStatuses) ? (params.txStatuses || []).join(",") : null;
-      const apiUrl = new URL(`${API_URL3}/binance/transactions`);
+      const apiUrl = new URL(`${API_URL2}/binance/transactions`);
       apiUrl.searchParams.append("walletAddress", params.walletAddress);
       if (!!txStatus?.length) apiUrl.searchParams.append("txStatus", txStatus);
       if (!!params.page) apiUrl.searchParams.append("page", params.page.toString());
@@ -5253,12 +7566,14 @@ var SdkChannelManager = class {
   /**
    * Create a new SDK channel
    */
-  createChannel(projectId, origin) {
+  /** @param sdkVersion announced by the parent in SDK_AUTH; absent for SDKs that predate iframe sessions */
+  createChannel(projectId, origin, sdkVersion) {
     const channelToken = this.generateSecureToken();
     const channel = {
       token: channelToken,
       projectId,
       origin,
+      ...sdkVersion ? { sdkVersion } : {},
       createdAt: Date.now(),
       lastActivity: Date.now()
     };
@@ -5296,6 +7611,7 @@ var SdkChannelManager = class {
    * Get channel by token
    */
   getChannel(channelToken) {
+    if (!channelToken) return null;
     return this.channels.get(channelToken) || null;
   }
   /**
@@ -5493,18 +7809,20 @@ var SecureMessenger = class {
       console.error("[iframe][Messenger] No parent window");
       return;
     }
-    const errorMessage = error instanceof Error ? error.message : error;
+    const errorMessage2 = error instanceof Error ? error.message : error;
     const errorCode = error instanceof AccountAbstractionError ? error.code : void 0;
+    const errorDetails = error instanceof AccountAbstractionError ? error.details : void 0;
     const response = {
       type: "IFRAME_MSG_ERROR",
       messageId,
       timestamp: Date.now(),
-      error: errorMessage,
-      code: errorCode
+      error: errorMessage2,
+      code: errorCode,
+      details: errorDetails
     };
     window.parent.postMessage(response, targetOrigin);
     console.log(
-      `[iframe][Messenger] Sent error to ${targetOrigin}: ${errorMessage}${errorCode ? ` [${errorCode}]` : ""}`
+      `[iframe][Messenger] Sent error to ${targetOrigin}: ${errorMessage2}${errorCode ? ` [${errorCode}]` : ""}`
     );
   }
   /**
@@ -5552,240 +7870,143 @@ var SecureMessenger = class {
       "GET_TRUSTED_APPS",
       "REMOVE_TRUSTED_APP",
       "CLEAR_AUTHORIZATIONS",
-      "CREATE_BACKUP",
-      "ENCRYPT_BACKUP_DATA",
-      "ENCRYPT_ENVELOPE_DATA",
-      "DECRYPT_AND_RESTORE_ENVELOPE",
-      "RESTORE_BACKUP",
-      "RESTORE_FROM_FILE",
-      "GET_BACKUP_STATUS",
-      "GET_CLOUD_PROVIDERS",
-      "REQUEST_NEW_TOKEN",
-      "RESPONSE",
-      "ERROR",
-      "TRUSTED_APP_REMOVED",
-      "TOKEN_REFRESHED"
-    ];
-    const validTypeGroups = [
-      "BINANCE_",
-      "RAMPNOW_",
-      "FINCHPAY_",
-      "HYPERLANE_",
-      "USER_ASSETS_POLICY_",
-      "USER_ACTIVITY_LOG_"
-    ];
-    const isTypeValid = validTypes.includes(message.type);
-    const isGroupTypeValid = validTypeGroups.some((prefix) => message.type.startsWith(prefix));
-    if (!message.type || !isTypeValid && !isGroupTypeValid) return false;
-    return !!(message.messageId && message.timestamp);
-  }
-  /**
-   * Validate message structure
-   */
-  validateMessageStructure(message) {
-    return message && typeof message === "object" && typeof message.type === "string" && typeof message.messageId === "string" && typeof message.timestamp === "number" && typeof message.nonce === "string" && typeof message.projectId === "string" && "data" in message;
-  }
-  /**
-   * Check if origin is allowed
-   */
-  isAllowedOrigin(origin) {
-    if (this.allowedOrigins.has(origin)) {
-      return true;
-    }
-    if (this.allowedOrigins.size === 0) {
-      const isLocalhost = origin.startsWith("http://localhost:") || origin.startsWith("http://127.0.0.1:");
-      const isHttps = origin.startsWith("https://");
-      return isHttps || isLocalhost;
-    }
-    return false;
-  }
-  /**
-   * Compute HMAC-SHA256 for message authentication
-   */
-  async computeHMAC(message) {
-    if (!this.channelToken) {
-      throw new Error("No SDK channel token for HMAC");
-    }
-    const encoder3 = new TextEncoder();
-    const payload = JSON.stringify({
-      type: message.type,
-      messageId: message.messageId,
-      timestamp: message.timestamp,
-      nonce: message.nonce,
-      data: JSON.stringify(message.data)
-    });
-    const data = encoder3.encode(payload);
-    const key = encoder3.encode(this.channelToken);
-    const cryptoKey = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-    const signature = await crypto.subtle.sign("HMAC", cryptoKey, data);
-    return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  }
-  /**
-   * Constant-time string comparison (prevent timing attacks)
-   */
-  constantTimeCompare(a, b) {
-    if (a.length !== b.length) return false;
-    let result = 0;
-    for (let i = 0; i < a.length; i++) {
-      result |= a.charCodeAt(i) ^ b.charCodeAt(i);
-    }
-    return result === 0;
-  }
-  /**
-   * Cleanup old nonces to prevent memory growth
-   */
-  cleanupOldNonces() {
-    if (this.usedNonces.size > 1e3) {
-      const noncesArray = Array.from(this.usedNonces);
-      this.usedNonces = new Set(noncesArray.slice(-500));
-      console.log("[iframe][Messenger] Cleaned up old nonces");
-    }
-  }
-  /**
-   * Get messenger statistics
-   */
-  getStats() {
-    return {
-      allowedOrigins: this.allowedOrigins.size,
-      usedNonces: this.usedNonces.size,
-      pendingMessages: this.pendingMessages.size
-    };
-  }
-};
-
-// src/iframe/lib/storage-manager.ts
-var StorageManager = class {
-  constructor() {
-    __publicField(this, "storage");
-    if (typeof window === "undefined" || !window.localStorage) {
-      throw new Error("localStorage not available in iframe");
-    }
-    this.storage = window.localStorage;
-    console.log("[iframe][Storage] Initialized");
-    console.log("[iframe][Storage] Origin:", window.location.origin);
-  }
-  /**
-   * Save keyshare to IFRAME localStorage
-   * CRITICAL: This is the secure isolated storage
-   */
-  saveKeyshare(userId, data) {
-    try {
-      const keyshareKey = `tss.${userId}.keyshare`;
-      this.storage.setItem(
-        keyshareKey,
-        JSON.stringify({
-          keyshare_b64: data.keyshare_b64
-        })
-      );
-      this.storage.setItem(`tss.${userId}.ownerAddress`, data.ownerAddress);
-      this.storage.setItem(`tss.${userId}.sessionId`, data.sessionId);
-      console.log(`[iframe][Storage] \u2705 Saved keyshare for user: ${userId}`);
-      console.log(`[iframe][Storage] Storage origin: ${window.location.origin}`);
-    } catch (error) {
