@waaskey/sdk 0.0.1 → 0.1.0

package/dist/index.d.cts

@@ -1,12 +1,867 @@
+import { PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, AuthenticationResponseJSON } from '@simplewebauthn/browser';
+
+/** Thin typed HTTP client over fetch — the single place requests are issued. */
+declare class HttpClient {
+    private readonly apiKey;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private memberAccessToken?;
+    constructor(apiKey: string, baseUrl: string, fetchImpl?: typeof fetch);
+    /**
+     * Wire a provider of the held org-member access token (from {@link Members}). When it returns a
+     * token, {@link requestAsMember} authenticates member calls with `Authorization: Bearer <token>`
+     * rather than the ambient dashboard cookie. Injected by the client (not imported) so `Members` and
+     * `HttpClient` don't form an import cycle.
+     */
+    useMemberAccessToken(provider: () => string | undefined): void;
+    request<T>(method: string, path: string, body?: unknown, signal?: AbortSignal, bearer?: string): Promise<T>;
+    /**
+     * `@Public` request: NO `Authorization` header and NO cookie. Used by the org-member Firebase
+     * login exchange (`POST /v1/auth/firebase`), which authenticates from the Firebase ID token in the
+     * body alone and returns the member bearer tokens in its response.
+     */
+    requestPublic<T>(method: string, path: string, body?: unknown, signal?: AbortSignal): Promise<T>;
+    /**
+     * Member-session request (#349). Authenticates as the org member in one of two ways, transparent
+     * to the caller ({@link Wallets.joinCeremony} / {@link Wallets.joinSignCeremony}):
+     *
+     * - **Held bearer session** (a {@link memberAccessToken} provider returns a token — e.g. after
+     *   {@link Members.loginWithFirebase}): sends `Authorization: Bearer <accessToken>`. The backend's
+     *   `ApiKeyAuthGuard` recognises a non-API-key bearer and falls through to the member-session
+     *   resolver, so a headless (non-browser) consumer authenticates without a cookie.
+     * - **No held session** (the browser dashboard path): sends NO `Authorization` header and
+     *   `credentials: 'include'`, relying on the caller's own same-site httpOnly member cookie. The
+     *   guard only falls back to the cookie resolver when the header is absent entirely, so it is
+     *   omitted here.
+     *
+     * Never used by the tenant-apiKey ({@link request}) or embedded-end-user paths.
+     */
+    requestAsMember<T>(method: string, path: string, body?: unknown, signal?: AbortSignal): Promise<T>;
+    private send;
+}
+
+/** Lifecycle events the SDK emits for the tenant dashboard. */
+type AnalyticsEventType = 'wallet.created' | 'wallet.signed' | 'wallet.sent' | 'wallet.recovered' | 'wallet.reshared';
+/**
+ * A privacy-respecting SDK analytics event. Carries NO PII, secrets, key shares, addresses, or
+ * signing digests — only the action, a timestamp, and tenant-owned non-sensitive identifiers.
+ */
+interface AnalyticsEvent {
+    type: AnalyticsEventType;
+    /** ISO-8601 timestamp. */
+    timestamp: string;
+    /** Wallet id — an opaque Waaskey identifier owned by the tenant (not PII). */
+    walletId?: string;
+    /** Chain slug, e.g. "ethereum". */
+    chain?: string;
+    /** Signing curve, e.g. "secp256k1". */
+    curve?: string;
+}
+/**
+ * Receives SDK analytics events. The default is an HTTP sink to the Waaskey API; pass your own to
+ * forward to a custom pipeline, or `false` in {@link WaaskeyOptions.analytics} to opt out entirely.
+ */
+interface AnalyticsSink {
+    track(event: AnalyticsEvent): void;
+}
+
+/**
+ * Emits lifecycle events to a {@link AnalyticsSink}; a no-op when analytics is disabled (no sink).
+ * Fire-and-forget and exception-safe — analytics must NEVER break or slow a wallet operation.
+ */
+declare class Analytics {
+    private readonly sink?;
+    constructor(sink?: AnalyticsSink | undefined);
+    track(type: AnalyticsEventType, props?: Omit<AnalyticsEvent, 'type' | 'timestamp'>): void;
+}
+
+/** Default sink: POST events to the Waaskey API, fire-and-forget — delivery failures are swallowed. */
+declare class HttpAnalyticsSink implements AnalyticsSink {
+    private readonly http;
+    constructor(http: HttpClient);
+    track(event: AnalyticsEvent): void;
+}
+
+/**
+ * Client-side balance reads.
+ *
+ * WaaS is non-custodial and the backend does not index chain state — balances are
+ * read **directly from a chain provider** (dApp-style), never from the backend. The
+ * SDK depends on the {@link ChainProvider} port; the default web implementation is a
+ * JSON-RPC provider for EVM chains, and a consumer can plug a custom provider for
+ * any chain/transport.
+ */
+/** Reads chain state for one chain. Native is always supported; tokens/decimals are EVM-style. */
+interface ChainProvider {
+    /** Native asset balance of `address`, in base units (wei / sat / lamports). */
+    getNativeBalance(address: string): Promise<bigint>;
+    /** Token balance of `owner` for `token`, in the token's base units. */
+    getTokenBalance(token: string, owner: string): Promise<bigint>;
+    /** Token decimals, if the provider can resolve them (EVM `decimals()`). */
+    getTokenDecimals?(token: string): Promise<number>;
+}
+/** Per-chain provider configuration. */
+interface ChainConfig {
+    /** JSON-RPC URL for an EVM chain. Ignored if `provider` is set. */
+    rpcUrl?: string;
+    /** A custom provider (for non-EVM chains or a bespoke transport). Overrides `rpcUrl`. */
+    provider?: ChainProvider;
+}
+/** A resolved balance — exact base units plus a human-readable rendering. */
+interface Balance {
+    /** Exact balance in base units (no float). */
+    raw: bigint;
+    /** Decimals of the asset. */
+    decimals: number;
+    /** `raw` rendered as a decimal string (e.g. `"1.5"`). */
+    formatted: string;
+    /** Asset symbol, when known. */
+    symbol?: string;
+}
+/** Options for a token balance read. */
+interface TokenBalanceOptions {
+    /** Token decimals (skips an on-chain `decimals()` lookup). */
+    decimals?: number;
+    /** Token symbol, for the returned {@link Balance}. */
+    symbol?: string;
+}
+
+/**
+ * Reads balances directly from a chain provider (never the backend). EVM chains work
+ * out of the box via a default public RPC; override per chain with `chains` (an RPC
+ * URL or a custom {@link ChainProvider}), and supply a provider for non-EVM chains.
+ */
+declare class Balances {
+    private readonly config;
+    private readonly fetchImpl?;
+    private readonly providers;
+    constructor(config?: Partial<Record<Chain, ChainConfig>>, fetchImpl?: typeof fetch | undefined);
+    /** Native (gas-token) balance of an address on a chain. */
+    getBalance(chain: Chain, address: string): Promise<Balance>;
+    /** Token balance of `owner` for `token` on a chain (ERC-20 on EVM). */
+    getTokenBalance(chain: Chain, token: string, owner: string, options?: TokenBalanceOptions): Promise<Balance>;
+    /** Resolve (and cache) the provider for a chain: custom → configured RPC → default EVM RPC. */
+    private provider;
+}
+
+/**
+ * {@link ChainProvider} backed by an EVM JSON-RPC endpoint (`eth_getBalance`,
+ * `eth_call`). Reads are dApp-style and need no backend. A custom `fetch` can be
+ * injected (non-browser runtimes / tests).
+ */
+declare class EvmRpcProvider implements ChainProvider {
+    private readonly rpcUrl;
+    private readonly fetchImpl;
+    constructor(rpcUrl: string, fetchImpl?: typeof fetch);
+    getNativeBalance(address: string): Promise<bigint>;
+    getTokenBalance(token: string, owner: string): Promise<bigint>;
+    getTokenDecimals(token: string): Promise<number>;
+    private call;
+    private toBigInt;
+}
+
+/** Render a base-unit integer as a decimal string (e.g. `formatUnits(1500000n, 6)` → `"1.5"`). No float. */
+declare function formatUnits(raw: bigint, decimals: number): string;
+
+/**
+ * Device-party MPC contract.
+ *
+ * Waaskey wallets are 2-of-3: the user's **device** holds one key share and runs
+ * its half of the cggmp24 ceremony locally (in WASM), talking to the Waaskey
+ * `signer` (the server party) over the relay. The private key never exists whole
+ * anywhere. This is the device side of that ceremony.
+ *
+ * The wire shapes mirror the waas-core `client-wasm` exports (`keygen` / `sign`),
+ * which mirror the server `party-runner`. The backend tells the SDK the per-party
+ * routing (relay url, session id, indices, roles) in the create-wallet response.
+ */
+/** Curves the device party can run a ceremony on. */
+type MpcCurve = 'secp256k1';
+/** Relay routing + party identity shared by keygen and sign. */
+interface CeremonyParams {
+    curve: MpcCurve;
+    /** Relay websocket URL both parties connect to. */
+    relayUrl: string;
+    /** Ceremony id shared by all parties; derives the execution ids. */
+    sessionId: string;
+    /** This party's relay routing id. Defaults to `"device"`. */
+    role?: string;
+    /** The peer (server) party's relay routing id. Defaults to `"server"`. */
+    peerRole?: string;
+    /** This party's keygen index. */
+    partyIndex: number;
+    /** The peer (server) party's keygen index. */
+    peerPartyIndex: number;
+    /**
+     * Short-lived relay token (JWT) the device presents to the relay to join this session as
+     * `role`. Returned by the backend on the ceremony / sign-session response; present only when
+     * relay authentication is enabled. Absent ⇒ the relay accepts an unauthenticated join.
+     */
+    relayToken?: string;
+}
+/** Parameters for the device half of a keygen ceremony. */
+interface DeviceKeygenParams extends CeremonyParams {
+    /** Total parties `n`. */
+    parties: number;
+    /** Signing threshold `t` (`2 <= t <= n`). */
+    threshold: number;
+    /**
+     * Pre-generated Paillier safe-primes (JSON) for this device, produced ahead of time off the
+     * hot path (see {@link MpcCore.pregeneratePrimes} / `PrimePool`). When omitted the core
+     * generates them inline — correct, but slow in single-threaded browser WASM. The primes are
+     * this device's private aux material and are NEVER sent to the server.
+     */
+    pregeneratedPrimes?: string;
+}
+/** Result of the device half of keygen — the device's share never leaves the device. */
+interface DeviceKeygenResult {
+    /** The device's KeyShare (JSON). Seal + store on the device; never send to the server. */
+    keyShare: string;
+    /** The ceremony's aux info (JSON). */
+    auxInfo: string;
+    /** The wallet's shared public key (hex), derived from the share — safe to publish. */
+    sharedPublicKey: string;
+}
+/** Parameters for the device half of a sign ceremony. */
+interface DeviceSignParams extends CeremonyParams {
+    /**
+     * The device's KeyShare as its JSON **string** — the bare crypto material from a prior keygen
+     * ({@link DeviceKeygenResult.keyShare}), NOT the on-device storage blob. It rides the sign wire as
+     * a parsed JSON OBJECT (the wasm deserializes it with `serde_json::from_value::<KeyShare>`).
+     */
+    share: string;
+    /** Keygen indices signing together (any `t` of `n`). */
+    participants: number[];
+    /** This party's 0-based position within `participants`. */
+    signerPosition: number;
+    /** 32-byte hex digest to sign (`0x` prefix optional). */
+    digest: string;
+}
+/** Result of the device half of sign. */
+interface DeviceSignResult {
+    /** The cggmp24 signature (JSON). */
+    signature: string;
+}
+/**
+ * Parameters for the device's reshare **assemble** stage ({@link MpcCore.runReshareAssemble}).
+ * A structural mirror of the backend `DeviceReshareMaterial` plus the wallet's curve — pure
+ * and local, so no relay routing is needed. The fields are opaque JSON produced by the backend
+ * reshare; the device only routes them into the core.
+ */
+interface DeviceReshareAssembleParams {
+    curve: MpcCurve;
+    /** This device's 0-based slot within {@link newPreimages}. */
+    newPosition: number;
+    /** New share preimages `I'` (32-byte big-endian hex scalars), new-holder order. */
+    newPreimages: string[];
+    /** The new signing threshold `t'`. */
+    newThreshold: number;
+    /** The unchanged wallet public info (`WalletPublicInfo` JSON, opaque). */
+    wallet: unknown;
+    /** One Feldman-commitments object per dealer (the broadcast set), opaque JSON. */
+    commitments: unknown[];
+    /** This device's private sub-share from each dealer, one per dealer, opaque JSON. */
+    subShares: unknown[];
+}
+/**
+ * Result of the device reshare **assemble** — the bare NEW-epoch core. It cannot sign yet
+ * (aux material is generated in {@link MpcCore.runCompleteReshare}), and it is secret: seal it,
+ * never log it.
+ */
+interface DeviceReshareAssembleResult {
+    /** The device's NEW-epoch bare core (`IncompleteKeyShare` JSON). Secret. */
+    core: string;
+    /** The assembled shared public key (hex) — must equal the wallet's (unchanged across a reshare). */
+    sharedPublicKey: string;
+}
+/**
+ * Parameters for the device's **complete-reshare** stage ({@link MpcCore.runCompleteReshare}) —
+ * the interactive aux-info ceremony over the NEW committee that turns the bare core into a
+ * signable share. Relay routing mirrors keygen/sign ({@link CeremonyParams}); the backend uses
+ * `<sessionId>/reshare-aux` (kind `reshare-aux`) and drives the server + recovery parties.
+ */
+interface DeviceCompleteReshareParams extends CeremonyParams {
+    /** The device's bare NEW-epoch core (JSON) from {@link MpcCore.runReshareAssemble}. */
+    core: string;
+    /** Total parties `n'` in the NEW committee. */
+    parties: number;
+    /**
+     * This device's OWN pre-generated Paillier safe-primes (JSON) for the aux ceremony, off the hot
+     * path (see {@link MpcCore.pregeneratePrimes} / `PrimePool`). When omitted the core generates
+     * them inline. The primes are the device's private material and are NEVER server-provided — a
+     * server-supplied prime pool would collapse the threshold to custodial.
+     */
+    pregeneratedPrimes?: string;
+}
+/** Result of the device **complete-reshare** — the COMPLETE, signable share. Seal it, never log it. */
+interface DeviceCompleteReshareResult {
+    /** The device's complete KeyShare (JSON). Seal + store on the device; never send to the server. */
+    keyShare: string;
+    /** The wallet's shared public key (hex), preserved across the reshare — verify it is unchanged. */
+    sharedPublicKey: string;
+}
+/** Relay connection info shared by an n-party (member-bound) keygen/sign ceremony (#349). */
+interface MemberCeremonyParams {
+    curve: MpcCurve;
+    /** Relay websocket URL every party connects to. */
+    relayUrl: string;
+    /** Ceremony id shared by every party; derives the execution ids. */
+    sessionId: string;
+    /**
+     * Short-lived relay token (JWT) this party presents to join the session as its own role in
+     * {@link MemberKeygenParams.roles} / {@link MemberSignParams.roles}. Present only when relay
+     * authentication is enabled. Absent ⇒ the relay accepts an unauthenticated join.
+     */
+    relayToken?: string;
+}
+/** Parameters for this party's half of an n-party keygen ceremony (member-bound wallets, #349). */
+interface MemberKeygenParams extends MemberCeremonyParams {
+    /** Every party's relay role, in protocol index order — the FULL n-party roster (`roles[i]` is party `i`'s role). */
+    roles: string[];
+    /** This party's own 0-based index into {@link roles} (its keygen index). */
+    partyIndex: number;
+    /** Signing threshold `t` (`2 <= t <= roles.length`). */
+    threshold: number;
+    /**
+     * Pre-generated Paillier safe-primes (JSON) for this party, produced ahead of time off the hot
+     * path (see {@link MpcCore.pregeneratePrimes}). When omitted the core generates them inline.
+     */
+    pregeneratedPrimes?: string;
+}
+/** Parameters for this party's half of an n-party sign ceremony (member-bound wallets, #349). */
+interface MemberSignParams extends MemberCeremonyParams {
+    /** The FIXED t-of-n quorum's relay roles, in signing order (this ceremony's `PartyRouting`). */
+    roles: string[];
+    /**
+     * This party's KeyShare as its JSON **string** — the bare crypto material from a prior
+     * {@link MpcCore.runMemberKeygen} ({@link DeviceKeygenResult.keyShare}), NOT the on-device storage
+     * blob. It rides the sign wire as a parsed JSON OBJECT (`serde_json::from_value::<KeyShare>`).
+     */
+    share: string;
+    /** Keygen indices of the parties signing together, parallel to {@link roles}. */
+    participants: number[];
+    /** This party's 0-based position within {@link roles} / {@link participants}. */
+    signerPosition: number;
+    /** 32-byte hex digest to sign (`0x` prefix optional). */
+    digest: string;
+}
+/** Relay connection info shared by an ed25519 (FROST) keygen/sign ceremony (#110). */
+interface EddsaCeremonyParams {
+    /** Relay websocket URL every party connects to. */
+    relayUrl: string;
+    /** Ceremony id shared by every party; derives the FROST execution ids. */
+    sessionId: string;
+    /**
+     * Short-lived relay token (JWT) this party presents to join the session as its own role in
+     * {@link roles}. Present only when relay authentication is enabled; absent ⇒ unauthenticated join.
+     */
+    relayToken?: string;
+    /**
+     * Every party's relay role, in protocol-index order (`roles[i]` is party `i`'s role) — for keygen
+     * the FULL n-party roster; for sign the FIXED t-of-n quorum in {@link EddsaSignParams.participants}
+     * order. MUST match the platform/party-runner order (role ↔ FROST identifier).
