@waaskey/sdk 0.0.1 → 0.2.0

package/dist/index.cjs

@@ -1,104 +1,2670 @@
 'use strict';
 
-// src/types.ts
+var ed25519_js = require('@noble/curves/ed25519.js');
+
+// src/analytics/analytics.ts
+var Analytics = class {
+  constructor(sink) {
+    this.sink = sink;
+  }
+  sink;
+  track(type, props = {}) {
+    if (!this.sink) return;
+    try {
+      this.sink.track({ type, timestamp: (/* @__PURE__ */ new Date()).toISOString(), ...props });
+    } catch {
+    }
+  }
+};
+
+// src/analytics/http-sink.ts
+var HttpAnalyticsSink = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  track(event) {
+    void this.http.request("POST", "/v1/analytics/events", event).catch(() => void 0);
+  }
+};
+
+// src/errors.ts
 var WaaskeyError = class extends Error {
-  constructor(message, status, code) {
-    super(message);
-    this.status = status;
-    this.code = code;
+  code;
+  status;
+  details;
+  constructor(message, code, options = {}) {
+    super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
     this.name = "WaaskeyError";
+    this.code = code;
+    this.status = options.status;
+    this.details = options.details;
   }
-  status;
-  code;
 };
+var STATUS_CODES = {
+  400: "validation",
+  401: "unauthorized",
+  403: "forbidden",
+  404: "not_found",
+  409: "conflict",
+  429: "rate_limited"
+};
+function errorFromResponse(status, body) {
+  const code = STATUS_CODES[status] ?? (status >= 500 ? "server_error" : "unknown");
+  return new WaaskeyError(messageFromBody(body, status), code, { status, details: body });
+}
+function messageFromBody(body, status) {
+  if (body && typeof body === "object") {
+    const { message, error } = body;
+    if (Array.isArray(message)) return message.filter((m) => typeof m === "string").join("; ");
+    if (typeof message === "string" && message) return message;
+    if (typeof error === "string" && error) return error;
+  }
+  return `Request failed with status ${status}`;
+}
+
+// src/auth.ts
+var Auth = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  current;
+  /** Email one-time-code login. */
+  email = {
+    /** Send a login code to `email`. */
+    start: (email, signal) => this.http.request("POST", "/v1/embedded/auth/email/start", { email }, signal),
+    /** Verify the code; on success the end-user is provisioned and the session is established. */
+    verify: (email, code, signal) => this.establish("/v1/embedded/auth/email/verify", { email, code }, signal)
+  };
+  /** Phone one-time-code (SMS) login. `phone` is E.164, e.g. `+14155550123`. */
+  phone = {
+    /** Send a login code to `phone`. */
+    start: (phone, signal) => this.http.request("POST", "/v1/embedded/auth/phone/start", { phone }, signal),
+    /** Verify the code; on success the end-user is provisioned and the session is established. */
+    verify: (phone, code, signal) => this.establish("/v1/embedded/auth/phone/verify", { phone, code }, signal)
+  };
+  /** Social / federated-provider login. */
+  social = {
+    /**
+     * Exchange a Google ID token (obtained on the client via Google Identity Services) for a
+     * session. Requires the tenant's Google client id to be configured server-side.
+     */
+    google: (idToken, signal) => this.establish("/v1/embedded/auth/social/google", { idToken }, signal),
+    /**
+     * Exchange a Firebase ID token (obtained on the client via the Firebase Auth SDK) for a session
+     * — the Firebase analogue of {@link social.google}. Requires the tenant to have opted into
+     * embedded Firebase sign-in (`firebaseAuthEnabled`); when it hasn't, the API replies 412 and the
+     * SDK surfaces a typed `firebase_not_enabled` {@link WaaskeyError}.
+     */
+    firebase: (idToken, signal) => this.establish("/v1/embedded/auth/firebase", { idToken }, signal).catch((error) => {
+      if (error instanceof WaaskeyError && error.status === 412) {
+        throw new WaaskeyError("Firebase sign-in is not enabled for this tenant.", "firebase_not_enabled", { status: 412, cause: error, details: error.details });
+      }
+      throw error;
+    })
+  };
+  /**
+   * Passkey (WebAuthn) login. `register` adds a passkey to the **currently logged-in** end-user;
+   * `login` is usernameless (a passkey assertion resolves the user and establishes a session).
+   *
+   * The browser ceremony uses `@simplewebauthn/browser` (an optional peer dependency, loaded on
+   * demand). Pass a `ceremony` to override it — e.g. on React Native with a native authenticator.
+   */
+  passkey = {
+    /** Add a passkey to the logged-in end-user. Requires an active session. */
+    register: async (ceremony) => {
+      const token = this.requireToken();
+      const options = await this.http.request("POST", "/v1/embedded/auth/passkey/register/options", void 0, void 0, token);
+      const response = await (ceremony ?? await defaultCeremony()).create(options);
+      await this.http.request("POST", "/v1/embedded/auth/passkey/register/verify", { response }, void 0, token);
+    },
+    /** Usernameless passkey login — establishes the session on success. */
+    login: async (ceremony) => {
+      const { challengeId, options } = await this.http.request("POST", "/v1/embedded/auth/passkey/login/options", {});
+      const response = await (ceremony ?? await defaultCeremony()).get(options);
+      return this.establish("/v1/embedded/auth/passkey/login/verify", { challengeId, response });
+    }
+  };
+  /** The active session, or `undefined` when not logged in. */
+  get session() {
+    return this.current;
+  }
+  /** The end-user session token, or `undefined` when not logged in. */
+  get token() {
+    return this.current?.token;
+  }
+  /** Whether an end-user is currently logged in. */
+  get isAuthenticated() {
+    return this.current !== void 0;
+  }
+  /** The logged-in end-user (re-fetched from the session token). Rejects if not logged in. */
+  async me(signal) {
+    return this.http.request("GET", "/v1/embedded/auth/me", void 0, signal, this.requireToken());
+  }
+  /** Restore a session from a previously stored token (e.g. across reloads). */
+  restore(session) {
+    this.current = session;
+  }
+  /** Clear the session (sign out). */
+  logout() {
+    this.current = void 0;
+  }
+  /** POST a verify request, store the resulting session, and return it. */
+  async establish(path, body, signal) {
+    const session = await this.http.request("POST", path, body, signal);
+    this.current = session;
+    return session;
+  }
+  requireToken() {
+    if (!this.current) throw new WaaskeyError("Not authenticated \u2014 verify a login code first.", "unauthenticated");
+    return this.current.token;
+  }
+};
+async function defaultCeremony() {
+  let mod;
+  try {
+    mod = await import('@simplewebauthn/browser');
+  } catch {
+    throw new WaaskeyError('Passkeys need "@simplewebauthn/browser" installed, or pass a custom ceremony.', "unsupported");
+  }
+  return {
+    create: (options) => mod.startRegistration({ optionsJSON: options }),
+    get: (options) => mod.startAuthentication({ optionsJSON: options })
+  };
+}
+
+// src/balances/evm-provider.ts
+var SELECTOR_BALANCE_OF = "0x70a08231";
+var SELECTOR_DECIMALS = "0x313ce567";
+var EvmRpcProvider = class {
+  constructor(rpcUrl, fetchImpl) {
+    this.rpcUrl = rpcUrl;
+    const resolved = fetchImpl ?? globalThis.fetch;
+    if (!resolved) throw new WaaskeyError("No fetch implementation for the EVM provider.", "provider_error");
+    this.fetchImpl = resolved.bind(globalThis);
+  }
+  rpcUrl;
+  fetchImpl;
+  async getNativeBalance(address) {
+    return this.toBigInt(await this.call("eth_getBalance", [address, "latest"]));
+  }
+  async getTokenBalance(token, owner) {
+    const data = SELECTOR_BALANCE_OF + padAddress(owner);
+    return this.toBigInt(await this.call("eth_call", [{ to: token, data }, "latest"]));
+  }
+  async getTokenDecimals(token) {
+    const result = await this.call("eth_call", [{ to: token, data: SELECTOR_DECIMALS }, "latest"]);
+    return result === "0x" || result === void 0 ? 18 : Number(this.toBigInt(result));
+  }
+  async call(method, params) {
+    let res;
+    try {
+      res = await this.fetchImpl(this.rpcUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
+      });
+    } catch (cause) {
+      throw new WaaskeyError(`Chain RPC request failed (${method}).`, "provider_error", { cause });
+    }
+    if (!res.ok) throw new WaaskeyError(`Chain RPC returned ${res.status} (${method}).`, "provider_error", { status: res.status });
+    const json = await res.json().catch(() => ({}));
+    if (json.error) throw new WaaskeyError(`Chain RPC error (${method}): ${json.error.message ?? "unknown"}.`, "provider_error", { details: json.error });
+    return json.result;
+  }
+  toBigInt(hex) {
+    return hex && hex !== "0x" ? BigInt(hex) : 0n;
+  }
+};
+function padAddress(address) {
+  return address.replace(/^0x/i, "").toLowerCase().padStart(64, "0");
+}
+
+// src/balances/format.ts
+function formatUnits(raw, decimals) {
+  if (decimals === 0) return raw.toString();
+  const negative = raw < 0n;
+  const value = negative ? -raw : raw;
+  const base = 10n ** BigInt(decimals);
+  const whole = value / base;
+  const fraction = (value % base).toString().padStart(decimals, "0").replace(/0+$/, "");
+  const text = fraction ? `${whole}.${fraction}` : `${whole}`;
+  return negative ? `-${text}` : text;
+}
+
+// src/balances/balances.ts
+var NATIVE_ASSETS = {
+  ethereum: { symbol: "ETH", decimals: 18 },
+  polygon: { symbol: "POL", decimals: 18 },
+  arbitrum: { symbol: "ETH", decimals: 18 },
+  base: { symbol: "ETH", decimals: 18 },
+  optimism: { symbol: "ETH", decimals: 18 },
+  bitcoin: { symbol: "BTC", decimals: 8 },
+  solana: { symbol: "SOL", decimals: 9 }
+};
+var DEFAULT_EVM_RPC = {
+  ethereum: "https://eth.llamarpc.com",
+  polygon: "https://polygon-rpc.com",
+  arbitrum: "https://arb1.arbitrum.io/rpc",
+  base: "https://mainnet.base.org",
+  optimism: "https://mainnet.optimism.io"
+};
+var isEvm = (chain) => chain in DEFAULT_EVM_RPC;
+var Balances = class {
+  constructor(config = {}, fetchImpl) {
+    this.config = config;
+    this.fetchImpl = fetchImpl;
+  }
+  config;
+  fetchImpl;
+  providers = /* @__PURE__ */ new Map();
+  /** Native (gas-token) balance of an address on a chain. */
+  async getBalance(chain, address) {
+    const { symbol, decimals } = NATIVE_ASSETS[chain];
+    const raw = await this.provider(chain).getNativeBalance(address);
+    return { raw, decimals, symbol, formatted: formatUnits(raw, decimals) };
+  }
+  /** Token balance of `owner` for `token` on a chain (ERC-20 on EVM). */
+  async getTokenBalance(chain, token, owner, options = {}) {
+    const provider = this.provider(chain);
+    const raw = await provider.getTokenBalance(token, owner);
+    const decimals = options.decimals ?? (provider.getTokenDecimals ? await provider.getTokenDecimals(token) : 18);
+    return { raw, decimals, symbol: options.symbol, formatted: formatUnits(raw, decimals) };
+  }
+  /** Resolve (and cache) the provider for a chain: custom → configured RPC → default EVM RPC. */
+  provider(chain) {
+    const cached = this.providers.get(chain);
+    if (cached) return cached;
+    const cfg = this.config[chain];
+    let provider = cfg?.provider;
+    if (!provider) {
+      const rpcUrl = cfg?.rpcUrl ?? DEFAULT_EVM_RPC[chain];
+      if (rpcUrl && isEvm(chain)) provider = new EvmRpcProvider(rpcUrl, this.fetchImpl);
+    }
+    if (!provider) {
+      throw new WaaskeyError(`No chain provider configured for "${chain}". Pass chains: { ${chain}: { rpcUrl } } or a custom provider.`, "unsupported_chain");
+    }
+    this.providers.set(chain, provider);
+    return provider;
+  }
+};
+
+// src/broadcast.ts
+async function broadcast(signedTx, options) {
+  if (!signedTx) throw new WaaskeyError("`signedTx` is required to broadcast.", "validation");
+  if (!options?.rpcUrl) throw new WaaskeyError("`rpcUrl` is required \u2014 broadcast from your own node/provider.", "validation");
+  const fetchImpl = (options.fetch ?? globalThis.fetch)?.bind(globalThis);
+  if (!fetchImpl) throw new WaaskeyError("No fetch implementation for broadcast \u2014 pass `fetch`.", "provider_error");
+  const rawTx = signedTx.startsWith("0x") ? signedTx : `0x${signedTx}`;
+  let res;
+  try {
+    res = await fetchImpl(options.rpcUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "eth_sendRawTransaction", params: [rawTx] }),
+      signal: options.signal
+    });
+  } catch (cause) {
+    if (options.signal?.aborted) throw new WaaskeyError("Broadcast aborted.", "aborted", { cause });
+    throw new WaaskeyError("Broadcast request failed.", "provider_error", { cause });
+  }
+  if (!res.ok) throw new WaaskeyError(`Broadcast RPC returned ${res.status}.`, "provider_error", { status: res.status });
+  const json = await res.json().catch(() => ({}));
+  if (json.error) throw new WaaskeyError(`Broadcast rejected by the node: ${json.error.message ?? "unknown"}.`, "provider_error", { details: json.error });
+  if (!json.result) throw new WaaskeyError("Broadcast returned no transaction hash.", "provider_error");
+  return { txHash: json.result };
+}
 
 // src/http.ts
 var HttpClient = class {
   apiKey;
   baseUrl;
   fetchImpl;
+  memberAccessToken;
   constructor(apiKey, baseUrl, fetchImpl) {
     this.apiKey = apiKey;
-    this.baseUrl = baseUrl.replace(/\/$/, "");
+    this.baseUrl = assertSecureBaseUrl(baseUrl).replace(/\/$/, "");
     const resolved = fetchImpl ?? globalThis.fetch;
     if (!resolved) {
       throw new Error("No fetch implementation available \u2014 pass `fetch` in WaaskeyOptions.");
     }
     this.fetchImpl = resolved.bind(globalThis);
   }
-  async request(method, path, body) {
-    const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
-      method,
-      headers: {
-        authorization: `Bearer ${this.apiKey}`,
-        "content-type": "application/json"
-      },
-      body: body === void 0 ? void 0 : JSON.stringify(body)
-    });
+  /**
+   * Wire a provider of the held org-member access token (from {@link Members}). When it returns a
+   * token, {@link requestAsMember} authenticates member calls with `Authorization: Bearer <token>`
+   * rather than the ambient dashboard cookie. Injected by the client (not imported) so `Members` and
+   * `HttpClient` don't form an import cycle.
+   */
+  useMemberAccessToken(provider) {
+    this.memberAccessToken = provider;
+  }
+  async request(method, path, body, signal, bearer) {
+    return this.send(method, path, { authorization: `Bearer ${bearer ?? this.apiKey}`, "content-type": "application/json" }, body, signal);
+  }
+  /**
+   * `@Public` request: NO `Authorization` header and NO cookie. Used by the org-member Firebase
+   * login exchange (`POST /v1/auth/firebase`), which authenticates from the Firebase ID token in the
+   * body alone and returns the member bearer tokens in its response.
