@waaskey/sdk 0.3.2 → 0.4.0

package/README.md

@@ -29,6 +29,7 @@ const sessionSecret = await deriveUserSessionSecret();
 
 const waaskey = new Waaskey({
   apiKey: process.env.WAASKEY_PUBLISHABLE_KEY!,
+  baseUrl: process.env.WAASKEY_API_URL!, // required — there is no default
   // Non-custodial: the device runs its half of the ceremony and seals its key share.
   mpc: new WasmMpcCore(loadClientWasm), // dynamic-imports @waaskey/client-wasm
   shareStore: EncryptedShareStore.browser(sessionSecret), // sealed in IndexedDB
@@ -76,6 +77,7 @@ async function loadClientWasmNode() {
 const mpc = new WasmMpcCore(loadClientWasmNode);
 const waaskey = new Waaskey({
   apiKey: process.env.WAASKEY_API_KEY!,
+  baseUrl: process.env.WAASKEY_API_URL!,
   mpc,
   shareStore: new EncryptedShareStore(new MemoryKeyValueStore(), process.env.SHARE_SECRET!),
   primePool: new PrimePool(mpc),
@@ -158,7 +160,7 @@ const { items } = await wallet.signatures({ page: 1, limit: 20 });
 
 | Method                                                                                                   | Description                                                                                                                                  |
 | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
-| `new Waaskey({ apiKey, mpc, shareStore, baseUrl?, fetch? })`                                             | Create a client. `mpc` + `shareStore` are required to create wallets.                                                                        |
+| `new Waaskey({ apiKey, baseUrl, mpc, shareStore, fetch? })`                                              | Create a client. `mpc` + `shareStore` are required to create wallets.                                                                        |
 | `waaskey.wallets.create({ chain, label?, threshold?, parties?, custodyKinds?, custodyType? }, options?)` | Create (keygen + sealed share). Optional custody policy (default: non-custodial 2-of-3 `[device, server, user_backup]`). Returns a `Wallet`. |
 | `waaskey.wallets.list(query?, options?)`                                                                 | List the tenant's wallets, newest first (paginated `WalletData` rows).                                                                       |
 | `waaskey.wallets.get(id, options?)`                                                                      | Load an existing wallet.                                                                                                                     |

package/dist/index.cjs

@@ -519,6 +519,17 @@ async function deriveKey(secret, salt) {
     "decrypt"
   ]);
 }
+async function deriveKeyFromBytes(material, salt, info) {
+  const s = subtle();
+  const baseKey = await s.importKey("raw", material, "HKDF", false, ["deriveKey"]);
+  return s.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt, info: new TextEncoder().encode(info) },
+    baseKey,
+    { name: "AES-GCM", length: AES_KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
 async function seal(key, plaintext) {
   const iv = randomBytes(IV_BYTES);
   const data = new TextEncoder().encode(plaintext);
@@ -561,6 +572,60 @@ function base64ToBytes(base64) {
   return bytes;
 }
 
+// src/recovery-envelope.ts
+var KEK_INFO = "waaskey-backup-kek-v1";
+var DEK_INFO = "waaskey-backup-dek-v1";
+async function sealRecoveryBackup(share, recoveryCode, passkey) {
+  const dataKeyBytes = randomBytes(32);
+  const dataKey = await deriveKeyFromBytes(dataKeyBytes, new Uint8Array(0), DEK_INFO);
+  const ciphertext = await seal(dataKey, share);
+  const codeSalt = freshSalt();
+  const keyWraps = [
+    {
+      method: "passphrase",
+      wrapped: await seal(await deriveKey(recoveryCode, codeSalt), bytesToBase64(dataKeyBytes)),
+      salt: bytesToBase64(codeSalt)
+    }
+  ];
+  if (passkey) {
+    const prfSalt = base64ToBytes(passkey.salt);