+     */
+    roles: string[];
+    /** This party's own 0-based index into {@link roles} (its slot in the ceremony). */
+    partyIndex: number;
+}
+/** Parameters for this device's half of an ed25519 (FROST) DKG keygen ceremony (#110). */
+interface EddsaKeygenParams extends EddsaCeremonyParams {
+    /** Signing threshold `t` (`2 <= t <= roles.length`, validated by the FROST DKG). */
+    threshold: number;
+    /**
+     * The FROST DKG round-2 encryption roster (#114): one X25519 encryption PUBLIC key (32-byte hex) per
+     * party, in `roles`/protocol-index order (`encPubkeys[i]` ↔ FROST identifier `i + 1`). Every party
+     * seals its round-2 packages to these keys so no secret share crosses the relay in the clear — the
+     * device needs the whole ordered roster (chiefly the server's key). Maps to the wasm `enc_pubkeys`.
+     */
+    encPubkeys: string[];
+    /**
+     * This device's OWN X25519 encryption SECRET key (32-byte hex) — opens the round-2 packages sealed to
+     * it (the counterpart of this device's entry in {@link encPubkeys}). SECRET: never logged, never sent
+     * to the server. Maps to the wasm `enc_secret`.
+     */
+    encSecret: string;
+}
+/**
+ * Result of the device half of an ed25519 keygen — the device's FROST share. The `keyPackage` is
+ * **secret** (the device's signing share): seal + store it, never send it to the server. The
+ * `publicKeyPackage` is the wallet's group verifying key package (safe to publish). Both are opaque
+ * FROST JSON objects (the exact shapes `signEddsa` feeds back), not the cggmp24 KeyShare blob.
+ */
+interface EddsaKeygenResult {
+    /** The device's FROST `key_package` (JSON object). Secret — seal + store on the device. */
+    keyPackage: unknown;
+    /** The wallet's shared `public_key_package` (JSON object). Group key — safe to publish. */
+    publicKeyPackage: unknown;
+}
+/** Parameters for this device's half of an ed25519 (FROST) two-round sign ceremony (#110). */
+interface EddsaSignParams extends EddsaCeremonyParams {
+    /** This device's FROST `key_package` — the secret share from {@link EddsaKeygenResult.keyPackage}, as a JSON object (or its JSON string). */
+    keyPackage: unknown;
+    /** The wallet's shared `public_key_package` from {@link EddsaKeygenResult.publicKeyPackage}, as a JSON object (or its JSON string). */
+    publicKeyPackage: unknown;
+    /** The 1-based FROST identifiers of the signing quorum, parallel to {@link EddsaCeremonyParams.roles}. */
+    participants: number[];
+    /** Hex-encoded raw message bytes to sign (`0x` prefix optional) — the chain adapter's serialized tx message. */
+    message: string;
+}
+/** Result of the device half of an ed25519 sign — the RFC 8032 signature. */
+interface EddsaSignResult {
+    /** The 64-byte ed25519 signature, hex. */
+    signature: string;
+}
+/**
+ * The device-party crypto core. Implemented by {@link WasmMpcCore} (web) and, in
+ * future, a native core on mobile — the SDK depends on this port, not the engine.
+ */
+interface MpcCore {
+    runKeygen(params: DeviceKeygenParams): Promise<DeviceKeygenResult>;
+    runSign(params: DeviceSignParams): Promise<DeviceSignResult>;
+    /**
+     * Pre-generate this device's Paillier safe-primes for `curve`, off the keygen hot path
+     * (e.g. in a Web Worker during onboarding/idle). Returns opaque serialized primes (JSON) to
+     * cache and later pass as {@link DeviceKeygenParams.pregeneratedPrimes}. Optional: a native
+     * mobile core generates primes fast inline and need not implement it.
+     */
+    pregeneratePrimes?(curve: MpcCurve): Promise<string>;
+    /**
+     * Assemble this device's NEW-epoch bare core from a device-retaining reshare's material (#318).
+     * Pure and local — no relay. Optional: only a core built with the reshare capability implements
+     * it (the web wasm needs a `--features reshare` build).
+     */
+    runReshareAssemble?(params: DeviceReshareAssembleParams): Promise<DeviceReshareAssembleResult>;
+    /**
+     * Complete a reshared bare core into a signable share by running the aux-info ceremony over the
+     * NEW committee (#318 / #95). Relay-driven, mirroring keygen's aux phase. Optional: only a core
+     * built with the reshare capability implements it (the web wasm needs a `--features reshare` build).
+     */
+    runCompleteReshare?(params: DeviceCompleteReshareParams): Promise<DeviceCompleteReshareResult>;
+    /**
+     * Run this party's half of an n-party (member-bound wallet) keygen ceremony (#349) — every
+     * member device + the platform join the SAME relay session, addressed by the full
+     * {@link MemberKeygenParams.roles} roster rather than a single peer. Optional: only a core built
+     * with n-party (member-ceremony) support implements it.
+     */
+    runMemberKeygen?(params: MemberKeygenParams): Promise<DeviceKeygenResult>;
+    /**
+     * Run this party's half of an n-party (member-bound wallet) sign ceremony (#349) over the FIXED
+     * t-of-n quorum in {@link MemberSignParams.roles}. Optional: only a core built with n-party
+     * (member-ceremony) support implements it.
+     */
+    runMemberSign?(params: MemberSignParams): Promise<DeviceSignResult>;
+    /**
+     * Run this device's half of an ed25519 (FROST) DKG keygen ceremony (#110) — the device holds one
+     * FROST share in a real 2-of-3 wallet, co-generating the group key with the server (+ recovery)
+     * parties on the same relay session. Optional: only a core with the ed25519 (FROST) exports
+     * (`keygenEddsa`) implements it.
+     */
+    runEddsaKeygen?(params: EddsaKeygenParams): Promise<EddsaKeygenResult>;
+    /**
+     * Run this device's half of an ed25519 (FROST) two-round sign ceremony (#110) over the fixed
+     * quorum in {@link EddsaSignParams.roles} — co-signing the raw message with the server party.
+     * Optional: only a core with the ed25519 (FROST) exports (`signEddsa`) implements it.
+     */
+    runEddsaSign?(params: EddsaSignParams): Promise<EddsaSignResult>;
+}
+
+/** The subset of the client-wasm module the SDK drives. Each export takes one JSON string. */
+interface ClientWasmModule {
+    /** Device half of keygen; resolves with `{ aux_info_json, keyshare_json, shared_public_key_json }`. */
+    keygen(paramsJson: string): Promise<unknown>;
+    /** Device half of sign; resolves with `{ signature_json }`. */
+    sign(paramsJson: string): Promise<unknown>;
+    /** Pre-generate Paillier safe-primes off the hot path; resolves with `{ primes_json }`. Optional. */
+    pregeneratePrimes?(paramsJson: string): Promise<unknown>;
+    /**
+     * Device reshare **assemble** — compute the NEW-epoch bare core locally; returns
+     * `{ core_json, shared_public_key_json }`. Present only in a `--features reshare` wasm build.
+     * Synchronous in the core (no relay); the SDK awaits it uniformly.
+     */
+    reshareAssemble?(paramsJson: string): unknown | Promise<unknown>;
+    /**
+     * Device **complete-reshare** — run the aux ceremony over the new committee and return the
+     * signable share as `{ keyshare_json, shared_public_key_json }`. Present only in a
+     * `--features reshare` wasm build.
+     */
+    completeReshare?(paramsJson: string): Promise<unknown>;
+    /**
+     * This party's half of an n-party (member-bound wallet) keygen ceremony (#349); resolves with
+     * `{ aux_info_json, keyshare_json, shared_public_key_json }`. Present only in a client-wasm
+     * build with n-party (member-ceremony) support.
+     */
+    keygenMember?(paramsJson: string): Promise<unknown>;
+    /**
+     * This party's half of an n-party (member-bound wallet) sign ceremony over a fixed t-of-n
+     * quorum (#349); resolves with `{ signature_json }`. Present only in a client-wasm build with
+     * n-party (member-ceremony) support.
+     */
+    signMember?(paramsJson: string): Promise<unknown>;
+    /**
+     * This device's half of an ed25519 (FROST) DKG keygen ceremony (#110); resolves with
+     * `{ key_package, public_key_package }` (JSON objects). Present only in a client-wasm build with
+     * the ed25519 (FROST) exports.
+     */
+    keygenEddsa?(paramsJson: string): Promise<unknown>;
+    /**
+     * This device's half of an ed25519 (FROST) two-round sign ceremony (#110); resolves with
+     * `{ signature }` (64-byte hex). Present only in a client-wasm build with the ed25519 (FROST) exports.
+     */
+    signEddsa?(paramsJson: string): Promise<unknown>;
+}
+/** Lazily loads + initializes the client-wasm module (e.g. dynamic `import()` of the wasm-pack pkg). */
+type ClientWasmLoader = () => Promise<ClientWasmModule>;
+/**
+ * {@link MpcCore} backed by the waas-core `client-wasm` module (`keygen` / `sign`).
+ *
+ * The wasm engine is injected via a loader so the SDK stays runtime-agnostic and
+ * the core is unit-testable without a real ceremony. The device key share returned
+ * by keygen must be sealed and stored on the device — it is never sent to the server.
+ */
+declare class WasmMpcCore implements MpcCore {
+    private readonly load;
+    private modulePromise?;
+    constructor(load: ClientWasmLoader);
+    private init;
+    runKeygen(params: DeviceKeygenParams): Promise<DeviceKeygenResult>;
+    runSign(params: DeviceSignParams): Promise<DeviceSignResult>;
+    pregeneratePrimes(curve: MpcCurve): Promise<string>;
+    runReshareAssemble(params: DeviceReshareAssembleParams): Promise<DeviceReshareAssembleResult>;
+    runCompleteReshare(params: DeviceCompleteReshareParams): Promise<DeviceCompleteReshareResult>;
+    runMemberKeygen(params: MemberKeygenParams): Promise<DeviceKeygenResult>;
+    runMemberSign(params: MemberSignParams): Promise<DeviceSignResult>;
+    runEddsaKeygen(params: EddsaKeygenParams): Promise<EddsaKeygenResult>;
+    runEddsaSign(params: EddsaSignParams): Promise<EddsaSignResult>;
+    /** Build the snake_case params JSON the wasm exports expect from the common routing + extras. */
+    private encode;
+    /**
+     * Build the snake_case params JSON for an n-party (member-bound, #349) member ceremony — the
+     * roster-based routing shape (`roles` + `party_index`), not the 2-party `role`/`peer_role` shape
+     * {@link encode} builds. The `roles` roster and `party_index` are passed through in `extra` by
+     * the caller and land on the wire under those exact keys — what `keygenMember` / `signMember`
+     * deserialize.
+     */
+    private encodeMember;
+    /**
+     * Build the snake_case params JSON for an ed25519 (FROST, #110) ceremony — the roster-based routing
+     * shape (`roles` + `party_index`) the `keygenEddsa` / `signEddsa` exports deserialize. Unlike
+     * {@link encodeMember} there is NO `curve` (ed25519-only) and no Paillier primes; the caller passes
+     * the ceremony-specific extras (keygen: `threshold`; sign: the FROST packages + participants + message).
+     */
+    private encodeEddsa;
+}
+
+/**
+ * The **exact** `@waaskey/client-wasm` version this SDK build is pinned to (issue #40).
+ *
+ * Pin an exact version — never a floating `^`/`~` range — so a compromised or
+ * dependency-confused higher release can't be silently pulled in. Keep this in
+ * lockstep with the `@waaskey/client-wasm` entry in `package.json` and with
+ * {@link CLIENT_WASM_SHA384}.
+ *
+ * **`0.2.0` adds the ed25519 (FROST) exports** (`keygenEddsa` / `signEddsa`, waas-core #110) the SDK's
+ * ed25519 wallet path drives. It is **published on npm** (`client-wasm-v0.2.0`) and pinned as the SDK's
+ * exact, optional peer dependency in `package.json` — so an app that installs `@waaskey/client-wasm`
+ * alongside the SDK runs the real ed25519 create/send path end to end.
+ */
+declare const CLIENT_WASM_VERSION = "0.2.0";
+/**
+ * Verify the integrity of raw wasm bytes against an expected **SHA-384** hash, in
+ * Subresource-Integrity (`sha384-<base64>`) form (issue #40).
+ *
+ * The wasm MPC core handles the plaintext device share, so it must be
+ * cryptographically verified **before** `WebAssembly.compile` / `instantiate` — a
+ * registry compromise or malicious re-host otherwise silently exfiltrates share-1.
+ * Throws (fails closed) on any mismatch.
+ */
+declare function verifyWasmIntegrity(bytes: BufferSource, expectedSha384: string): Promise<void>;
+/** Options for {@link createVerifiedClientWasmLoader}. */
+interface VerifiedWasmLoaderOptions {
+    /**
+     * URL (or path the runtime's `fetch` accepts) of the `@waaskey/client-wasm` `.wasm`
+     * binary — vendored/self-hosted so its bytes can be fetched and hashed before use.
+     */
+    wasmUrl: string | URL;
+    /** Expected SHA-384 of the wasm binary, SRI form (`sha384-<base64>`). Pin per {@link CLIENT_WASM_VERSION}. */
+    expectedSha384: string;
+    /** Custom fetch (non-browser runtimes / tests). Defaults to global `fetch`. */
+    fetch?: typeof fetch;
+}
+/**
+ * Build an integrity-checked {@link ClientWasmLoader} (issue #40): it fetches the
+ * pinned `.wasm` bytes, verifies their SHA-384 against `expectedSha384`, and only
+ * **then** compiles + initializes the module — so a tampered binary is rejected
+ * before any wasm code runs.
+ *
+ * Requires a non-auto-initializing (wasm-pack `--target web`) `@waaskey/client-wasm`
+ * build, so the verified bytes drive initialization:
+ *
+ * ```ts
+ * const mpc = new WasmMpcCore(
+ *   createVerifiedClientWasmLoader({ wasmUrl: '/waaskey_client_wasm_bg.wasm', expectedSha384: CLIENT_WASM_SHA384 }),
+ * );
+ * ```
+ */
+declare function createVerifiedClientWasmLoader(options: VerifiedWasmLoaderOptions): ClientWasmLoader;
+/**
+ * Convenience loader for the Waaskey client-wasm engine — dynamically imports `@waaskey/client-wasm`
+ * (the wasm-pack/bundler build, auto-initialized on import) and returns it as a {@link ClientWasmModule}:
+ *
+ * ```ts
+ * import { Waaskey, WasmMpcCore, loadClientWasm } from '@waaskey/sdk';
+ * const waaskey = new Waaskey({ apiKey, mpc: new WasmMpcCore(loadClientWasm), shareStore });
+ * ```
+ *
+ * ⚠️ **No integrity verification (issue #40).** A bundler-target build instantiates the wasm on
+ * import, so its bytes cannot be checked first. For production — where a registry compromise or
+ * dependency-confusion attack on `@waaskey/client-wasm` could exfiltrate the plaintext device share
+ * — use {@link createVerifiedClientWasmLoader} with a vendored `.wasm` and the pinned SHA-384 instead.
+ *
+ * `@waaskey/client-wasm` is an OPTIONAL peer dependency pinned to {@link CLIENT_WASM_VERSION}: install
+ * it alongside the SDK in apps that create wallets. The indirect import specifier keeps it out of
+ * static module resolution — so a missing install fails here with an actionable message, not at build.
+ */
+declare const loadClientWasm: ClientWasmLoader;
+
+/**
+ * Client-side pool of pre-generated Paillier safe-primes (#2).
+ *
+ * Safe-prime generation is the slow part of a device keygen — minutes in single-threaded
+ * browser WASM. Primes don't depend on the key, so we generate them **ahead of the hot path**
+ * (a Web Worker during onboarding/idle) and cache a small pool; at keygen time we hand one over
+ * instantly. The primes are this device's PRIVATE aux material — they are cached locally and
+ * NEVER sent to the server (serving them from the API would let the server recover the device's
+ * share). Use an encrypted store in production.
+ */
+/** Where the pool persists cached primes. Swap in an encrypted IndexedDB store for production. */
+interface PrimePoolStore {
+    /** Remove and return one cached prime for `curve`, or undefined if the pool is empty. */
+    take(curve: MpcCurve): Promise<string | undefined>;
+    /** Add a generated prime to the pool. */
+    add(curve: MpcCurve, primes: string): Promise<void>;
+    /** Current number of cached primes for `curve`. */
+    size(curve: MpcCurve): Promise<number>;
+}
+/** Default in-memory store (lost on reload). Production should persist to an encrypted store. */
+declare class MemoryPrimeStore implements PrimePoolStore {
+    private readonly pools;
+    take(curve: MpcCurve): Promise<string | undefined>;
+    add(curve: MpcCurve, primes: string): Promise<void>;
+    size(curve: MpcCurve): Promise<number>;
+}
+/** The minimal core capability the pool needs — just prime generation. */
+interface PrimeGenerator {
+    pregeneratePrimes(curve: MpcCurve): Promise<string>;
+}
+interface PrimePoolOptions {
+    /** How many spare primes to keep cached per curve. Default 2. */
+    targetSize?: number;
+    /** Persistence for the pool. Defaults to an in-memory store. */
+    store?: PrimePoolStore;
+}
+declare class PrimePool {
+    private readonly core;
+    private readonly store;
+    private readonly targetSize;
+    /** Per-curve in-flight refill, so concurrent calls don't over-generate. */
+    private readonly refilling;
+    constructor(core: PrimeGenerator, options?: PrimePoolOptions);
+    /**
+     * Top up the pool to the target size — call this OFF the hot path (onboarding/idle, ideally a
+     * Web Worker). Deduped per curve, so calling it repeatedly is safe and cheap.