-      console.error("[iframe][Storage] Failed to save keyshare:", error);
-      throw new Error(`Failed to save keyshare: ${error instanceof Error ? error.message : "Unknown error"}`);
-    }
-  }
-  /**
-   * Load keyshare from IFRAME localStorage
-   */
-  loadKeyshare(userId) {
-    try {
-      const keyshareKey = `tss.${userId}.keyshare`;
-      const keyshareData = this.storage.getItem(keyshareKey);
-      if (!keyshareData) {
-        console.log(`[iframe][Storage] No keyshare found for user: ${userId}`);
-        return null;
-      }
-      const parsed = JSON.parse(keyshareData);
-      const ownerAddress = this.storage.getItem(`tss.${userId}.ownerAddress`);
-      const sessionId = this.storage.getItem(`tss.${userId}.sessionId`);
-      if (!ownerAddress || !sessionId) {
-        console.error("[iframe][Storage] Missing owner address or session ID");
-        return null;
-      }
-      return {
-        keyshare_b64: parsed.keyshare_b64,
-        ownerAddress,
-        sessionId
-      };
-    } catch (error) {
-      console.error("[iframe][Storage] Failed to load keyshare:", error);
-      return null;
-    }
+      "CREATE_BACKUP",
+      "ENCRYPT_BACKUP_DATA",
+      "ENCRYPT_ENVELOPE_DATA",
+      "DECRYPT_AND_RESTORE_ENVELOPE",
+      "RESTORE_BACKUP",
+      "RESTORE_FROM_FILE",
+      "GET_BACKUP_STATUS",
+      "ENSURE_SERVER_BACKUP",
+      "GET_CLOUD_PROVIDERS",
+      "SIGN_IN_START",
+      "SIGN_IN_FINISH",
+      "SIGN_OUT",
+      "GET_SESSION",
+      "GET_DAPP_TOKENS",
+      "ACCOUNT_REQUEST",
+      "REQUEST_NEW_TOKEN",
+      "RESPONSE",
+      "ERROR",
+      "TRUSTED_APP_REMOVED",
+      "TOKEN_REFRESHED"
+    ];
+    const validTypeGroups = ["BINANCE_", "RAMPNOW_", "FINCHPAY_", "HYPERLANE_", "USER_POLICY_", "USER_ACTIVITY_LOG_"];
+    const isTypeValid = validTypes.includes(message.type);
+    const isGroupTypeValid = validTypeGroups.some((prefix) => message.type.startsWith(prefix));
+    if (!message.type || !isTypeValid && !isGroupTypeValid) return false;
+    return !!(message.messageId && message.timestamp);
   }
   /**
-   * Check if keyshare exists for user
+   * Validate message structure
    */
-  hasKeyshare(userId) {
-    const keyshareKey = `tss.${userId}.keyshare`;
-    const ownerAddressKey = `tss.${userId}.ownerAddress`;
-    const hasKeyshare = this.storage.getItem(keyshareKey) !== null;
-    const hasAddress = this.storage.getItem(ownerAddressKey) !== null;
-    return hasKeyshare && hasAddress;
+  validateMessageStructure(message) {
+    return message && typeof message === "object" && typeof message.type === "string" && typeof message.messageId === "string" && typeof message.timestamp === "number" && typeof message.nonce === "string" && typeof message.projectId === "string" && "data" in message;
   }
   /**
-   * Get owner address for user
+   * Check if origin is allowed
    */
-  getOwnerAddress(userId) {
-    const address = this.storage.getItem(`tss.${userId}.ownerAddress`);
-    return address ? address : null;
+  isAllowedOrigin(origin) {
+    if (this.allowedOrigins.has(origin)) {
+      return true;
+    }
+    if (this.allowedOrigins.size === 0) {
+      const isLocalhost = origin.startsWith("http://localhost:") || origin.startsWith("http://127.0.0.1:");
+      const isHttps = origin.startsWith("https://");
+      return isHttps || isLocalhost;
+    }
+    return false;
   }
   /**
-   * Get session ID for user
+   * Compute HMAC-SHA256 for message authentication
    */
-  getSessionId(userId) {
-    return this.storage.getItem(`tss.${userId}.sessionId`);
+  async computeHMAC(message) {
+    if (!this.channelToken) {
+      throw new Error("No SDK channel token for HMAC");
+    }
+    const encoder3 = new TextEncoder();
+    const payload = JSON.stringify({
+      type: message.type,
+      messageId: message.messageId,
+      timestamp: message.timestamp,
+      nonce: message.nonce,
+      data: JSON.stringify(message.data)
+    });
+    const data = encoder3.encode(payload);
+    const key = encoder3.encode(this.channelToken);
+    const cryptoKey = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await crypto.subtle.sign("HMAC", cryptoKey, data);
+    return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
   }
   /**
-   * Remove keyshare for user
+   * Constant-time string comparison (prevent timing attacks)
    */
-  removeKeyshare(userId) {
-    try {
-      this.storage.removeItem(`tss.${userId}.keyshare`);
-      this.storage.removeItem(`tss.${userId}.ownerAddress`);
-      this.storage.removeItem(`tss.${userId}.sessionId`);
-      const allKeys = Object.keys(this.storage);
-      const userKeys = allKeys.filter((key) => key.startsWith(`tss.${userId}.`));
-      userKeys.forEach((key) => this.storage.removeItem(key));
-      console.log(`[iframe][Storage] \u2705 Removed keyshare for user: ${userId}`);
-    } catch (error) {
-      console.error("[iframe][Storage] Failed to remove keyshare:", error);
-      throw new Error(`Failed to remove keyshare: ${error instanceof Error ? error.message : "Unknown error"}`);
+  constantTimeCompare(a, b) {
+    if (a.length !== b.length) return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+      result |= a.charCodeAt(i) ^ b.charCodeAt(i);
     }
+    return result === 0;
   }
   /**
-   * List all users with keyshares (for debugging)
+   * Cleanup old nonces to prevent memory growth
    */
-  listUsers() {
-    const allKeys = Object.keys(this.storage);
-    const keyshareKeys = allKeys.filter((key) => key.endsWith(".keyshare"));
-    return keyshareKeys.map((key) => {
-      const match = key.match(/^tss\.(.+)\.keyshare$/);
-      return match ? match[1] : null;
-    }).filter(Boolean);
+  cleanupOldNonces() {
+    if (this.usedNonces.size > 1e3) {
+      const noncesArray = Array.from(this.usedNonces);
+      this.usedNonces = new Set(noncesArray.slice(-500));
+      console.log("[iframe][Messenger] Cleaned up old nonces");
+    }
   }
   /**
-   * Get storage statistics (for debugging)
+   * Get messenger statistics
    */
   getStats() {
-    const allKeys = Object.keys(this.storage);
-    const users = this.listUsers();
-    let storageSize = 0;
-    allKeys.forEach((key) => {
-      const value = this.storage.getItem(key);
-      if (value) {
-        storageSize += key.length + value.length;
-      }
-    });
     return {
-      totalKeys: allKeys.length,
-      users: users.length,
-      storageSize
+      allowedOrigins: this.allowedOrigins.size,
+      usedNonces: this.usedNonces.size,
+      pendingMessages: this.pendingMessages.size
     };
   }
 };
 
+// src/lib/session-messages.ts
+var SESSION_FREE_MESSAGES = /* @__PURE__ */ new Set([
+  "SDK_AUTH",
+  "SDK_CHANNEL_HEARTBEAT",
+  "SIGN_IN_START",
+  "SIGN_IN_FINISH",