+   */
+  async requestPublic(method, path, body, signal) {
+    return this.send(method, path, { "content-type": "application/json" }, body, signal);
+  }
+  /**
+   * Member-session request (#349). Authenticates as the org member in one of two ways, transparent
+   * to the caller ({@link Wallets.joinCeremony} / {@link Wallets.joinSignCeremony}):
+   *
+   * - **Held bearer session** (a {@link memberAccessToken} provider returns a token — e.g. after
+   *   {@link Members.loginWithFirebase}): sends `Authorization: Bearer <accessToken>`. The backend's
+   *   `ApiKeyAuthGuard` recognises a non-API-key bearer and falls through to the member-session
+   *   resolver, so a headless (non-browser) consumer authenticates without a cookie.
+   * - **No held session** (the browser dashboard path): sends NO `Authorization` header and
+   *   `credentials: 'include'`, relying on the caller's own same-site httpOnly member cookie. The
+   *   guard only falls back to the cookie resolver when the header is absent entirely, so it is
+   *   omitted here.
+   *
+   * Never used by the tenant-apiKey ({@link request}) or embedded-end-user paths.
+   */
+  async requestAsMember(method, path, body, signal) {
+    const token = this.memberAccessToken?.();
+    if (token) {
+      return this.send(method, path, { authorization: `Bearer ${token}`, "content-type": "application/json" }, body, signal);
+    }
+    return this.send(method, path, { "content-type": "application/json" }, body, signal, "include");
+  }
+  async send(method, path, headers, body, signal, credentials) {
+    let res;
+    try {
+      res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+        method,
+        headers,
+        body: body === void 0 ? void 0 : JSON.stringify(body),
+        signal,
+        ...credentials === void 0 ? {} : { credentials }
+      });
+    } catch (cause) {
+      if (signal?.aborted) throw new WaaskeyError("Request aborted.", "aborted", { cause });
+      throw new WaaskeyError("Network request failed.", "network", { cause });
+    }
     if (!res.ok) {
       const detail = await res.json().catch(() => ({}));
-      const message = typeof detail.message === "string" ? detail.message : res.statusText;
-      const code = typeof detail.code === "string" ? detail.code : void 0;
-      throw new WaaskeyError(message, res.status, code);
+      throw errorFromResponse(res.status, detail);
+    }
+    const text = await res.text();
+    return text ? JSON.parse(text) : void 0;
+  }
+};
+function assertSecureBaseUrl(baseUrl) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch (cause) {
+    throw new WaaskeyError(`Invalid API baseUrl "${baseUrl}" \u2014 expected an absolute URL.`, "validation", { cause });
+  }
+  const isLoopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol === "https:") return baseUrl;
+  if (url.protocol === "http:" && isLoopback) return baseUrl;
+  throw new WaaskeyError(`Insecure API baseUrl "${baseUrl}" \u2014 the API key would be sent in cleartext. Use https:// (http:// is allowed only for localhost).`, "validation");
+}
+
+// src/members.ts
+var Members = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  held;
+  /**
+   * Exchange a Firebase ID token for an org-member session and hold it.
+   *
+   * The token must belong to an ALREADY-INVITED member — Firebase never self-provisions a member, so
+   * an unknown email is rejected (`no_member`). A member with 2FA enrolled must present a Firebase
+   * token that itself passed a second factor, or the login is refused (`mfa_required`).
+   *
+   * @throws {WaaskeyError} `no_member` — no org member exists for the token's Firebase identity (401).
+   * @throws {WaaskeyError} `mfa_required` — the member needs a second factor the token didn't carry (401).
+   */
+  async loginWithFirebase(idToken, signal) {
+    const body = { idToken };
+    let session;
+    try {
+      session = await this.http.requestPublic("POST", "/v1/auth/firebase", body, signal);
+    } catch (error) {
+      throw mapFirebaseMemberError(error);
+    }
+    this.held = session;
+    return session;
+  }
+  /** The current member, or `undefined` when not logged in. */
+  get member() {
+    return this.held?.member;
+  }
+  /** The held member session (access + refresh tokens + member), or `undefined` when not logged in. */
+  get session() {
+    return this.held;
+  }
+  /** The held member access token — the value the client wires into {@link HttpClient.requestAsMember}. */
+  get accessToken() {
+    return this.held?.accessToken;
+  }
+  /** Whether an org member is currently logged in over a held bearer session. */
+  get isAuthenticated() {
+    return this.held !== void 0;
+  }
+  /** Restore a previously stored member session (e.g. across process restarts). */
+  restore(session) {
+    this.held = session;
+  }
+  /** Clear the held member session (sign out); member calls fall back to the cookie path afterwards. */
+  memberSignOut() {
+    this.held = void 0;
+  }
+};
+function mapFirebaseMemberError(error) {
+  if (error instanceof WaaskeyError && error.status === 401) {
+    const message = error.message.toLowerCase();
+    if (message.includes("multi-factor") || message.includes("second factor")) {
+      return new WaaskeyError(error.message, "mfa_required", { status: 401, cause: error, details: error.details });
+    }
+    if (message.includes("no member account")) {
+      return new WaaskeyError(error.message, "no_member", { status: 401, cause: error, details: error.details });
     }
-    return await res.json();
+  }
+  return error;
+}
+
+// src/onramp.ts
+var Onramp = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Get a provider widget URL to buy `cryptoCurrency` on `chainId` for `walletAddress`. */
+  widgetUrl(params, signal) {
+    return this.http.request("POST", "/onramp/widget-url", params, signal);
   }
 };
 
+// src/storage/crypto.ts
+var PBKDF2_ITERATIONS = 21e4;
+var PBKDF2_HASH = "SHA-256";
+var SALT_BYTES = 16;
+var IV_BYTES = 12;
+var AES_KEY_BITS = 256;
+function subtle() {
+  const c = globalThis.crypto;
+  if (!c?.subtle) {
+    throw new Error("WebCrypto (crypto.subtle) is unavailable \u2014 a secure context (https/localhost) or Node \u2265 22 is required for share storage.");
+  }
+  return c.subtle;
+}
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+async function sha256Hex(input) {
+  const digest = await subtle().digest("SHA-256", new TextEncoder().encode(input));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function freshSalt() {
+  return randomBytes(SALT_BYTES);
+}
+async function deriveKey(secret, salt) {
+  const s = subtle();
+  const baseKey = await s.importKey("raw", new TextEncoder().encode(secret), "PBKDF2", false, ["deriveKey"]);
+  return s.deriveKey({ name: "PBKDF2", salt, iterations: PBKDF2_ITERATIONS, hash: PBKDF2_HASH }, baseKey, { name: "AES-GCM", length: AES_KEY_BITS }, false, [
+    "encrypt",
+    "decrypt"
+  ]);
+}
+async function seal(key, plaintext) {
+  const iv = randomBytes(IV_BYTES);
+  const data = new TextEncoder().encode(plaintext);
+  const ct = await subtle().encrypt({ name: "AES-GCM", iv }, key, data);
+  return `${bytesToBase64(iv)}.${bytesToBase64(new Uint8Array(ct))}`;
+}
+async function open(key, record) {
+  const dot = record.indexOf(".");
+  if (dot <= 0) throw new Error("Malformed encrypted share record.");
+  const iv = base64ToBytes(record.slice(0, dot));
+  const ct = base64ToBytes(record.slice(dot + 1));
+  try {
+    const plain = await subtle().decrypt({ name: "AES-GCM", iv }, key, ct);
+    return new TextDecoder().decode(plain);
+  } catch {
+    throw new Error("Failed to decrypt share \u2014 wrong secret or corrupted data.");
+  }
+}
+async function sealWithPassword(password, plaintext) {
+  const salt = freshSalt();
+  const key = await deriveKey(password, salt);
+  return `${bytesToBase64(salt)}.${await seal(key, plaintext)}`;
+}
+async function openWithPassword(password, record) {
+  const dot = record.indexOf(".");
+  if (dot <= 0) throw new Error("Malformed password-sealed record.");
+  const salt = base64ToBytes(record.slice(0, dot));
+  const key = await deriveKey(password, salt);
+  return open(key, record.slice(dot + 1));
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function base64ToBytes(base64) {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+
+// src/recovery.ts
+var MIN_FACTORS = 3;
+var Recovery = class {
+  constructor(http, deps = {}) {
+    this.http = http;
+    this.deps = deps;
+  }
+  http;
+  deps;
+  /**
+   * Back up a wallet's device share: encrypt it with the recovery code and enrol the
+   * factors. Returns the (possibly generated) recovery code — show it to the user
+   * once; it is the only key to the backup and is never recoverable from the server.
+   */
+  async register(walletId, params, options = {}) {
+    return registerRecoveryShare(this.http, walletId, params, options.signal);
+  }
+  /** The registered recovery factors for a wallet (no secrets). */
+  getInfo(walletId, options = {}) {
+    return this.http.request("GET", `/v1/wallets/${walletId}/recovery/info`, void 0, options.signal);
+  }
+  /** Start a recovery session — returns the challengeId + the factors the user must verify. */
+  challenge(walletId, options = {}) {
+    return this.http.request("POST", `/v1/wallets/${walletId}/recovery/challenge`, void 0, options.signal);
+  }
+  /**
+   * Device-loss recovery: verify factors, have the server rotate the key shares,
+   * then decrypt the backup with the recovery code and restore it to the share store
+   * (when one is configured). Returns when the share is restored.
+   */
+  async recover(walletId, params, options = {}) {
+    const res = await this.http.request(
+      "POST",
+      `/v1/wallets/${walletId}/recovery/recover`,
+      { challengeId: params.challengeId, verifications: await hashRecoveryFactors(params.verifications) },
+      options.signal
+    );
+    const share = await this.decrypt(res.ciphertext, params.recoveryCode);
+    await this.deps.shareStore?.put(walletId, share);
+    this.deps.analytics?.track("wallet.recovered", { walletId });
+    return { share, refreshedAt: res.refreshedAt };
+  }
+  /**
+   * Verify factors and decrypt the backed-up share **without** rotating keys — for a
+   * read-only restore. Use {@link recover} for true device-loss (which re-keys).
+   *
+   * NOTE (issue #41, LOW): because this path does not rotate the (possibly lost) device
+   * share, the server `/verify` endpoint must enforce that **all ≥3 factors** were
+   * satisfied before releasing the ciphertext; prefer {@link recover} (always-rotate) for
+   * device-loss so a leaked backup can't be replayed against a still-valid old share.
+   */
+  async retrieveShare(walletId, params, options = {}) {
+    const ciphertext = await fetchRecoveryCiphertext(this.http, walletId, params, options.signal);
+    return this.decrypt(ciphertext, params.recoveryCode);
+  }
+  async decrypt(ciphertext, recoveryCode) {
+    try {
+      return await openWithPassword(recoveryCode, ciphertext);
+    } catch (cause) {
+      throw new WaaskeyError("Could not decrypt the recovery share \u2014 wrong recovery code?", "recovery_failed", { cause });
+    }
+  }
+};
+async function buildRecoveryRegistration(params) {
+  const recoveryCode = params.recoveryCode ?? generateRecoveryCode();
+  const ciphertext = await sealWithPassword(recoveryCode, params.share);
+  const factors = [
+    { type: "recovery_code", credentialHash: await sha256Hex(recoveryCode) },
+    { type: "totp", credential: params.totpSecret },
+    { type: "email_otp", credential: params.email },
+    ...params.extraFactors ?? []
+  ];
+  if (factors.length < MIN_FACTORS) {
+    throw new WaaskeyError(`Recovery requires at least ${MIN_FACTORS} factors.`, "validation");
+  }
+  return { recoveryCode, payload: { ciphertext, factors } };
+}
+function postRecoveryRegistration(http, walletId, payload, signal) {
+  return http.request("POST", `/v1/wallets/${walletId}/recovery/register`, payload, signal);
+}
+async function fetchRecoveryCiphertext(http, walletId, params, signal) {
+  const res = await http.request(
+    "POST",
+    `/v1/wallets/${walletId}/recovery/verify`,
+    { challengeId: params.challengeId, verifications: await hashRecoveryFactors(params.verifications) },
+    signal
+  );
+  return res.ciphertext;
+}
+async function registerRecoveryShare(http, walletId, params, signal) {
+  const { recoveryCode, payload } = await buildRecoveryRegistration(params);
+  const share = await postRecoveryRegistration(http, walletId, payload, signal);
+  return { recoveryCode, share };
+}
+async function hashRecoveryFactors(verifications) {
+  return Promise.all(verifications.map(async (v) => v.type === "recovery_code" && v.token !== void 0 ? { type: v.type, credentialHash: await sha256Hex(v.token) } : v));
+}
+function generateRecoveryCode() {
+  const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+  const bytes = randomBytes(20);
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) {
+    out += alphabet[bytes[i] % alphabet.length];
+    if ((i + 1) % 4 === 0 && i + 1 < bytes.length) out += "-";
+  }
+  return out;
+}
+
+// src/chains.ts
+var CHAIN_CURVES = {
+  ethereum: "secp256k1",
+  polygon: "secp256k1",
+  arbitrum: "secp256k1",
+  base: "secp256k1",
+  optimism: "secp256k1",
+  bitcoin: "secp256k1",
+  // Solana signs with threshold EdDSA (ed25519 / FROST, #110): the device co-signs 2-party with the
+  // server `server` party over the relay (keygenEddsa / signEddsa), distinct from the cggmp24 path.
+  solana: "ed25519"
+};
+function curveForChain(chain) {
+  const curve = CHAIN_CURVES[chain];
+  if (!curve) {
+    throw new WaaskeyError(`Chain "${chain}" is not supported yet.`, "unsupported_chain");
+  }
+  return curve;
+}
+function toMpcCurve(curve) {
+  if (curve === "ed25519") {
+    throw new WaaskeyError("ed25519 (FROST) wallets do not use the cggmp24 curve-based MPC path.", "unsupported");
+  }
+  return curve;
+}
+
+// src/internal.ts
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw new WaaskeyError("Operation aborted.", "aborted");
+}
+function delay(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new WaaskeyError("Operation aborted.", "aborted"));
+      return;
+    }
+    const handle = {};
+    const onAbort = () => {
+      if (handle.timer) clearTimeout(handle.timer);
+      reject(new WaaskeyError("Operation aborted.", "aborted"));
+    };
+    handle.timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// src/reshare.ts
+var Reshare = class {
+  constructor(http, deps = {}) {
+    this.http = http;
+    this.deps = deps;
+  }
+  http;
+  deps;
+  /**
+   * Complete this device's share for a device-retaining reshare and make the wallet signable on the
+   * device under the new epoch.
+   *
+   * 1. Fetch the wallet to learn its (unchanged) public key — the invariant the completion is checked
+   *    against, taken from the server's truth rather than the caller.
+   * 2. Assemble the NEW-epoch bare core locally from {@link ReshareCompletionParams.material} (no relay).
+   * 3. Run the aux-completion ceremony over the relay ({@link ReshareCompletionParams.ceremony}),
+   *    alongside the platform server + recovery parties, to obtain the COMPLETE signable share.
+   * 4. Verify the completed share's public key equals the wallet's (fail closed on any mismatch).
+   * 5. Seal + persist the completed share under `(walletId, keyEpoch)`, keeping the old-epoch share.