+    keyWraps.push({
+      method: "passkey_prf",
+      wrapped: await seal(await deriveKeyFromBytes(base64ToBytes(passkey.secret), prfSalt, KEK_INFO), bytesToBase64(dataKeyBytes)),
+      salt: passkey.salt,
+      credentialId: passkey.credentialId
+    });
+  }
+  return { ciphertext, keyWraps };
+}
+async function openRecoveryBackup(envelope, opener) {
+  const prfWrap = envelope.keyWraps.find((w) => w.method === "passkey_prf");
+  if (opener.passkeySecret !== void 0 && prfWrap) {
+    const kek = await deriveKeyFromBytes(base64ToBytes(opener.passkeySecret), base64ToBytes(prfWrap.salt), KEK_INFO);
+    return openWith(envelope.ciphertext, prfWrap, kek, "passkey");
+  }
+  const codeWrap = envelope.keyWraps.find((w) => w.method === "passphrase");
+  if (opener.recoveryCode !== void 0 && codeWrap) {
+    const kek = await deriveKey(opener.recoveryCode, base64ToBytes(codeWrap.salt));
+    return openWith(envelope.ciphertext, codeWrap, kek, "recovery code");
+  }
+  const enrolled = envelope.keyWraps.map((w) => w.method).join(", ") || "none";
+  throw new WaaskeyError(`No key available to open this backup \u2014 it is wrapped for [${enrolled}] and none of those was supplied.`, "recovery_failed");
+}
+async function openWith(ciphertext, wrap, kek, label) {
+  let dataKeyBytes;
+  try {
+    dataKeyBytes = base64ToBytes(await open(kek, wrap.wrapped));
+  } catch (cause) {
+    throw new WaaskeyError(`Could not unwrap the backup key with the ${label} \u2014 wrong ${label}?`, "recovery_failed", { cause });
+  }
+  try {
+    return await open(await deriveKeyFromBytes(dataKeyBytes, new Uint8Array(0), DEK_INFO), ciphertext);
+  } catch (cause) {
+    throw new WaaskeyError("The backup key does not open this backup \u2014 the stored ciphertext and key wrap do not belong together.", "recovery_failed", { cause });
+  }
+}
+
 // src/recovery.ts
 var MIN_FACTORS = 3;
 var Recovery = class {
@@ -598,7 +663,7 @@ var Recovery = class {
       { challengeId: params.challengeId, verifications: await hashRecoveryFactors(params.verifications) },
       options.signal
     );
-    const share = await this.decrypt(res.ciphertext, params.recoveryCode);
+    const share = await this.decrypt(res, params);
     await this.deps.shareStore?.put(walletId, share);
     this.deps.analytics?.track("wallet.recovered", { walletId });
     return { share, refreshedAt: res.refreshedAt };
@@ -613,20 +678,15 @@ var Recovery = class {
    * device-loss so a leaked backup can't be replayed against a still-valid old share.
    */
   async retrieveShare(walletId, params, options = {}) {
-    const ciphertext = await fetchRecoveryCiphertext(this.http, walletId, params, options.signal);
-    return this.decrypt(ciphertext, params.recoveryCode);
+    return this.decrypt(await fetchRecoveryBackup(this.http, walletId, params, options.signal), params);
   }
-  async decrypt(ciphertext, recoveryCode) {
-    try {
-      return await openWithPassword(recoveryCode, ciphertext);
-    } catch (cause) {
-      throw new WaaskeyError("Could not decrypt the recovery share \u2014 wrong recovery code?", "recovery_failed", { cause });
-    }
+  decrypt(backup, params) {
+    return openRecoveryBlob(backup, params);
   }
 };
 async function buildRecoveryRegistration(params) {
   const recoveryCode = params.recoveryCode ?? generateRecoveryCode();
-  const ciphertext = await sealWithPassword(recoveryCode, params.share);
+  const backup = params.passkey ? await sealRecoveryBackup(params.share, recoveryCode, params.passkey) : { ciphertext: await sealWithPassword(recoveryCode, params.share), keyWraps: void 0 };
   const factors = [
     { type: "recovery_code", credential: await sha256Hex(recoveryCode) },
     { type: "totp", credential: params.totpSecret },
@@ -636,19 +696,31 @@ async function buildRecoveryRegistration(params) {
   if (factors.length < MIN_FACTORS) {