+  "SIGN_OUT",
+  "GET_SESSION",
+  "GET_DAPP_TOKENS",
+  "ACCOUNT_REQUEST"
+]);
+
+// src/iframe/lib/session-auth.ts
+var CONSENT_MESSAGE = "AUTHENTICATE";
+async function resolveMessageAuth(data, channelSupportsIframeSession, session, options = {}) {
+  const parentToken = typeof data?.accessToken === "string" && data.accessToken ? data.accessToken : void 0;
+  const parentUserId = typeof data?.userId === "string" && data.userId ? data.userId : void 0;
+  if (parentToken || !channelSupportsIframeSession) {
+    return { mode: "legacy", userId: parentUserId, accessToken: parentToken };
+  }
+  const stored = options.includeUnconfirmed ? session.getIncludingUnconfirmed() : session.get();
+  if (!stored) return { mode: "none" };
+  return { mode: "iframe", userId: stored.userId, accessToken: await session.getAccessToken() };
+}
+function applyMessageAuth(data, auth) {
+  const base = { ...data ?? {} };
+  if (auth.mode === "legacy") return base;
+  delete base.accessToken;
+  delete base.userId;
+  if (auth.mode === "none") return base;
+  return { ...base, userId: auth.userId, accessToken: auth.accessToken };
+}
+function basicBackupAllowed(auth) {
+  return auth.mode === "iframe";
+}
+
 // src/iframe/lib/trusted-apps-manager.ts
 var STORAGE_KEY2 = "lumia_passport_trusted_apps";
 var TrustedAppsManager = class {
@@ -5889,11 +8110,159 @@ var TrustedAppsManager = class {
   }
 };
 
+// src/lib/userop-calls.ts
+var executeAbi = [
+  {
+    type: "function",
+    name: "execute",
+    stateMutability: "payable",
+    inputs: [
+      { name: "target", type: "address" },
+      { name: "value", type: "uint256" },
+      { name: "data", type: "bytes" }
+    ],
+    outputs: []
+  }
+];
+var executeBatchAbi = [
+  {
+    type: "function",
+    name: "executeBatch",
+    stateMutability: "payable",
+    inputs: [
+      { name: "dest", type: "address[]" },
+      { name: "value", type: "uint256[]" },
+      { name: "func", type: "bytes[]" }
+    ],
+    outputs: []
+  }
+];
+var EXECUTE_SELECTOR2 = "0xb61d27f6";
+var EXECUTE_BATCH_SELECTOR = "0x47e1da2a";
+function decodeUserOpCalls(userOp) {
+  const callData = (userOp.callData || "0x").toLowerCase();
+  if (callData === "0x") {
+    return { kind: "deploy" };
+  }
+  const selector = callData.slice(0, 10);
+  try {
+    if (selector === EXECUTE_SELECTOR2) {
+      const decoded = decodeFunctionData({ abi: executeAbi, data: callData });
+      const [to, value, data] = decoded.args;
+      return { kind: "calls", calls: [{ to: to.toLowerCase(), value: value.toString(), data }] };
+    }
+    if (selector === EXECUTE_BATCH_SELECTOR) {
+      const decoded = decodeFunctionData({ abi: executeBatchAbi, data: callData });
+      const [targets, values, datas] = decoded.args;
+      if (targets.length === 0 || targets.length !== values.length || targets.length !== datas.length) {
+        return { kind: "unknown", selector };
+      }
+      return {
+        kind: "calls",
+        calls: targets.map((to, index) => ({ to: to.toLowerCase(), value: values[index].toString(), data: datas[index] }))
+      };
+    }
+  } catch {
+    return { kind: "unknown", selector };
+  }
+  return { kind: "unknown", selector };
+}
+
+// src/iframe/lib/userop-display.ts
+var ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+function isMinimalSafeOperation(transaction) {
+  if (transaction.decoded && transaction.decoded.kind !== "deploy") {
+    return false;
+  }
+  const to = transaction.to?.toLowerCase();
+  const value = transaction.value?.toString() || "0";
+  const data = transaction.data?.toLowerCase() || "0x";
+  return to === ZERO_ADDRESS && (value === "0" || value === "0x0") && (data === "0x" || data === "0x0");
+}
+function isUserOpSigningPayload(signing) {
+  if (signing === null || typeof signing !== "object") return false;
+  const candidate = signing;
+  return candidate.kind === "userOp" && typeof candidate.chainId === "number" && Number.isInteger(candidate.chainId) && candidate.chainId > 0 && typeof candidate.entryPoint === "string" && /^0x[0-9a-fA-F]{40}$/.test(candidate.entryPoint) && candidate.userOp !== null && typeof candidate.userOp === "object" && typeof candidate.userOp.callData === "string" && typeof candidate.userOp.sender === "string";
+}
+function effectiveTransaction(transaction) {
+  if (!transaction.signing) {
+    return transaction;
+  }
+  if (!isUserOpSigningPayload(transaction.signing)) {
+    throw new Error("Unsupported signing payload for a transaction");
+  }
+  const { userOp } = transaction.signing;
+  const decoded = decodeUserOpCalls(userOp);
+  const details = {
+    ...transaction.userOpDetails,
+    sender: userOp.sender,
+    callGasLimit: userOp.callGasLimit,
+    verificationGasLimit: userOp.verificationGasLimit,
+    preVerificationGas: userOp.preVerificationGas,
+    maxFeePerGas: userOp.maxFeePerGas,
+    maxPriorityFeePerGas: userOp.maxPriorityFeePerGas,
+    paymaster: userOp.paymaster,
+    factory: userOp.factory,
+    factoryData: userOp.factoryData,
+    nonce: userOp.nonce
+  };
+  if (decoded.kind === "deploy") {
+    return {
+      ...transaction,
+      to: ZERO_ADDRESS,
+      value: "0",
+      data: "0x",
+      decoded,
+      userOpDetails: { ...details, callTarget: ZERO_ADDRESS, value: "0", callData: "0x", operations: void 0 }
+    };
+  }
+  if (decoded.kind === "unknown") {
+    return {
+      ...transaction,
+      to: "",
+      value: "0",
+      data: userOp.callData,
+      decoded,
+      userOpDetails: { ...details, callTarget: "", value: "0", callData: userOp.callData, operations: void 0 }
+    };
+  }
+  const [first] = decoded.calls;
+  const total = decoded.calls.reduce((sum, call) => sum + BigInt(call.value), 0n).toString();
+  const isBatch = decoded.calls.length > 1;
+  return {
+    ...transaction,
+    to: first.to,
+    value: total,
+    data: first.data,
+    decoded,
+    userOpDetails: {
+      ...details,
+      callTarget: first.to,
+      value: total,
+      callData: first.data,
+      operations: isBatch ? decoded.calls.map((call) => ({ to: call.to, value: call.value, data: call.data })) : void 0
+    }
+  };
+}
+
 // src/iframe/lib/signing-manager.ts
-var DASHBOARD_URL2 = (
-  // checks for custom service url
-  typeof window.__EMBARK_SERVICES__ !== "undefined" && window.__EMBARK_SERVICES__?.dashboardUrl || "https://dashboard.embarkai.io"
-);
+function signStartBody(sessionId, digest32, chainPath, payload) {
+  if (!payload) {
+    return { sessionId, digest32, chainPath };
+  }
+  if (payload.kind === "userOp") {
+    return {
+      sessionId,
+      digest32,
+      chainPath,
+      kind: "userOp",
+      chainId: payload.chainId,
+      entryPoint: payload.entryPoint,
+      userOp: payload.userOp