+     */
+    ensure(curve: MpcCurve): Promise<void>;
+    private refill;
+    /**
+     * Claim a prime for a keygen. Returns a cached one instantly when the pool is warm; otherwise
+     * generates one inline (the slow fallback) so keygen never fails on an empty pool. Either way it
+     * kicks off a background refill so the next wallet is instant.
+     */
+    take(curve: MpcCurve): Promise<string>;
+}
+
+/**
+ * Device key-share storage contract.
+ *
+ * In a Waaskey 2-of-3 wallet the user's **device** holds one key share (produced by
+ * the device-party keygen — see {@link MpcCore}). That share is the user's half of
+ * the key and must (a) never be persisted in plaintext, (b) survive a page reload,
+ * and (c) be wiped on explicit logout. The SDK depends on the {@link ShareStore}
+ * port; the web implementation seals shares with WebCrypto and persists the
+ * ciphertext in IndexedDB, and a native Keychain/Keystore core can implement the
+ * same port on mobile.
+ */
+/** Stores the device's (already-serialized) key share per wallet, encrypted at rest. */
+interface ShareStore {
+    /** Seal and persist the share for `walletId` (overwrites any existing one). */
+    put(walletId: string, share: string): Promise<void>;
+    /** Load and decrypt the share for `walletId`, or `null` if none is stored. */
+    get(walletId: string): Promise<string | null>;
+    /** Whether a share is stored for `walletId` (does not decrypt it). */
+    has(walletId: string): Promise<boolean>;
+    /** Remove the stored share for `walletId` (no-op if absent). */
+    remove(walletId: string): Promise<void>;
+    /** Wipe every stored share — call on explicit logout. */
+    clear(): Promise<void>;
+}
+/**
+ * Low-level opaque string key/value persistence backing an encrypting
+ * {@link ShareStore}. The web adapter is IndexedDB-backed; an in-memory adapter is
+ * used for tests / non-persistent (SSR) contexts. It only ever sees ciphertext.
+ */
+interface KeyValueStore {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    /** All stored keys (used to enumerate stored shares). */
+    keys(): Promise<string[]>;
+    /** Remove every entry. */
+    clear(): Promise<void>;
+}
+
+/** Options for the {@link EncryptedShareStore} constructor / {@link EncryptedShareStore.browser}. */
+interface EncryptedShareStoreOptions {
+    dbName?: string;
+    storeName?: string;
+    /** Bypass the {@link MIN_SECRET_LENGTH} entropy floor — only when the secret's entropy is guaranteed elsewhere. */
+    allowWeakSecret?: boolean;
+}
+/**
+ * {@link ShareStore} that seals every share with AES-256-GCM before handing it to a
+ * {@link KeyValueStore}, so the backing storage only ever holds ciphertext.
+ *
+ * The AES key is derived (PBKDF2) from a **secret the app supplies** — from the
+ * user's authenticated session, a passkey/PRF, or a device secret — never embedded
+ * in the bundle. A random salt is generated once and persisted alongside the data;
+ * `clear()` wipes both, so a subsequent login derives a fresh key.
+ *
+ * @example
+ * ```ts
+ * const store = EncryptedShareStore.browser(sessionSecret);
+ * await store.put(wallet.id, keygen.keyShare); // sealed in IndexedDB
+ * const share = await store.get(wallet.id);    // decrypted, or null
+ * await store.clear();                          // on logout
+ * ```
+ */
+declare class EncryptedShareStore implements ShareStore {
+    private readonly kv;
+    private readonly secret;
+    private keyPromise?;
+    constructor(kv: KeyValueStore, secret: string, options?: {
+        allowWeakSecret?: boolean;
+    });
+    /** Default web store: AES-GCM sealing over IndexedDB. */
+    static browser(secret: string, options?: EncryptedShareStoreOptions): EncryptedShareStore;
+    put(walletId: string, share: string): Promise<void>;
+    get(walletId: string): Promise<string | null>;
+    has(walletId: string): Promise<boolean>;
+    remove(walletId: string): Promise<void>;
+    clear(): Promise<void>;
+    /** Lazily load (or create) the persisted salt and derive the AES key once. */
+    private key;
+    private loadKey;
+}
+
+/**
+ * In-memory {@link KeyValueStore} — non-persistent. Used in tests and as a fallback
+ * where IndexedDB is unavailable (e.g. SSR). Shares stored here do NOT survive a
+ * reload; for persistent device storage use {@link IndexedDbKeyValueStore}.
+ */
+declare class MemoryKeyValueStore implements KeyValueStore {
+    private readonly map;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    keys(): Promise<string[]>;
+    clear(): Promise<void>;
+}
+
+/**
+ * IndexedDB-backed {@link KeyValueStore} — the default persistent backend on web.
+ * A single object store holds opaque ciphertext records keyed by string, so device
+ * shares survive a reload. Stores only sealed data (see EncryptedShareStore).
+ */
+declare class IndexedDbKeyValueStore implements KeyValueStore {
+    private readonly dbName;
+    private readonly storeName;
+    private dbPromise?;
+    constructor(dbName?: string, storeName?: string);
+    private db;
+    private run;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    keys(): Promise<string[]>;
+    clear(): Promise<void>;
+}
+
+/**
+ * Structured error model for the SDK.
+ *
+ * Every failure surfaces as a {@link WaaskeyError} carrying a typed {@link WaaskeyErrorCode}
+ * — never a bare string — so callers can branch on `error.code` instead of matching
+ * message text. Transport/HTTP failures map the API's error envelope
+ * (`{ statusCode, message, error }`) to a code; orchestration failures (device keygen,
+ * missing share, cancellation) use the SDK-side codes.
+ */
+type WaaskeyErrorCode = 'unauthorized' | 'forbidden' | 'not_found' | 'validation' | 'conflict' | 'rate_limited' | 'server_error' | 'network' | 'unsupported_chain' | 'provider_error' | 'device_core_required' | 'keygen_failed' | 'sign_failed' | 'reshare_failed' | 'reshare_pubkey_mismatch' | 'share_not_found' | 'recovery_failed' | 'invalid_recovery_code' | 'backup_failed' | 'wallet_activation_timeout' | 'sign_ceremony_timeout' | 'unauthenticated' | 'firebase_not_enabled' | 'mfa_required' | 'no_member' | 'unsupported' | 'aborted' | 'unknown';
+interface WaaskeyErrorOptions {
+    /** HTTP status, when the error originates from an API response. */
+    status?: number;
+    /** Raw error payload from the API (or other context), for debugging. */
+    details?: unknown;
+    /** The underlying error that triggered this one. */
+    cause?: unknown;
+}
+/** The single error type thrown by the SDK. */
+declare class WaaskeyError extends Error {
+    readonly code: WaaskeyErrorCode;
+    readonly status?: number;
+    readonly details?: unknown;
+    constructor(message: string, code: WaaskeyErrorCode, options?: WaaskeyErrorOptions);
+}
+
 /**
  * Public contract for the Waaskey SDK.
  *
- * These types describe the wire shapes the SDK exchanges with the Waaskey API.
- * They will be replaced by types generated from the backend OpenAPI spec once the
- * API contract is stable; until then this file is the single source of truth.
+ * These types mirror the wire shapes the Waaskey API exchanges (the backend
+ * `@waas/types` request/response contracts). They will be replaced by types
+ * generated from the backend OpenAPI spec once it is published; until then this
+ * file is the single source of truth and must track the API exactly — a drift
+ * here is a contract bug.
  */
+
 /** Chains a wallet can be created on. */
 type Chain = 'ethereum' | 'polygon' | 'arbitrum' | 'base' | 'optimism' | 'bitcoin' | 'solana';
+/**
+ * Threshold-signing curve a wallet uses (backend `WalletCurve`). `ed25519` is threshold EdDSA
+ * (FROST, RFC 8032/9591) — the ed25519 chains (Solana, NEAR, Aptos, Sui); the others are cggmp24
+ * ECDSA. An `ed25519` wallet's device share and sign flow are the FROST path, distinct from the
+ * cggmp24 KeyShare blob (see the `mpc` Eddsa* types).
+ */
+type WalletCurve = 'secp256k1' | 'ed25519';
+/**
+ * Lifecycle state of a wallet — tracks keygen progress (backend `WalletStatus`).
+ * `pending_keygen` is a member-bound wallet (#342/#344) whose keygen roster is still open —
+ * waiting for every {@link WalletShareholder} to {@link Wallets.joinCeremony} before the
+ * multi-device keygen ceremony runs. Not fundable (no `publicKey`/`address`) until `active`.
+ */
+type WalletStatus = 'pending' | 'pending_keygen' | 'active' | 'failed';
+/**
+ * Custody role of a single MPC key share, independent of its party-role label
+ * (backend `CustodyKind`, #293). Drives the wallet's custody attestation:
+ * `platform_signer` / `platform_recovery` are shares WaaS itself holds; the other
+ * kinds are shares only the user or a third party holds.
+ */
+type CustodyKind = 'user_device' | 'user_backup' | 'platform_signer' | 'platform_recovery' | 'external_party';
+/**
+ * The custody posture a wallet's topology attests to (backend `CustodyType`, #293),
+ * derived from its {@link CustodyKind} shares vs the threshold `t`:
+ * `embedded` when the platform alone holds `>= t` shares (custodial-capable — the
+ * default 2-of-3), `self_custody` when the platform holds none, `shared` otherwise
+ * (neither party alone meets `t` — a true multi-party quorum).
+ */
+type CustodyType = 'embedded' | 'shared' | 'self_custody';
 /** Options accepted by `new Waaskey(...)`. */
 interface WaaskeyOptions {
     /** Publishable API key issued from the Waaskey dashboard. */
@@ -15,81 +870,1812 @@ interface WaaskeyOptions {
     baseUrl?: string;
     /** Custom fetch implementation (e.g. for non-browser runtimes). Defaults to global `fetch`. */
     fetch?: typeof fetch;
+    /**
+     * Device-party MPC core (e.g. `WasmMpcCore`). Required to create a wallet — the
+     * device runs its half of the keygen ceremony with this.
+     */
+    mpc?: MpcCore;
+    /**
+     * Where the device key share is sealed and persisted (e.g.
+     * `EncryptedShareStore.browser(secret)`). Required to create a wallet.
+     */
+    shareStore?: ShareStore;
+    /**
+     * Per-chain provider config for client-side balance reads (RPC URL or a custom
+     * provider). EVM chains have built-in public-RPC defaults; override them here.
+     */
+    chains?: Partial<Record<Chain, ChainConfig>>;
+    /**
+     * Analytics for the tenant dashboard (wallet created/signed/recovered — no PII or secrets).
+     * Defaults to an HTTP sink to the Waaskey API; pass a custom {@link AnalyticsSink}, or `false`
+     * to opt out entirely.
+     */
+    analytics?: AnalyticsSink | false;
 }
 /** Parameters for creating a wallet. */
 interface CreateWalletParams {
-    /** Your end-user's id in your own system; binds the wallet to that user. */
-    userId?: string;
-    /** Chain the wallet is created on. */
+    /** Chain the wallet is created on (determines the signing curve). */
     chain: Chain;
+    /** Human label for the wallet. Defaults to the chain name. */
+    label?: string;
+    /**
+     * Signing threshold `t` for this wallet's `t`-of-`n` MPC key. Optional — omit the whole
+     * custody policy for the deployment default (embedded 2-of-3). When a topology is supplied
+     * it must satisfy `2 <= threshold <= parties.length` (validated client-side before the request).
+     */
+    threshold?: number;
+    /**
+     * Ordered party roles of the keygen topology, length `n` (e.g. `['device','server','recovery']`).
+     * Optional. When supplied it must be at least 2 distinct, non-empty role strings.
+     */
+    parties?: string[];
+    /**
+     * Per-party custody kind, parallel to {@link parties} (same length, same order) (#293). Optional —
+     * when omitted the backend derives the kind from each party's role name. When supplied it must
+     * have exactly one entry per party.
+     */
+    custodyKinds?: CustodyKind[];
+    /**
+     * Requested custody posture (#293) — the backend enforces it against the resolved
+     * `(threshold, custodyKinds)` and refuses the create (400) when the topology does not attest to it
+     * (e.g. asking for `self_custody` but the shares are platform-heavy enough to be `embedded`).
+     */
+    custodyType?: CustodyType;
+}
+/** Options for `wallets.create(...)`. */
+interface CreateWalletOptions {
+    /** Cancel the create (request + ceremony + activation wait). */
+    signal?: AbortSignal;
+    /** Wait until the wallet is ACTIVE (keygen finished) before resolving. Default `true`. */
+    waitForActive?: boolean;
+    /** Max time to wait for activation, ms. Default 60000. */
+    activationTimeoutMs?: number;
+    /** Poll interval while waiting for activation, ms. Default 1000. */
+    pollIntervalMs?: number;
+    /**
+     * Recovery-backup material for a **non-custodial** `[device, server, user_backup]` create (#351/#78):
+     * REQUIRED when the returned ceremony carries a `user_backup` party ({@link WalletCeremony.additionalParties}).
+     * In that topology the device runs a SECOND client party (`user_backup`) whose share replaces the
+     * platform's recovery share — so it must be sealed with the user's recovery code and registered as an
+     * opaque ciphertext server-side at keygen time (the same mechanism as `recovery.register`), or the
+     * wallet would be unrecoverable on device loss. Absent/ignored for a single-client-party create
+     * (`[device, server]`, custodial `[device, server, recovery]`, ed25519).
+     */
+    backup?: WalletBackupParams;
+}
+/**
+ * Recovery-backup factors sealing + enrolling the client-held `user_backup` share on a non-custodial
+ * create ({@link CreateWalletOptions.backup}, #351/#78) — the `recovery.register` material minus the
+ * `share` (the SDK supplies the freshly-generated user_backup share itself). The `recoveryCode` is
+ * **caller-provided** (unlike `recovery.register`, which may generate one): `create` returns the
+ * {@link Wallet}, so it cannot hand a generated code back — the caller mints one up front (e.g. with
+ * `generateRecoveryCode()`), shows it to the user, and passes it here. It is a client-side sealing
+ * secret and never leaves the device (only its SHA-256 is enrolled), so a lost code is an
+ * unrecoverable backup.
+ */
+interface WalletBackupParams {
+    /** High-entropy recovery code that seals the user_backup share. Show it to the user once — it is the only key to the backup and never leaves the client. */
+    recoveryCode: string;
+    /** Base32 TOTP secret to enrol the authenticator factor. */
+    totpSecret: string;
+    /** Email address to enrol the email-OTP factor. */
+    email: string;
+    /** Extra factor enrolments beyond the standard three. */
+    extraFactors?: FactorEnrollment[];
+}
+/** Options for `wallets.joinCeremony(...)` (#349). */
+interface JoinCeremonyOptions {
+    /** Cancel the join (roster ack + the relay keygen ceremony). */
+    signal?: AbortSignal;
+}
+/** Options for `wallets.joinSignCeremony(...)` (#349). */
+interface JoinSignCeremonyOptions {
+    /** Cancel the join (the approve vote + waiting for the quorum + the relay sign ceremony). */
+    signal?: AbortSignal;
+    /** Max time to wait for the t-of-n quorum to fix and select this member, ms. Default 60000. */
+    readyTimeoutMs?: number;
+    /** Poll interval while waiting for the quorum, ms. Default 1000. */
+    pollIntervalMs?: number;
+}
+/**
+ * A WebAuthn assertion attached for passkey step-up (issue #21/#39) — the structural
+ * shape of `@simplewebauthn/browser`'s `AuthenticationResponseJSON`. Declared here (not
+ * imported) so the field is typed without a hard dependency on the optional passkey peer.
+ */
+interface PasskeyAssertionJSON {
+    id: string;
+    rawId: string;
+    type: string;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle?: string;
+    };
+    authenticatorAttachment?: unknown;
+    clientExtensionResults?: unknown;
 }
-/** A wallet as returned by the API. */
+/** Options for signing. */
+interface SignOptions {
+    /** Cancel the signing request. */
+    signal?: AbortSignal;
+    /**
+     * When `true`, run a WebAuthn assertion before submitting (passkey step-up,
+     * Pattern B / issue #21/#39). The SDK fetches a server-issued one-time challenge,
+     * prompts the user's authenticator over it, and attaches the resulting
+     * `passkeyAssertion` (+ its `passkeyChallengeId`) to the POST body.
+     *
+     * Requires WebAuthn / `@simplewebauthn/browser` to be available.  Throws
+     * `WaaskeyError('unsupported')` when passkeys are unavailable, and
+     * `WaaskeyError('aborted')` when the user cancels the prompt.
+     *
+     * Alternatively pass a pre-built assertion directly via `passkeyAssertion`.
+     */
+    requirePasskey?: boolean;
+    /**
+     * A pre-built WebAuthn `AuthenticationResponseJSON` to attach as
+     * `passkeyAssertion` on the sign request.  Takes precedence over
+     * `requirePasskey` when supplied.
+     */
+    passkeyAssertion?: PasskeyAssertionJSON;
+    /**
+     * Id of the server-issued step-up challenge the pre-built `passkeyAssertion` was
+     * produced against (from {@link StepUpChallengeResponse}). The server verifies the
+     * assertion against this one-time challenge and burns it. Required only when you
+     * supply `passkeyAssertion` yourself; with `requirePasskey` the SDK fetches and
+     * echoes it for you.
+     */
+    passkeyChallengeId?: string;
+    /**
+     * Credential id to restrict the passkey assertion to (used with `requirePasskey`).
+     * When omitted the browser presents all resident credentials for the RP.
+     */
+    passkeyCredentialId?: string;
+}
+/** Options for sending a transaction. */
+interface SendOptions {
+    /** Cancel the send request. */
+    signal?: AbortSignal;
+    /**
+     * When `true`, run a WebAuthn assertion before submitting (passkey step-up,
+     * Pattern B / issue #21/#39), over a server-issued one-time challenge.