+   *
+   * Requires `mpc` (built with the reshare capability) + `shareStore`. Idempotent/recoverable: safe to
+   * retry, since nothing is overwritten until the new share is assembled, verified, and stored.
+   */
+  async complete(walletId, params, options = {}) {
+    const { mpc, shareStore } = this.deps;
+    if (!mpc || !shareStore) {
+      throw new WaaskeyError("Completing a reshare requires a device MPC core and a share store \u2014 pass `mpc` and `shareStore` to `new Waaskey(...)`.", "device_core_required");
+    }
+    if (!mpc.runReshareAssemble || !mpc.runCompleteReshare) {
+      throw new WaaskeyError("The configured MPC core does not support reshare \u2014 use a client-wasm built with the `reshare` feature.", "unsupported");
+    }
+    const { material, ceremony, keyEpoch } = params;
+    const { signal } = options;
+    throwIfAborted(signal);
+    const wallet = await this.http.request("GET", `/v1/wallets/${walletId}`, void 0, signal);
+    if (!wallet.publicKey) {
+      throw new WaaskeyError("The wallet has no public key yet \u2014 it must be an ACTIVE reshared wallet to complete on device.", "reshare_failed", { details: { walletId } });
+    }
+    throwIfAborted(signal);
+    let completed;
+    try {
+      const assembled = await mpc.runReshareAssemble({
+        curve: toMpcCurve(material.curve),
+        newPosition: material.newPosition,
+        newPreimages: material.newPreimages,
+        newThreshold: material.newThreshold,
+        wallet: material.wallet,
+        commitments: material.commitments,
+        subShares: material.subShares
+      });
+      assertPublicKey(assembled.sharedPublicKey, wallet.publicKey, walletId);
+      throwIfAborted(signal);
+      completed = await mpc.runCompleteReshare({
+        curve: toMpcCurve(material.curve),
+        relayUrl: ceremony.relayUrl,
+        sessionId: ceremony.sessionId,
+        role: ceremony.role,
+        peerRole: ceremony.peerRole,
+        partyIndex: ceremony.partyIndex,
+        peerPartyIndex: ceremony.peerPartyIndex,
+        parties: ceremony.parties,
+        relayToken: ceremony.relayToken,
+        core: assembled.core,
+        pregeneratedPrimes: params.pregeneratedPrimes
+      });
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      throw new WaaskeyError("The device reshare-completion ceremony failed.", "reshare_failed", { cause });
+    }
+    assertPublicKey(completed.sharedPublicKey, wallet.publicKey, walletId);
+    await shareStore.put(epochShareKey(walletId, keyEpoch), serializeCompletedShare(completed));
+    this.deps.analytics?.track("wallet.reshared", { walletId, curve: material.curve });
+    return { walletId, keyEpoch, sharedPublicKey: completed.sharedPublicKey };
+  }
+};
+function epochShareKey(walletId, keyEpoch) {
+  return keyEpoch <= 1 ? walletId : `${walletId}@epoch-${keyEpoch}`;
+}
+function assertPublicKey(actual, expected, walletId) {
+  if (actual !== expected) {
+    throw new WaaskeyError("The reshared share reproduced a DIFFERENT public key than the wallet \u2014 aborting (device share not stored).", "reshare_pubkey_mismatch", {
+      details: { walletId, expected, actual }
+    });
+  }
+}
+function serializeCompletedShare(completed) {
+  return JSON.stringify({ keyShare: completed.keyShare, sharedPublicKey: completed.sharedPublicKey });
+}
+
+// src/custody.ts
+var CUSTODY_KINDS = /* @__PURE__ */ new Set(["user_device", "user_backup", "platform_signer", "platform_recovery", "external_party"]);
+var CUSTODY_TYPES = /* @__PURE__ */ new Set(["embedded", "shared", "self_custody"]);
+function isNonCustodial(wallet) {
+  return wallet.platformShareCount < wallet.threshold;
+}
+function validateCustodyPolicy(params) {
+  const { threshold, parties, custodyKinds, custodyType } = params;
+  if (threshold === void 0 && parties === void 0 && custodyKinds === void 0 && custodyType === void 0) return;
+  if (parties !== void 0) {
+    if (!Array.isArray(parties) || parties.length < 2) {
+      throw new WaaskeyError("`parties` must list at least 2 party roles.", "validation");
+    }
+    if (parties.some((role) => typeof role !== "string" || role.trim() === "")) {
+      throw new WaaskeyError("`parties` roles must be non-empty strings.", "validation");
+    }
+    if (new Set(parties).size !== parties.length) {
+      throw new WaaskeyError("`parties` roles must be distinct.", "validation");
+    }
+  }
+  if (threshold !== void 0) {
+    if (!Number.isInteger(threshold) || threshold < 2) {
+      throw new WaaskeyError("`threshold` must be an integer of at least 2.", "validation");
+    }
+    if (parties !== void 0 && threshold > parties.length) {
+      throw new WaaskeyError("`threshold` cannot exceed the number of parties.", "validation");
+    }
+  }
+  if (custodyKinds !== void 0) {
+    if (parties === void 0) {
+      throw new WaaskeyError("`custodyKinds` requires `parties` \u2014 they are parallel arrays.", "validation");
+    }
+    if (custodyKinds.length !== parties.length) {
+      throw new WaaskeyError("`custodyKinds` must have exactly one entry per party (same length as `parties`).", "validation");
+    }
+    const unknown = custodyKinds.find((kind) => !CUSTODY_KINDS.has(kind));
+    if (unknown !== void 0) {
+      throw new WaaskeyError(`\`custodyKinds\` contains an unknown custody kind: ${String(unknown)}.`, "validation");
+    }
+  }
+  if (custodyType !== void 0 && !CUSTODY_TYPES.has(custodyType)) {
+    throw new WaaskeyError(`\`custodyType\` is not a valid custody type: ${String(custodyType)}.`, "validation");
+  }
+}
+
+// src/eddsa-share.ts
+function serializeEddsaShare(keygen) {
+  return JSON.stringify({ keyPackage: keygen.keyPackage, publicKeyPackage: keygen.publicKeyPackage });
+}
+function deserializeEddsaShare(blob) {
+  let parsed;
+  try {
+    parsed = JSON.parse(blob);
+  } catch (cause) {
+    throw new WaaskeyError("Stored ed25519 device share is corrupt \u2014 it is not valid JSON.", "share_not_found", { cause });
+  }
+  if (parsed.keyPackage === void 0 || parsed.publicKeyPackage === void 0) {
+    throw new WaaskeyError("Stored ed25519 device share is malformed \u2014 it is missing its FROST key/public-key package.", "share_not_found", {
+      details: { keys: Object.keys(parsed) }
+    });
+  }
+  return { keyPackage: parsed.keyPackage, publicKeyPackage: parsed.publicKeyPackage };
+}
+var DEVICE_ENC_STORE_KEY = "__waaskey_device_enc_v1__";
+async function getOrCreateDeviceEncKeypair(shareStore) {
+  const existing = await shareStore.get(DEVICE_ENC_STORE_KEY);
+  if (existing !== null) return parseDeviceEncKeypair(existing);
+  const keypair = generateDeviceEncKeypair();
+  await shareStore.put(DEVICE_ENC_STORE_KEY, JSON.stringify(keypair));
+  return keypair;
+}
+function generateDeviceEncKeypair() {
+  const secret = ed25519_js.x25519.utils.randomSecretKey();
+  const publicKey = ed25519_js.x25519.getPublicKey(secret);
+  if (isAllZero(publicKey)) {
+    throw new WaaskeyError("Generated an all-zero X25519 encryption public key \u2014 refusing to seal keygen packages to it.", "keygen_failed");
+  }
+  return { secretHex: bytesToHex(secret), publicHex: bytesToHex(publicKey) };
+}
+function parseDeviceEncKeypair(blob) {
+  let parsed;
+  try {
+    parsed = JSON.parse(blob);
+  } catch (cause) {
+    throw new WaaskeyError("Stored device encryption keypair is corrupt \u2014 it is not valid JSON.", "keygen_failed", { cause });
+  }
+  if (!isHex32(parsed.secretHex) || !isHex32(parsed.publicHex)) {
+    throw new WaaskeyError("Stored device encryption keypair is malformed \u2014 expected 32-byte (64 hex) secret + public keys.", "keygen_failed", {
+      details: { keys: Object.keys(parsed) }
+    });
+  }
+  return { secretHex: parsed.secretHex, publicHex: parsed.publicHex };
+}
+function isHex32(v) {
+  return typeof v === "string" && /^[0-9a-fA-F]{64}$/.test(v);
+}
+function isAllZero(bytes) {
+  return bytes.every((byte) => byte === 0);
+}
+function bytesToHex(bytes) {
+  let hex = "";
+  for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+  return hex;
+}
+
+// src/passkey/assertion.ts
+function isPasskeyAssertionSupported() {
+  return typeof globalThis.navigator !== "undefined" && typeof globalThis.navigator.credentials !== "undefined";
+}
+async function defaultAssertionCeremony() {
+  let mod;
+  try {
+    mod = await import('@simplewebauthn/browser');
+  } catch {
+    throw new WaaskeyError('Passkey step-up requires "@simplewebauthn/browser" installed, or pass a custom ceremony.', "unsupported");
+  }
+  return {
+    get: (options) => mod.startAuthentication({ optionsJSON: options })
+  };
+}
+async function getSigningAssertion(challenge, options = {}) {
+  if (options.ceremony === void 0 && !isPasskeyAssertionSupported()) {
+    throw new WaaskeyError("Passkey step-up is not available in this runtime (no WebAuthn API).", "unsupported");
+  }
+  const ceremony = options.ceremony ?? await defaultAssertionCeremony();
+  const rpId = options.rpId ?? (typeof location === "undefined" ? void 0 : location.hostname);
+  const requestOptions = {
+    challenge,
+    userVerification: "required",
+    ...rpId ? { rpId } : {},
+    ...options.credentialId ? { allowCredentials: [{ id: options.credentialId, type: "public-key" }] } : {}
+  };
+  try {
+    return await ceremony.get(requestOptions);
+  } catch (cause) {
+    if (cause instanceof WaaskeyError) throw cause;
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    if (/cancel|abort|not allowed|user gesture/i.test(msg)) {
+      throw new WaaskeyError("Passkey authentication was cancelled by the user.", "aborted", { cause });
+    }
+    throw new WaaskeyError("Passkey step-up assertion failed.", "unsupported", { cause });
+  }
+}
+
 // src/wallet.ts
 var Wallet = class {
-  constructor(http, data) {
+  constructor(http, data, analytics, device = {}) {
     this.http = http;
+    this.analytics = analytics;
+    this.device = device;
     this.id = data.id;
-    this.address = data.address;
-    this.chain = data.chain;
+    this.data = data;
   }
   http;
+  analytics;
+  device;
+  /** Waaskey wallet id, e.g. `wlt_…`. */
   id;
-  address;
-  chain;
-  /** Sign an arbitrary message with this wallet's key (2-of-3 threshold MPC). */
-  async signMessage(message) {
-    const { signature } = await this.http.request("POST", `/v1/wallets/${this.id}/sign-message`, { message });
-    return signature;
+  /** The full wallet record as returned by the API. */
+  data;
+  /** On-chain address (set once keygen completes). */
+  get address() {
+    return this.data.address;
+  }
+  /** Lifecycle state (`pending` until keygen completes, then `active`). */
+  get status() {
+    return this.data.status;
+  }
+  /** Signing curve of the wallet. */
+  get curve() {
+    return this.data.curve;
+  }
+  /** Signing threshold `t` of the wallet's `t`-of-`n` MPC key. */
+  get threshold() {
+    return this.data.threshold;
+  }
+  /** Ordered party roles of the wallet's keygen topology, length `n`. */
+  get parties() {
+    return this.data.parties;
+  }
+  /** Per-party custody kind, parallel to {@link parties}. */
+  get custodyKinds() {
+    return this.data.custodyKinds;
+  }
+  /** How many of the wallet's shares the platform itself holds. */
+  get platformShareCount() {
+    return this.data.platformShareCount;
+  }
+  /**
+   * The wallet's custody attestation (`embedded` / `shared` / `self_custody`) — display
+   * it to prove the custody guarantee to the end-user (see {@link isNonCustodial}).
+   */
+  get custodyType() {
+    return this.data.custodyType;
+  }
+  /**
+   * Whether this wallet is **non-custodial** — the platform's shares alone do not meet
+   * the threshold (`platformShareCount < threshold`, i.e. custody type `shared` or
+   * `self_custody`), so WaaS cannot sign without the user/external party.
+   */
+  get isNonCustodial() {
+    return isNonCustodial(this.data);
+  }
+  /**
+   * Sign a 32-byte message digest with this wallet's key (2-of-3 threshold MPC).
+   *
+   * `digest` is a 32-byte hash as hex (the `0x` prefix is optional) — e.g. the
+   * keccak-256 of an EVM transaction. Hashing a higher-level message/transaction
+   * into a digest is the caller's (or a chain helper's) responsibility.
+   *
+   * **Passkey step-up (Pattern B / issue #21, #39):** pass `{ requirePasskey: true }` to run a
+   * WebAuthn assertion before signing. The SDK fetches a **server-issued one-time challenge**,
+   * prompts the user's authenticator over it, and attaches `passkeyAssertion` + its
+   * `passkeyChallengeId` to the POST body; the backend verifies both the MPC signature and the
+   * assertion, then burns the challenge (so it cannot be replayed). Alternatively supply a
+   * pre-built assertion via `options.passkeyAssertion` (with its `options.passkeyChallengeId`).
+   */
+  async sign(digest, options = {}) {
+    const message = normalizeDigest(digest);
+    const body = { message };
+    await this.attachStepUp(body, "sign", options);
+    const res = await this.http.request("POST", `/v1/wallets/${this.id}/sign`, body, options.signal);
+    this.analytics?.track("wallet.signed", { walletId: this.id, curve: this.data.curve });
+    return res.signature;
+  }
+  /**
+   * Send a transaction from this wallet. The platform builds the chain-specific transaction
+   * and co-signs it with the 2-of-3 MPC quorum, returning the **signed raw transaction**.
+   * `value` is in the chain's base unit (wei) as a numeric string.
+   *
+   * **WaaS is sign-only — it never broadcasts.** The result's {@link SendResult.signedTx} is
+   * the signed raw tx the *client* submits to its own node/provider (see
+   * {@link Waaskey.broadcast} or your own submitter); {@link SendResult.txHash} is a
+   * deterministic offline id for reference, not proof of broadcast.
+   *
+   * **Passkey step-up (Pattern B / issue #21, #39):** pass `{ requirePasskey: true }` to run a
+   * WebAuthn assertion before sending, over a server-issued one-time challenge (verified + burned
+   * server-side). Alternatively supply a pre-built assertion via `options.passkeyAssertion`.
+   */
+  async send(params, options = {}) {
+    if (this.data.curve === "ed25519") {
+      return this.sendEd25519(params, options);
+    }
+    const body = { ...params };
+    await this.attachStepUp(body, "send", options);
+    const res = await this.http.request("POST", `/v1/wallets/${this.id}/send`, body, options.signal);
+    this.analytics?.track("wallet.sent", { walletId: this.id, chain: params.chainId });
+    return res;
+  }
+  /**
+   * Device-co-signed send for an ed25519 (FROST) wallet (#110) — the browser holds the device FROST
+   * share and co-signs 2-party with the backend `server` party over the relay:
+   *
+   * 1. **START** (`POST …/send-session`): the backend builds the unsigned tx (chain adapter), starts
+   *    its server FROST party on the relay in the background, and returns the raw `message` bytes to
+   *    sign + the relay coordination ({@link EddsaSendSession}).