+    };
+  }
+  return { sessionId, digest32, chainPath, kind: "typedData", typedData: payload.typedData };
+}
 var SigningManager = class extends TokenRefreshApiClient {
   constructor() {
     super();
@@ -5902,11 +8271,6 @@ var SigningManager = class extends TokenRefreshApiClient {
     __publicField(this, "trustedApps");
     __publicField(this, "optedOutApps");
     __publicField(this, "explorerUrl", "https://beam-explorer.lumia.org");
-    // private readonly METADATA_API_URL = 'https://dashboard.embarkai.io/api/public/project'
-    __publicField(this, "METADATA_API_URL", `${DASHBOARD_URL2}/api/public/project`);
-    __publicField(this, "METADATA_CACHE_TTL", 36e5);
-    // 1 hour in milliseconds
-    __publicField(this, "metadataCache", /* @__PURE__ */ new Map());
     this.storage = new StorageManager();
     this.trustedApps = new TrustedAppsManager();
     this.optedOutApps = new OptedOutAppsManager();
@@ -5925,70 +8289,17 @@ var SigningManager = class extends TokenRefreshApiClient {
       throw new Error("Failed to initialize signing WASM module");
     }
   }
-  /**
-   * Check if transaction is a minimal safe operation (account deployment)
-   *
-   * Minimal operations are safe to auto-approve without user consent:
-   * - to: 0x0000000000000000000000000000000000000000 (burn address)
-   * - value: 0 (no funds transfer)
-   * - data: 0x (no contract call)
-   *
-   * This is used for smart account deployment without spending any funds.
-   */
-  isMinimalSafeOperation(transaction) {
-    const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
-    const ZERO_VALUE = "0";
-    const EMPTY_DATA = "0x";
-    const to = transaction.to?.toLowerCase();
-    const value = transaction.value?.toString() || "0";
-    const data = transaction.data?.toLowerCase() || "0x";
-    const isMinimal = to === ZERO_ADDRESS.toLowerCase() && (value === ZERO_VALUE || value === "0x0") && (data === EMPTY_DATA || data === "0x0");
-    if (isMinimal) {
-      console.log("[iframe][Sign] Detected minimal safe operation:", {
-        to,
-        value,
-        data,
-        reason: "Account deployment - no funds at risk"
-      });
-    }
-    return isMinimal;
-  }
-  /**
-   * Fetch project metadata from public API (with caching)
-   */
-  async fetchProjectMetadata(projectId) {
-    const cached = this.metadataCache.get(projectId);
-    const now = Date.now();
-    if (cached && now - cached.timestamp < this.METADATA_CACHE_TTL) {
-      console.log(`[iframe][Sign] Using cached metadata for project: ${cached.data.name}`);
-      return cached.data;
-    }
-    try {
-      const response = await fetch(`${this.METADATA_API_URL}/${projectId}/metadata`);
-      if (!response.ok) {
-        console.warn(`[iframe][Sign] Failed to fetch project metadata: ${response.status}`);
-        return null;
-      }
-      const metadata = await response.json();
-      console.log(`[iframe][Sign] Fetched metadata for project: ${metadata.name}`);
-      this.metadataCache.set(projectId, {
-        data: metadata,
-        timestamp: now
-      });
-      return metadata;
-    } catch (error) {
-      console.error("[iframe][Sign] Error fetching project metadata:", error);
-      return null;
-    }
+  fetchProjectMetadata(projectId) {
+    return fetchProjectCard(projectId);
   }
   /**
    * Sign transaction with user confirmation
    */
-  async signTransaction(userId, projectId, origin, transaction, accessToken, userProfile) {
+  async signTransaction(userId, projectId, origin, transaction, accessToken, userProfile, walletOwner) {
     if (!this.wasmLoaded) {
       await this.initialize();
     }
-    const keyshareData = this.storage.loadKeyshare(userId);
+    const keyshareData = this.storage.loadKeyshareOf(userId, walletOwner);
     if (!keyshareData) {
       throw new Error("No keyshare found. Please complete DKG first.");
     }
@@ -5999,16 +8310,25 @@ var SigningManager = class extends TokenRefreshApiClient {
       website: origin,
       domains: [origin]
     };
-    const isMinimalOperation = this.isMinimalSafeOperation(transaction);
+    const effective = effectiveTransaction(transaction);
+    const isMinimalOperation = isMinimalSafeOperation(effective);
+    if (isMinimalOperation) {
+      console.log("[iframe][Sign] Detected minimal safe operation:", {
+        to: effective.to,
+        value: effective.value,
+        data: effective.data,
+        reason: "Account deployment - no funds at risk"
+      });
+    }
     const isTrusted = this.trustedApps.isTrusted(userId, projectId, origin);
     if (!isTrusted && !isMinimalOperation) {
-      const risk = await this.assessRisk(transaction);
+      const risk = await this.assessRisk(effective);
       const confirmResult = await this.showConfirmationDialog(
         userId,
         projectId,
         projectInfo,
         origin,
-        transaction,
+        effective,
         risk,
         userProfile
       );
@@ -6023,13 +8343,13 @@ var SigningManager = class extends TokenRefreshApiClient {
       console.log("[iframe][Sign] Auto-approving minimal safe operation (account deployment)");
     }
     const digest32 = transaction.digest32 || this.computeTransactionHash(transaction);
-    const signature = await this.performMPCSigning(userId, keyshareData, digest32, projectId, accessToken);
+    const signature = await this.performMPCSigning(userId, keyshareData, digest32, projectId, accessToken, effective.signing);
     return signature;
   }
   /**
    * Perform MPC signing protocol
    */
-  async performMPCSigning(userId, keyshareData, digest32, projectId, accessToken) {
+  async performMPCSigning(userId, keyshareData, digest32, projectId, accessToken, payload) {
     const keyshare = keyshareData.keyshare_b64;
     const sessionId = keyshareData.sessionId;
     const digestHex = digest32.startsWith("0x") ? digest32.slice(2) : digest32;
@@ -6045,11 +8365,7 @@ var SigningManager = class extends TokenRefreshApiClient {
     const serverStartResponse = await this.apiCall(
       "POST",
       `/api/tss/${userId}/sign/start`,
-      {
-        sessionId,
-        digest32,
-        chainPath: CHAIN_PATH
-      },
+      signStartBody(sessionId, digest32, CHAIN_PATH, payload),
       projectId,
       accessToken
     );
@@ -6203,12 +8519,12 @@ var SigningManager = class extends TokenRefreshApiClient {
   computeTransactionHash(transaction) {
     const encoder3 = new TextEncoder();
     const data = encoder3.encode(JSON.stringify(transaction));
-    let hash = 0;
+    let hash2 = 0;
     for (let i = 0; i < data.length; i++) {
-      hash = (hash << 5) - hash + data[i];
-      hash = hash & hash;
+      hash2 = (hash2 << 5) - hash2 + data[i];
+      hash2 = hash2 & hash2;