     throw new WaaskeyError(`Recovery requires at least ${MIN_FACTORS} factors.`, "validation");
   }
-  return { recoveryCode, payload: { ciphertext, factors } };
+  return { recoveryCode, payload: { ciphertext: backup.ciphertext, factors, ...backup.keyWraps ? { keyWraps: backup.keyWraps } : {} } };
 }
 function postRecoveryRegistration(http, walletId, payload, signal) {
   return http.request("POST", `/v1/wallets/${walletId}/recovery/register`, payload, signal);
 }
-async function fetchRecoveryCiphertext(http, walletId, params, signal) {
-  const res = await http.request(
+async function fetchRecoveryBackup(http, walletId, params, signal) {
+  return http.request(
     "POST",
     `/v1/wallets/${walletId}/recovery/verify`,
     { challengeId: params.challengeId, verifications: await hashRecoveryFactors(params.verifications) },
     signal
   );
-  return res.ciphertext;
+}
+async function openRecoveryBlob(backup, opener) {
+  if (backup.keyWraps?.length) {
+    return openRecoveryBackup({ ciphertext: backup.ciphertext, keyWraps: backup.keyWraps }, opener);
+  }
+  if (opener.recoveryCode === void 0) {
+    throw new WaaskeyError("This backup predates passkey wrapping and can only be opened with the recovery code.", "recovery_failed");
+  }
+  try {
+    return await openWithPassword(opener.recoveryCode, backup.ciphertext);
+  } catch (cause) {
+    throw new WaaskeyError("Could not decrypt the recovery share \u2014 wrong recovery code?", "recovery_failed", { cause });
+  }
 }
 async function registerRecoveryShare(http, walletId, params, signal) {
   const { recoveryCode, payload } = await buildRecoveryRegistration(params);
@@ -694,6 +766,47 @@ function toMpcCurve(curve) {
   }
   return curve;
 }
+var DEVICE_ENC_STORE_KEY = "__waaskey_device_enc_v1__";
+async function getOrCreateDeviceEncKeypair(shareStore) {
+  const existing = await shareStore.get(DEVICE_ENC_STORE_KEY);
+  if (existing !== null) return parseDeviceEncKeypair(existing);
+  const keypair = generateDeviceEncKeypair();
+  await shareStore.put(DEVICE_ENC_STORE_KEY, JSON.stringify(keypair));
+  return keypair;
+}
+function generateDeviceEncKeypair() {
+  const secret = ed25519_js.x25519.utils.randomSecretKey();
+  const publicKey = ed25519_js.x25519.getPublicKey(secret);
+  if (isAllZero(publicKey)) {
+    throw new WaaskeyError("Generated an all-zero X25519 encryption public key \u2014 refusing to seal keygen packages to it.", "keygen_failed");
+  }
+  return { secretHex: bytesToHex(secret), publicHex: bytesToHex(publicKey) };
+}
+function parseDeviceEncKeypair(blob) {
+  let parsed;
+  try {
+    parsed = JSON.parse(blob);
+  } catch (cause) {
+    throw new WaaskeyError("Stored device encryption keypair is corrupt \u2014 it is not valid JSON.", "keygen_failed", { cause });
+  }
+  if (!isHex32(parsed.secretHex) || !isHex32(parsed.publicHex)) {
+    throw new WaaskeyError("Stored device encryption keypair is malformed \u2014 expected 32-byte (64 hex) secret + public keys.", "keygen_failed", {
+      details: { keys: Object.keys(parsed) }
+    });
+  }
+  return { secretHex: parsed.secretHex, publicHex: parsed.publicHex };
+}
+function isHex32(v) {
+  return typeof v === "string" && /^[0-9a-fA-F]{64}$/.test(v);
+}
+function isAllZero(bytes) {
+  return bytes.every((byte) => byte === 0);
+}
+function bytesToHex(bytes) {
+  let hex = "";
+  for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+  return hex;
+}
 
 // src/internal.ts
 function throwIfAborted(signal) {
@@ -719,6 +832,7 @@ function delay(ms, signal) {
 }
 
 // src/reshare.ts
+var USER_BACKUP_ROLE = "user_backup";
 var Reshare = class {
   constructor(http, deps = {}) {
     this.http = http;
@@ -726,6 +840,116 @@ var Reshare = class {
   }
   http;
   deps;
+  /**
+   * Rotate the wallet onto a NEW committee, keeping its address, and drive this device's whole half of
+   * the ceremony (#488).