+   * 2. **CO-SIGN**: the device runs `signEddsa` over the relay with its stored `{keyPackage,
+   *    publicKeyPackage}` share; the two parties aggregate the RFC 8032 signature (returned locally).
+   * 3. **ASSEMBLE** (`POST …/send-session/:txId/assemble`): the backend embeds the aggregated
+   *    signature into the wire tx (chain adapter) and returns the signed raw tx + offline `txHash`.
+   *
+   * WaaS stays sign-only: the returned {@link SendResult.signedTx} is what the client broadcasts.
+   */
+  async sendEd25519(params, options) {
+    const { mpc, shareStore } = this.device;
+    if (!mpc || !shareStore) {
+      throw new WaaskeyError(
+        "Signing an ed25519 transaction requires a device MPC core and a share store \u2014 pass `mpc` and `shareStore` to `new Waaskey(...)`.",
+        "device_core_required"
+      );
+    }
+    if (!mpc.runEddsaSign) {
+      throw new WaaskeyError(
+        "The configured MPC core does not support ed25519 (FROST) signing \u2014 use a client-wasm build with the ed25519 (keygenEddsa/signEddsa) exports.",
+        "unsupported"
+      );
+    }
+    const { signal } = options;
+    throwIfAborted(signal);
+    const blob = await shareStore.get(this.id);
+    if (!blob) {
+      throw new WaaskeyError(`No stored device share for wallet "${this.id}" \u2014 this device never completed the ed25519 keygen.`, "share_not_found", {
+        details: { walletId: this.id }
+      });
+    }
+    const { keyPackage, publicKeyPackage } = deserializeEddsaShare(blob);
+    const startBody = { ...params };
+    await this.attachStepUp(startBody, "send", options);
+    throwIfAborted(signal);
+    const session = await this.http.request("POST", `/v1/wallets/${this.id}/send-session`, startBody, signal);
+    throwIfAborted(signal);
+    let signature;
+    try {
+      ({ signature } = await mpc.runEddsaSign({
+        relayUrl: session.relayUrl,
+        sessionId: session.sessionId,
+        roles: session.roles,
+        partyIndex: session.signerPosition,
+        keyPackage,
+        publicKeyPackage,
+        participants: session.participants,
+        message: session.message,
+        relayToken: session.relayToken
+      }));
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      throw new WaaskeyError("The device ed25519 sign ceremony failed.", "sign_failed", { cause });
+    }
+    throwIfAborted(signal);
+    const assemble = { signature };
+    const res = await this.http.request("POST", `/v1/wallets/${this.id}/send-session/${session.txId}/assemble`, assemble, signal);
+    this.analytics?.track("wallet.sent", { walletId: this.id, chain: params.chainId });
+    return res;
+  }
+  /**
+   * Attach a passkey step-up assertion to `body` when the caller requests one (issue #39).
+   *
+   * The challenge is a **server-issued one-time nonce**, never derived from the request
+   * payload: the SDK fetches it from the step-up challenge endpoint, runs the WebAuthn
+   * assertion over it, and echoes its `challengeId` so the server can verify and burn it —
+   * making a captured assertion non-replayable. A pre-built `passkeyAssertion` (with its
+   * `passkeyChallengeId`) is attached as-is and takes precedence over `requirePasskey`.
+   */
+  attachStepUp(body, operation, options) {
+    return attachPasskeyStepUp(this.http, this.id, body, operation, options);
+  }
+  /**
+   * List this wallet's **signing activity**, newest first (paginated) — the unified audit
+   * trail of what this key signed (raw signs and send/sweep signed txs, #289). A send/sweep
+   * record carries the `signedTx` the client broadcasts.
+   */
+  async signatures(query = {}, options = {}) {
+    const qs = new URLSearchParams();
+    if (query.page !== void 0) qs.set("page", String(query.page));
+    if (query.limit !== void 0) qs.set("limit", String(query.limit));
+    const suffix = qs.toString() ? `?${qs}` : "";
+    return this.http.request("GET", `/v1/wallets/${this.id}/signatures${suffix}`, void 0, options.signal);
   }
 };
+async function attachPasskeyStepUp(http, walletId, body, operation, options) {
+  if (options.passkeyAssertion !== void 0) {
+    body["passkeyAssertion"] = options.passkeyAssertion;
+    if (options.passkeyChallengeId !== void 0) body["passkeyChallengeId"] = options.passkeyChallengeId;
+    return;
+  }
+  if (!options.requirePasskey) return;
+  const { challengeId, challenge } = await http.request("POST", `/v1/wallets/${walletId}/stepup/challenge`, { operation }, options.signal);
+  body["passkeyAssertion"] = await getSigningAssertion(challenge, { credentialId: options.passkeyCredentialId });
+  body["passkeyChallengeId"] = challengeId;
+}
+function normalizeDigest(digest) {
+  const hex = digest.startsWith("0x") || digest.startsWith("0X") ? digest.slice(2) : digest;
+  if (!/^[0-9a-fA-F]{64}$/.test(hex)) {
+    throw new WaaskeyError("`digest` must be a 32-byte hex string (64 hex chars, optional 0x prefix).", "validation");
+  }
+  return hex;
+}
 
 // src/wallets.ts
+var BACKUP_REGISTER_ATTEMPTS = 3;
+var BACKUP_REGISTER_BACKOFF_MS = 200;
+var USER_BACKUP_ROLE = "user_backup";
+var DEFAULT_ACTIVATION_TIMEOUT_MS = 6e4;
+var DEFAULT_POLL_INTERVAL_MS = 1e3;
 var Wallets = class {
-  constructor(http) {
+  constructor(http, deps = {}) {
     this.http = http;
+    this.deps = deps;
   }
   http;
-  /** Create a new MPC wallet on the given chain. */
-  async create(params) {
-    const data = await this.http.request("POST", "/v1/wallets", params);
-    return new Wallet(this.http, data);
+  deps;
+  /**
+   * Create a new MPC wallet on the given chain. The keygen is a `t`-of-`n` ceremony:
+   *
+   * 1. ask the API to start a wallet + the server party (returns the ceremony params),
+   * 2. run the **device** half of keygen locally (in WASM) against the relay,
+   * 3. seal + persist the device share (it never leaves the device),
+   * 4. wait until the wallet is ACTIVE (server party finished) and return it.
+   *
+   * By default (no custody policy) this is the embedded **2-of-3** topology. Supply an
+   * explicit `{ threshold, parties, custodyKinds }` and/or a requested `custodyType` to
+   * change the topology / custody posture — the SDK validates it client-side (see
+   * {@link validateCustodyPolicy}) and the backend enforces the attested invariant. The
+   * device runs whatever `t`-of-`n` the returned ceremony describes (its `parties` /
+   * `threshold`), so the ceremony is not pinned to 2-of-3.
+   *
+   * **Non-custodial `[device, server, user_backup]` (#351/#78).** When the returned ceremony carries a
+   * `user_backup` party ({@link WalletCeremony.additionalParties}), the platform signer drives ONLY the
+   * `server` share, so this ONE device runs BOTH client parties in the SAME keygen ceremony — the
+   * `device` party AND the client-held `user_backup` party — joining the same relay session with each
+   * party's own relay token. It then persists the `device` share locally (as always) and, because there
+   * is no platform recovery share, seals the `user_backup` share with the caller's recovery code and
+   * registers the ciphertext server-side (reusing the recovery mechanism), so device-loss can never lock
+   * funds. This path therefore REQUIRES `options.backup`. The sealed backup is persisted to a local
+   * pending slot BEFORE the network call, so if registration fails the (non-re-derivable) share is not
+   * lost — `create` throws `backup_failed` and {@link retryBackup} re-registers it (no re-keygen).
+   *
+   * Requires `mpc` + `shareStore` on the client. The device share is the user's half
+   * of the key; without storing it the wallet would be unrecoverable.
+   */
+  async create(params, options = {}) {
+    const { mpc, shareStore, primePool } = this.deps;
+    if (!mpc || !shareStore) {
+      throw new WaaskeyError("Creating a wallet requires a device MPC core and a share store \u2014 pass `mpc` and `shareStore` to `new Waaskey(...)`.", "device_core_required");
+    }
+    validateCustodyPolicy(params);
+    const curve = curveForChain(params.chain);
+    const { signal } = options;
+    throwIfAborted(signal);
+    const body = { label: params.label ?? params.chain, curve };
+    if (params.threshold !== void 0) body["threshold"] = params.threshold;
+    if (params.parties !== void 0) body["parties"] = params.parties;
+    if (params.custodyKinds !== void 0) body["custodyKinds"] = params.custodyKinds;
+    if (params.custodyType !== void 0) body["custodyType"] = params.custodyType;
+    let deviceEncKeypair;
+    if (curve === "ed25519") {
+      deviceEncKeypair = await getOrCreateDeviceEncKeypair(shareStore);
+      body["deviceEncPubkey"] = deviceEncKeypair.publicHex;
+      throwIfAborted(signal);
+    }
+    const created = await this.http.request("POST", "/v1/wallets", body, signal);
+    const { ceremony } = created;
+    if (!ceremony) {
+      throw new WaaskeyError("The API did not return a keygen ceremony to join.", "keygen_failed", { details: created });
+    }
+    throwIfAborted(signal);
+    if (curve === "ed25519") {
+      await this.runEddsaKeygen(mpc, shareStore, created.id, ceremony, deviceEncKeypair);
+    } else {
+      await this.runSecpKeygen(mpc, shareStore, primePool, created.id, ceremony, curve, options.backup, signal);
+    }
+    this.deps.analytics?.track("wallet.created", { walletId: created.id, chain: params.chain, curve });
+    if (options.waitForActive === false) {
+      return new Wallet(this.http, created, this.deps.analytics, this.walletDeviceDeps());
+    }
+    const active = await this.waitUntilActive(created.id, options);
+    return new Wallet(this.http, active, this.deps.analytics, this.walletDeviceDeps());
+  }
+  /**
+   * Create a **member-bound** wallet (#342-#349): an N+1 threshold topology where `N` specific ORG
+   * MEMBERSHIPS (`shareholderMembershipIds`) each hold one share and the platform holds exactly
+   * one (a derived `shared` custody topology — never `embedded`). Unlike {@link create} (the
+   * embedded device+server(+recovery) flow, which runs the device's keygen inline and waits for
+   * ACTIVE), this wallet is provisioned `pending_keygen` with **no ceremony to join here** — it
+   * has no `mpc`/`shareStore` dependency and no custody-policy validation (that machinery is for
+   * the raw `parties`/`custodyKinds` embedded topology, mutually exclusive with
+   * `shareholderMembershipIds` server-side). Each invited member later runs {@link joinCeremony}
+   * from their OWN device/session; the wallet only activates once every member has joined.
+   */
+  async createWallet(params, options = {}) {
+    if (!Array.isArray(params.shareholderMembershipIds) || params.shareholderMembershipIds.length === 0) {
+      throw new WaaskeyError("`shareholderMembershipIds` must list at least 1 member.", "validation");
+    }
+    if (new Set(params.shareholderMembershipIds).size !== params.shareholderMembershipIds.length) {
+      throw new WaaskeyError("`shareholderMembershipIds` must be distinct.", "validation");
+    }
+    if (params.threshold !== void 0) {
+      const n = params.shareholderMembershipIds.length + 1;
+      if (!Number.isInteger(params.threshold) || params.threshold < 2 || params.threshold > n) {
+        throw new WaaskeyError(`\`threshold\` must be an integer in [2, ${n}] (the ${n - 1} members + 1 platform party).`, "validation");
+      }
+    }
+    const { signal } = options;
+    throwIfAborted(signal);
+    const body = { label: params.label, shareholderMembershipIds: params.shareholderMembershipIds };
+    if (params.curve !== void 0) body["curve"] = params.curve;
+    if (params.threshold !== void 0) body["threshold"] = params.threshold;
+    return this.http.request("POST", "/v1/wallets", body, signal);
+  }
+  /**
+   * Warm the prime pool for a chain's curve OFF the hot path — call during onboarding/idle (ideally
+   * from a Web Worker) so the next {@link create} on that chain doesn't pay the safe-prime cost.
+   * No-op when no prime pool is configured.
+   */
+  async prewarm(chain) {
+    const curve = curveForChain(chain);
+    if (curve === "ed25519") return;
+    await this.deps.primePool?.ensure(curve);
+  }
+  /**
+   * List the tenant's wallets, newest first (paginated). Returns plain {@link WalletData}
+   * rows — pass an `id` to {@link get} to obtain a signing-capable {@link Wallet}.
+   */
+  async list(query = {}, options = {}) {
+    const qs = new URLSearchParams();
+    if (query.page !== void 0) qs.set("page", String(query.page));
+    if (query.limit !== void 0) qs.set("limit", String(query.limit));
+    const suffix = qs.toString() ? `?${qs}` : "";
+    return this.http.request("GET", `/v1/wallets${suffix}`, void 0, options.signal);
   }
   /** Load an existing wallet by id. */
-  async get(id) {
-    const data = await this.http.request("GET", `/v1/wallets/${id}`);
-    return new Wallet(this.http, data);
+  async get(id, options = {}) {
+    const data = await this.http.request("GET", `/v1/wallets/${id}`, void 0, options.signal);
+    return new Wallet(this.http, data, this.deps.analytics, this.walletDeviceDeps());
+  }
+  /** The device core + share store a {@link Wallet} needs to co-sign an ed25519 (FROST) tx locally. */
+  walletDeviceDeps() {
+    return { mpc: this.deps.mpc, shareStore: this.deps.shareStore };
+  }
+  /**
+   * Join a **member-bound** wallet's multi-device keygen ceremony (#344, #349) as an invited org
+   * member — call this from the member's OWN device/session (never a tenant API key: every HTTP
+   * call here is member-session-authenticated, see {@link HttpClient.requestAsMember}). Unlike
+   * {@link create}, every member (N of them) + the platform join the SAME relay session, so:
+   *
+   * 1. fetch this member's own party ({@link MemberCeremony}) plus the wallet's other
+   *    share-holders (to derive the full n-party relay roster the ceremony needs),
+   * 2. ack readiness (`POST .../ceremony/join`) — the backend starts its platform party's own
+   *    relay connection only once EVERY member has acked, so this must happen before the ceremony
+   *    can complete,
+   * 3. run this device's half of the n-party keygen over the relay (blocks until every party,
+   *    including the platform, is present and the ceremony completes),
+   * 4. seal + persist the device's ONE share, keyed by `(walletId, membershipId)` — never by
+   *    `walletId` alone, since several members' shares for the SAME wallet may live in one
+   *    `shareStore` (e.g. a shared device, or a test harness).
+   *
+   * Safe to retry: a failed ceremony reopens the roster server-side, and re-acking/re-running is
+   * idempotent from the caller's perspective.