     }
-    const hashHex = Math.abs(hash).toString(16).padStart(64, "0");
+    const hashHex = Math.abs(hash2).toString(16).padStart(64, "0");
     return `0x${hashHex}`;
   }
   formatValue(value) {
@@ -6244,7 +8560,7 @@ var SigningManager = class extends TokenRefreshApiClient {
   /**
    * Sign EIP712 typed data with user confirmation
    */
-  async signTypedData(userId, projectId, origin, typedData, digest32, accessToken, userProfile) {
+  async signTypedData(userId, projectId, origin, typedData, digest32, accessToken, userProfile, walletOwner) {
     console.log("[iframe][Sign] EIP712 signing request:", {
       userId,
       projectId,
@@ -6277,11 +8593,14 @@ var SigningManager = class extends TokenRefreshApiClient {
         this.optedOutApps.removeOptedOut(userId, projectId, origin);
       }
     }
-    const keyshareData = this.storage.loadKeyshare(userId);
+    const keyshareData = this.storage.loadKeyshareOf(userId, walletOwner);
     if (!keyshareData) {
       throw new Error("No keyshare found. Please complete DKG first.");
     }
-    const signature = await this.performMPCSigning(userId, keyshareData, digest32, projectId, accessToken);
+    const signature = await this.performMPCSigning(userId, keyshareData, digest32, projectId, accessToken, {
+      kind: "typedData",
+      typedData
+    });
     console.log("[iframe][Sign] EIP712 signature generated");
     return signature;
   }
@@ -6348,8 +8667,93 @@ var SigningManager = class extends TokenRefreshApiClient {
   }
 };
 
+// src/iframe/lib/user-policy-api.ts
+function requirePolicyId(payload) {
+  const policyId = payload?.policyId;
+  if (typeof policyId !== "string" || policyId.length === 0) {
+    throw new Error("policyId is required");
+  }
+  return policyId;
+}
+function requireInput(payload) {
+  if (typeof payload?.name !== "string" || !payload.rules) {
+    throw new Error("name and rules are required");
+  }
+  return {
+    name: payload.name,
+    description: payload.description ?? "",
+    enabled: payload.enabled ?? true,
+    allChains: payload.allChains ?? false,
+    chainIds: payload.chainIds ?? [],
+    rules: payload.rules
+  };
+}
+var UserPolicyAPI = class extends TokenRefreshApiClient {
+  constructor(sendResponseFn) {
+    super();
+    __publicField(this, "sendResponseFn");
+    this.sendResponseFn = sendResponseFn;
+  }
+  path(userId, suffix = "") {
+    return `/api/tss/${encodeURIComponent(userId)}/policies${suffix}`;
+  }
+  async listUserPolicies(userId, projectId, accessToken) {
+    return this.apiCall("GET", this.path(userId), void 0, projectId, accessToken);
+  }
+  async createUserPolicy(userId, projectId, input, accessToken) {
+    return this.apiCall("POST", this.path(userId), input, projectId, accessToken);
+  }
+  async updateUserPolicy(userId, projectId, policyId, input, accessToken) {
+    return this.apiCall("PUT", this.path(userId, `/${encodeURIComponent(policyId)}`), input, projectId, accessToken);
+  }
+  async deleteUserPolicy(userId, projectId, policyId, accessToken) {
+    return this.apiCall("POST", this.path(userId, `/${encodeURIComponent(policyId)}/delete`), {}, projectId, accessToken);
+  }
+  async cancelPending(userId, projectId, policyId, accessToken) {
+    return this.apiCall("POST", this.path(userId, `/${encodeURIComponent(policyId)}/cancel-pending`), {}, projectId, accessToken);
+  }
+  async handleMessage(message, origin) {
+    const { type, messageId } = message;
+    const data = message.data || {};
+    const accessToken = data.accessToken;
+    const userId = data.userId;
+    const projectId = data.projectId;
+    if (!accessToken) throw new Error("accessToken is required");
+    if (!userId) throw new Error("userId is required");
+    if (!projectId) throw new Error("projectId is required");
+    let view;
+    switch (type) {
+      case "USER_POLICY_LIST":
+        view = await this.listUserPolicies(userId, projectId, accessToken);
+        break;
+      case "USER_POLICY_CREATE":
+        view = await this.createUserPolicy(userId, projectId, requireInput(data.payload), accessToken);
+        break;
+      case "USER_POLICY_UPDATE":
+        view = await this.updateUserPolicy(userId, projectId, requirePolicyId(data.payload), requireInput(data.payload), accessToken);
+        break;
+      case "USER_POLICY_DELETE":
+        view = await this.deleteUserPolicy(userId, projectId, requirePolicyId(data.payload), accessToken);
+        break;
+      case "USER_POLICY_CANCEL_PENDING":
+        view = await this.cancelPending(userId, projectId, requirePolicyId(data.payload), accessToken);
+        break;
+      default:
+        throw new Error(`[USER_POLICY_API]: Unknown message type: ${type}`);
+    }
+    this.sendResponseFn(messageId, view, origin);
+  }
+};
+
 // src/iframe/main.ts
-var IFRAME_VERSION = "0.4.128";
+var IFRAME_VERSION = "0.6.9";
+function walletOwnerOf(data) {
+  const owner = data?.walletOwner;
+  return typeof owner === "string" && /^0x[0-9a-fA-F]{40}$/.test(owner) ? owner : void 0;
+}
+function publicBackupInfo(data) {
+  return { userId: data.userId, sessionId: data.sessionId, ownerAddress: data.ownerAddress };
+}
 var IframeWallet = class {
   // private finchpay: FinchPayRampAPI
   // private rampnow: RampnowOnrampAPI
@@ -6365,8 +8769,9 @@ var IframeWallet = class {
     __publicField(this, "backupManager");
     __publicField(this, "binance");
     __publicField(this, "hyperlane");
-    __publicField(this, "assetsPolicies");
+    __publicField(this, "userPolicies");
     __publicField(this, "activityLogging");
+    __publicField(this, "signIn");
     console.log("=".repeat(60));
     console.log(`  EmbarkAI Secure Wallet - iframe version ${IFRAME_VERSION}`);
     console.log("=".repeat(60));
@@ -6379,7 +8784,8 @@ var IframeWallet = class {
     this.trustedApps = new TrustedAppsManager();
     this.optedOutApps = new OptedOutAppsManager();
     this.backupManager = new BackupManager();
-    this.assetsPolicies = new AssetsPoliciesAPI(this.messenger.sendResponse.bind(this.messenger));
+    this.signIn = new IframeSignIn();
+    this.userPolicies = new UserPolicyAPI(this.messenger.sendResponse.bind(this.messenger));
     this.activityLogging = new ActivityLoggingAPI(this.messenger.sendResponse.bind(this.messenger));
     this.hyperlane = new HyperlaneAPI(this.messenger.sendResponse.bind(this.messenger));
     this.binance = new BinanceOnrampAPI(
@@ -6417,11 +8823,20 @@ var IframeWallet = class {
     }
   }
   async handleMessage(message, origin) {
-    const { type, messageId, projectId } = message;
+    const { type, messageId } = message;
     try {
+      let auth = { mode: "legacy" };
+      if (!SESSION_FREE_MESSAGES.has(type)) {