+   *
+   * The client is not a bystander here: the platform holds ONE share and cannot reach the threshold, so
+   * without this device's deal there is no ceremony at all.
+   *
+   * 1. Open the ceremony with the committee asked for (an empty request re-issues the current one).
+   * 2. DEAL from this device's current-epoch share — pure and local; every sub-share leaves sealed.
+   * 3. For each CLIENT-held new holder — identified by custody KIND, never by role name — fetch its
+   *    material and assemble its new-epoch core locally, refusing any share that reproduces a different
+   *    public key.
+   * 4. Acknowledge each one. The `user_backup` holder's ack carries its new share re-sealed under the
+   *    user's EXISTING recovery code, so the wallet's no-lock-out property survives the rotation; the
+   *    last acknowledgement drives the backend's atomic cutover.
+   *
+   * The assembled cores are BARE (no aux): the wallet is `reshareAuxPending` until aux-completion, which
+   * is {@link complete}'s job — and which re-assembles from the material itself, so nothing here needs
+   * to be kept on the device between the two. Nothing here can leave the device worse off — the old-epoch share is
+   * untouched, and a ceremony that fails cuts nothing over.
+   */
+  async rotate(walletId, params = {}, options = {}) {
+    const { mpc, shareStore } = this.deps;
+    if (!mpc || !shareStore) {
+      throw new WaaskeyError("Driving a reshare requires a device MPC core and a share store \u2014 pass `mpc` and `shareStore` to `new Waaskey(...)`.", "device_core_required");
+    }
+    if (!mpc.runReshareDeal || !mpc.runReshareAssemble) {
+      throw new WaaskeyError("The configured MPC core does not support reshare \u2014 use a client-wasm built with the `reshare` feature.", "unsupported");
+    }
+    const { signal } = options;
+    throwIfAborted(signal);
+    const wallet = await this.http.request("GET", `/v1/wallets/${walletId}`, void 0, signal);
+    if (!wallet.publicKey) {
+      throw new WaaskeyError("The wallet has no public key yet \u2014 only an ACTIVE wallet can be reshared.", "reshare_failed", { details: { walletId } });
+    }
+    const share = await shareStore.get(epochShareKey(walletId, wallet.keyEpoch));
+    if (!share) {
+      throw new WaaskeyError(`This device holds no share for wallet "${walletId}" at epoch ${wallet.keyEpoch} \u2014 it cannot deal the reshare.`, "reshare_failed");
+    }
+    throwIfAborted(signal);
+    const ceremony = await this.http.request("POST", `/v1/wallets/${walletId}/reshare-embedded`, params, signal);
+    const encKeypair = await getOrCreateDeviceEncKeypair(shareStore);
+    const curve = toMpcCurve(ceremony.curve);
+    const clientHolders = ceremony.newParties.filter((_role, i) => isClientCustody(ceremony.newCustodyKinds[i]));
+    try {
+      throwIfAborted(signal);
+      const dealt = await mpc.runReshareDeal({
+        curve,
+        share,
+        quorumIndices: ceremony.quorumIndices,
+        newPreimages: ceremony.newPreimages,
+        newThreshold: ceremony.newThreshold,
+        recipientPubkeys: ceremony.recipientPubkeys
+      });
+      await this.http.request(
+        "POST",
+        `/v1/wallets/${walletId}/reshare-drop/${ceremony.id}/deal`,
+        { commitments: dealt.commitments, sealedSubShares: dealt.sealedSubShares },
+        signal
+      );
+      let { status } = ceremony;
+      for (const role of clientHolders) {
+        throwIfAborted(signal);
+        const material = await this.http.request(
+          "GET",
+          `/v1/wallets/${walletId}/reshare-drop/${ceremony.id}/assembly?role=${encodeURIComponent(role)}`,
+          void 0,
+          signal
+        );
+        const assembled = await mpc.runReshareAssemble({
+          curve,
+          newPosition: material.newPosition,