+   */
+  async joinCeremony(walletId, options = {}) {
+    const { mpc, shareStore } = this.deps;
+    if (!mpc || !shareStore) {
+      throw new WaaskeyError("Joining a keygen ceremony requires a device MPC core and a share store \u2014 pass `mpc` and `shareStore` to `new Waaskey(...)`.", "device_core_required");
+    }
+    if (!mpc.runMemberKeygen) {
+      throw new WaaskeyError("The configured MPC core does not support n-party (member-bound) keygen \u2014 use a client-wasm build with member-ceremony support.", "unsupported");
+    }
+    const { signal } = options;
+    throwIfAborted(signal);
+    const [ceremony, shareholders] = await Promise.all([
+      this.http.requestAsMember("GET", `/v1/wallets/${walletId}/ceremony/mine`, void 0, signal),
+      this.http.requestAsMember("GET", `/v1/wallets/${walletId}/shareholders`, void 0, signal)
+    ]);
+    const roles = buildMemberRoster(shareholders, ceremony.parties);
+    throwIfAborted(signal);
+    const joined = await this.http.requestAsMember("POST", `/v1/wallets/${walletId}/ceremony/join`, void 0, signal);
+    throwIfAborted(signal);
+    let keygen;
+    try {
+      keygen = await mpc.runMemberKeygen({
+        curve: toMpcCurve(ceremony.curve),
+        relayUrl: ceremony.relayUrl,
+        sessionId: ceremony.sessionId,
+        roles,
+        partyIndex: ceremony.partyIndex,
+        threshold: ceremony.threshold,
+        relayToken: ceremony.relayToken
+      });
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      throw new WaaskeyError("The member device keygen ceremony failed.", "keygen_failed", { cause });
+    }
+    await shareStore.put(memberShareKey(walletId, membershipIdFromRole(ceremony.role)), serializeShare(keygen));
+    return joined;
+  }
+  /**
+   * Join a **member-bound** wallet's multi-device SIGN ceremony (#347, #349) as an invited org
+   * member — the signing analogue of {@link joinCeremony}, called from the member's OWN
+   * device/session. A sign is a `t`-of-`n` SELECTION (only `t` of the N+1 parties actually sign),
+   * so the flow is:
+   *
+   * 1. cast this member's APPROVE vote (`POST .../sign-requests/:reqId/approve`) — a no-op if
+   *    already cast; once `t-1` members have approved, the backend fixes the signing quorum,
+   * 2. poll this member's own sign-ceremony party (`GET .../sign-requests/:reqId/ceremony/mine`)
+   *    until the quorum is fixed AND this member was selected into it ({@link MemberSignCeremony.ready}),
+   * 3. load this member's OWN stored share (keyed by `(walletId, membershipId)`, from
+   *    {@link joinCeremony}) and run this device's half of the fixed-quorum sign ceremony —
+   *    the interactive protocol's public output IS the completed signature.
+   *
+   * A member who is not selected into the fixed quorum, or whose approval never gets it there,
+   * simply times out (`sign_ceremony_timeout`) rather than running anything.
+   */
+  async joinSignCeremony(walletId, reqId, options = {}) {
+    const { mpc, shareStore } = this.deps;
+    if (!mpc || !shareStore) {
+      throw new WaaskeyError("Joining a sign ceremony requires a device MPC core and a share store \u2014 pass `mpc` and `shareStore` to `new Waaskey(...)`.", "device_core_required");
+    }
+    if (!mpc.runMemberSign) {
+      throw new WaaskeyError("The configured MPC core does not support n-party (member-bound) signing \u2014 use a client-wasm build with member-ceremony support.", "unsupported");
+    }
+    const { signal } = options;
+    throwIfAborted(signal);
+    await this.http.requestAsMember("POST", `/v1/wallets/${walletId}/sign-requests/${reqId}/approve`, void 0, signal);
+    const ceremony = await this.waitUntilReady(walletId, reqId, options);
+    const membershipId = membershipIdFromRole(ceremony.role);
+    const blob = await shareStore.get(memberShareKey(walletId, membershipId));
+    if (!blob) {
+      throw new WaaskeyError(`No stored device share for wallet "${walletId}" / member "${membershipId}" \u2014 this device never completed joinCeremony.`, "share_not_found", {
+        details: { walletId, membershipId }
+      });
+    }
+    const { keyShare } = deserializeShare(blob);
+    throwIfAborted(signal);
+    try {
+      return await mpc.runMemberSign({
+        curve: toMpcCurve(ceremony.curve),
+        relayUrl: ceremony.relayUrl,
+        sessionId: ceremony.sessionId,
+        roles: ceremony.quorumRoles,
+        share: keyShare,
+        participants: ceremony.participants,
+        signerPosition: ceremony.signerPosition,
+        digest: ceremony.digest,
+        relayToken: ceremony.relayToken
+      });
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      throw new WaaskeyError("The member device sign ceremony failed.", "sign_failed", { cause });
+    }
+  }
+  /**
+   * Approve a pending async signing request (#229) — either completing a single
+   * device-approval request outright, or casting one APPROVE vote in an M-of-N approver
+   * quorum (#309) configured on the wallet (via the tenant dashboard's `PUT .../quorum`). A
+   * non-quorum request starts the MPC ceremony immediately; a quorum request only starts
+   * it once enough approvers vote, and until then the response reports how many
+   * approvals are still needed via {@link SigningRequestResponse.approvalsRemaining}.
+   *
+   * Takes `walletId` + `reqId` directly (rather than a {@link Wallet} instance) since an
+   * approver typically learns of a pending request out-of-band — e.g. a
+   * `sign_request.created` webhook or push notification — without first loading the wallet.
+   */
+  async approveSignRequest(walletId, reqId, options = {}) {
+    return this.http.request("POST", `/v1/wallets/${walletId}/sign-requests/${reqId}/approve`, void 0, options.signal);
+  }
+  /**
+   * Decline a pending async signing request (#229) — either rejecting a single
+   * device-approval request outright, or casting a REJECT vote in an M-of-N approver
+   * quorum (#309), which declines the request as soon as one approver rejects it.
+   */
+  async declineSignRequest(walletId, reqId, options = {}) {
+    return this.http.request("POST", `/v1/wallets/${walletId}/sign-requests/${reqId}/decline`, void 0, options.signal);
+  }
+  /**
+   * List a wallet's async signing requests, newest first (paginated) — optionally filtered to
+   * a single lifecycle {@link SignRequestsQuery.status} (#332). The API paginates the
+   * *filtered* set, so `total`/`page` always describe what was actually matched.
+   */
+  async listSignRequests(walletId, query = {}, options = {}) {
+    const qs = new URLSearchParams();
+    if (query.status !== void 0) qs.set("status", query.status);
+    if (query.page !== void 0) qs.set("page", String(query.page));
+    if (query.limit !== void 0) qs.set("limit", String(query.limit));
+    const suffix = qs.toString() ? `?${qs}` : "";
+    return this.http.request("GET", `/v1/wallets/${walletId}/sign-requests${suffix}`, void 0, options.signal);
+  }
+  /**
+   * List a wallet's **pending approver queue** — the ergonomic entry point over
+   * {@link listSignRequests} pinned to `status: 'pending_approval'` (#309, #329): the
+   * requests currently awaiting an approver's {@link approveSignRequest}/
+   * {@link declineSignRequest} vote, either a single device-approval request or one still
+   * short of its M-of-N quorum (see {@link SigningRequestResponse.approvalsRemaining}).
+   */
+  async listPendingApprovals(walletId, query = {}, options = {}) {
+    return this.listSignRequests(walletId, { ...query, status: "pending_approval" }, options);
+  }
+  /**
+   * Run the cggmp24 (secp256k1) device keygen and persist the resulting share(s) (#351/#78). Two shapes,
+   * chosen by whether the ceremony carries client-held extra parties ({@link WalletCeremony.additionalParties}):
+   *
+   * - **Single client party** (today's path — `[device, server]` or custodial `[device, server, recovery]`,
+   *   where the platform drives every non-device party): run just the `device` party and seal its share
+   *   under the wallet id, exactly as before.
+   * - **Non-custodial `[device, server, user_backup]`** (a `user_backup` extra party): run BOTH the
+   *   `device` and `user_backup` parties CONCURRENTLY in the SAME relay session (each with its own
+   *   role-scoped relay token + its OWN Paillier primes), then persist the `device` share locally and
+   *   seal + register the `user_backup` share as the non-custodial backup (requires `backup`).
+   *
+   * Any additional party the client cannot drive (a non-`user_backup` role) is refused up front — leaving
+   * it unjoined would hang the whole ceremony, so failing loud beats silently deadlocking.
+   */
+  async runSecpKeygen(mpc, shareStore, primePool, walletId, ceremony, curve, backup, signal) {
+    const extras = ceremony.additionalParties ?? [];
+    const unsupported = extras.filter((party) => party.role !== USER_BACKUP_ROLE);
+    if (unsupported.length > 0) {
+      throw new WaaskeyError(
+        `The keygen ceremony carries an additional client party this SDK cannot drive (${unsupported.map((party) => party.role).join(", ")}) \u2014 refusing to keygen, since leaving a party unjoined would hang the ceremony.`,
+        "unsupported",
+        { details: { roles: unsupported.map((party) => party.role) } }
+      );
+    }
+    const userBackupParty = extras.find((party) => party.role === USER_BACKUP_ROLE);
+    if (!userBackupParty) {
+      const pregeneratedPrimes = primePool ? await primePool.take(curve) : void 0;
+      throwIfAborted(signal);
+      const [keygen] = await this.runKeygenParties(mpc, [{ ...ceremony, curve, pregeneratedPrimes }]);
+      await shareStore.put(walletId, serializeShare(keygen));
+      return;
+    }
+    if (!backup) {
+      throw new WaaskeyError(
+        "This wallet is a non-custodial [device, server, user_backup] topology whose user_backup share must be backed up at keygen \u2014 pass `options.backup` (recoveryCode + totpSecret + email) to `wallets.create(...)`, otherwise the wallet would be unrecoverable on device loss.",
+        "validation"
+      );
+    }
+    const [devicePrimes, backupPrimes] = primePool ? await Promise.all([primePool.take(curve), primePool.take(curve)]) : [void 0, void 0];
+    throwIfAborted(signal);
+    const [deviceKeygen, backupKeygen] = await this.runKeygenParties(mpc, [
+      { ...ceremony, curve, pregeneratedPrimes: devicePrimes },
+      { ...userBackupParty, curve, pregeneratedPrimes: backupPrimes }
+    ]);
+    await shareStore.put(walletId, serializeShare(deviceKeygen));
+    throwIfAborted(signal);
+    const { payload } = await buildRecoveryRegistration({ share: serializeShare(backupKeygen), ...backup });
+    await shareStore.put(userBackupPendingKey(walletId), JSON.stringify(payload));
+    await this.registerBackup(walletId, payload, signal);
+    await shareStore.remove(userBackupPendingKey(walletId));
+  }
+  /**
+   * Register a sealed user_backup {@link RecoveryRegisterPayload} server-side, with a small bounded retry
+   * on TRANSIENT failures (network / 5xx / rate-limit) — a flaky moment must not cost the backup. A
+   * non-transient failure (4xx) fails fast. On abort, the abort propagates unchanged. If it ultimately
+   * cannot register, throws a distinct, actionable {@link WaaskeyError} `backup_failed` (NOT `keygen_failed`)
+   * — the caller's cue that the wallet was created but its backup is only local, and pointing at
+   * {@link retryBackup}. The pending slot is intentionally NOT touched here, so a failure leaves the
+   * sealed share intact for the retry.
+   */
+  async registerBackup(walletId, payload, signal) {
+    let lastCause;
+    for (let attempt = 1; attempt <= BACKUP_REGISTER_ATTEMPTS; attempt++) {
+      throwIfAborted(signal);
+      try {
+        return await postRecoveryRegistration(this.http, walletId, payload, signal);
+      } catch (cause) {
+        if (cause instanceof WaaskeyError && cause.code === "aborted") throw cause;
+        lastCause = cause;
+        const transient = cause instanceof WaaskeyError && (cause.code === "network" || cause.code === "server_error" || cause.code === "rate_limited");
+        if (!transient || attempt === BACKUP_REGISTER_ATTEMPTS) break;
+        await delay(BACKUP_REGISTER_BACKOFF_MS * attempt, signal);
+      }
+    }
+    throw new WaaskeyError(
+      `The wallet "${walletId}" was created, but registering its user_backup recovery backup failed. The sealed backup is retained locally \u2014 retry with \`wallets.retryBackup("${walletId}")\`.`,
+      "backup_failed",
+      { cause: lastCause, details: { walletId } }
+    );
+  }
+  /**
+   * Re-register a non-custodial wallet's user_backup backup that a previous {@link create} sealed locally
+   * but could not register (a `backup_failed` create) (#351/#78). Reads the LOCAL pending-backup slot's
+   * sealed ciphertext and re-POSTs it — **no re-keygen** (the share is not re-derivable) — with the same
+   * bounded transient retry, then clears the slot on success. Idempotent-ish: a no-op `share_not_found`
+   * when nothing is pending (already registered, or never created here). Requires a share store.
+   */
+  async retryBackup(walletId, options = {}) {
+    const { shareStore } = this.deps;
+    if (!shareStore) {
+      throw new WaaskeyError("Retrying a wallet backup requires a share store \u2014 pass `shareStore` to `new Waaskey(...)`.", "device_core_required");
+    }
+    const { signal } = options;
+    throwIfAborted(signal);
+    const stored = await shareStore.get(userBackupPendingKey(walletId));
+    if (!stored) {
+      throw new WaaskeyError(
+        `No pending user_backup backup for wallet "${walletId}" \u2014 nothing to retry (it was already registered, or this device never created it).`,
+        "share_not_found",
+        { details: { walletId } }
+      );
+    }
+    const payload = parseBackupPayload(stored, walletId);
+    const share = await this.registerBackup(walletId, payload, signal);
+    await shareStore.remove(userBackupPendingKey(walletId));
+    return share;
+  }
+  /**
+   * Device-loss RECOVERY CO-SIGN for a non-custodial `[device, server, user_backup]` secp256k1 wallet
+   * (#351/#78). When the device is lost, the user restores their client-held `user_backup` share from the
+   * sealed server-side backup and co-signs `digest` with the platform's `server` party — the 2-party
+   * `{server, user_backup}` quorum. This is NOT the platform-only custodial `{server, recovery}` recoverSign
+   * (`recovery.recoverSign` / `POST …/recovery/recover-sign`): here the platform CANNOT sign alone; the
+   * user's restored share is the co-signing factor.
+   *
+   * 1. **RESTORE** — retrieve the sealed `user_backup` ciphertext (the multi-factor recovery gate,
+   *    {@link RecoverParams}, releases it) and open it with the recovery code CLIENT-SIDE (Contract A: the
+   *    raw code never leaves the device), yielding the cggmp24 `user_backup` KeyShare. No registered backup
+   *    fails `share_not_found`; a wrong recovery code fails `invalid_recovery_code` — either BEFORE any
+   *    ceremony starts, so a bad restore never signs (and never hangs).
+   * 2. **START** — `POST /v1/wallets/:id/recover-sign-session` with the digest (+ passkey step-up when the
+   *    wallet requires it, threaded exactly like a normal sign via `options`) → the `user_backup` party's
+   *    ceremony descriptor: its role, the `{server, user_backup}` keygen `participants`, this party's
+   *    `signerPosition`, and a `user_backup`-role relay token.
+   * 3. **CO-SIGN** — run the `user_backup` MPC party ({@link MpcCore.runSign}) over the relay with the
+   *    restored share + that descriptor; the platform `server` party co-signs server-side. Returns the
+   *    resulting signature.