+        const channel = this.sdkChannelManager.getChannel(message.data?.sessionToken);
+        const channelSupportsIframeSession = !!channel && channel.origin === origin && !!channel.sdkVersion;
+        auth = await resolveMessageAuth(message.data, channelSupportsIframeSession, iframeSession, {
+          includeUnconfirmed: type === CONSENT_MESSAGE
+        });
+        message.data = applyMessageAuth(message.data, auth);
+      }
       switch (true) {
-        case type.startsWith("USER_ASSETS_POLICY_"):
-          await this.assetsPolicies.handleMessage(message, origin);
+        case type.startsWith("USER_POLICY_"):
+          await this.userPolicies.handleMessage(message, origin);
           break;
         case type.startsWith("USER_ACTIVITY_LOG_"):
           await this.activityLogging.handleMessage(message, origin);
@@ -6444,11 +8859,29 @@ var IframeWallet = class {
         case type === "SDK_CHANNEL_HEARTBEAT":
           await this.handleHeartbeat(message, origin);
           break;
+        case type === "SIGN_IN_START":
+          await this.handleSignInStart(message, origin);
+          break;
+        case type === "SIGN_IN_FINISH":
+          await this.handleSignInFinish(message, origin);
+          break;
+        case type === "SIGN_OUT":
+          await this.handleSignOut(message, origin);
+          break;
+        case type === "GET_SESSION":
+          await this.handleGetSession(message, origin);
+          break;
+        case type === "GET_DAPP_TOKENS":
+          await this.handleGetDappTokens(message, origin);
+          break;
+        case type === "ACCOUNT_REQUEST":
+          await this.handleAccountRequest(message, origin);
+          break;
         case type === "AUTHENTICATE":
           await this.handleAuthenticate(message, origin);
           break;
         case type === "START_DKG":
-          await this.handleStartDKG(message, origin);
+          await this.handleStartDKG(message, origin, auth);
           break;
         case type === "SIGN_TRANSACTION":
           await this.handleSignTransaction(message, origin);
@@ -6472,16 +8905,19 @@ var IframeWallet = class {
           await this.handleClearAuthorizations(message, origin);
           break;
         case type === "CREATE_BACKUP":
-          await this.handleCreateBackup(message, origin);
+          await this.handleCreateBackup(message, origin, auth);
           break;
         case type === "GET_BACKUP_STATUS":
           await this.handleGetBackupStatus(message, origin);
           break;
+        case type === "ENSURE_SERVER_BACKUP":
+          await this.handleEnsureServerBackup(message, origin, auth);
+          break;
         case type === "GET_CLOUD_PROVIDERS":
           await this.handleGetCloudProviders(message, origin);
           break;
         case type === "RESTORE_BACKUP":
-          await this.handleRestoreBackup(message, origin);
+          await this.handleRestoreBackup(message, origin, auth);
           break;
         case type === "RESTORE_FROM_FILE":
           await this.handleRestoreFromFile(message, origin);
@@ -6523,15 +8959,19 @@ var IframeWallet = class {
     console.log(`[iframe] HEARTBEAT: valid=${isValid}, channels=${stats.total}`);
   }
   async handleSDKAuth(message, origin) {
-    const { projectId } = message.data;
+    const { projectId, sdkVersion } = message.data;
     const { messageId } = message;
-    console.log(`[iframe] SDK_AUTH: projectId=${projectId}`);
+    console.log(`[iframe] SDK_AUTH: projectId=${projectId}, sdkVersion=${sdkVersion ?? "legacy"}`);
     const isLocalhost = origin.startsWith("http://localhost:") || origin.startsWith("http://127.0.0.1:");
     const isHttps = origin.startsWith("https://");
     if (!isHttps && !isLocalhost) {
       throw new Error("Only HTTPS origins are allowed (or localhost for dev)");
     }
-    const sessionToken = this.sdkChannelManager.createChannel(projectId, origin);
+    const sessionToken = this.sdkChannelManager.createChannel(
+      projectId,
+      origin,
+      typeof sdkVersion === "string" && sdkVersion ? sdkVersion.slice(0, 32) : void 0
+    );
     this.messenger.setChannelToken(sessionToken);
     this.messenger.addAllowedOrigin(origin);
     this.messenger.sendResponse(
@@ -6544,8 +8984,55 @@ var IframeWallet = class {
     );
     console.log(`[iframe] \u2705 SDK authenticated for origin: ${origin.substring(0, 40)}...`);
   }
+  requireChannel(message, origin) {
+    const channel = this.sdkChannelManager.validateChannel(message.data?.sessionToken, origin) ? this.sdkChannelManager.getChannel(message.data.sessionToken) : null;
+    if (!channel) throw new Error("Invalid SDK channel");
+    return channel;
+  }
+  /** Sign-in requests: the parent passes the user input, the iframe holds the flow secret */
+  async handleSignInStart(message, origin) {
+    const channel = this.requireChannel(message, origin);
+    const result = await this.signIn.start(message.data, origin, channel.projectId);
+    this.messenger.sendResponse(message.messageId, { type: "IFRAME_MSG_SIGN_IN_STARTED", ...result }, origin);
+  }
+  /** Finishes the flow: the iframe keeps the session, the parent gets a dApp token pair */
+  async handleSignInFinish(message, origin) {
+    const channel = this.requireChannel(message, origin);
+    const loginResponse = await this.signIn.finish(message.data, origin, channel.projectId);
+    this.messenger.sendResponse(message.messageId, { type: "IFRAME_MSG_SIGN_IN_FINISHED", loginResponse }, origin);
+  }
+  async handleSignOut(message, origin) {
+    this.requireChannel(message, origin);
+    this.signIn.cancel(origin);
+    await iframeSession.signOut();
+    this.messenger.sendResponse(message.messageId, { type: "IFRAME_MSG_SIGNED_OUT", success: true }, origin);
+  }
+  /** Session state and profile basics, never the tokens */
+  async handleGetSession(message, origin) {
+    this.requireChannel(message, origin);
+    this.messenger.sendResponse(message.messageId, { type: "IFRAME_MSG_SESSION", session: iframeSession.info() }, origin);
+  }
+  /** A new dApp pair for the parent (lost storage, dead refresh token); null when the iframe has no session */
+  async handleGetDappTokens(message, origin) {
+    const channel = this.requireChannel(message, origin);
+    const info = iframeSession.info();
+    const tokens = info.signedIn ? {
+      ...await iframeSession.mintDappTokens(channel.projectId),
+      hasKeyshare: !!info.hasKeyshare,
+      displayName: info.displayName ?? null,
+      avatar: info.avatar ?? null,
+      providers: info.providers ?? []
+    } : null;
+    this.messenger.sendResponse(message.messageId, { type: "IFRAME_MSG_DAPP_TOKENS", tokens }, origin);
+  }
+  /** Account changes a dApp token cannot make (profile, nickname, devices, smart account), sent with the iframe session */