+          newPreimages: material.newPreimages,
+          newThreshold: material.newThreshold,
+          wallet: material.wallet,
+          commitments: material.commitments,
+          subShares: material.subShares,
+          encryptionSecret: encKeypair.secretHex
+        });
+        assertPublicKey(assembled.sharedPublicKey, wallet.publicKey, walletId);
+        const body = role === USER_BACKUP_ROLE ? { backupCiphertext: await this.sealBackup(assembled.core, params.recoveryCode) } : {};
+        const ack = await this.http.request(
+          "POST",
+          `/v1/wallets/${walletId}/reshare-drop/${ceremony.id}/assembled?role=${encodeURIComponent(role)}`,
+          body,
+          signal
+        );
+        ({ status } = ack);
+      }
+      this.deps.analytics?.track("wallet.reshared", { walletId, curve: ceremony.curve });
+      return { walletId, ceremonyId: ceremony.id, status, keyEpoch: ceremony.keyEpoch, assembledRoles: clientHolders, sharedPublicKey: wallet.publicKey };
+    } catch (cause) {
+      if (cause instanceof WaaskeyError) throw cause;
+      throw new WaaskeyError("The reshare ceremony failed.", "reshare_failed", { cause });
+    }
+  }
+  /**
+   * Re-seal the new `user_backup` core under the user's EXISTING recovery code. The code never leaves
+   * the device — only the ciphertext does — which is the same trust model registration has, and the
+   * reason the server cannot check WHICH code sealed it.
+   */
+  async sealBackup(core, recoveryCode) {
+    if (!recoveryCode) {
+      throw new WaaskeyError(
+        "This committee keeps a `user_backup` holder, so its new share must be re-sealed under the wallet existing recovery code \u2014 pass `recoveryCode` to `reshare.rotate(...)`.",
+        "reshare_failed"
+      );
+    }
+    return sealWithPassword(recoveryCode, core);
+  }
   /**
    * Complete this device's share for a device-retaining reshare and make the wallet signable on the
    * device under the new epoch.
@@ -756,6 +980,7 @@ var Reshare = class {
     if (!wallet.publicKey) {
       throw new WaaskeyError("The wallet has no public key yet \u2014 it must be an ACTIVE reshared wallet to complete on device.", "reshare_failed", { details: { walletId } });
     }
+    const encKeypair = await getOrCreateDeviceEncKeypair(shareStore);
     throwIfAborted(signal);
     let completed;
     try {
@@ -766,7 +991,8 @@ var Reshare = class {
         newThreshold: material.newThreshold,
         wallet: material.wallet,
         commitments: material.commitments,
-        subShares: material.subShares
+        subShares: material.subShares,
+        encryptionSecret: encKeypair.secretHex
       });
       assertPublicKey(assembled.sharedPublicKey, wallet.publicKey, walletId);
       throwIfAborted(signal);
@@ -796,6 +1022,9 @@ var Reshare = class {
 function epochShareKey(walletId, keyEpoch) {
   return keyEpoch <= 1 ? walletId : `${walletId}@epoch-${keyEpoch}`;
 }
+function isClientCustody(kind) {
+  return kind !== void 0 && kind !== "platform_signer" && kind !== "platform_recovery";
+}
 function assertPublicKey(actual, expected, walletId) {
   if (actual !== expected) {
     throw new WaaskeyError("The reshared share reproduced a DIFFERENT public key than the wallet \u2014 aborting (device share not stored).", "reshare_pubkey_mismatch", {
@@ -870,47 +1099,6 @@ function deserializeEddsaShare(blob) {
   }
   return { keyPackage: parsed.keyPackage, publicKeyPackage: parsed.publicKeyPackage };
 }
-var DEVICE_ENC_STORE_KEY = "__waaskey_device_enc_v1__";
-async function getOrCreateDeviceEncKeypair(shareStore) {
-  const existing = await shareStore.get(DEVICE_ENC_STORE_KEY);
-  if (existing !== null) return parseDeviceEncKeypair(existing);
-  const keypair = generateDeviceEncKeypair();
-  await shareStore.put(DEVICE_ENC_STORE_KEY, JSON.stringify(keypair));
-  return keypair;