+   *
+   * The ONLY differences from a normal `{device, server}` device sign are the SHARE (the restored
+   * `user_backup`, not the local device share) and the DESCRIPTOR (from the recover-sign session, not the
+   * normal sign session) — the same {@link MpcCore.runSign} relay machinery drives both.
+   *
+   * Requires `mpc` on the client (the co-signing core). No share store is needed: the restored share is
+   * held only in memory for the ceremony and never persisted (the device is lost/new). secp256k1 only —
+   * re-provisioning a fresh device share (reshare back to a full 2-of-3) is a separate follow-up.
+   */
+  async recoverSign(walletId, params, options = {}) {
+    const { mpc } = this.deps;
+    if (!mpc) {
+      throw new WaaskeyError("Recovery co-signing requires a device MPC core \u2014 pass `mpc` to `new Waaskey(...)`.", "device_core_required");
+    }
+    const { signal } = options;
+    throwIfAborted(signal);
+    const digest = normalizeDigest(params.digest);
+    const ciphertext = await this.fetchUserBackupCiphertext(walletId, params, signal);
+    const share = await restoreUserBackupShare(ciphertext, params.recoveryCode);
+    throwIfAborted(signal);
+    const body = { digest };
+    if (params.chainId !== void 0) body["chainId"] = params.chainId;
+    await attachPasskeyStepUp(this.http, walletId, body, "sign", options);
+    throwIfAborted(signal);
+    const session = await this.http.request("POST", `/v1/wallets/${walletId}/recover-sign-session`, body, signal);
+    throwIfAborted(signal);
+    let signature;
+    try {
+      ({ signature } = await mpc.runSign(toUserBackupSignParams(session, share, digest)));
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      throw new WaaskeyError("The user_backup device recover-sign ceremony failed.", "sign_failed", { cause });
+    }
+    this.deps.analytics?.track("wallet.recovered", { walletId, curve: session.curve });
+    return signature;
+  }
+  /**
+   * Retrieve the sealed `user_backup` ciphertext via the recovery gate ({@link fetchRecoveryCiphertext}),
+   * mapping a "no recovery share registered" (404) to the actionable `share_not_found` — this wallet has no
+   * client-held `user_backup` backup to co-sign with (its device-loss recovery is the custodial path instead).
+   */
+  async fetchUserBackupCiphertext(walletId, params, signal) {
+    try {
+      return await fetchRecoveryCiphertext(this.http, walletId, params, signal);
+    } catch (cause) {
+      if (cause instanceof WaaskeyError && cause.code === "not_found") {
+        throw new WaaskeyError(
+          `No registered user_backup recovery backup for wallet "${walletId}" \u2014 device-loss recover-sign needs a non-custodial [device, server, user_backup] wallet whose backup was registered at create.`,
+          "share_not_found",
+          { cause, details: { walletId } }
+        );
+      }
+      throw cause;
+    }
+  }
+  /**
+   * Run one or more device keygen parties (each `mpc.runKeygen`), concurrently, mapping any failure to a
+   * single `keygen_failed`. Used for both the single `device` party and the two-party non-custodial
+   * `[device, user_backup]` ceremony — one place owns the error contract so both paths stay identical.
+   */
+  async runKeygenParties(mpc, params) {
+    try {
+      return await Promise.all(params.map((party) => mpc.runKeygen(party)));
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      throw new WaaskeyError("The device keygen ceremony failed.", "keygen_failed", { cause });
+    }
+  }
+  /**
+   * Run the device half of an ed25519 (FROST) keygen (#110) and seal the resulting `{keyPackage,
+   * publicKeyPackage}` share — the EdDSA counterpart of the cggmp24 `runKeygen` branch in {@link create}.
+   * The device co-generates the group key with the backend `server` party over the relay; the FROST DKG
+   * is the 2-party {device, server} quorum the ceremony names (M6 scope), roster-addressed like the
+   * member ceremony rather than the cggmp24 single-peer shape.
+   */
+  async runEddsaKeygen(mpc, shareStore, walletId, ceremony, encKeypair) {
+    if (!mpc.runEddsaKeygen) {
+      throw new WaaskeyError(
+        "The configured MPC core does not support ed25519 (FROST) keygen \u2014 use a client-wasm build with the ed25519 (keygenEddsa/signEddsa) exports.",
+        "unsupported"
+      );
+    }
+    const roles = buildEddsaKeygenRoster(ceremony);
+    const encPubkeys = readEddsaEncRoster(ceremony, encKeypair);
+    let keygen;
+    try {
+      keygen = await mpc.runEddsaKeygen({
+        relayUrl: ceremony.relayUrl,
+        sessionId: ceremony.sessionId,
+        roles,
+        partyIndex: ceremony.partyIndex,
+        threshold: ceremony.threshold,
+        relayToken: ceremony.relayToken,
+        encPubkeys,
+        encSecret: encKeypair.secretHex
+      });
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      throw new WaaskeyError("The device ed25519 keygen ceremony failed.", "keygen_failed", { cause });
+    }
+    await shareStore.put(walletId, serializeEddsaShare(keygen));
+  }
+  /** Poll the wallet until keygen completes (ACTIVE), or throw on failure/timeout. */
+  async waitUntilActive(id, options) {
+    const timeoutMs = options.activationTimeoutMs ?? DEFAULT_ACTIVATION_TIMEOUT_MS;
+    const intervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    const { signal } = options;
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      throwIfAborted(signal);
+      const wallet = await this.http.request("GET", `/v1/wallets/${id}`, void 0, signal);
+      if (wallet.status === "active") return wallet;
+      if (wallet.status === "failed") {
+        throw new WaaskeyError("Wallet keygen failed.", "keygen_failed", { details: wallet });
+      }
+      if (Date.now() >= deadline) {
+        throw new WaaskeyError("Wallet did not activate before the timeout.", "wallet_activation_timeout", { details: wallet });
+      }
+      await delay(intervalMs, signal);
+    }
+  }
+  /** Poll the member's own sign ceremony until the t-of-n quorum is fixed AND this member is selected, or throw on timeout. */
+  async waitUntilReady(walletId, reqId, options) {
+    const timeoutMs = options.readyTimeoutMs ?? DEFAULT_ACTIVATION_TIMEOUT_MS;
+    const intervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    const { signal } = options;
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      throwIfAborted(signal);
+      const ceremony = await this.http.requestAsMember("GET", `/v1/wallets/${walletId}/sign-requests/${reqId}/ceremony/mine`, void 0, signal);
+      if (isReadyMemberSignCeremony(ceremony)) return ceremony;
+      if (Date.now() >= deadline) {
+        throw new WaaskeyError("The signing quorum did not fix (or did not select this member) before the timeout.", "sign_ceremony_timeout", { details: { walletId, reqId } });
+      }
+      await delay(intervalMs, signal);
+    }
   }
 };
+function serializeShare(keygen) {
+  return JSON.stringify({ keyShare: keygen.keyShare, auxInfo: keygen.auxInfo, sharedPublicKey: keygen.sharedPublicKey });
+}
+function deserializeShare(blob) {
+  let parsed;
+  try {
+    parsed = JSON.parse(blob);
+  } catch (cause) {
+    throw new WaaskeyError("Stored device share is corrupt \u2014 it is not valid JSON.", "share_not_found", { cause });
+  }
+  if (typeof parsed.keyShare !== "string") {
+    throw new WaaskeyError("Stored device share is malformed \u2014 it is missing its KeyShare.", "share_not_found", { details: { keys: Object.keys(parsed) } });
+  }
+  return { keyShare: parsed.keyShare, sharedPublicKey: typeof parsed.sharedPublicKey === "string" ? parsed.sharedPublicKey : void 0 };
+}
+async function restoreUserBackupShare(ciphertext, recoveryCode) {
+  let blob;
+  try {
+    blob = await openWithPassword(recoveryCode, ciphertext);
+  } catch (cause) {
+    throw new WaaskeyError("Could not open the user_backup backup \u2014 wrong recovery code?", "invalid_recovery_code", { cause });
+  }
+  return deserializeShare(blob).keyShare;
+}
+function toUserBackupSignParams(session, share, digest) {
+  if (session.participants.length !== 2 || session.signerPosition < 0 || session.signerPosition > 1) {
+    throw new WaaskeyError(
+      `Unexpected recover-sign descriptor: the {server, user_backup} quorum must be exactly 2 parties with signerPosition in {0, 1} (got ${session.participants.length} participants, signerPosition ${session.signerPosition}).`,
+      "sign_failed",
+      { details: { participants: session.participants, signerPosition: session.signerPosition } }
+    );
+  }
+  return {
+    curve: toMpcCurve(session.curve),
+    relayUrl: session.relayUrl,
+    sessionId: session.sessionId,
+    role: session.role,
+    peerRole: session.peerRole,
+    partyIndex: session.signerPosition,
+    peerPartyIndex: 1 - session.signerPosition,
+    relayToken: session.relayToken,
+    share,
+    participants: session.participants,
+    signerPosition: session.signerPosition,
+    digest
+  };
+}
+function memberShareKey(walletId, membershipId) {
+  return `${walletId}@member-${membershipId}`;
+}
+function userBackupPendingKey(walletId) {
+  return `${walletId}:user_backup_pending`;
+}
+function parseBackupPayload(stored, walletId) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stored);
+  } catch (cause) {
+    throw new WaaskeyError(`The pending user_backup backup for wallet "${walletId}" is corrupt \u2014 it is not valid JSON.`, "backup_failed", { cause, details: { walletId } });
+  }
+  if (typeof parsed.ciphertext !== "string" || !Array.isArray(parsed.factors)) {
+    throw new WaaskeyError(`The pending user_backup backup for wallet "${walletId}" is malformed.`, "backup_failed", { details: { walletId, keys: Object.keys(parsed) } });
+  }
+  return { ciphertext: parsed.ciphertext, factors: parsed.factors };
+}
+function membershipIdFromRole(role) {
+  const prefix = "member:";
+  if (!role.startsWith(prefix)) {
+    throw new WaaskeyError(`Unexpected relay role "${role}" \u2014 expected a member-bound "member:<membershipId>" role.`, "validation");
+  }
+  return role.slice(prefix.length);
+}
+function buildMemberRoster(shareholders, parties) {
+  const roles = new Array(parties).fill(void 0);
+  for (const shareholder of shareholders) {
+    if (shareholder.partyIndex < 0 || shareholder.partyIndex >= parties) {
+      throw new WaaskeyError(`Share-holder partyIndex ${shareholder.partyIndex} is out of range for a ${parties}-party ceremony.`, "validation");
+    }
+    roles[shareholder.partyIndex] = shareholder.role;
+  }
+  const gaps = roles.reduce((acc, role, index) => role === void 0 ? [...acc, index] : acc, []);
+  if (gaps.length !== 1) {
+    throw new WaaskeyError("Could not derive the platform party slot from the wallet share-holders.", "validation", { details: { parties, shareholders } });
+  }
+  roles[gaps[0]] = "platform";
+  return roles;
+}
+function buildEddsaKeygenRoster(ceremony) {
+  const slots = Math.max(ceremony.partyIndex, ceremony.peerPartyIndex) + 1;
+  const roles = new Array(slots).fill(void 0);
+  roles[ceremony.partyIndex] = ceremony.role;
+  roles[ceremony.peerPartyIndex] = ceremony.peerRole;
+  if (roles.some((role) => role === void 0)) {
+    throw new WaaskeyError("The ed25519 keygen ceremony did not fully describe its party roster (only the 2-party device+server topology is supported).", "keygen_failed", {
+      details: { ceremony }
+    });
+  }
+  return roles;
+}
+function readEddsaEncRoster(ceremony, encKeypair) {
+  const roster = ceremony.encPubkeys;
+  if (!Array.isArray(roster) || roster.length === 0) {
+    throw new WaaskeyError(
+      "The ed25519 keygen ceremony did not return the FROST DKG round-2 encryption roster (encPubkeys) \u2014 the backend must advertise it (#114) before the device can seal its DKG packages.",
+      "keygen_failed",
+      { details: { ceremony } }
+    );
+  }
+  const own = roster[ceremony.partyIndex];
+  if (typeof own !== "string" || own.toLowerCase() !== encKeypair.publicHex.toLowerCase()) {
+    throw new WaaskeyError(
+      "The ed25519 keygen ceremony's encPubkeys roster does not carry this device's own encryption public key at its party index \u2014 refusing to keygen against a mismatched roster (it would mis-seal the DKG packages).",
+      "keygen_failed",
+      { details: { partyIndex: ceremony.partyIndex } }
+    );
+  }
+  return roster;
+}
+function isReadyMemberSignCeremony(ceremony) {
+  return ceremony.ready && ceremony.quorumRoles !== void 0 && ceremony.signerPosition !== void 0 && ceremony.participants !== void 0 && ceremony.digest !== void 0;
+}
 
 // src/client.ts
 var DEFAULT_BASE_URL = "https://api.waaskey.com";
 var Waaskey = class {
   /** The `wallets` resource. */
   wallets;
+  /** The `recovery` resource — multi-factor, client-encrypted wallet recovery. */
+  recovery;
+  /** The `reshare` resource — device-side completion of a device-retaining reshare (#318). */
+  reshare;
+  /** The `balances` resource — client-side balance reads from a chain provider (no backend). */
+  balances;
+  /** The `auth` resource — embedded end-user login (email-OTP, …) → non-custodial wallet. */
+  auth;
+  /** The `members` resource — org-member (dashboard "plane B") bearer login for headless consumers. */
+  members;
+  /** The `onramp` resource — fund the wallet with fiat via a provider on-ramp. */
+  onramp;
+  /** Default fetch used by the optional {@link broadcast} helper (from `WaaskeyOptions.fetch`). */
+  defaultFetch;
   constructor(options) {
     if (!options?.apiKey) {
       throw new Error("Waaskey: `apiKey` is required.");
     }
     const http = new HttpClient(options.apiKey, options.baseUrl ?? DEFAULT_BASE_URL, options.fetch);
-    this.wallets = new Wallets(http);
+    const analytics = new Analytics(resolveSink(options.analytics, http));
+    this.auth = new Auth(http);
+    this.members = new Members(http);
+    http.useMemberAccessToken(() => this.members.accessToken);
+    this.wallets = new Wallets(http, { mpc: options.mpc, shareStore: options.shareStore, primePool: options.primePool, analytics });
+    this.recovery = new Recovery(http, { shareStore: options.shareStore, analytics });
+    this.reshare = new Reshare(http, { mpc: options.mpc, shareStore: options.shareStore, analytics });
+    this.balances = new Balances(options.chains, options.fetch);
+    this.onramp = new Onramp(http);
+    this.defaultFetch = options.fetch;
+  }
+  /**
+   * **Optional** client-side broadcast of a signed raw tx from {@link Wallet.send}.
+   *
+   * WaaS is a **signing service** — `wallet.send(...)` returns `signedTx` and WaaS never
+   * submits it. This is a thin, best-effort convenience to broadcast from **your own**
+   * node/provider (one JSON-RPC call, no status polling / no retries — tracking is your
+   * concern). Most integrators broadcast with their own infra.