+  async handleAccountRequest(message, origin) {
+    const channel = this.requireChannel(message, origin);
+    const result = await sendAccountRequest(message.data, channel.projectId, void 0, void 0, origin);
+    this.messenger.sendResponse(message.messageId, { type: "IFRAME_MSG_ACCOUNT_RESPONSE", ...result }, origin);
+  }
   async handleAuthenticate(message, origin) {
-    const { sessionToken, projectId, userId, avatar, displayName } = message.data;
+    const { sessionToken, projectId, userId, avatar, displayName, accessToken } = message.data;
     const { messageId } = message;
     if (!this.sdkChannelManager.validateChannel(sessionToken, origin)) {
       throw new Error("Invalid SDK channel");
@@ -6589,6 +9076,11 @@ var IframeWallet = class {
         console.log(`[iframe] \u2705 Authorization granted: ${userId} -> ${projectId}`);
       }
     }
+    iframeSession.confirm(userId);
+    if (accessToken) {
+      const walletOwner = await this.backupManager.walletOwnerForProject(userId, accessToken, projectId);
+      if (walletOwner) this.storage.reconcileWithServer(userId, { hasKeyshare: true, ownerAddress: walletOwner });
+    }
     const address = this.storage.getOwnerAddress(userId);
     this.messenger.sendResponse(
       messageId,
@@ -6607,7 +9099,7 @@ var IframeWallet = class {
       console.log(`[iframe] \u2139\uFE0F User needs DKG or restore to create/recover keyshare`);
     }
   }
-  async handleStartDKG(message, origin) {
+  async handleStartDKG(message, origin, auth) {
     const { sessionToken, userId, projectId, accessToken } = message.data;
     const { messageId } = message;
     if (!this.sdkChannelManager.validateChannel(sessionToken, origin)) {
@@ -6620,12 +9112,27 @@ var IframeWallet = class {
     console.log(`[iframe] START_DKG: userId=${userId}, projectId=${projectId}, hasToken=${!!accessToken}`);
     this.displayLoadingIndicator("Generating secure keys...");
     try {
-      const result = await this.dkgManager.performDKG(userId, projectId, accessToken);
-      this.storage.saveKeyshare(userId, {
-        keyshare_b64: result.keyshare.keyshare_b64,
-        ownerAddress: result.ownerAddress,
-        sessionId: result.sessionId
-      });
+      let ownerAddress;
+      try {
+        const result2 = await this.dkgManager.performDKG(userId, projectId, accessToken);
+        const previous = this.storage.getOwnerAddress(userId);
+        if (previous && previous.toLowerCase() !== result2.ownerAddress.toLowerCase()) {
+          this.storage.archiveKeyshare(userId);
+        }
+        this.storage.saveKeyshare(userId, {
+          keyshare_b64: result2.keyshare.keyshare_b64,
+          ownerAddress: result2.ownerAddress,
+          sessionId: result2.sessionId
+        });
+        ownerAddress = result2.ownerAddress;
+      } catch (error) {
+        const existing = existingOwnerAddressOf(error);
+        const current = this.storage.getOwnerAddress(userId);
+        const isCurrent = !!existing && !!current && current.toLowerCase() === existing.toLowerCase();
+        if (!existing || !isCurrent && !this.storage.restoreArchivedKeyshare(userId, existing)) throw error;
+        ownerAddress = this.storage.getOwnerAddress(userId);
+      }
+      const result = { ownerAddress };
       this.hideLoadingIndicator();
       this.messenger.sendResponse(
         messageId,
@@ -6636,6 +9143,8 @@ var IframeWallet = class {
         origin
       );
       console.log(`[iframe] \u2705 DKG completed: ${result.ownerAddress}`);
+      void this.backupManager.ensureServerBackup(userId, accessToken, projectId, basicBackupAllowed(auth), ownerAddress);
+      if (auth.mode === "iframe") iframeSession.update({ hasKeyshare: true });
       this.sendWalletReadyStatus(userId, origin);
     } catch (error) {
       this.hideLoadingIndicator();
@@ -6654,10 +9163,16 @@ var IframeWallet = class {
     }
     console.log(`[iframe] SIGN_TRANSACTION: userId=${userId}, hasAccessToken=${!!accessToken}`);
     try {
-      const signature = await this.signingManager.signTransaction(userId, projectId, origin, transaction, accessToken, {
-        avatar,
-        displayName
-      });
+      const walletOwner = await this.backupManager.walletOwnerForProject(userId, accessToken, projectId);
+      const signature = await this.signingManager.signTransaction(
+        userId,
+        projectId,
+        origin,
+        transaction,
+        accessToken,
+        { avatar, displayName },
+        walletOwner
+      );
       this.messenger.sendResponse(
         messageId,
         {
@@ -6684,6 +9199,7 @@ var IframeWallet = class {
     }
     console.log(`[iframe] SIGN_TYPED_DATA: userId=${userId}, primaryType=${typedData?.primaryType}`);
     try {
+      const walletOwner = await this.backupManager.walletOwnerForProject(userId, accessToken, projectId);
       const signature = await this.signingManager.signTypedData(
         userId,
         projectId,
@@ -6691,7 +9207,8 @@ var IframeWallet = class {
         typedData,
         digest32,
         accessToken,
-        { avatar, displayName }
+        { avatar, displayName },
+        walletOwner
       );
       this.messenger.sendResponse(
         messageId,
@@ -6724,11 +9241,14 @@ var IframeWallet = class {
     );
   }
   async handleCheckKeyshare(message, origin) {
-    const { sessionToken, userId } = message.data;
+    const { sessionToken, userId, server } = message.data;
     const { messageId } = message;
     if (!this.sdkChannelManager.validateChannel(sessionToken, origin)) {
       throw new Error("Invalid SDK channel");
     }
+    if (server && typeof server.hasKeyshare === "boolean") {
+      this.storage.reconcileWithServer(userId, server);
+    }
     const hasKeyshare = this.storage.hasKeyshare(userId);
     const address = hasKeyshare ? this.storage.getOwnerAddress(userId) : void 0;
     this.messenger.sendResponse(
@@ -6820,9 +9340,9 @@ var IframeWallet = class {
     );
     console.log(`[iframe] \u2705 CLEAR_AUTHORIZATIONS: Cleared ${clearedCount} authorizations for project ${projectId}`);
   }
-  async handleCreateBackup(message, origin) {
+  async handleCreateBackup(message, origin, auth) {
     const { sessionToken, userId, backupRequest, accessToken } = message.data;
-    const { messageId } = message;
+    const { messageId, projectId } = message;
     console.log(`[iframe] CREATE_BACKUP received:`, {
       userId,
       method: backupRequest?.method,
@@ -6846,7 +9366,9 @@ var IframeWallet = class {
       return;
     }
     try {
-      const backupOp = () => this.backupManager.createBackup(userId, backupRequest, accessToken);
+      const walletOwner = await this.resolveWalletOwner(userId, message);