+     */
+    requirePasskey?: boolean;
+    /**
+     * A pre-built WebAuthn `AuthenticationResponseJSON` to attach as
+     * `passkeyAssertion` on the send request.  Takes precedence over
+     * `requirePasskey` when supplied.
+     */
+    passkeyAssertion?: PasskeyAssertionJSON;
+    /**
+     * Id of the server-issued step-up challenge the pre-built `passkeyAssertion` was
+     * produced against (from {@link StepUpChallengeResponse}). Required only when you
+     * supply `passkeyAssertion` yourself; with `requirePasskey` the SDK handles it.
+     */
+    passkeyChallengeId?: string;
+    /** Credential id to restrict the passkey assertion to (used with `requirePasskey`). */
+    passkeyCredentialId?: string;
+}
+/** The step-up operation a passkey challenge is minted for (issue #39). */
+type StepUpOperation = 'sign' | 'send';
+/**
+ * A server-issued **one-time** WebAuthn step-up challenge (issue #39). The SDK
+ * fetches this before running a passkey assertion so the challenge is a fresh
+ * server nonce — not derived from the request payload — which the server verifies
+ * and **burns** on use, making a captured assertion non-replayable.
+ */
+interface StepUpChallengeResponse {
+    /** Opaque id the client echoes back (`passkeyChallengeId`) so the server can verify + burn the challenge. */
+    challengeId: string;
+    /** base64url one-time challenge nonce the authenticator signs over. */
+    challenge: string;
+}
+/** Per-party relay coordination returned on create so the device can join the keygen ceremony (backend `IWalletCeremony`). */
+interface WalletCeremony {
+    relayUrl: string;
+    sessionId: string;
+    curve: WalletCurve;
+    role: string;
+    peerRole: string;
+    partyIndex: number;
+    peerPartyIndex: number;
+    parties: number;
+    threshold: number;
+    /** Short-lived relay token (JWT) the device presents to join this keygen session; present only when relay auth is enabled. */
+    relayToken?: string;
+    /**
+     * The FROST DKG round-2 encryption roster — **ed25519 keygen only** (#114, backend `IWalletCeremony`).
+     * One X25519 encryption PUBLIC key (32-byte hex) per party, in `parties`/protocol-index order, so
+     * `encPubkeys[i]` is the key of FROST participant `i + 1` (e.g. `[deviceEncPubkey, serverEncPubkey]`
+     * for `[device, server]`). The device seals its round-2 packages to these keys (chiefly the server's).
+     * The device's own entry is the `deviceEncPubkey` it supplied on create, echoed back so it builds the
+     * exact same ordered roster the signer uses. Absent for secp keygen and on a refresh fetch.
+     */
+    encPubkeys?: string[];
+    /**
+     * Additional CLIENT-run party descriptors the SAME caller must ALSO drive for this keygen ceremony,
+     * beyond the primary `device` party this object describes (backend `IWalletCeremony`, #396/#351/#78).
+     * Present for the non-custodial default `[device, server, user_backup]` (secp256k1): ONE entry — the
+     * client-held `user_backup` party (`role: 'user_backup'`, its own `partyIndex`, `peerRole: 'server'`,
+     * and its OWN role-scoped {@link relayToken}) — because the platform signer drives ONLY the `server`
+     * share, so the one device must run BOTH its `device` party (this object) AND the `user_backup` party.
+     * Each entry is a full, self-contained {@link WalletCeremony} joining the SAME relay `sessionId`.
+     *
+     * ADDITIVE: absent for single-client-party rosters (`[device, server]`, custodial
+     * `[device, server, recovery]`) and for ed25519 — a client that reads only `ceremony` and ignores
+     * this field keeps running exactly one party. Each entry's own `additionalParties` is always absent
+     * (the list is flat, never recursive).
+     */
+    additionalParties?: WalletCeremony[];
+}
+/** A wallet as returned by the API (backend `WalletResponse`). Dates are ISO strings on the wire. */
 interface WalletData {
-    /** Waaskey wallet id, e.g. `wlt_...`. */
     id: string;
-    /** On-chain address. */
-    address: string;
-    /** Chain the wallet belongs to. */
-    chain: Chain;
+    tenantId: string;
+    label: string;
+    curve: WalletCurve;
+    status: WalletStatus;
+    /** Compressed public key (hex). Set once keygen completes. */
+    publicKey?: string;
+    /** On-chain address derived from the public key. Set once keygen completes. */
+    address?: string;
+    /** When the key shares were last proactively rotated. */
+    keyRefreshedAt?: string;
+    /** Effective signing threshold `t` of the wallet's `t`-of-`n` key (the persisted value, or the deployment default). */
+    threshold: number;
+    /** Effective ordered party roles of the wallet's keygen topology, length `n`. */
+    parties: string[];
+    /** Effective per-party custody kind, parallel to {@link parties} (same length, same order). */
+    custodyKinds: CustodyKind[];
+    /** Count of {@link custodyKinds} entries the platform itself holds (`platform_signer` + `platform_recovery`). */
+    platformShareCount: number;
+    /**
+     * The wallet's custody attestation (#293): `embedded` when `platformShareCount >= threshold`
+     * (platform alone is custodial-capable — the default 2-of-3), `self_custody` when
+     * `platformShareCount === 0`, else `shared`. See {@link isNonCustodial}.
+     */
+    custodyType: CustodyType;
+    createdAt: string;
+    /**
+     * Keygen ceremony params — present on create and on `GET` while the wallet is `pending`
+     * (backend `WalletResponse.ceremony`). **Absent** for a member-bound wallet (#342): it is
+     * provisioned `pending_keygen` with no single ceremony to join here — each
+     * {@link WalletShareholder} instead runs {@link Wallets.joinCeremony} for its own party.
+     */
+    ceremony?: WalletCeremony;
 }
-/** Error thrown for any non-2xx API response. */
-declare class WaaskeyError extends Error {
-    readonly status: number;
-    readonly code?: string | undefined;
-    constructor(message: string, status: number, code?: string | undefined);
+/**
+ * Response to creating a wallet (backend `CreateWalletResponse`) — structurally identical to
+ * {@link WalletData} (`ceremony` lives there now, since `GET` returns it too while pending).
+ */
+type CreateWalletResponse = WalletData;
+/** Parameters for `wallets.createWallet(...)` — the member-bound create (#342). */
+interface CreateMemberWalletParams {
+    /** Human label for the wallet. */
+    label: string;
+    /** Elliptic curve for threshold signing. Defaults to secp256k1 (the backend default) when omitted. */
+    curve?: WalletCurve;
+    /**
+     * The `N` org membership ids that each hold one share of this wallet's key. The backend derives
+     * the full topology from them — `n = N+1` parties (the N members + exactly one platform share),
+     * `parties = ['member:<membershipId>' × N, 'platform']`. Every id must be a membership of the
+     * caller's tenant with the `canHoldShare` capability, and distinct.
+     */
+    shareholderMembershipIds: string[];
+    /** Signing threshold `t` (`2 <= t <= N+1`). Defaults to 2 when omitted. */
+    threshold?: number;
+}
+/**
+ * A single org-member share-holder of a member-bound wallet's `t`-of-`n` key (#342, backend
+ * `IWalletShareholder`). The N member share-holders plus exactly one (non-row) platform share make
+ * up the wallet's N+1 topology.
+ */
+interface WalletShareholder {
+    id: string;
+    tenantId: string;
+    walletId: string;
+    /** The membership that holds this share — must have `canHoldShare`. */
+    membershipId: string;
+    /** 0-based index of this party in the wallet's topology (the protocol party index). */
+    partyIndex: number;
+    /** Deterministic protocol role string for this party — `member:<membershipId>`. */
+    role: string;
+    /** Custody kind of this share (a member share-holder is always `user_device`). */
+    custodyKind: CustodyKind;
+    /** The member's device this share is bound to, once enrolled. Absent before it binds. */
+    deviceId?: string;
+    /** When this member's device joined/ack'd the keygen roster ({@link Wallets.joinCeremony}). Absent until it acks. */
+    joinedAt?: string;
+    createdAt: string;
+}
+/**
+ * The CALLING member's own party of a member-bound wallet's multi-device keygen ceremony (#344,
+ * backend `IMemberCeremony`), returned by {@link Wallets.joinCeremony}'s internal `ceremony/mine`
+ * fetch. Carries only the caller's own party params — never another party's. Unlike
+ * {@link WalletCeremony} (the 2-party device/server keygen), an n-party member ceremony has no
+ * single peer: every other member + the platform party join the SAME relay session, so the caller
+ * only needs its own `partyIndex`, the total party count `parties`, and a relay token bound to its
+ * `{sessionId, role, sub=membershipId}`.
+ */
+interface MemberCeremony {
+    /** Relay websocket URL the member device connects to. */
+    relayUrl: string;
+    /** Ceremony id shared by every party on the relay — the wallet id (registered verbatim). */
+    sessionId: string;
+    curve: WalletCurve;
+    /** The caller's own relay routing role — `member:<membershipId>` (registered byte-for-byte). */
+    role: string;
+    /** The caller's own 0-based protocol party index in the wallet's topology. */
+    partyIndex: number;
+    /** Total parties `n` (= N members + the single platform party). */
+    parties: number;
+    /** Signing threshold `t`. */
+    threshold: number;
+    /**
+     * Short-lived relay token (JWT) the device presents to join this session as {@link role}. Bound
+     * to `{sessionId, role, sub=membershipId}`; present only when relay authentication is enabled.
+     */
+    relayToken?: string;
+}
+/**
+ * Result of a member device acking the keygen roster (#344, backend `MemberCeremonyJoinResponse`) —
+ * reports roster progress so the caller can render "3 of 4 devices ready" and learn when the
+ * multi-device keygen has started ({@link rosterComplete} flips true on the last member's join).
+ */
+interface MemberCeremonyJoinResponse {
+    walletId: string;
+    /** The wallet status after the ack — `pending_keygen` while filling / running, `active` once complete. */
+    status: WalletStatus;
+    /** How many of the wallet's member share-holders have joined/ack'd so far. */
+    joined: number;
+    /** The total member share-holders `N` that must join before keygen runs. */
+    total: number;
+    /** True once every member has joined — the multi-device keygen ceremony has been triggered. */
+    rosterComplete: boolean;
+}
+/** Response to signing (backend `SignMessageResponse`). */
+interface SignMessageResponse {
+    walletId: string;
+    /** Hex-encoded signature produced by the MPC protocol. */
+    signature: string;
+}
+/**
+ * Lifecycle of a send/sweep signing activity (backend `TxStatus`). WaaS is
+ * **sign-only** — a send is built (`pending`), MPC-signed (`signed`, terminal:
+ * the signed raw tx is returned for the client to broadcast), or its ceremony
+ * fails (`failed`). WaaS never broadcasts, so there is no on-chain/broadcast state.
+ */
+type TxStatus = 'pending' | 'signed' | 'failed';
+/** Parameters to send a transaction (backend `SendTxRequest`). */
+interface SendParams {
+    /** Target chain id, e.g. `evm:1`, `evm:11155111`. */
+    chainId: string;
+    /** Destination address. */
+    to: string;
+    /** Transfer amount in the chain's base unit (wei), as a numeric string. */
+    value?: string;
+    /** Arbitrary call data (hex) for contract interactions. */
+    data?: string;
+}
+/**
+ * Result of a send (backend `SendTxResponse`). WaaS is **sign-only**: it builds
+ * and MPC-signs the transaction and returns the signed raw tx — it does **not**
+ * broadcast it. Submit `signedTx` from your own node/provider (see
+ * {@link Waaskey.broadcast} or your own submitter).
+ */
+interface SendResult {
+    walletId: string;
+    chainId: string;
+    /**
+     * The signed raw transaction — the canonical broadcast payload the **client**
+     * submits to its own node (an EVM raw RLP tx hex, a Bitcoin tx hex, …). WaaS
+     * never broadcasts this.
+     */
+    signedTx: string;
+    /**
+     * The transaction id, computed offline as a deterministic hash of the signed
+     * tx — for reference/tracking only. It is **not** fetched from a node and is
+     * not proof of broadcast or confirmation.
+     */
+    txHash: string;
+    /** The 32-byte digest the MPC signer signed. */
+    digest: string;
+}
+/**
+ * The relay coordination + raw message the device co-signs for an ed25519 send (backend
+ * `EddsaSendSessionResponse`, #110). Returned by the START phase (`POST …/send-session`). Unlike the
+ * secp {@link SignSessionResponse} (a 32-byte digest + 2-party peer roles), this carries the FROST
+ * signing quorum roster (`roles` in `participants` order) and the WHOLE `message` bytes (ed25519 signs
+ * the message, not a digest).
+ */
+interface EddsaSendSession {
+    /** The pending signing-activity row id — echoed back to the ASSEMBLE phase to finalize the signed tx. */
+    txId: string;
+    /** Relay websocket URL the device connects to. */
+    relayUrl: string;
+    /** Relay session id shared by the device + server parties. */
+    sessionId: string;
+    /** The FROST signing quorum's relay roles, in `participants` order (`roles[i]` ↔ `participants[i]`), e.g. `['device','server']`. */
+    roles: string[];
+    /** The 1-based FROST identifiers of the quorum, parallel to {@link roles} (e.g. `[1, 2]`). */
+    participants: number[];
+    /** This device's own 0-based slot into {@link roles} (its position in the quorum). */
+    signerPosition: number;
+    /** The raw message bytes to sign, hex (`0x` prefix optional) — the chain adapter's serialized tx message. */
+    message: string;
+    /** Short-lived relay token (JWT) the device presents to join this session; present only when relay auth is enabled. */
+    relayToken?: string;
+}
+/** Body of the ASSEMBLE phase (`POST …/send-session/:txId/assemble`) — the aggregated ed25519 signature the backend embeds into the wire tx (backend `AssembleEddsaTxRequest`). */
+interface EddsaAssembleRequest {
+    /** The 64-byte RFC 8032 ed25519 signature (hex) the device + server co-produced. */
+    signature: string;
+}
+/** How a signature was produced (backend `SignatureKind`). */
+type SignatureKind = 'message' | 'personal_sign' | 'typed_data' | 'session' | 'transaction';
+/**
+ * A record in the wallet's unified **signing activity** (backend `SignatureResponse`,
+ * #289). A raw sign is `kind` + `digest` + `signature`; a send/sweep (`kind =
+ * 'transaction'`) additionally carries the tx fields, including the `signedTx` the
+ * client broadcasts. Dates are ISO strings on the wire.
+ */
+interface Signature {
+    id: string;
+    tenantId: string;
+    walletId: string;
+    kind: SignatureKind;
+    /** 32-byte hex digest that was signed. */
+    digest?: string;
+    /** Hex-encoded signature from the MPC protocol. */
+    signature?: string;
+    /** Chain id, e.g. `evm:1` (send/sweep only). */
+    chainId?: string;
+    /** Destination address (send/sweep only). */
+    to?: string;
+    /** Amount in the chain's base unit, numeric string (send/sweep value transfer). */
+    value?: string;
+    /** The signed raw transaction returned to the client to broadcast (send/sweep, once signed). */
+    signedTx?: string;
+    /** Transaction id computed offline from the signed tx (send/sweep, once signed). */
+    txHash?: string;
+    /** Send/sweep lifecycle status (absent for a plain sign). */
+    status?: TxStatus;
+    createdAt: string;
+}
+/** A wallet operation gated behind approval before its MPC ceremony runs (backend `WalletActionType`). */
+type WalletActionType = 'sign' | 'send';
+/**
+ * Lifecycle of an asynchronous, approval-gated signing request (backend `SigningRequestStatus`).
+ * `requested` is the single device-approval flow (#229, back-compat); `pending_approval` is the
+ * M-of-N approver-quorum flow (#309) — distinct so a caller can tell the two apart. `approved`
+ * means the quorum settled and the MPC ceremony started; it flips to `signed` once the ceremony
+ * completes, or `declined`/`expired`/`failed` otherwise.
+ */
+type SigningRequestStatus = 'requested' | 'pending_approval' | 'approved' | 'signed' | 'declined' | 'expired' | 'failed';
+/**
+ * Relay coordination to run an approved request's MPC ceremony (backend `SignSessionResponse`).
+ * Returned only from `approveSignRequest` of a `sign` action, once the approval requirement is
+ * met — the device runs its half of the ceremony with these params.
+ */
+interface SignSessionResponse {
+    relayUrl: string;
+    sessionId: string;
+    curve: WalletCurve;
+    /** The device party's relay routing id (e.g. `"device"`). */
+    role: string;
+    /** The server party's relay routing id (e.g. `"server"`). */
+    peerRole: string;
+    /** This device's signer slot — its keygen index among the participants. */
+    signerPosition: number;
+    /** Keygen indices of the signing quorum, in protocol order (e.g. `[0, 1]`). */
+    participants: number[];
+    /** Short-lived relay token (JWT) the device presents to join this session; present only when relay auth is enabled. */
+    relayToken?: string;
+    /** Additive BIP32 child tweak (32-byte hex) applied when signing under a derived deposit address. */
+    tweak?: string;
+    /** The 32-byte hex digest to sign, present only when the server built the transaction server-side. */
+    digest?: string;
+}
+/**
+ * An asynchronous wallet action (sign/send) awaiting approval — either the device owner
+ * (single-approval, #229) or an M-of-N approver quorum (#309) — (backend `SigningRequestResponse`).