+   *
+   * @example
+   * ```ts
+   * const { signedTx } = await wallet.send({ chainId: 'evm:1', to, value });
+   * const { txHash } = await waaskey.broadcast(signedTx, { rpcUrl: 'https://your-rpc' });
+   * ```
+   */
+  broadcast(signedTx, options) {
+    return broadcast(signedTx, { fetch: this.defaultFetch, ...options });
+  }
+};
+function resolveSink(analytics, http) {
+  if (analytics === false) return void 0;
+  return analytics ?? new HttpAnalyticsSink(http);
+}
+
+// src/mpc/wasm-core.ts
+var WasmMpcCore = class {
+  constructor(load) {
+    this.load = load;
+  }
+  load;
+  modulePromise;
+  init() {
+    return this.modulePromise ??= this.load();
+  }
+  async runKeygen(params) {
+    const wasm = await this.init();
+    const raw = await wasm.keygen(
+      this.encode(params, { parties: params.parties, threshold: params.threshold, pregenerated_primes_json: params.pregeneratedPrimes })
+    );
+    if (!raw || typeof raw.keyshare_json !== "string") {
+      throw new Error("client-wasm returned an unexpected keygen result");
+    }
+    return {
+      keyShare: raw.keyshare_json,
+      auxInfo: raw.aux_info_json,
+      sharedPublicKey: extractSharedPublicKey(raw.keyshare_json)
+    };
+  }
+  async runSign(params) {
+    const wasm = await this.init();
+    const raw = await wasm.sign(
+      this.encode(params, {
+        // The wasm deserializes `share` with `serde_json::from_value::<KeyShare>`, so it must ride
+        // the wire as the KeyShare OBJECT — not a JSON string, and not the storage blob.
+        share: toShareObject(params.share),
+        participants: params.participants,
+        signer_position: params.signerPosition,
+        digest: params.digest
+      })
+    );
+    if (!raw || typeof raw.signature_json !== "string") {
+      throw new Error("client-wasm returned an unexpected sign result");
+    }
+    return { signature: raw.signature_json };
+  }
+  async pregeneratePrimes(curve) {
+    const wasm = await this.init();
+    if (!wasm.pregeneratePrimes) {
+      throw new Error("client-wasm does not expose pregeneratePrimes");
+    }
+    const raw = await wasm.pregeneratePrimes(JSON.stringify({ curve }));
+    if (!raw || typeof raw.primes_json !== "string") {
+      throw new Error("client-wasm returned an unexpected pregeneratePrimes result");
+    }
+    return raw.primes_json;
+  }
+  async runReshareAssemble(params) {
+    const wasm = await this.init();
+    if (!wasm.reshareAssemble) {
+      throw new Error(reshareFeatureHint("reshareAssemble"));
+    }
+    const raw = await wasm.reshareAssemble(
+      JSON.stringify({
+        curve: params.curve,
+        new_position: params.newPosition,
+        new_preimages: params.newPreimages,
+        new_threshold: params.newThreshold,
+        wallet: params.wallet,
+        commitments: params.commitments,
+        sub_shares: params.subShares
+      })
+    );
+    if (!raw || typeof raw.core_json !== "string") {
+      throw new Error("client-wasm returned an unexpected reshareAssemble result");
+    }
+    return { core: raw.core_json, sharedPublicKey: decodePublicKey(raw.shared_public_key_json) };
+  }
+  async runCompleteReshare(params) {
+    const wasm = await this.init();
+    if (!wasm.completeReshare) {
+      throw new Error(reshareFeatureHint("completeReshare"));
+    }
+    const raw = await wasm.completeReshare(
+      this.encode(params, {
+        // The wasm expects the bare core as an inline JSON object (serde_json::Value), not a string.
+        core: JSON.parse(params.core),
+        parties: params.parties,
+        // The device's OWN primes for the aux ceremony — never server-provided. Absent ⇒ generated inline.
+        ...params.pregeneratedPrimes === void 0 ? {} : { pregenerated_primes_json: params.pregeneratedPrimes }
+      })
+    );
+    if (!raw || typeof raw.keyshare_json !== "string") {
+      throw new Error("client-wasm returned an unexpected completeReshare result");
+    }
+    return { keyShare: raw.keyshare_json, sharedPublicKey: extractSharedPublicKey(raw.keyshare_json) };
+  }
+  async runMemberKeygen(params) {
+    const wasm = await this.init();
+    if (!wasm.keygenMember) {
+      throw new Error(memberCeremonyFeatureHint("keygenMember"));
+    }
+    const raw = await wasm.keygenMember(
+      this.encodeMember(params, {
+        roles: params.roles,
+        party_index: params.partyIndex,
+        threshold: params.threshold,
+        ...params.pregeneratedPrimes === void 0 ? {} : { pregenerated_primes_json: params.pregeneratedPrimes }
+      })
+    );
+    if (!raw || typeof raw.keyshare_json !== "string") {
+      throw new Error("client-wasm returned an unexpected keygenMember result");
+    }
+    return {
+      keyShare: raw.keyshare_json,
+      auxInfo: raw.aux_info_json,
+      sharedPublicKey: extractSharedPublicKey(raw.keyshare_json)
+    };
+  }
+  async runMemberSign(params) {
+    const wasm = await this.init();
+    if (!wasm.signMember) {
+      throw new Error(memberCeremonyFeatureHint("signMember"));
+    }
+    const raw = await wasm.signMember(
+      this.encodeMember(params, {
+        roles: params.roles,
+        // Mirrors runSign: the wasm deserializes `share` with `serde_json::from_value::<KeyShare>`,
+        // so the KeyShare rides the wire as an OBJECT, not a JSON string (and not the storage blob).
+        share: toShareObject(params.share),
+        participants: params.participants,
+        // This device's protocol index into `roles` (the value the SDK calls `signerPosition`).
+        // The wire key is `party_index` — the same field keygen sends — NOT `signer_position`.
+        party_index: params.signerPosition,
+        digest: params.digest
+      })
+    );
+    if (!raw || typeof raw.signature_json !== "string") {
+      throw new Error("client-wasm returned an unexpected signMember result");
+    }
+    return { signature: raw.signature_json };
+  }
+  async runEddsaKeygen(params) {
+    const wasm = await this.init();
+    if (!wasm.keygenEddsa) {
+      throw new Error(eddsaFeatureHint("keygenEddsa"));
+    }
+    const raw = await wasm.keygenEddsa(
+      this.encodeEddsa(params, {
+        threshold: params.threshold,
+        // The FROST DKG round-2 encryption roster (#114): every party's X25519 enc PUBLIC key in `roles`
+        // order (`enc_pubkeys[i]` ↔ FROST id i+1) + THIS device's own X25519 enc SECRET. `enc_secret` is
+        // secret and MUST NOT be logged; the wasm seals/opens the round-2 packages with these.
+        enc_pubkeys: params.encPubkeys,
+        enc_secret: params.encSecret
+      })
+    );
+    if (!raw || raw.key_package === void 0 || raw.public_key_package === void 0) {
+      throw new Error("client-wasm returned an unexpected keygenEddsa result");
+    }
+    return { keyPackage: raw.key_package, publicKeyPackage: raw.public_key_package };
+  }
+  async runEddsaSign(params) {
+    const wasm = await this.init();
+    if (!wasm.signEddsa) {
+      throw new Error(eddsaFeatureHint("signEddsa"));
+    }
+    const raw = await wasm.signEddsa(
+      this.encodeEddsa(params, {
+        // The wasm re-serializes these with `serde_json::to_vec` + `import_*_package`, so each MUST
+        // ride the wire as the FROST JSON OBJECT — not a JSON string (and not a storage wrapper).
+        key_package: toFrostPackage(params.keyPackage, "key_package"),
+        public_key_package: toFrostPackage(params.publicKeyPackage, "public_key_package"),
+        participants: params.participants,
+        message: params.message
+      })
+    );
+    if (!raw || typeof raw.signature !== "string") {
+      throw new Error("client-wasm returned an unexpected signEddsa result");
+    }
+    return { signature: raw.signature };
+  }
+  /** Build the snake_case params JSON the wasm exports expect from the common routing + extras. */
+  encode(p, extra) {
+    assertAllowedRelayUrl(p.relayUrl);
+    return JSON.stringify({
+      curve: p.curve,
+      relay_url: p.relayUrl,
+      session_id: p.sessionId,
+      role: p.role ?? "device",
+      peer_role: p.peerRole ?? "server",
+      party_index: p.partyIndex,
+      peer_party_index: p.peerPartyIndex,
+      // Only present the relay token when set, so an auth-disabled ceremony's wire payload
+      // is byte-identical to before (the client-wasm treats absent as an unauthenticated join).
+      ...p.relayToken === void 0 ? {} : { relay_token: p.relayToken },
+      ...extra
+    });
+  }
+  /**
+   * Build the snake_case params JSON for an n-party (member-bound, #349) member ceremony — the
+   * roster-based routing shape (`roles` + `party_index`), not the 2-party `role`/`peer_role` shape
+   * {@link encode} builds. The `roles` roster and `party_index` are passed through in `extra` by
+   * the caller and land on the wire under those exact keys — what `keygenMember` / `signMember`
+   * deserialize.
+   */
+  encodeMember(p, extra) {
+    assertAllowedRelayUrl(p.relayUrl);
+    return JSON.stringify({
+      curve: p.curve,
+      relay_url: p.relayUrl,
+      session_id: p.sessionId,
+      ...p.relayToken === void 0 ? {} : { relay_token: p.relayToken },
+      ...extra
+    });
+  }
+  /**
+   * Build the snake_case params JSON for an ed25519 (FROST, #110) ceremony — the roster-based routing
+   * shape (`roles` + `party_index`) the `keygenEddsa` / `signEddsa` exports deserialize. Unlike
+   * {@link encodeMember} there is NO `curve` (ed25519-only) and no Paillier primes; the caller passes
+   * the ceremony-specific extras (keygen: `threshold`; sign: the FROST packages + participants + message).
+   */
+  encodeEddsa(p, extra) {
+    assertAllowedRelayUrl(p.relayUrl);
+    return JSON.stringify({
+      relay_url: p.relayUrl,
+      session_id: p.sessionId,
+      roles: p.roles,
+      party_index: p.partyIndex,
+      ...p.relayToken === void 0 ? {} : { relay_token: p.relayToken },
+      ...extra
+    });
+  }
+};
+function reshareFeatureHint(fn) {
+  return `client-wasm does not expose ${fn} \u2014 rebuild @waaskey/client-wasm with the \`reshare\` feature enabled (wasm-pack build \u2026 -- --features reshare).`;
+}
+function memberCeremonyFeatureHint(fn) {
+  return `client-wasm does not expose ${fn} \u2014 rebuild @waaskey/client-wasm with n-party (member-ceremony) support (the keygenMember/signMember exports).`;
+}
+function eddsaFeatureHint(fn) {
+  return `client-wasm does not expose ${fn} \u2014 rebuild @waaskey/client-wasm with the ed25519 (FROST) exports (keygenEddsa/signEddsa).`;
+}
+function assertAllowedRelayUrl(relayUrl) {
+  let url;
+  try {
+    url = new URL(relayUrl);
+  } catch (cause) {
+    throw new Error(`Invalid relay URL "${relayUrl}".`, { cause });
+  }
+  if (url.protocol === "ws:" && isLoopbackHost(url.hostname)) return;
+  if (url.protocol !== "wss:") {
+    throw new Error(`Refusing server-supplied relay URL "${relayUrl}" \u2014 only wss:// (or ws:// on localhost) is allowed for the MPC transport.`);
+  }
+  if (isInternalHost(url.hostname)) {
+    throw new Error(`Refusing server-supplied relay URL "${relayUrl}" \u2014 the relay host is internal/private; only a public wss:// endpoint is allowed.`);
+  }
+}
+function isLoopbackHost(hostname) {
+  const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  return host === "localhost" || host === "::1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+function isInternalHost(hostname) {
+  const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (isLoopbackHost(hostname)) return true;
+  if (host.endsWith(".internal") || host.endsWith(".local")) return true;
+  const v4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    const [a, b] = [Number(v4[1]), Number(v4[2])];
+    if (a === 10) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 169 && b === 254) return true;
+    return false;
+  }
+  if (host.includes(":")) {
+    if (/^f[cd][0-9a-f]{0,2}:/.test(host)) return true;
+    if (/^fe[89ab][0-9a-f]:/.test(host)) return true;
+  }
+  return false;
+}
+function toShareObject(share) {
+  const value = typeof share === "string" ? JSON.parse(share) : share;
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("KeyShare must be a JSON object (or its JSON string), not a scalar or array.");
+  }
+  return value;
+}
+function toFrostPackage(pkg, which) {
+  const value = typeof pkg === "string" ? JSON.parse(pkg) : pkg;
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`FROST ${which} must be a JSON object (or its JSON string), not a scalar or array.`);
+  }
+  return value;
+}
+function extractSharedPublicKey(keyShareJson) {
+  const parsed = JSON.parse(keyShareJson);
+  const pk = parsed.core?.shared_public_key;
+  if (typeof pk !== "string") {
+    throw new Error("KeyShare is missing core.shared_public_key");
+  }
+  return pk;
+}
+function decodePublicKey(sharedPublicKeyJson) {
+  const pk = JSON.parse(sharedPublicKeyJson);
+  if (typeof pk !== "string") {
+    throw new Error("reshare assemble result is missing a shared_public_key");
+  }
+  return pk;
+}
+
+// src/mpc/load-wasm.ts
+var CLIENT_WASM_PACKAGE = "@waaskey/client-wasm";
+var CLIENT_WASM_VERSION = "0.2.1";
+async function verifyWasmIntegrity(bytes, expectedSha384) {
+  if (!expectedSha384 || !expectedSha384.startsWith("sha384-")) {
+    throw new Error("Waaskey: an expected SHA-384 integrity hash (sha384-<base64>) is required to load the wasm MPC core.");
+  }
+  const digest = await crypto.subtle.digest("SHA-384", bytes);
+  const actual = `sha384-${toBase64(new Uint8Array(digest))}`;
+  if (!timingSafeEqual(actual, expectedSha384)) {
+    throw new Error(`Waaskey: client-wasm integrity check FAILED \u2014 refusing to instantiate the MPC core (expected ${expectedSha384}, got ${actual}).`);
+  }
+}
+function createVerifiedClientWasmLoader(options) {
+  return async () => {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    if (!fetchImpl) {
+      throw new Error("Waaskey: no fetch implementation available to load the wasm MPC core \u2014 pass `fetch` in the loader options.");
+    }
+    let bytes;
+    try {
+      const res = await fetchImpl(options.wasmUrl instanceof URL ? options.wasmUrl.href : options.wasmUrl);
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      bytes = await res.arrayBuffer();
+    } catch (cause) {
+      throw new Error(`Waaskey: failed to fetch the client-wasm binary from ${String(options.wasmUrl)}.`, { cause });
+    }
+    await verifyWasmIntegrity(bytes, options.expectedSha384);
+    const compiled = await WebAssembly.compile(bytes);
+    let mod;
+    try {
+      mod = await import(CLIENT_WASM_PACKAGE);
+    } catch (cause) {
+      throw new Error("Waaskey: creating a wallet needs the wasm engine \u2014 install '@waaskey/client-wasm' alongside '@waaskey/sdk'.", { cause });
+    }
+    const init = mod["default"] ?? mod["init"];
+    const initSync = mod["initSync"];
+    if (typeof init === "function") {
+      await init(compiled);
+    } else if (typeof initSync === "function") {
+      initSync(compiled);
+    }
+    return mod;
+  };
+}
+var loadClientWasm = async () => {
+  try {
+    const mod = await import(CLIENT_WASM_PACKAGE);
+    return mod;
+  } catch (cause) {
+    throw new Error("Waaskey: creating a wallet needs the wasm engine \u2014 install '@waaskey/client-wasm' alongside '@waaskey/sdk'.", { cause });
+  }
+};
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+// src/mpc/prime-pool.ts
+var MemoryPrimeStore = class {
+  pools = /* @__PURE__ */ new Map();
+  async take(curve) {
+    return this.pools.get(curve)?.shift();
+  }
+  async add(curve, primes) {
+    const pool = this.pools.get(curve) ?? [];
+    pool.push(primes);
+    this.pools.set(curve, pool);
+  }
+  async size(curve) {
+    return this.pools.get(curve)?.length ?? 0;
+  }
+};
+var PrimePool = class {
+  constructor(core, options = {}) {
+    this.core = core;
+    this.store = options.store ?? new MemoryPrimeStore();
+    this.targetSize = Math.max(1, options.targetSize ?? 2);
+  }
+  core;
+  store;
+  targetSize;
+  /** Per-curve in-flight refill, so concurrent calls don't over-generate. */
+  refilling = /* @__PURE__ */ new Map();
+  /**
+   * Top up the pool to the target size — call this OFF the hot path (onboarding/idle, ideally a
+   * Web Worker). Deduped per curve, so calling it repeatedly is safe and cheap.