-}
-function generateDeviceEncKeypair() {
-  const secret = ed25519_js.x25519.utils.randomSecretKey();
-  const publicKey = ed25519_js.x25519.getPublicKey(secret);
-  if (isAllZero(publicKey)) {
-    throw new WaaskeyError("Generated an all-zero X25519 encryption public key \u2014 refusing to seal keygen packages to it.", "keygen_failed");
-  }
-  return { secretHex: bytesToHex(secret), publicHex: bytesToHex(publicKey) };
-}
-function parseDeviceEncKeypair(blob) {
-  let parsed;
-  try {
-    parsed = JSON.parse(blob);
-  } catch (cause) {
-    throw new WaaskeyError("Stored device encryption keypair is corrupt \u2014 it is not valid JSON.", "keygen_failed", { cause });
-  }
-  if (!isHex32(parsed.secretHex) || !isHex32(parsed.publicHex)) {
-    throw new WaaskeyError("Stored device encryption keypair is malformed \u2014 expected 32-byte (64 hex) secret + public keys.", "keygen_failed", {
-      details: { keys: Object.keys(parsed) }
-    });
-  }
-  return { secretHex: parsed.secretHex, publicHex: parsed.publicHex };
-}
-function isHex32(v) {
-  return typeof v === "string" && /^[0-9a-fA-F]{64}$/.test(v);
-}
-function isAllZero(bytes) {
-  return bytes.every((byte) => byte === 0);
-}
-function bytesToHex(bytes) {
-  let hex = "";
-  for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
-  return hex;
-}
 
 // src/session-sign.ts
 function toDeviceSignParams(ceremony, share, digest) {
@@ -1397,7 +1585,7 @@ function normalizeDigest(digest) {
 // src/wallets.ts
 var BACKUP_REGISTER_ATTEMPTS = 3;
 var BACKUP_REGISTER_BACKOFF_MS = 200;
-var USER_BACKUP_ROLE = "user_backup";
+var USER_BACKUP_ROLE2 = "user_backup";
 var DEFAULT_ACTIVATION_TIMEOUT_MS = 6e4;
 var DEFAULT_POLL_INTERVAL_MS = 1e3;
 var Wallets = class {
@@ -1709,7 +1897,7 @@ var Wallets = class {
    */
   async runSecpKeygen(mpc, shareStore, primePool, walletId, ceremony, curve, backup, signal) {
     const extras = ceremony.additionalParties ?? [];
-    const unsupported = extras.filter((party) => party.role !== USER_BACKUP_ROLE);
+    const unsupported = extras.filter((party) => party.role !== USER_BACKUP_ROLE2);
     if (unsupported.length > 0) {
       throw new WaaskeyError(
         `The keygen ceremony carries an additional client party this SDK cannot drive (${unsupported.map((party) => party.role).join(", ")}) \u2014 refusing to keygen, since leaving a party unjoined would hang the ceremony.`,
@@ -1717,7 +1905,7 @@ var Wallets = class {
         { details: { roles: unsupported.map((party) => party.role) } }
       );
     }
-    const userBackupParty = extras.find((party) => party.role === USER_BACKUP_ROLE);
+    const userBackupParty = extras.find((party) => party.role === USER_BACKUP_ROLE2);
     if (!userBackupParty) {
       const pregeneratedPrimes = primePool ? await primePool.take(curve) : void 0;
       throwIfAborted(signal);
@@ -1837,8 +2025,8 @@ var Wallets = class {
     const { signal } = options;
     throwIfAborted(signal);
     const digest = normalizeDigest(params.digest);
-    const ciphertext = await this.fetchUserBackupCiphertext(walletId, params, signal);
-    const share = await restoreUserBackupShare(ciphertext, params.recoveryCode);
+    const backup = await this.fetchUserBackup(walletId, params, signal);
+    const share = await restoreUserBackupShare(backup, params);
     throwIfAborted(signal);
     const body = { digest };
     if (params.chainId !== void 0) body["chainId"] = params.chainId;
@@ -1857,13 +2045,15 @@ var Wallets = class {
     return signature;
   }
   /**
-   * Retrieve the sealed `user_backup` ciphertext via the recovery gate ({@link fetchRecoveryCiphertext}),
-   * mapping a "no recovery share registered" (404) to the actionable `share_not_found` — this wallet has no
-   * client-held `user_backup` backup to co-sign with (its device-loss recovery is the custodial path instead).