+ */
+interface SigningRequestResponse {
+    id: string;
+    walletId: string;
+    /** The operation being approved. */
+    action: WalletActionType;
+    status: SigningRequestStatus;
+    /** 32-byte hex digest being signed (the message for `sign`; the tx digest for `send`, once built). */
+    digest?: string;
+    /** Present once a `sign` action is approved and signed. */
+    signature?: string;
+    /** Transaction id computed offline from the signed tx. Present once a `send` action is signed. */
+    txHash?: string;
+    createdAt: string;
+    /** ISO time after which an un-approved request expires. */
+    expiresAt: string;
+    /**
+     * Returned only from `approveSignRequest` of a `sign` action: the relay coordination params
+     * the approving device runs its half of the MPC ceremony with — immediately for a non-quorum
+     * request, or once an approver quorum settles APPROVED. Absent on `get` and on `send` approvals.
+     */
+    session?: SignSessionResponse;
+    /**
+     * Under an M-of-N approver quorum (#309): the number of further approvals still needed before
+     * the MPC ceremony runs. `0` once the quorum is reached (the ceremony has started and a
+     * `session` is returned). Absent for a non-quorum (single device-approval) request.
+     */
+    approvalsRemaining?: number;
+}
+/**
+ * The CALLING member's own party of a member-bound sign-request's multi-device SIGN ceremony
+ * (#347, backend `IMemberSignCeremony`), returned by {@link Wallets.joinSignCeremony}'s internal
+ * `sign-requests/:reqId/ceremony/mine` fetch. The signing analogue of {@link MemberCeremony}
+ * (keygen): only the caller's own params, never another party's. Because a sign is a t-of-n
+ * SELECTION (only `t` of the N+1 parties sign), the participant set is not known until `t-1`
+ * members have approved and the quorum is FIXED — so the quorum fields appear only once
+ * {@link ready}: `false` while the roster is still collecting approvals, or when the caller was
+ * not selected into the fixed quorum.
+ */
+interface MemberSignCeremony {
+    /** Relay websocket URL the member device connects to. */
+    relayUrl: string;
+    /** The sign ceremony's relay session id (unique per sign-request) — registered verbatim. */
+    sessionId: string;
+    curve: WalletCurve;
+    /** The caller's own relay routing role — `member:<membershipId>` (registered byte-for-byte). */
+    role: string;
+    /**
+     * `true` once the quorum is fixed AND the caller is one of its `t` signing parties — only then
+     * are the quorum fields below present and the device can run its half.
+     */
+    ready: boolean;
+    /** The fixed quorum's relay roles in signing order (this ceremony's `PartyRouting`). Present only when {@link ready}. */
+    quorumRoles?: string[];
+    /** The caller's 0-based signer position within {@link quorumRoles}/{@link participants}. Present only when {@link ready}. */
+    signerPosition?: number;
+    /** Keygen indices of the fixed quorum, in signing order. Present only when {@link ready}. */
+    participants?: number[];
+    /** The 32-byte hex digest to sign. Present only when {@link ready}. */
+    digest?: string;
+    /**
+     * Short-lived relay token (JWT) bound to `{sessionId, role, sub=membershipId}`. Present only
+     * when relay authentication is enabled.
+     */
+    relayToken?: string;
+}
+/** Options for the optional client-side broadcast helper ({@link Waaskey.broadcast}). */
+interface BroadcastOptions {
+    /** JSON-RPC endpoint of **your** node/provider to submit the signed tx to. */
+    rpcUrl: string;
+    /**
+     * Chain id (e.g. `evm:1`) — reserved for future per-chain routing. The helper
+     * assumes an EVM raw tx (`eth_sendRawTransaction`) today.
+     */
+    chainId?: string;
+    /** Custom fetch implementation (non-browser runtimes / tests). Defaults to global `fetch`. */
+    fetch?: typeof fetch;
+    /** Cancel the broadcast request. */
+    signal?: AbortSignal;
+}
+/** Result of a client-side broadcast — the hash the node returned for the submitted tx. */
+interface BroadcastResult {
+    /** Transaction hash the node returned when it accepted the raw tx. */
+    txHash: string;
+}
+/** A page of results (backend `Pagination<T>`). */
+interface Page<T> {
+    items: T[];
+    /** Total matching records across all pages. */
+    total: number;
+    /** 1-based page number returned. */
+    page: number;
+    /** Page size applied. */
+    limit: number;
+}
+/** Query for a paginated list. */
+interface PageQuery {
+    page?: number;
+    limit?: number;
+}
+/**
+ * Query for a wallet's signing requests — {@link PageQuery} plus an optional status filter
+ * (e.g. `pending_approval` to build an approver queue, #329). Backed by the API's
+ * `status` query param on `GET /v1/wallets/{id}/sign-requests` (#332), which paginates the
+ * filtered set correctly (unlike a client-side filter over an unfiltered page).
+ */
+interface SignRequestsQuery extends PageQuery {
+    status?: SigningRequestStatus;
+}
+/** Parameters for an on-ramp widget URL (backend `GetWidgetUrlRequest`). */
+interface OnrampWidgetParams {
+    /** Wallet address the purchased crypto is delivered to. */
+    walletAddress: string;
+    /** Crypto to buy, e.g. `ETH`. */
+    cryptoCurrency: string;
+    /** Chain id, e.g. `evm:1`. */
+    chainId: string;
+    /** Fiat the user pays with (defaults to USD server-side). */
+    fiatCurrency?: string;
+    /** Pre-fill the fiat amount. */
+    fiatAmount?: number;
+}
+/** A provider on-ramp widget URL (backend `OnrampWidgetUrl`). */
+interface OnrampWidgetUrl {
+    /** Open this URL to launch the on-ramp widget. */
+    url: string;
+    /** Provider that generated the URL, e.g. `transak`. */
+    provider: string;
+    /** ISO timestamp when the signed URL expires, if applicable. */
+    expiresAt?: string;
+}
+/** The recovery factors a wallet enrols (backend `RecoveryFactor`). */
+type RecoveryFactor = 'recovery_code' | 'totp' | 'email_otp';
+/**
+ * Enrolment of one factor at register time (backend `FactorEnrollment`).
+ *
+ * Contract A: the recovery code is a client-side **sealing secret** and must never
+ * reach the server, so the `recovery_code` factor enrols `credentialHash` (the
+ * lowercase-hex SHA-256 of the code), never the code itself. `totp` / `email_otp`
+ * enrol their non-sealing `credential` (base32 secret / email) as before.
+ */
+interface FactorEnrollment {
+    type: RecoveryFactor;
+    /** totp → base32 secret; email_otp → email address. Omitted for `recovery_code`. */
+    credential?: string;
+    /** recovery_code → lowercase-hex SHA-256 of the recovery code (the raw code never leaves the client). */
+    credentialHash?: string;
+}
+/**
+ * One factor's proof at recovery time (backend `FactorVerification`).
+ *
+ * Contract A: `recovery_code` proves possession with `credentialHash` (the same
+ * SHA-256 the server stored), never the plaintext code — the server compares the
+ * hash in constant time and can never derive the code to unseal the ciphertext.
+ */
+interface FactorVerification {
+    type: RecoveryFactor;
+    /** totp → current 6-digit OTP; email_otp → the emailed OTP. Omitted for `recovery_code`. */
+    token?: string;
+    /** recovery_code → lowercase-hex SHA-256 of the code (matches the enrolled hash). */
+    credentialHash?: string;
+}
+/** A registered recovery record's metadata (backend `RecoveryShareResponse`). */
+interface RecoveryShareInfo {
+    id: string;
+    walletId: string;
+    factors: RecoveryFactor[];
+    createdAt: string;
+}
+/** Response to initiating a recovery session (backend `RecoveryChallengeResponse`). */
+interface RecoveryChallengeResponse {
+    challengeId: string;
+    requiredFactors: RecoveryFactor[];
+}
+/** Encrypted share returned after verifying factors (backend `RecoveryRetrieveResponse`). */
+interface RecoveryRetrieveResponse {
+    id: string;
+    ciphertext: string;
+}
+/** Result of device-loss recovery — factors verified + shares rotated (backend `RecoverWalletResponse`). */
+interface RecoverWalletResponse {
+    recovered: boolean;
+    id: string;
+    ciphertext: string;
+    refreshedAt: string;
+}
+/** Parameters for `recovery.register(...)`. */
+interface RegisterRecoveryParams {
+    /** The device key share to back up (e.g. `await shareStore.get(walletId)`). */
+    share: string;
+    /** High-entropy recovery code used to encrypt the backup. Generated and returned if omitted. */
+    recoveryCode?: string;
+    /** Base32 TOTP secret to enrol the authenticator factor. */
+    totpSecret: string;
+    /** Email address to enrol the email-OTP factor. */
+    email: string;
+    /** Extra factor enrolments beyond the standard three. */
+    extraFactors?: FactorEnrollment[];
+}
+/** Parameters for `recovery.recover(...)` / `recovery.retrieveShare(...)`. */
+interface RecoverParams {
+    /** challengeId from `recovery.challenge(...)`. */
+    challengeId: string;
+    /** One verification per enrolled factor. */
+    verifications: FactorVerification[];
+    /** The recovery code — decrypts the retrieved share client-side. */
+    recoveryCode: string;
+}
+/**
+ * Parameters for `wallets.recoverSign(...)` — the device-loss RECOVERY CO-SIGN of a non-custodial
+ * `[device, server, user_backup]` secp256k1 wallet (#351/#78). Extends the recovery gate ({@link RecoverParams})
+ * that releases the sealed `user_backup` ciphertext with the digest to co-sign. The `recoveryCode` opens
+ * the backup CLIENT-SIDE (Contract A: it never reaches the server); the restored `user_backup` share then
+ * co-signs 2-party with the platform's `server` party. Passkey step-up (when the wallet requires it) rides
+ * the call's options, exactly like a normal sign.
+ */
+interface RecoverSignParams extends RecoverParams {
+    /** 32-byte hex digest to co-sign (a leading `0x` is accepted and stripped). */
+    digest: string;
+    /** Target chain (e.g. `"evm:1"`) — forwarded to the recover-sign session for plan/chain gating, parity with `sign-session`. */
+    chainId?: string;
+}
+/**
+ * Assemble material the backend hands a retained USER_DEVICE new holder so it can finish its OWN
+ * reshared share client-side — the platform never learns the device's share (backend
+ * `DeviceReshareMaterial`, #83/#318). Present on {@link ReshareWalletResponse.deviceMaterial} only
+ * when a reshare keeps a device holder. The values are opaque JSON the device routes into the core.
+ */
+interface DeviceReshareMaterial {
+    curve: WalletCurve;
+    /** The device holder's 0-based position within {@link newPreimages}. */
+    newPosition: number;
+    /** New share preimages (32-byte hex), one per new holder. */
+    newPreimages: string[];
+    /** The new signing threshold `t'`. */
+    newThreshold: number;
+    /** The unchanged `WalletPublicInfo` JSON. */
+    wallet: unknown;
+    /** One Feldman-commitments object per dealer (the broadcast set). */
+    commitments: unknown[];
+    /** The device holder's private sub-share from each dealer. */
+    subShares: unknown[];
+}
+/**
+ * Relay coordination for the device to join the post-reshare **aux-completion** ceremony (#318 /
+ * #95) — the interactive `aux_info_gen` over the NEW committee that the backend signer drives for
+ * the server + recovery parties. Mirrors the keygen {@link WalletCeremony} / sign-session relay
+ * fields; the backend uses `<sessionId>/reshare-aux` (kind `reshare-aux`), with `sessionId` the
+ * wallet id. `curve` is taken from {@link DeviceReshareMaterial}, so it is not repeated here.
+ */
+interface ReshareCompletionCeremony {
+    /** Relay websocket URL the device connects to. */
+    relayUrl: string;
+    /** Ceremony id shared by every committee party (the wallet id). */
+    sessionId: string;
+    /** This device's relay routing id in the NEW committee, e.g. `device`. */
+    role: string;
+    /** The peer (server) party's relay routing id, e.g. `server`. */
+    peerRole: string;
+    /** This device's 0-based party index in the NEW committee. */
+    partyIndex: number;
+    /** The peer (server) party's party index in the NEW committee. */
+    peerPartyIndex: number;
+    /** Total parties `n'` in the NEW committee. */
+    parties: number;
+    /** Short-lived relay token (JWT) the device presents to join the reshare-aux session; present only when relay auth is enabled. */
+    relayToken?: string;
+}
+/** Parameters for `reshare.complete(...)` — everything the device needs to finish its NEW-epoch share. */
+interface ReshareCompletionParams {
+    /** Assemble material from the reshare response ({@link ReshareWalletResponse.deviceMaterial}). */
+    material: DeviceReshareMaterial;
+    /** Relay coordination for the `<sessionId>/reshare-aux` ceremony the device joins. */
+    ceremony: ReshareCompletionCeremony;
+    /** The wallet's NEW key epoch ({@link ReshareWalletResponse.keyEpoch}) — the completed share is stored under it. */
+    keyEpoch: number;
+    /** This device's OWN pre-generated Paillier safe-primes for the aux ceremony (never server-provided). Absent ⇒ generated inline. */
+    pregeneratedPrimes?: string;
+}
+/** Result of `reshare.complete(...)` — the wallet is now signable on this device under the new epoch. */
+interface ReshareCompletionResult {
+    walletId: string;
+    /** The key epoch the completed share was stored under (the wallet's new epoch). */
+    keyEpoch: number;
+    /** The wallet's shared public key (hex) — verified unchanged across the reshare. */
+    sharedPublicKey: string;
+}
+/**
+ * Result of a wallet reshare (backend `ReshareWalletResponse`, #295): the wallet's NEW topology +
+ * custody attestation and the bumped `keyEpoch` (the public key/address are UNCHANGED). When the
+ * new committee retains a USER_DEVICE holder, {@link deviceMaterial} carries the material that
+ * device completes client-side (see `reshare.complete`).
+ */
+interface ReshareWalletResponse {
+    walletId: string;
+    /** The new signing threshold `t'`. */
+    threshold: number;
+    /** The new ordered party roles, length `n'`. */
+    parties: string[];
+    /** The new per-party custody kinds. */
+    custodyKinds: CustodyKind[];
+    /** Count of {@link custodyKinds} entries the platform itself holds. */
+    platformShareCount: number;
+    /** The wallet's new custody attestation. */
+    custodyType: CustodyType;
+    /** The wallet's new key epoch (bumped). */
+    keyEpoch: number;
+    /** True: the new committee cannot sign until its aux material is (re)generated (device completion clears it). */
+    auxPending: boolean;
+    /** ISO timestamp the reshare completed at. */
+    resharedAt: string;
+    /** Assemble material for a retained USER_DEVICE new holder. Present only when the new committee keeps a device holder. */
+    deviceMaterial?: DeviceReshareMaterial;
+}
+/** An embedded-wallet end-user (authenticates through the app, distinct from a dashboard member). */
+interface EndUser {
+    id: string;
+    tenantId: string;
+    /** Email identifier (email-OTP / social). Absent when signed up by phone or passkey. */
+    email?: string;
+    /** Phone identifier (phone-OTP, E.164). Absent unless a verified phone is linked. */
+    phone?: string;
+    createdAt: string;
+}
+/** Result of starting an OTP login (email or phone). */
+interface EmailStartResult {
+    sent: boolean;
+    /** TEST-ONLY: the code, present only when the backend runs with `EMBEDDED_OTP_DEBUG` (non-prod). */
+    debugCode?: string;
+}
+/** An authenticated end-user session. */
+interface EmbeddedSession {
+    /** End-user session token (sent on subsequent end-user-scoped calls). */
+    token: string;
+    endUser: EndUser;
+}
+/** Body of a Firebase Auth login — the client-obtained Firebase ID token (backend `FirebaseAuthDto`). */
+interface FirebaseAuthRequest {
+    /** Firebase ID token obtained on the client via the Firebase Auth SDK. */
+    idToken: string;
+}
+/** A dashboard member's role within a tenant (backend `MemberRole`). */
+type MemberRole = 'owner' | 'admin' | 'member';
+/** Which environments a member may operate in (backend `MembershipScope`). */
+type MembershipScope = 'all' | 'production' | 'sandbox';
+/**
+ * A dashboard org member — a human who logs into the tenant console (distinct from an embedded
+ * {@link EndUser}, and from an API key). Mirrors the backend `IMember`; `createdAt` is an ISO string
+ * on the wire.
+ */
+interface Member {
+    id: string;
+    tenantId: string;
+    email: string;
+    role: MemberRole;
+    /** Which environments this member may operate in (production / sandbox / all). */
+    environmentScope: MembershipScope;
+    /** Whether the member has completed TOTP 2FA enrolment. */
+    totpEnabled: boolean;
+    createdAt: string;
+}
+/**
+ * A held org-member bearer session (mirrors the backend `FirebaseAuthResponse`). Returned by
+ * {@link Members.loginWithFirebase} and held by the client so member-scoped calls authenticate with
+ * `Authorization: Bearer <accessToken>` instead of the ambient dashboard cookie.
+ */
+interface MemberSession {
+    /** Member access token (JWT) — presented as `Authorization: Bearer …` on member calls. */
+    accessToken: string;
+    /**
+     * Member refresh token (JWT). The SDK holds it but does NOT yet auto-refresh (out of scope) — once
+     * the access token expires a member call surfaces a 401 error; a future revision exchanges it at
+     * `/v1/auth/refresh`.
+     */
+    refreshToken: string;
+    /** The authenticated member. */
+    member: Member;
 }
 
-/** Thin typed HTTP client over fetch — the single place requests are issued. */
-declare class HttpClient {
-    private readonly apiKey;
-    private readonly baseUrl;
-    private readonly fetchImpl;
-    constructor(apiKey: string, baseUrl: string, fetchImpl?: typeof fetch);
-    request<T>(method: string, path: string, body?: unknown): Promise<T>;
+/**
+ * Embedded end-user authentication (#6) — Privy-style login that maps an end-user to a
+ * non-custodial wallet, distinct from the dashboard member auth. The developer's API key
+ * authorizes the flow; a successful login yields an end-user **session token** the SDK
+ * holds and sends on end-user-scoped calls.