+   */
+  ensure(curve) {
+    const inflight = this.refilling.get(curve);
+    if (inflight) return inflight;
+    const task = this.refill(curve).finally(() => this.refilling.delete(curve));
+    this.refilling.set(curve, task);
+    return task;
+  }
+  async refill(curve) {
+    while (await this.store.size(curve) < this.targetSize) {
+      await this.store.add(curve, await this.core.pregeneratePrimes(curve));
+    }
+  }
+  /**
+   * Claim a prime for a keygen. Returns a cached one instantly when the pool is warm; otherwise
+   * generates one inline (the slow fallback) so keygen never fails on an empty pool. Either way it
+   * kicks off a background refill so the next wallet is instant.
+   */
+  async take(curve) {
+    const cached = await this.store.take(curve);
+    const primes = cached ?? await this.core.pregeneratePrimes(curve);
+    void this.ensure(curve).catch(() => void 0);
+    return primes;
+  }
+};
+
+// src/storage/indexeddb-store.ts
+var IndexedDbKeyValueStore = class {
+  constructor(dbName = "waaskey", storeName = "shares") {
+    this.dbName = dbName;
+    this.storeName = storeName;
+  }
+  dbName;
+  storeName;
+  dbPromise;
+  db() {
+    return this.dbPromise ??= new Promise((resolve, reject) => {
+      const idb = globalThis.indexedDB;
+      if (!idb) {
+        reject(new Error("IndexedDB is unavailable \u2014 pass a custom KeyValueStore (e.g. MemoryKeyValueStore) in this runtime."));
+        return;
+      }
+      const request = idb.open(this.dbName, 1);
+      request.onupgradeneeded = () => {
+        if (!request.result.objectStoreNames.contains(this.storeName)) {
+          request.result.createObjectStore(this.storeName);
+        }
+      };
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error("Failed to open IndexedDB."));
+    });
+  }
+  async run(mode, op) {
+    const db = await this.db();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(this.storeName, mode);
+      const request = op(tx.objectStore(this.storeName));
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error("IndexedDB request failed."));
+    });
+  }
+  async get(key) {
+    const value = await this.run("readonly", (store) => store.get(key));
+    return typeof value === "string" ? value : null;
+  }
+  async set(key, value) {
+    await this.run("readwrite", (store) => store.put(value, key));
+  }
+  async delete(key) {
+    await this.run("readwrite", (store) => store.delete(key));
+  }
+  async keys() {
+    const keys = await this.run("readonly", (store) => store.getAllKeys());
+    return keys.filter((key) => typeof key === "string");
+  }
+  async clear() {
+    await this.run("readwrite", (store) => store.clear());
+  }
+};
+
+// src/storage/encrypted-share-store.ts
+var SHARE_PREFIX = "share:";
+var SALT_KEY = "meta:salt";
+var MIN_SECRET_LENGTH = 16;
+var bytesToBase642 = (bytes) => {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+};
+var base64ToBytes2 = (base64) => {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+};
+var EncryptedShareStore = class _EncryptedShareStore {
+  constructor(kv, secret, options = {}) {
+    this.kv = kv;
+    this.secret = secret;
+    if (!secret) throw new Error("EncryptedShareStore: a non-empty `secret` is required.");
+    if (!options.allowWeakSecret && secret.length < MIN_SECRET_LENGTH) {
+      throw new Error(
+        `EncryptedShareStore: the sealing secret is too weak (< ${MIN_SECRET_LENGTH} chars) and is brute-forceable offline. Use the 32-byte passkey-PRF secret (PasskeyPrfSecretProvider), or pass { allowWeakSecret: true } only when entropy is guaranteed elsewhere.`
+      );
+    }
+  }
+  kv;
+  secret;
+  keyPromise;
+  /** Default web store: AES-GCM sealing over IndexedDB. */
+  static browser(secret, options) {
+    return new _EncryptedShareStore(new IndexedDbKeyValueStore(options?.dbName, options?.storeName), secret, { allowWeakSecret: options?.allowWeakSecret });
+  }
+  async put(walletId, share) {
+    const key = await this.key();
+    await this.kv.set(SHARE_PREFIX + walletId, await seal(key, share));
+  }
+  async get(walletId) {
+    const record = await this.kv.get(SHARE_PREFIX + walletId);
+    if (record === null) return null;
+    return open(await this.key(), record);
+  }
+  async has(walletId) {
+    return await this.kv.get(SHARE_PREFIX + walletId) !== null;
+  }
+  async remove(walletId) {
+    await this.kv.delete(SHARE_PREFIX + walletId);
+  }
+  async clear() {
+    this.keyPromise = void 0;
+    await this.kv.clear();
+  }
+  /** Lazily load (or create) the persisted salt and derive the AES key once. */
+  key() {
+    return this.keyPromise ??= this.loadKey();
+  }
+  async loadKey() {
+    const stored = await this.kv.get(SALT_KEY);
+    let salt;
+    if (stored) {
+      salt = base64ToBytes2(stored);
+    } else {
+      salt = freshSalt();
+      await this.kv.set(SALT_KEY, bytesToBase642(salt));
+    }
+    return deriveKey(this.secret, salt);
+  }
+};
+
+// src/storage/memory-store.ts
+var MemoryKeyValueStore = class {
+  map = /* @__PURE__ */ new Map();
+  async get(key) {
+    return this.map.get(key) ?? null;
+  }
+  async set(key, value) {
+    this.map.set(key, value);
+  }
+  async delete(key) {
+    this.map.delete(key);
+  }
+  async keys() {
+    return [...this.map.keys()];
+  }
+  async clear() {
+    this.map.clear();
+  }
+};
+
+// src/passkey/prf.ts
+var LEGACY_PRF_SALT_STRING = "waaskey-share-seal-v1";
+function legacyPrfSalt() {
+  return new TextEncoder().encode(LEGACY_PRF_SALT_STRING).buffer;
+}
+function randomPrfSalt() {
+  return crypto.getRandomValues(new Uint8Array(32)).buffer;
+}
+function saltToBase64(salt) {
+  let binary = "";
+  for (const byte of new Uint8Array(salt)) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function saltFromBase64(base64) {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes.buffer;
+}
+function isPasskeySupported() {
+  return typeof globalThis.navigator !== "undefined" && typeof globalThis.navigator.credentials !== "undefined";
+}
+async function isPrfSupported() {
+  if (!isPasskeySupported()) return false;
+  try {
+    const cred = globalThis.PublicKeyCredential;
+    if (typeof cred?.isConditionalMediationAvailable === "function") {
+      return cred.isConditionalMediationAvailable();
+    }
+  } catch {
+  }
+  return isPasskeySupported();
+}
+async function loadSimpleWebAuthn() {
+  try {
+    return await import('@simplewebauthn/browser');
+  } catch {
+    throw new WaaskeyError('Passkey PRF requires "@simplewebauthn/browser" installed, or pass a custom ceremony.', "unsupported");
+  }
+}
+async function defaultPrfCeremony() {
+  const mod = await loadSimpleWebAuthn();
+  return {
+    async register(options) {
+      const response = await mod.startRegistration({ optionsJSON: options });
+      const outputs = response.clientExtensionResults;
+      const prfResult = outputs.prf?.results?.first ?? null;
+      return { credentialId: response.id, prfResult };
+    },
+    async authenticate(_credentialId, options) {
+      const response = await mod.startAuthentication({ optionsJSON: options });
+      const outputs = response.clientExtensionResults;
+      const prfResult = outputs.prf?.results?.first ?? null;
+      return { prfResult };
+    }
+  };
+}
+var PasskeyPrfSecretProvider = class {
+  /**
+   * Register a new passkey that supports PRF and derive the initial secret from it.
+   *
+   * @returns `{ credentialId, secret }` — persist `credentialId`; use `secret`
+   * to construct `EncryptedShareStore.browser(secret)` for this session only.
+   *
+   * @throws `WaaskeyError('unsupported')` when PRF isn't available in this runtime.
+   * @throws `WaaskeyError('aborted')` when the user cancels the authenticator dialog.
+   */
+  async enroll(opts = {}) {
+    const ceremony = opts.ceremony ?? await defaultPrfCeremony();
+    const salt = randomPrfSalt();
+    const rpId = opts.rpId ?? (typeof location === "undefined" ? void 0 : location.hostname);
+    const creationOptions = {
+      rp: { name: opts.rpName ?? "Waaskey", ...rpId ? { id: rpId } : {} },
+      user: {
+        id: btoa(String.fromCharCode(...new Uint8Array(crypto.getRandomValues(new Uint8Array(16))))),
+        name: opts.userName ?? "user",
+        displayName: opts.userName ?? "User"
+      },
+      challenge: btoa(String.fromCharCode(...new Uint8Array(crypto.getRandomValues(new Uint8Array(32))))),
+      pubKeyCredParams: [
+        { type: "public-key", alg: -7 },
+        // ES256 (secp256r1)
+        { type: "public-key", alg: -257 }
+        // RS256
+      ],
+      authenticatorSelection: { userVerification: "required", residentKey: "required" },
+      extensions: { prf: { eval: { first: salt } } }
+    };
+    let credentialId;
+    let prfResult;
+    try {
+      ({ credentialId, prfResult } = await ceremony.register(creationOptions));
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      const msg = cause instanceof Error ? cause.message : String(cause);
+      if (/cancel|abort|not allowed|user gesture/i.test(msg)) {
+        throw new WaaskeyError("Passkey registration was cancelled by the user.", "aborted", { cause });
+      }
+      throw new WaaskeyError("Passkey registration failed.", "unsupported", { cause });
+    }
+    if (prfResult === null) {
+      throw new WaaskeyError("This authenticator does not support the PRF extension. Use a password or device-secret share instead.", "unsupported");
+    }
+    return { credentialId, salt: saltToBase64(salt), secret: prfOutputToSecret(prfResult) };
+  }
+  /**
+   * Authenticate with an existing passkey and re-derive the same stable secret.
+   *
+   * @param credentialId — the id returned by `enroll()`.
+   * @param opts.salt — the per-user salt `enroll()` returned (issue #41). Pass it to
+   *   re-derive the same secret; omit only for legacy credentials enrolled before
+   *   per-user salts (falls back to the constant salt).
+   * @returns `{ credentialId, salt, secret }` — reconstruct `EncryptedShareStore.browser(secret)`.
+   *
+   * @throws `WaaskeyError('unsupported')` when PRF isn't available.
+   * @throws `WaaskeyError('aborted')` when the user cancels.
+   */
+  async unlock(credentialId, opts = {}) {
+    const ceremony = opts.ceremony ?? await defaultPrfCeremony();
+    const salt = opts.salt ? saltFromBase64(opts.salt) : legacyPrfSalt();
+    const rpId = opts.rpId ?? (typeof location === "undefined" ? void 0 : location.hostname);
+    const requestOptions = {
+      challenge: btoa(String.fromCharCode(...new Uint8Array(crypto.getRandomValues(new Uint8Array(32))))),
+      allowCredentials: [{ id: credentialId, type: "public-key" }],
+      userVerification: "required",
+      ...rpId ? { rpId } : {},
+      extensions: { prf: { eval: { first: salt } } }
+    };
+    let prfResult;
+    try {
+      ({ prfResult } = await ceremony.authenticate(credentialId, requestOptions));
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      const msg = cause instanceof Error ? cause.message : String(cause);
+      if (/cancel|abort|not allowed|user gesture/i.test(msg)) {
+        throw new WaaskeyError("Passkey authentication was cancelled by the user.", "aborted", { cause });
+      }
+      throw new WaaskeyError("Passkey authentication failed.", "unsupported", { cause });
+    }
+    if (prfResult === null) {
+      throw new WaaskeyError("Passkey PRF output was not returned \u2014 authenticator may not support PRF or the credential was not created with PRF enabled.", "unsupported");
+    }
+    return { credentialId, salt: saltToBase64(salt), secret: prfOutputToSecret(prfResult) };
   }
 };
+function prfOutputToSecret(prfResult) {
+  const bytes = new Uint8Array(prfResult);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
 
+exports.Analytics = Analytics;
+exports.Auth = Auth;
+exports.Balances = Balances;
+exports.CLIENT_WASM_VERSION = CLIENT_WASM_VERSION;
+exports.EncryptedShareStore = EncryptedShareStore;
+exports.EvmRpcProvider = EvmRpcProvider;
+exports.HttpAnalyticsSink = HttpAnalyticsSink;
+exports.IndexedDbKeyValueStore = IndexedDbKeyValueStore;
+exports.Members = Members;
+exports.MemoryKeyValueStore = MemoryKeyValueStore;
+exports.MemoryPrimeStore = MemoryPrimeStore;
+exports.Onramp = Onramp;
+exports.PasskeyPrfSecretProvider = PasskeyPrfSecretProvider;
+exports.PrimePool = PrimePool;
+exports.Recovery = Recovery;
+exports.Reshare = Reshare;
 exports.Waaskey = Waaskey;
 exports.WaaskeyError = WaaskeyError;
 exports.Wallet = Wallet;
 exports.Wallets = Wallets;
+exports.WasmMpcCore = WasmMpcCore;
+exports.broadcast = broadcast;
+exports.createVerifiedClientWasmLoader = createVerifiedClientWasmLoader;
+exports.epochShareKey = epochShareKey;
+exports.formatUnits = formatUnits;
+exports.generateRecoveryCode = generateRecoveryCode;
+exports.getSigningAssertion = getSigningAssertion;
+exports.isNonCustodial = isNonCustodial;
+exports.isPasskeyAssertionSupported = isPasskeyAssertionSupported;
+exports.isPasskeySupported = isPasskeySupported;
+exports.isPrfSupported = isPrfSupported;
+exports.loadClientWasm = loadClientWasm;
+exports.memberShareKey = memberShareKey;
+exports.userBackupPendingKey = userBackupPendingKey;
+exports.validateCustodyPolicy = validateCustodyPolicy;
+exports.verifyWasmIntegrity = verifyWasmIntegrity;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map