+      const currentServerMethod = backupRequest.method === "server" ? await this.backupManager.getServerBackupMethod(accessToken, projectId, walletOwner) : void 0;
+      const backupOp = () => this.backupManager.createBackup(userId, backupRequest, accessToken, projectId, currentServerMethod, basicBackupAllowed(auth), walletOwner);
       const result = !backupRequest.password && this.isSafari() ? await this.withPasskeyConfirmation("backup", backupOp) : await backupOp();
       this.messenger.sendResponse(
         messageId,
@@ -6866,6 +9388,13 @@ var IframeWallet = class {
       this.messenger.sendError(messageId, error.message || "Backup failed", origin);
     }
   }
+  /**
+   * The wallet a backup request is about (sdk #32, #31): the server's keyshare for the request's project as TSS
+   * reports it, also for older parents that name none; what the parent names only when TSS does not answer
+   */
+  resolveWalletOwner(userId, message) {
+    return this.backupManager.resolveWalletOwner(userId, walletOwnerOf(message.data), message.data?.accessToken, message.projectId);
+  }
   async handleGetBackupStatus(message, origin) {
     const { sessionToken, userId } = message.data;
     const { messageId } = message;
@@ -6885,6 +9414,17 @@ var IframeWallet = class {
     );
     console.log(`[iframe] \u2705 GET_BACKUP_STATUS: Status retrieved`);
   }
+  async handleEnsureServerBackup(message, origin, auth) {
+    const { sessionToken, userId, accessToken } = message.data;
+    const { messageId, projectId } = message;
+    console.log(`[iframe] ENSURE_SERVER_BACKUP: userId=${userId}`);
+    if (!this.sdkChannelManager.validateChannel(sessionToken, origin)) {
+      console.error("[iframe] ENSURE_SERVER_BACKUP: Session validation failed");
+      throw new Error("Invalid SDK channel");
+    }
+    const result = userId ? await this.backupManager.ensureServerBackup(userId, accessToken, projectId, basicBackupAllowed(auth), await this.resolveWalletOwner(userId, message)) : { status: "failed", reason: "unknown", error: "userId is required" };
+    this.messenger.sendResponse(messageId, { type: "IFRAME_MSG_SERVER_BACKUP_ENSURED", result }, origin);
+  }
   async handleGetCloudProviders(message, origin) {
     const { sessionToken } = message.data;
     const { messageId } = message;
@@ -6957,9 +9497,9 @@ var IframeWallet = class {
   isSafari() {
     return /^((?!chrome|android).)*safari/i.test(navigator.userAgent);
   }
-  async handleRestoreBackup(message, origin) {
+  async handleRestoreBackup(message, origin, auth) {
     const { sessionToken, userId, password, accessToken } = message.data;
-    const { messageId } = message;
+    const { messageId, projectId } = message;
     console.log(`[iframe] RESTORE_BACKUP received:`, {
       userId,
       hasPassword: !!password,
@@ -6978,8 +9518,10 @@ var IframeWallet = class {
       return;
     }
     try {
-      const restoreOp = () => this.backupManager.restoreFromServer(userId, password, accessToken);
-      const backupData = !password && this.isSafari() ? await this.withPasskeyConfirmation("restore", restoreOp) : await restoreOp();
+      const walletOwner = await this.resolveWalletOwner(userId, message);
+      const restoreOp = () => this.backupManager.restoreFromServer(userId, password, accessToken, projectId, basicBackupAllowed(auth), walletOwner);
+      const needsPasskey = !password && this.isSafari() && await this.backupManager.getServerBackupMethod(accessToken, projectId, walletOwner) !== "server-managed";
+      const backupData = needsPasskey ? await this.withPasskeyConfirmation("restore", restoreOp) : await restoreOp();
       this.messenger.sendResponse(
         messageId,
         {
@@ -6987,7 +9529,8 @@ var IframeWallet = class {
           result: {
             success: true,
             timestamp: Date.now(),
-            data: backupData
+            // the keyshare itself never leaves the iframe
+            data: publicBackupInfo(backupData)
           }
         },
         origin
@@ -6996,6 +9539,7 @@ var IframeWallet = class {
       this.sendWalletReadyStatus(userId, origin);
     } catch (error) {
       console.error("[iframe] RESTORE_BACKUP: Exception:", error);
+      const parentSupportsIframeSession = !!this.sdkChannelManager.getChannel(sessionToken)?.sdkVersion;
       this.messenger.sendResponse(
         messageId,
         {
@@ -7003,7 +9547,7 @@ var IframeWallet = class {
           result: {
             success: false,
             timestamp: Date.now(),
-            error: error.message || "Restore failed"
+            error: restoreErrorForParent(error.message || "Restore failed", parentSupportsIframeSession)
           }
         },
         origin
@@ -7045,7 +9589,8 @@ var IframeWallet = class {
           result: {
             success: true,
             timestamp: Date.now(),
-            data: backupData
+            // the keyshare itself never leaves the iframe
+            data: publicBackupInfo(backupData)
           }
         },
         origin
@@ -7089,7 +9634,7 @@ var IframeWallet = class {
       return;
     }
     try {
-      const encryptedData = await this.backupManager.encryptBackupData(userId, password);
+      const encryptedData = await this.backupManager.encryptBackupData(userId, password, await this.resolveWalletOwner(userId, message));
       this.messenger.sendResponse(
         messageId,
         {
@@ -7105,14 +9650,18 @@ var IframeWallet = class {
     }
   }
   async handleEncryptEnvelopeData(message, origin) {
-    const { userId, password } = message.data;
+    const { sessionToken, userId, password } = message.data;
     const { messageId } = message;
     if (!userId) {
       this.messenger.sendError(messageId, "userId is required", origin);
       return;
     }
+    if (!this.sdkChannelManager.validateChannel(sessionToken, origin)) {
+      this.messenger.sendError(messageId, "Invalid SDK channel", origin);
+      return;
+    }
     try {
-      const envelopeJson = await this.backupManager.encryptEnvelopeData(userId, password);
+      const envelopeJson = await this.backupManager.encryptEnvelopeData(userId, password, await this.resolveWalletOwner(userId, message));
       this.messenger.sendResponse(
         messageId,
         {
@@ -7208,6 +9757,11 @@ var IframeWallet = class {
     this.displayReadyIndicator();
   }
 };
+function existingOwnerAddressOf(error) {
+  const details = error?.details;
+  if (details?.status !== 409 || typeof details.existingOwnerAddress !== "string") return null;
+  return details.existingOwnerAddress;
+}
 function toggleAuthPermissions(e) {
   const isToggler = e.target?.id === "data-auth-permissions-toggler";
   if (!isToggler) return;