+ *
+ * Methods (email-OTP, phone-OTP, …) live behind the same `auth` surface and all establish
+ * the same session; social / passkey are added the same way.
+ */
+declare class Auth {
+    private readonly http;
+    private current?;
+    constructor(http: HttpClient);
+    /** Email one-time-code login. */
+    readonly email: {
+        /** Send a login code to `email`. */
+        start: (email: string, signal?: AbortSignal) => Promise<EmailStartResult>;
+        /** Verify the code; on success the end-user is provisioned and the session is established. */
+        verify: (email: string, code: string, signal?: AbortSignal) => Promise<EmbeddedSession>;
+    };
+    /** Phone one-time-code (SMS) login. `phone` is E.164, e.g. `+14155550123`. */
+    readonly phone: {
+        /** Send a login code to `phone`. */
+        start: (phone: string, signal?: AbortSignal) => Promise<EmailStartResult>;
+        /** Verify the code; on success the end-user is provisioned and the session is established. */
+        verify: (phone: string, code: string, signal?: AbortSignal) => Promise<EmbeddedSession>;
+    };
+    /** Social / federated-provider login. */
+    readonly social: {
+        /**
+         * Exchange a Google ID token (obtained on the client via Google Identity Services) for a
+         * session. Requires the tenant's Google client id to be configured server-side.
+         */
+        google: (idToken: string, signal?: AbortSignal) => Promise<EmbeddedSession>;
+        /**
+         * Exchange a Firebase ID token (obtained on the client via the Firebase Auth SDK) for a session
+         * — the Firebase analogue of {@link social.google}. Requires the tenant to have opted into
+         * embedded Firebase sign-in (`firebaseAuthEnabled`); when it hasn't, the API replies 412 and the
+         * SDK surfaces a typed `firebase_not_enabled` {@link WaaskeyError}.
+         */
+        firebase: (idToken: string, signal?: AbortSignal) => Promise<EmbeddedSession>;
+    };
+    /**
+     * Passkey (WebAuthn) login. `register` adds a passkey to the **currently logged-in** end-user;
+     * `login` is usernameless (a passkey assertion resolves the user and establishes a session).
+     *
+     * The browser ceremony uses `@simplewebauthn/browser` (an optional peer dependency, loaded on
+     * demand). Pass a `ceremony` to override it — e.g. on React Native with a native authenticator.
+     */
+    readonly passkey: {
+        /** Add a passkey to the logged-in end-user. Requires an active session. */
+        register: (ceremony?: PasskeyCeremony) => Promise<void>;
+        /** Usernameless passkey login — establishes the session on success. */
+        login: (ceremony?: PasskeyCeremony) => Promise<EmbeddedSession>;
+    };
+    /** The active session, or `undefined` when not logged in. */
+    get session(): EmbeddedSession | undefined;
+    /** The end-user session token, or `undefined` when not logged in. */
+    get token(): string | undefined;
+    /** Whether an end-user is currently logged in. */
+    get isAuthenticated(): boolean;
+    /** The logged-in end-user (re-fetched from the session token). Rejects if not logged in. */
+    me(signal?: AbortSignal): Promise<EndUser>;
+    /** Restore a session from a previously stored token (e.g. across reloads). */
+    restore(session: EmbeddedSession): void;
+    /** Clear the session (sign out). */
+    logout(): void;
+    /** POST a verify request, store the resulting session, and return it. */
+    private establish;
+    private requireToken;
+}
+/**
+ * The browser WebAuthn ceremony. Defaults to `@simplewebauthn/browser`; override for non-DOM
+ * runtimes (e.g. a React Native native-passkey module). `create` runs registration
+ * (navigator.credentials.create), `get` runs authentication (navigator.credentials.get).
+ */
+interface PasskeyCeremony {
+    create(options: unknown): Promise<unknown>;
+    get(options: unknown): Promise<unknown>;
 }
 
 /**
- * A handle to a single wallet. Returned by `waaskey.wallets.create(...)`.
+ * Org-member (dashboard "plane B") authentication — a bearer member login for a NON-browser
+ * consumer (a Node app, or the browser extension via the SDK) that cannot carry the ambient
+ * same-site dashboard session cookie the browser console relies on.
+ *
+ * {@link loginWithFirebase} exchanges a Firebase ID token at the `@Public` `POST /v1/auth/firebase`
+ * (no API key, no cookie) for a member session `{ accessToken, refreshToken, member }`, which the
+ * client HOLDS. Once held, member-scoped calls ({@link Wallets.joinCeremony} /
+ * {@link Wallets.joinSignCeremony}, which go through {@link HttpClient.requestAsMember}) send
+ * `Authorization: Bearer <accessToken>` rather than relying on the cookie — so a headless consumer
+ * can drive the member-bound ceremonies.
  *
- * Signing is an interactive threshold-MPC protocol; from the caller's point of
- * view it is a single awaited call that returns the signature.
+ * **Refresh is out of scope for now:** the SDK holds `refreshToken` but does not yet auto-refresh.
+ * Once the access token expires a member call surfaces a 401 (`unauthorized`) error; a future
+ * revision will exchange the refresh token at `/v1/auth/refresh` from here.
  */
-declare class Wallet implements WalletData {
+declare class Members {
     private readonly http;
+    private held?;
+    constructor(http: HttpClient);
+    /**
+     * Exchange a Firebase ID token for an org-member session and hold it.
+     *
+     * The token must belong to an ALREADY-INVITED member — Firebase never self-provisions a member, so
+     * an unknown email is rejected (`no_member`). A member with 2FA enrolled must present a Firebase
+     * token that itself passed a second factor, or the login is refused (`mfa_required`).
+     *
+     * @throws {WaaskeyError} `no_member` — no org member exists for the token's Firebase identity (401).
+     * @throws {WaaskeyError} `mfa_required` — the member needs a second factor the token didn't carry (401).
+     */
+    loginWithFirebase(idToken: string, signal?: AbortSignal): Promise<MemberSession>;
+    /** The current member, or `undefined` when not logged in. */
+    get member(): Member | undefined;
+    /** The held member session (access + refresh tokens + member), or `undefined` when not logged in. */
+    get session(): MemberSession | undefined;
+    /** The held member access token — the value the client wires into {@link HttpClient.requestAsMember}. */
+    get accessToken(): string | undefined;
+    /** Whether an org member is currently logged in over a held bearer session. */
+    get isAuthenticated(): boolean;
+    /** Restore a previously stored member session (e.g. across process restarts). */
+    restore(session: MemberSession): void;
+    /** Clear the held member session (sign out); member calls fall back to the cookie path afterwards. */
+    memberSignOut(): void;
+}
+
+/**
+ * The `onramp` resource — fund an embedded wallet with fiat (card/bank) via a provider
+ * (e.g. Transak). The SDK returns a provider widget URL to open; the purchase settles on
+ * chain to the wallet address and the on-chain balance reflects it once the provider delivers.
+ */
+declare class Onramp {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Get a provider widget URL to buy `cryptoCurrency` on `chainId` for `walletAddress`. */
+    widgetUrl(params: OnrampWidgetParams, signal?: AbortSignal): Promise<OnrampWidgetUrl>;
+}
+
+/** Dependencies the {@link Recovery} resource needs. */
+interface RecoveryDeps {
+    shareStore?: ShareStore;
+    /** Optional analytics emitter for the wallet.recovered event. */
+    analytics?: Analytics;
+}
+/**
+ * Multi-factor wallet recovery.
+ *
+ * The recovery share is encrypted **client-side** with the user's recovery code
+ * (the server stores only the opaque ciphertext) and its release is gated behind
+ * ≥3 factors (recovery code + TOTP + email OTP). Device-loss recovery verifies the
+ * factors, has the server rotate the key shares (invalidating the lost device
+ * share), then decrypts the backup and restores it on the new device.
+ */
+declare class Recovery {
+    private readonly http;
+    private readonly deps;
+    constructor(http: HttpClient, deps?: RecoveryDeps);
+    /**
+     * Back up a wallet's device share: encrypt it with the recovery code and enrol the
+     * factors. Returns the (possibly generated) recovery code — show it to the user
+     * once; it is the only key to the backup and is never recoverable from the server.
+     */
+    register(walletId: string, params: RegisterRecoveryParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        recoveryCode: string;
+        share: RecoveryShareInfo;
+    }>;
+    /** The registered recovery factors for a wallet (no secrets). */
+    getInfo(walletId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<RecoveryShareInfo>;
+    /** Start a recovery session — returns the challengeId + the factors the user must verify. */
+    challenge(walletId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<RecoveryChallengeResponse>;
+    /**
+     * Device-loss recovery: verify factors, have the server rotate the key shares,
+     * then decrypt the backup with the recovery code and restore it to the share store
+     * (when one is configured). Returns when the share is restored.
+     */
+    recover(walletId: string, params: RecoverParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        share: string;
+        refreshedAt: string;
+    }>;
+    /**
+     * Verify factors and decrypt the backed-up share **without** rotating keys — for a
+     * read-only restore. Use {@link recover} for true device-loss (which re-keys).
+     *
+     * NOTE (issue #41, LOW): because this path does not rotate the (possibly lost) device
+     * share, the server `/verify` endpoint must enforce that **all ≥3 factors** were
+     * satisfied before releasing the ciphertext; prefer {@link recover} (always-rotate) for
+     * device-loss so a leaked backup can't be replayed against a still-valid old share.
+     */
+    retrieveShare(walletId: string, params: RecoverParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<string>;
+    private decrypt;
+}
+/** A high-entropy (128-bit) recovery code, grouped for readability — e.g. `7F3A-9C21-...`. */
+declare function generateRecoveryCode(): string;
+
+/** Dependencies the {@link Reshare} resource needs for the device-side completion ceremony. */
+interface ReshareDeps {
+    mpc?: MpcCore;
+    shareStore?: ShareStore;
+    /** Optional analytics emitter for the wallet.reshared event. */
+    analytics?: Analytics;
+}
+/**
+ * Device-side completion of a **device-retaining** reshare (#318 phase 2b).
+ *
+ * A backend reshare that keeps a USER_DEVICE holder commits a NEW epoch whose shares are CORE-ONLY
+ * (no aux) — the wallet is `reshareAuxPending` and cannot sign until the aux material is generated
+ * over the new committee. The platform signer drives its server + recovery parties of that aux
+ * ceremony; the DEVICE must join it or the ceremony can't complete. This resource is the device's
+ * half: it assembles its NEW-epoch bare core locally from the reshare's {@link DeviceReshareMaterial},
+ * runs the `<sessionId>/reshare-aux` aux ceremony over the relay alongside the platform parties, and
+ * seals the resulting COMPLETE share on the device under the new epoch.
+ *
+ * The device is never left worse off: nothing is stored until the completed share's public key is
+ * verified equal to the wallet's (unchanged across a reshare — the funds-safety invariant), and the
+ * OLD-epoch share is kept intact, so an interrupted completion can simply be retried.
+ */
+declare class Reshare {
+    private readonly http;
+    private readonly deps;
+    constructor(http: HttpClient, deps?: ReshareDeps);
+    /**
+     * Complete this device's share for a device-retaining reshare and make the wallet signable on the
+     * device under the new epoch.
+     *
+     * 1. Fetch the wallet to learn its (unchanged) public key — the invariant the completion is checked
+     *    against, taken from the server's truth rather than the caller.
+     * 2. Assemble the NEW-epoch bare core locally from {@link ReshareCompletionParams.material} (no relay).
+     * 3. Run the aux-completion ceremony over the relay ({@link ReshareCompletionParams.ceremony}),
+     *    alongside the platform server + recovery parties, to obtain the COMPLETE signable share.
+     * 4. Verify the completed share's public key equals the wallet's (fail closed on any mismatch).
+     * 5. Seal + persist the completed share under `(walletId, keyEpoch)`, keeping the old-epoch share.
+     *
+     * Requires `mpc` (built with the reshare capability) + `shareStore`. Idempotent/recoverable: safe to
+     * retry, since nothing is overwritten until the new share is assembled, verified, and stored.
+     */
+    complete(walletId: string, params: ReshareCompletionParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<ReshareCompletionResult>;
+}
+/**
+ * Compose the epoch-keyed device-share storage key `(walletId, keyEpoch)`, mirroring the backend's
+ * epoch-keyed share model (#295). Epoch 1 (a fresh keygen) keeps the bare `walletId` key for
+ * back-compat with existing stored shares; later epochs (reshares) use a distinct suffixed key, so a
+ * completed reshare never overwrites the old-epoch share until cutover is confirmed.
+ */
+declare function epochShareKey(walletId: string, keyEpoch: number): string;
+
+/** Device-party dependencies a {@link Wallet} needs to co-sign an ed25519 (FROST) transaction locally. */
+interface WalletDeviceDeps {
+    mpc?: MpcCore;
+    shareStore?: ShareStore;
+}
+/**
+ * A handle to a single wallet. Returned by `waaskey.wallets.create(...)` /
+ * `waaskey.wallets.get(...)`.
+ */
+declare class Wallet {
+    private readonly http;
+    private readonly analytics?;
+    /** Device core + share store, threaded from {@link Wallets}, so an ed25519 wallet can co-sign locally. */
+    private readonly device;
+    /** Waaskey wallet id, e.g. `wlt_…`. */
     readonly id: string;
-    readonly address: string;
-    readonly chain: Chain;
-    constructor(http: HttpClient, data: WalletData);
-    /** Sign an arbitrary message with this wallet's key (2-of-3 threshold MPC). */
-    signMessage(message: string): Promise<string>;
+    /** The full wallet record as returned by the API. */
+    readonly data: WalletData;
+    constructor(http: HttpClient, data: WalletData, analytics?: Analytics | undefined, 
+    /** Device core + share store, threaded from {@link Wallets}, so an ed25519 wallet can co-sign locally. */
+    device?: WalletDeviceDeps);
+    /** On-chain address (set once keygen completes). */
+    get address(): string | undefined;
+    /** Lifecycle state (`pending` until keygen completes, then `active`). */
+    get status(): WalletStatus;
+    /** Signing curve of the wallet. */
+    get curve(): WalletCurve;
+    /** Signing threshold `t` of the wallet's `t`-of-`n` MPC key. */
+    get threshold(): number;
+    /** Ordered party roles of the wallet's keygen topology, length `n`. */
+    get parties(): string[];
+    /** Per-party custody kind, parallel to {@link parties}. */
+    get custodyKinds(): CustodyKind[];
+    /** How many of the wallet's shares the platform itself holds. */
+    get platformShareCount(): number;
+    /**
+     * The wallet's custody attestation (`embedded` / `shared` / `self_custody`) — display
+     * it to prove the custody guarantee to the end-user (see {@link isNonCustodial}).
+     */
+    get custodyType(): CustodyType;
+    /**
+     * Whether this wallet is **non-custodial** — the platform's shares alone do not meet
+     * the threshold (`platformShareCount < threshold`, i.e. custody type `shared` or
+     * `self_custody`), so WaaS cannot sign without the user/external party.
+     */
+    get isNonCustodial(): boolean;
+    /**
+     * Sign a 32-byte message digest with this wallet's key (2-of-3 threshold MPC).
+     *
+     * `digest` is a 32-byte hash as hex (the `0x` prefix is optional) — e.g. the
+     * keccak-256 of an EVM transaction. Hashing a higher-level message/transaction
+     * into a digest is the caller's (or a chain helper's) responsibility.
+     *
+     * **Passkey step-up (Pattern B / issue #21, #39):** pass `{ requirePasskey: true }` to run a
+     * WebAuthn assertion before signing. The SDK fetches a **server-issued one-time challenge**,
+     * prompts the user's authenticator over it, and attaches `passkeyAssertion` + its
+     * `passkeyChallengeId` to the POST body; the backend verifies both the MPC signature and the
+     * assertion, then burns the challenge (so it cannot be replayed). Alternatively supply a
+     * pre-built assertion via `options.passkeyAssertion` (with its `options.passkeyChallengeId`).
+     */
+    sign(digest: string, options?: SignOptions): Promise<string>;
+    /**
+     * Send a transaction from this wallet. The platform builds the chain-specific transaction
+     * and co-signs it with the 2-of-3 MPC quorum, returning the **signed raw transaction**.
+     * `value` is in the chain's base unit (wei) as a numeric string.
+     *
+     * **WaaS is sign-only — it never broadcasts.** The result's {@link SendResult.signedTx} is
+     * the signed raw tx the *client* submits to its own node/provider (see
+     * {@link Waaskey.broadcast} or your own submitter); {@link SendResult.txHash} is a
+     * deterministic offline id for reference, not proof of broadcast.
+     *
+     * **Passkey step-up (Pattern B / issue #21, #39):** pass `{ requirePasskey: true }` to run a
+     * WebAuthn assertion before sending, over a server-issued one-time challenge (verified + burned
+     * server-side). Alternatively supply a pre-built assertion via `options.passkeyAssertion`.
+     */
+    send(params: SendParams, options?: SendOptions): Promise<SendResult>;
+    /**
+     * Device-co-signed send for an ed25519 (FROST) wallet (#110) — the browser holds the device FROST
+     * share and co-signs 2-party with the backend `server` party over the relay:
+     *
+     * 1. **START** (`POST …/send-session`): the backend builds the unsigned tx (chain adapter), starts
+     *    its server FROST party on the relay in the background, and returns the raw `message` bytes to
+     *    sign + the relay coordination ({@link EddsaSendSession}).
+     * 2. **CO-SIGN**: the device runs `signEddsa` over the relay with its stored `{keyPackage,
+     *    publicKeyPackage}` share; the two parties aggregate the RFC 8032 signature (returned locally).
+     * 3. **ASSEMBLE** (`POST …/send-session/:txId/assemble`): the backend embeds the aggregated
+     *    signature into the wire tx (chain adapter) and returns the signed raw tx + offline `txHash`.
+     *
+     * WaaS stays sign-only: the returned {@link SendResult.signedTx} is what the client broadcasts.
+     */
+    private sendEd25519;
+    /**
+     * Attach a passkey step-up assertion to `body` when the caller requests one (issue #39).
+     *
+     * The challenge is a **server-issued one-time nonce**, never derived from the request
+     * payload: the SDK fetches it from the step-up challenge endpoint, runs the WebAuthn
+     * assertion over it, and echoes its `challengeId` so the server can verify and burn it —
+     * making a captured assertion non-replayable. A pre-built `passkeyAssertion` (with its
+     * `passkeyChallengeId`) is attached as-is and takes precedence over `requirePasskey`.
+     */
+    private attachStepUp;
+    /**
+     * List this wallet's **signing activity**, newest first (paginated) — the unified audit
+     * trail of what this key signed (raw signs and send/sweep signed txs, #289). A send/sweep
+     * record carries the `signedTx` the client broadcasts.
+     */
+    signatures(query?: PageQuery, options?: SendOptions): Promise<Page<Signature>>;
 }
 
-/** The `wallets` resource: create and load wallets. */
+/** Dependencies a {@link Wallets} resource needs for the non-custodial ceremony. */
+interface WalletsDeps {
+    mpc?: MpcCore;
+    shareStore?: ShareStore;
+    /** Optional pool of pre-generated primes; when present, keygen claims one instead of generating inline. */
+    primePool?: PrimePool;
+    /** Optional analytics emitter for wallet lifecycle events. */
+    analytics?: Analytics;
+}
+/**
+ * The `wallets` resource: create and load wallets, plus the approver actions
+ * ({@link Wallets.approveSignRequest}/{@link Wallets.declineSignRequest}) and the approver
+ * queue listing ({@link Wallets.listSignRequests}/{@link Wallets.listPendingApprovals}) on
+ * their async signing requests (#229, #309, #329).
+ */
 declare class Wallets {
     private readonly http;
-    constructor(http: HttpClient);
-    /** Create a new MPC wallet on the given chain. */
-    create(params: CreateWalletParams): Promise<Wallet>;
+    private readonly deps;
+    constructor(http: HttpClient, deps?: WalletsDeps);
+    /**
+     * Create a new MPC wallet on the given chain. The keygen is a `t`-of-`n` ceremony:
+     *
+     * 1. ask the API to start a wallet + the server party (returns the ceremony params),
+     * 2. run the **device** half of keygen locally (in WASM) against the relay,
+     * 3. seal + persist the device share (it never leaves the device),
+     * 4. wait until the wallet is ACTIVE (server party finished) and return it.
+     *
+     * By default (no custody policy) this is the embedded **2-of-3** topology. Supply an
+     * explicit `{ threshold, parties, custodyKinds }` and/or a requested `custodyType` to
+     * change the topology / custody posture — the SDK validates it client-side (see
+     * {@link validateCustodyPolicy}) and the backend enforces the attested invariant. The
+     * device runs whatever `t`-of-`n` the returned ceremony describes (its `parties` /
+     * `threshold`), so the ceremony is not pinned to 2-of-3.
+     *
+     * **Non-custodial `[device, server, user_backup]` (#351/#78).** When the returned ceremony carries a
+     * `user_backup` party ({@link WalletCeremony.additionalParties}), the platform signer drives ONLY the
+     * `server` share, so this ONE device runs BOTH client parties in the SAME keygen ceremony — the
+     * `device` party AND the client-held `user_backup` party — joining the same relay session with each
+     * party's own relay token. It then persists the `device` share locally (as always) and, because there
+     * is no platform recovery share, seals the `user_backup` share with the caller's recovery code and
+     * registers the ciphertext server-side (reusing the recovery mechanism), so device-loss can never lock
+     * funds. This path therefore REQUIRES `options.backup`. The sealed backup is persisted to a local
+     * pending slot BEFORE the network call, so if registration fails the (non-re-derivable) share is not
+     * lost — `create` throws `backup_failed` and {@link retryBackup} re-registers it (no re-keygen).
+     *
+     * Requires `mpc` + `shareStore` on the client. The device share is the user's half
+     * of the key; without storing it the wallet would be unrecoverable.
+     */
+    create(params: CreateWalletParams, options?: CreateWalletOptions): Promise<Wallet>;
+    /**
+     * Create a **member-bound** wallet (#342-#349): an N+1 threshold topology where `N` specific ORG
+     * MEMBERSHIPS (`shareholderMembershipIds`) each hold one share and the platform holds exactly
+     * one (a derived `shared` custody topology — never `embedded`). Unlike {@link create} (the
+     * embedded device+server(+recovery) flow, which runs the device's keygen inline and waits for
+     * ACTIVE), this wallet is provisioned `pending_keygen` with **no ceremony to join here** — it
+     * has no `mpc`/`shareStore` dependency and no custody-policy validation (that machinery is for
+     * the raw `parties`/`custodyKinds` embedded topology, mutually exclusive with
+     * `shareholderMembershipIds` server-side). Each invited member later runs {@link joinCeremony}
+     * from their OWN device/session; the wallet only activates once every member has joined.
+     */
+    createWallet(params: CreateMemberWalletParams, options?: {
+        signal?: AbortSignal;
+    }): Promise<WalletData>;
+    /**
+     * Warm the prime pool for a chain's curve OFF the hot path — call during onboarding/idle (ideally
+     * from a Web Worker) so the next {@link create} on that chain doesn't pay the safe-prime cost.
+     * No-op when no prime pool is configured.
+     */
+    prewarm(chain: CreateWalletParams['chain']): Promise<void>;
     /** Load an existing wallet by id. */
-    get(id: string): Promise<Wallet>;
+    get(id: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<Wallet>;
+    /** The device core + share store a {@link Wallet} needs to co-sign an ed25519 (FROST) tx locally. */
+    private walletDeviceDeps;
+    /**
+     * Join a **member-bound** wallet's multi-device keygen ceremony (#344, #349) as an invited org
+     * member — call this from the member's OWN device/session (never a tenant API key: every HTTP
+     * call here is member-session-authenticated, see {@link HttpClient.requestAsMember}). Unlike
+     * {@link create}, every member (N of them) + the platform join the SAME relay session, so:
+     *
+     * 1. fetch this member's own party ({@link MemberCeremony}) plus the wallet's other
+     *    share-holders (to derive the full n-party relay roster the ceremony needs),
+     * 2. ack readiness (`POST .../ceremony/join`) — the backend starts its platform party's own
+     *    relay connection only once EVERY member has acked, so this must happen before the ceremony
+     *    can complete,
+     * 3. run this device's half of the n-party keygen over the relay (blocks until every party,
+     *    including the platform, is present and the ceremony completes),
+     * 4. seal + persist the device's ONE share, keyed by `(walletId, membershipId)` — never by
+     *    `walletId` alone, since several members' shares for the SAME wallet may live in one
+     *    `shareStore` (e.g. a shared device, or a test harness).
+     *
+     * Safe to retry: a failed ceremony reopens the roster server-side, and re-acking/re-running is
+     * idempotent from the caller's perspective.
+     */
+    joinCeremony(walletId: string, options?: JoinCeremonyOptions): Promise<MemberCeremonyJoinResponse>;
+    /**
+     * Join a **member-bound** wallet's multi-device SIGN ceremony (#347, #349) as an invited org
+     * member — the signing analogue of {@link joinCeremony}, called from the member's OWN
+     * device/session. A sign is a `t`-of-`n` SELECTION (only `t` of the N+1 parties actually sign),
+     * so the flow is:
+     *
+     * 1. cast this member's APPROVE vote (`POST .../sign-requests/:reqId/approve`) — a no-op if
+     *    already cast; once `t-1` members have approved, the backend fixes the signing quorum,
+     * 2. poll this member's own sign-ceremony party (`GET .../sign-requests/:reqId/ceremony/mine`)
+     *    until the quorum is fixed AND this member was selected into it ({@link MemberSignCeremony.ready}),
+     * 3. load this member's OWN stored share (keyed by `(walletId, membershipId)`, from
+     *    {@link joinCeremony}) and run this device's half of the fixed-quorum sign ceremony —
+     *    the interactive protocol's public output IS the completed signature.
+     *
+     * A member who is not selected into the fixed quorum, or whose approval never gets it there,
+     * simply times out (`sign_ceremony_timeout`) rather than running anything.
+     */
+    joinSignCeremony(walletId: string, reqId: string, options?: JoinSignCeremonyOptions): Promise<DeviceSignResult>;
+    /**
+     * Approve a pending async signing request (#229) — either completing a single
+     * device-approval request outright, or casting one APPROVE vote in an M-of-N approver
+     * quorum (#309) configured on the wallet (via the tenant dashboard's `PUT .../quorum`). A
+     * non-quorum request starts the MPC ceremony immediately; a quorum request only starts
+     * it once enough approvers vote, and until then the response reports how many
+     * approvals are still needed via {@link SigningRequestResponse.approvalsRemaining}.
+     *
+     * Takes `walletId` + `reqId` directly (rather than a {@link Wallet} instance) since an
+     * approver typically learns of a pending request out-of-band — e.g. a
+     * `sign_request.created` webhook or push notification — without first loading the wallet.
+     */
+    approveSignRequest(walletId: string, reqId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SigningRequestResponse>;
+    /**
+     * Decline a pending async signing request (#229) — either rejecting a single
+     * device-approval request outright, or casting a REJECT vote in an M-of-N approver
+     * quorum (#309), which declines the request as soon as one approver rejects it.
+     */
+    declineSignRequest(walletId: string, reqId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SigningRequestResponse>;
+    /**
+     * List a wallet's async signing requests, newest first (paginated) — optionally filtered to
+     * a single lifecycle {@link SignRequestsQuery.status} (#332). The API paginates the
+     * *filtered* set, so `total`/`page` always describe what was actually matched.
+     */
+    listSignRequests(walletId: string, query?: SignRequestsQuery, options?: {
+        signal?: AbortSignal;
+    }): Promise<Page<SigningRequestResponse>>;
+    /**
+     * List a wallet's **pending approver queue** — the ergonomic entry point over
+     * {@link listSignRequests} pinned to `status: 'pending_approval'` (#309, #329): the
+     * requests currently awaiting an approver's {@link approveSignRequest}/
+     * {@link declineSignRequest} vote, either a single device-approval request or one still
+     * short of its M-of-N quorum (see {@link SigningRequestResponse.approvalsRemaining}).
+     */
+    listPendingApprovals(walletId: string, query?: PageQuery, options?: {
+        signal?: AbortSignal;
+    }): Promise<Page<SigningRequestResponse>>;
+    /**
+     * Run the cggmp24 (secp256k1) device keygen and persist the resulting share(s) (#351/#78). Two shapes,
+     * chosen by whether the ceremony carries client-held extra parties ({@link WalletCeremony.additionalParties}):
+     *
+     * - **Single client party** (today's path — `[device, server]` or custodial `[device, server, recovery]`,
+     *   where the platform drives every non-device party): run just the `device` party and seal its share
+     *   under the wallet id, exactly as before.
+     * - **Non-custodial `[device, server, user_backup]`** (a `user_backup` extra party): run BOTH the
+     *   `device` and `user_backup` parties CONCURRENTLY in the SAME relay session (each with its own
+     *   role-scoped relay token + its OWN Paillier primes), then persist the `device` share locally and
+     *   seal + register the `user_backup` share as the non-custodial backup (requires `backup`).
+     *
+     * Any additional party the client cannot drive (a non-`user_backup` role) is refused up front — leaving
+     * it unjoined would hang the whole ceremony, so failing loud beats silently deadlocking.
+     */
+    private runSecpKeygen;
+    /**
+     * Register a sealed user_backup {@link RecoveryRegisterPayload} server-side, with a small bounded retry
+     * on TRANSIENT failures (network / 5xx / rate-limit) — a flaky moment must not cost the backup. A
+     * non-transient failure (4xx) fails fast. On abort, the abort propagates unchanged. If it ultimately
+     * cannot register, throws a distinct, actionable {@link WaaskeyError} `backup_failed` (NOT `keygen_failed`)
+     * — the caller's cue that the wallet was created but its backup is only local, and pointing at
+     * {@link retryBackup}. The pending slot is intentionally NOT touched here, so a failure leaves the
+     * sealed share intact for the retry.
+     */
+    private registerBackup;
+    /**
+     * Re-register a non-custodial wallet's user_backup backup that a previous {@link create} sealed locally
+     * but could not register (a `backup_failed` create) (#351/#78). Reads the LOCAL pending-backup slot's
+     * sealed ciphertext and re-POSTs it — **no re-keygen** (the share is not re-derivable) — with the same
+     * bounded transient retry, then clears the slot on success. Idempotent-ish: a no-op `share_not_found`
+     * when nothing is pending (already registered, or never created here). Requires a share store.
+     */
+    retryBackup(walletId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<RecoveryShareInfo>;
+    /**
+     * Device-loss RECOVERY CO-SIGN for a non-custodial `[device, server, user_backup]` secp256k1 wallet
+     * (#351/#78). When the device is lost, the user restores their client-held `user_backup` share from the
+     * sealed server-side backup and co-signs `digest` with the platform's `server` party — the 2-party
+     * `{server, user_backup}` quorum. This is NOT the platform-only custodial `{server, recovery}` recoverSign
+     * (`recovery.recoverSign` / `POST …/recovery/recover-sign`): here the platform CANNOT sign alone; the
+     * user's restored share is the co-signing factor.
+     *
+     * 1. **RESTORE** — retrieve the sealed `user_backup` ciphertext (the multi-factor recovery gate,
+     *    {@link RecoverParams}, releases it) and open it with the recovery code CLIENT-SIDE (Contract A: the
+     *    raw code never leaves the device), yielding the cggmp24 `user_backup` KeyShare. No registered backup
+     *    fails `share_not_found`; a wrong recovery code fails `invalid_recovery_code` — either BEFORE any
+     *    ceremony starts, so a bad restore never signs (and never hangs).
+     * 2. **START** — `POST /v1/wallets/:id/recover-sign-session` with the digest (+ passkey step-up when the
+     *    wallet requires it, threaded exactly like a normal sign via `options`) → the `user_backup` party's
+     *    ceremony descriptor: its role, the `{server, user_backup}` keygen `participants`, this party's
+     *    `signerPosition`, and a `user_backup`-role relay token.
+     * 3. **CO-SIGN** — run the `user_backup` MPC party ({@link MpcCore.runSign}) over the relay with the
+     *    restored share + that descriptor; the platform `server` party co-signs server-side. Returns the
+     *    resulting signature.
+     *
+     * The ONLY differences from a normal `{device, server}` device sign are the SHARE (the restored
+     * `user_backup`, not the local device share) and the DESCRIPTOR (from the recover-sign session, not the
+     * normal sign session) — the same {@link MpcCore.runSign} relay machinery drives both.
+     *
+     * Requires `mpc` on the client (the co-signing core). No share store is needed: the restored share is
+     * held only in memory for the ceremony and never persisted (the device is lost/new). secp256k1 only —
+     * re-provisioning a fresh device share (reshare back to a full 2-of-3) is a separate follow-up.
+     */
+    recoverSign(walletId: string, params: RecoverSignParams, options?: SignOptions): Promise<string>;
+    /**
+     * Retrieve the sealed `user_backup` ciphertext via the recovery gate ({@link fetchRecoveryCiphertext}),
+     * mapping a "no recovery share registered" (404) to the actionable `share_not_found` — this wallet has no
+     * client-held `user_backup` backup to co-sign with (its device-loss recovery is the custodial path instead).
+     */
+    private fetchUserBackupCiphertext;
+    /**
+     * Run one or more device keygen parties (each `mpc.runKeygen`), concurrently, mapping any failure to a
+     * single `keygen_failed`. Used for both the single `device` party and the two-party non-custodial
+     * `[device, user_backup]` ceremony — one place owns the error contract so both paths stay identical.
+     */
+    private runKeygenParties;
+    /**
+     * Run the device half of an ed25519 (FROST) keygen (#110) and seal the resulting `{keyPackage,
+     * publicKeyPackage}` share — the EdDSA counterpart of the cggmp24 `runKeygen` branch in {@link create}.
+     * The device co-generates the group key with the backend `server` party over the relay; the FROST DKG
+     * is the 2-party {device, server} quorum the ceremony names (M6 scope), roster-addressed like the
+     * member ceremony rather than the cggmp24 single-peer shape.
+     */
+    private runEddsaKeygen;
+    /** Poll the wallet until keygen completes (ACTIVE), or throw on failure/timeout. */
+    private waitUntilActive;
+    /** Poll the member's own sign ceremony until the t-of-n quorum is fixed AND this member is selected, or throw on timeout. */
+    private waitUntilReady;
 }
+/**
+ * Storage key for a member-bound wallet's per-member share (#349) — distinct from the embedded
+ * flow's bare `walletId` key ({@link Wallet}'s single device share), since several members' shares
+ * for the SAME wallet may live in one {@link ShareStore} (e.g. a shared device, or a test harness).
+ */
+declare function memberShareKey(walletId: string, membershipId: string): string;
+/**
+ * Storage key for a non-custodial wallet's PENDING user_backup backup (#351/#78) — the sealed
+ * {@link RecoveryRegisterPayload} ciphertext {@link Wallets.create} persists before registering it
+ * server-side, so a failed/interrupted registration never loses the (non-re-derivable) user_backup share.
+ * Distinct from the device share's bare `walletId` key; cleared by {@link Wallets.retryBackup} on success.
+ * The value is opaque without the recovery code, so a local copy is a safe retry buffer.
+ */
+declare function userBackupPendingKey(walletId: string): string;
 
 /**
  * The Waaskey client — entry point of the SDK.
  *
  * @example
  * ```ts
- * import { Waaskey } from '@waaskey/sdk';
+ * import { Waaskey, WasmMpcCore, EncryptedShareStore } from '@waaskey/sdk';
  *
- * const waaskey = new Waaskey({ apiKey: process.env.WAASKEY_PUBLISHABLE_KEY! });
- * const wallet = await waaskey.wallets.create({ userId: user.id, chain: 'ethereum' });
- * const signature = await wallet.signMessage('Hello Waaskey');
+ * const waaskey = new Waaskey({
+ *   apiKey: process.env.WAASKEY_PUBLISHABLE_KEY!,
+ *   mpc: new WasmMpcCore(loadClientWasm),
+ *   shareStore: EncryptedShareStore.browser(sessionSecret),
+ * });
+ * const wallet = await waaskey.wallets.create({ chain: 'ethereum' });
+ * const signature = await wallet.sign(digestHex);
  * ```
  */
 declare class Waaskey {
     /** The `wallets` resource. */
     readonly wallets: Wallets;
+    /** The `recovery` resource — multi-factor, client-encrypted wallet recovery. */
+    readonly recovery: Recovery;
+    /** The `reshare` resource — device-side completion of a device-retaining reshare (#318). */
+    readonly reshare: Reshare;
+    /** The `balances` resource — client-side balance reads from a chain provider (no backend). */
+    readonly balances: Balances;
+    /** The `auth` resource — embedded end-user login (email-OTP, …) → non-custodial wallet. */
+    readonly auth: Auth;
+    /** The `members` resource — org-member (dashboard "plane B") bearer login for headless consumers. */
+    readonly members: Members;
+    /** The `onramp` resource — fund the wallet with fiat via a provider on-ramp. */
+    readonly onramp: Onramp;
+    /** Default fetch used by the optional {@link broadcast} helper (from `WaaskeyOptions.fetch`). */
+    private readonly defaultFetch?;
     constructor(options: WaaskeyOptions);
+    /**
+     * **Optional** client-side broadcast of a signed raw tx from {@link Wallet.send}.
+     *
+     * WaaS is a **signing service** — `wallet.send(...)` returns `signedTx` and WaaS never
+     * submits it. This is a thin, best-effort convenience to broadcast from **your own**
+     * node/provider (one JSON-RPC call, no status polling / no retries — tracking is your
+     * concern). Most integrators broadcast with their own infra.
+     *
+     * @example
+     * ```ts
+     * const { signedTx } = await wallet.send({ chainId: 'evm:1', to, value });
+     * const { txHash } = await waaskey.broadcast(signedTx, { rpcUrl: 'https://your-rpc' });
+     * ```
+     */
+    broadcast(signedTx: string, options: BroadcastOptions): Promise<BroadcastResult>;
 }
 
-export { type Chain, type CreateWalletParams, Waaskey, WaaskeyError, type WaaskeyOptions, Wallet, type WalletData, Wallets };
+/**
+ * Whether a wallet is **non-custodial** — the platform alone cannot produce a
+ * signature because the shares it holds do not meet the threshold
+ * (`platformShareCount < threshold`, i.e. custody type `shared` or `self_custody`).
+ *
+ * This mirrors the server-attested invariant `platformShares < t ⟺ non-custodial`,
+ * so an app can display the custody guarantee straight off the returned wallet.
+ */
+declare function isNonCustodial(wallet: Pick<WalletData, 'platformShareCount' | 'threshold'>): boolean;
+/**
+ * Validate a create-wallet custody policy client-side, before the request — clear
+ * errors instead of a round-trip to a 400. A no-op when no policy is supplied
+ * (the default embedded 2-of-3 topology).
+ *
+ * The rules mirror the backend contract: `parties` (when supplied) are ≥2 distinct,
+ * non-empty roles that define `n`; `threshold` is an integer in `[2, n]`; and
+ * `custodyKinds` has exactly one known kind per party.
+ */
+declare function validateCustodyPolicy(params: Pick<CreateWalletParams, 'threshold' | 'parties' | 'custodyKinds' | 'custodyType'>): void;
+
+/**
+ * **Optional** client-side broadcast helper.
+ *
+ * WaaS is a **signing service**, not a broadcaster: `wallet.send(...)` returns the
+ * signed raw transaction (`signedTx`) and WaaS never submits it. Broadcasting,
+ * nonce/mempool handling and status-tracking are the integrator's concern — that
+ * is what non-custodial means. This helper is a thin convenience so you can submit
+ * a signed tx from **your own** node/provider; it is deliberately best-effort:
+ * one JSON-RPC call, **no status polling and no retries**. For production you will
+ * usually broadcast (and track) with your own infra.
+ *
+ * Today it submits an EVM raw transaction via `eth_sendRawTransaction`. The node's
+ * returned hash is passed through as {@link BroadcastResult.txHash}.
+ */
+declare function broadcast(signedTx: string, options: BroadcastOptions): Promise<BroadcastResult>;
+
+/**
+ * PasskeyPrfSecretProvider — derives a stable AES-key secret from a passkey's
+ * PRF extension output, so the device share in {@link EncryptedShareStore} is
+ * sealed under a biometric-gated passkey rather than a password.
+ *
+ * ### How the secret stays stable
+ * The PRF extension evaluates a pseudo-random function keyed by the credential
+ * (stored in the authenticator) over a caller-supplied `salt`.  `enroll()` mints a
+ * **random per-user salt** (issue #41) and returns it alongside `credentialId`;
+ * persist both (they are non-secret) and pass the salt back to `unlock()`. Because
+ * the credential and the salt are the same, the PRF output — and therefore the
+ * derived `secret` — is identical on every `unlock()`. (A random per-user salt,
+ * rather than one global constant, prevents cross-context PRF correlation.)
+ *
+ * ### Wiring to EncryptedShareStore
+ * ```ts
+ * import { PasskeyPrfSecretProvider } from '@waaskey/sdk';
+ * import { EncryptedShareStore } from '@waaskey/sdk';
+ *
+ * const prf = new PasskeyPrfSecretProvider();
+ * const { credentialId, secret } = await prf.enroll({ rpName: 'My App', userName: user.email });
+ * // persist credentialId (non-secret); keep secret in memory for this session
+ * const store = EncryptedShareStore.browser(secret);
+ *
+ * // On a subsequent session:
+ * const { secret } = await prf.unlock(credentialId);
+ * const store = EncryptedShareStore.browser(secret);
+ *
+ * // @waaskey/react:  usePrfStore() wraps the above + stores credentialId in localStorage.
+ * // react-native:    use a native PRF authenticator, supply a custom PrfCeremony.
+ * ```
+ */
+
+/**
+ * Override the underlying WebAuthn ceremony calls.  Useful for React Native
+ * (pass a native PRF authenticator module) or tests (mock the PRF output).
+ */
+interface PrfCeremony {
+    register(options: PublicKeyCredentialCreationOptionsJSON): Promise<{
+        credentialId: string;
+        prfResult: ArrayBuffer | null;
+    }>;
+    authenticate(credentialId: string, options: PublicKeyCredentialRequestOptionsJSON): Promise<{
+        prfResult: ArrayBuffer | null;
+    }>;
+}
+/** Options accepted by `PasskeyPrfSecretProvider.enroll(...)`. */
+interface PasskeyPrfEnrollOptions {
+    /**
+     * Human-readable name for the relying party (your app).  Used in the
+     * authenticator's registration ceremony UI.
+     */
+    rpName?: string;
+    /** Display name shown in the authenticator UI for the user. */
+    userName?: string;
+    /**
+     * Fully qualified domain name of the relying party.  Defaults to the current
+     * origin's hostname in the browser.  Must match the value used for `unlock()`.
+     */
+    rpId?: string;
+    /** Custom ceremony (for non-browser runtimes or tests). */
+    ceremony?: PrfCeremony;
+}
+/** Result of a successful `enroll()` or `unlock()`. */
+interface PasskeyPrfResult {
+    /** Credential id (Base64URL).  Persist this — pass it to `unlock()` later. */
+    credentialId: string;
+    /**
+     * Base64-encoded per-user PRF evaluation salt (issue #41). Non-secret — persist it
+     * alongside `credentialId` and pass it back to `unlock({ salt })` so the same secret
+     * is re-derived. Omitting it on `unlock` falls back to the legacy constant salt.
+     */
+    salt: string;
+    /**
+     * Base64-encoded 32-byte PRF output.  Use as the `secret` argument to
+     * `EncryptedShareStore.browser(secret)`.  Keep in memory; never persist it.
+     */
+    secret: string;
+}
+/**
+ * Returns `true` if the current runtime has WebAuthn available at all.
+ * A `false` result means passkeys are completely unavailable; fall back to
+ * password or device-secret share sealing.
+ */
+declare function isPasskeySupported(): boolean;
+/**
+ * Returns `true` if the current platform authenticator supports the PRF
+ * extension (needed for passkey share sealing).
+ *
+ * This is a best-effort probe — not all browsers expose `credentials.get` in a
+ * way that lets us query PRF support without a full ceremony.  For definitive
+ * detection, attempt `enroll()` and handle the `unsupported` error.
+ *
+ * In practice: Chrome 116+ / Edge 116+ on a platform authenticator support PRF;
+ * Safari / iOS 17 do not yet.
+ */
+declare function isPrfSupported(): Promise<boolean>;
+/**
+ * Derives a stable AES-key `secret` from a passkey's PRF extension for use with
+ * {@link EncryptedShareStore}.  The secret is deterministic: same credential +
+ * same fixed salt → same 32 bytes every time.
+ */
+declare class PasskeyPrfSecretProvider {
+    /**
+     * Register a new passkey that supports PRF and derive the initial secret from it.
+     *
+     * @returns `{ credentialId, secret }` — persist `credentialId`; use `secret`
+     * to construct `EncryptedShareStore.browser(secret)` for this session only.
+     *
+     * @throws `WaaskeyError('unsupported')` when PRF isn't available in this runtime.
+     * @throws `WaaskeyError('aborted')` when the user cancels the authenticator dialog.
+     */
+    enroll(opts?: PasskeyPrfEnrollOptions): Promise<PasskeyPrfResult>;
+    /**
+     * Authenticate with an existing passkey and re-derive the same stable secret.
+     *
+     * @param credentialId — the id returned by `enroll()`.
+     * @param opts.salt — the per-user salt `enroll()` returned (issue #41). Pass it to
+     *   re-derive the same secret; omit only for legacy credentials enrolled before
+     *   per-user salts (falls back to the constant salt).
+     * @returns `{ credentialId, salt, secret }` — reconstruct `EncryptedShareStore.browser(secret)`.
+     *
+     * @throws `WaaskeyError('unsupported')` when PRF isn't available.
+     * @throws `WaaskeyError('aborted')` when the user cancels.
+     */
+    unlock(credentialId: string, opts?: {
+        rpId?: string;
+        ceremony?: PrfCeremony;
+        salt?: string;
+    }): Promise<PasskeyPrfResult>;
+}
+
+/**
+ * Passkey step-up signing assertion (Pattern B).
+ *
+ * The backend accepts an optional `passkeyAssertion` (`AuthenticationResponseJSON`)
+ * on sign/send/recover DTOs and verifies it server-side.  This module runs the
+ * WebAuthn assertion over a **server-issued one-time challenge** and returns the
+ * typed `AuthenticationResponseJSON` ready to be included in the POST body.
+ *
+ * ### Challenge (issue #39 — replay-safe)
+ * The challenge is a random nonce the **server** mints (via a step-up challenge
+ * endpoint), NOT a value derived from the request payload. `Wallet.sign`/`send`
+ * fetch it, run the assertion over it, and echo its `challengeId` on the request;
+ * the server verifies the assertion against the stored challenge and **burns** it,
+ * so a captured assertion cannot be replayed for a later identical payload.
+ *
+ * ### Wiring in Wallet
+ * ```ts
+ * // In wallet.sign() (handled by Wallet.resolveStepUp):
+ * const { challengeId, challenge } = await http.request('POST', '/v1/wallets/${id}/stepup/challenge', { operation: 'sign' });
+ * const assertion = await getSigningAssertion(challenge, { credentialId });
+ * await http.request('POST', '/v1/wallets/${id}/sign', { message, passkeyAssertion: assertion, passkeyChallengeId: challengeId });
+ *
+ * // Caller opts in:
+ * await wallet.sign(digest, { requirePasskey: true });
+ * ```
+ */
+
+/**
+ * Returns `true` if the current runtime has WebAuthn available — i.e. the SDK
+ * can attempt a passkey assertion.  Use this as a fast pre-flight before calling
+ * `getSigningAssertion()` when you want to show/hide a "sign with passkey" button.
+ */
+declare function isPasskeyAssertionSupported(): boolean;
+/**
+ * Override the WebAuthn `credentials.get` call.  Useful for React Native (native
+ * passkey module) or unit tests (mock the assertion response).
+ */
+interface SigningAssertionCeremony {
+    get(options: PublicKeyCredentialRequestOptionsJSON): Promise<AuthenticationResponseJSON>;
+}
+/** Options for `getSigningAssertion()`. */
+interface SigningAssertionOptions {
+    /**
+     * Restrict the assertion to a specific credential.  Pass the `credentialId`
+     * that was enrolled (e.g. from `PasskeyPrfSecretProvider.enroll()`).  When
+     * omitted the browser presents all resident credentials for the RP.
+     */
+    credentialId?: string;
+    /**
+     * Fully qualified domain name of the relying party.  Defaults to the current
+     * origin's hostname in the browser.
+     */
+    rpId?: string;
+    /**
+     * Custom ceremony implementation (for React Native or tests).
+     */
+    ceremony?: SigningAssertionCeremony;
+}
+/**
+ * Run a WebAuthn assertion over a **server-issued one-time `challenge`** and return
+ * the typed `AuthenticationResponseJSON` to attach as `passkeyAssertion` in the
+ * request body.
+ *
+ * @param challenge — the base64url one-time challenge nonce from the server's
+ *   step-up challenge endpoint ({@link StepUpChallengeResponse.challenge}). It is
+ *   passed to the authenticator verbatim; the server verifies the assertion against
+ *   the stored challenge and burns it, so the assertion cannot be replayed.
+ * @param options — optional ceremony override and credential hint.
+ *
+ * @throws `WaaskeyError('unsupported')` when WebAuthn is not available in this runtime.
+ * @throws `WaaskeyError('aborted')` when the user cancels the authenticator prompt.
+ */
+declare function getSigningAssertion(challenge: string, options?: SigningAssertionOptions): Promise<AuthenticationResponseJSON>;
+
+export { Analytics, type AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, Auth, type Balance, Balances, type BroadcastOptions, type BroadcastResult, CLIENT_WASM_VERSION, type CeremonyParams, type Chain, type ChainConfig, type ChainProvider, type ClientWasmLoader, type ClientWasmModule, type CreateMemberWalletParams, type CreateWalletOptions, type CreateWalletParams, type CreateWalletResponse, type CustodyKind, type CustodyType, type DeviceCompleteReshareParams, type DeviceCompleteReshareResult, type DeviceKeygenParams, type DeviceKeygenResult, type DeviceReshareAssembleParams, type DeviceReshareAssembleResult, type DeviceReshareMaterial, type DeviceSignParams, type DeviceSignResult, type EddsaAssembleRequest, type EddsaCeremonyParams, type EddsaKeygenParams, type EddsaKeygenResult, type EddsaSendSession, type EddsaSignParams, type EddsaSignResult, type EmailStartResult, type EmbeddedSession, EncryptedShareStore, type EndUser, EvmRpcProvider, type FactorEnrollment, type FactorVerification, type FirebaseAuthRequest, HttpAnalyticsSink, IndexedDbKeyValueStore, type JoinCeremonyOptions, type JoinSignCeremonyOptions, type KeyValueStore, type Member, type MemberCeremony, type MemberCeremonyJoinResponse, type MemberCeremonyParams, type MemberKeygenParams, type MemberRole, type MemberSession, type MemberSignCeremony, type MemberSignParams, Members, type MembershipScope, MemoryKeyValueStore, MemoryPrimeStore, type MpcCore, type MpcCurve, Onramp, type OnrampWidgetParams, type OnrampWidgetUrl, type Page, type PageQuery, type PasskeyAssertionJSON, type PasskeyCeremony, type PasskeyPrfEnrollOptions, type PasskeyPrfResult, PasskeyPrfSecretProvider, type PrfCeremony, PrimePool, type PrimePoolOptions, type PrimePoolStore, type RecoverParams, type RecoverSignParams, type RecoverWalletResponse, Recovery, type RecoveryChallengeResponse, type RecoveryFactor, type RecoveryRetrieveResponse, type RecoveryShareInfo, type RegisterRecoveryParams, Reshare, type ReshareCompletionCeremony, type ReshareCompletionParams, type ReshareCompletionResult, type ReshareWalletResponse, type SendOptions, type SendParams, type SendResult, type ShareStore, type SignMessageResponse, type SignOptions, type SignRequestsQuery, type SignSessionResponse, type Signature, type SignatureKind, type SigningAssertionCeremony, type SigningAssertionOptions, type SigningRequestResponse, type SigningRequestStatus, type StepUpChallengeResponse, type StepUpOperation, type TokenBalanceOptions, type TxStatus, type VerifiedWasmLoaderOptions, Waaskey, WaaskeyError, type WaaskeyErrorCode, type WaaskeyErrorOptions, type WaaskeyOptions, Wallet, type WalletActionType, type WalletBackupParams, type WalletCeremony, type WalletCurve, type WalletData, type WalletShareholder, type WalletStatus, Wallets, WasmMpcCore, broadcast, createVerifiedClientWasmLoader, epochShareKey, formatUnits, generateRecoveryCode, getSigningAssertion, isNonCustodial, isPasskeyAssertionSupported, isPasskeySupported, isPrfSupported, loadClientWasm, memberShareKey, userBackupPendingKey, validateCustodyPolicy, verifyWasmIntegrity };