+   * Retrieve the sealed `user_backup` backup via the recovery gate ({@link fetchRecoveryBackup}) — the
+   * ciphertext AND its key wraps (#510), since a backup registered with a passkey is an envelope and
+   * the wraps are what open it. Maps a "no recovery share registered" (404) to the actionable
+   * `share_not_found` — this wallet has no client-held `user_backup` backup to co-sign with (its
+   * device-loss recovery is the custodial path instead).
    */
-  async fetchUserBackupCiphertext(walletId, params, signal) {
+  async fetchUserBackup(walletId, params, signal) {
     try {
-      return await fetchRecoveryCiphertext(this.http, walletId, params, signal);
+      return await fetchRecoveryBackup(this.http, walletId, params, signal);
     } catch (cause) {
       if (cause instanceof WaaskeyError && cause.code === "not_found") {
         throw new WaaskeyError(
@@ -1985,12 +2175,12 @@ var Wallets = class {
     }
   }
 };
-async function restoreUserBackupShare(ciphertext, recoveryCode) {
+async function restoreUserBackupShare(backup, opener) {
   let blob;
   try {
-    blob = await openWithPassword(recoveryCode, ciphertext);
+    blob = await openRecoveryBlob(backup, opener);
   } catch (cause) {
-    throw new WaaskeyError("Could not open the user_backup backup \u2014 wrong recovery code?", "invalid_recovery_code", { cause });
+    throw new WaaskeyError("Could not open the user_backup backup \u2014 wrong recovery code or passkey?", "invalid_recovery_code", { cause });
   }
   return deserializeShare(blob).keyShare;
 }
@@ -2112,13 +2302,12 @@ function isReadyMemberSignCeremony(ceremony) {
 }
 
 // src/client.ts
-var DEFAULT_BASE_URL = "https://api.waaskey.com";
 var Waaskey = class {
   /** The `wallets` resource. */
   wallets;
   /** The `recovery` resource — multi-factor, client-encrypted wallet recovery. */
   recovery;
-  /** The `reshare` resource — device-side completion of a device-retaining reshare (#318). */
+  /** The `reshare` resource — this device's half of a committee rotation (#488) and the aux-completion that follows (#318). */
   reshare;
   /** The `balances` resource — client-side balance reads from a chain provider (no backend). */
   balances;
@@ -2134,7 +2323,10 @@ var Waaskey = class {
     if (!options?.apiKey) {
       throw new Error("Waaskey: `apiKey` is required.");
     }
-    const http = new HttpClient(options.apiKey, options.baseUrl ?? DEFAULT_BASE_URL, options.fetch);
+    if (!options.baseUrl) {
+      throw new Error("Waaskey: `baseUrl` is required \u2014 pass the URL of your Waaskey API (there is no default).");
+    }
+    const http = new HttpClient(options.apiKey, options.baseUrl, options.fetch);
     const analytics = new Analytics(resolveSink(options.analytics, http));
     this.auth = new Auth(http);
     this.members = new Members(http);
@@ -2169,6 +2361,15 @@ function resolveSink(analytics, http) {
   return analytics ?? new HttpAnalyticsSink(http);
 }
 
+// src/passkey/recovery-factor.ts
+function passkeyFactorEnrollment(credentialId) {
+  return { type: "passkey", credential: credentialId };
+}
+async function passkeyFactorVerification(challenge, options = {}) {
+  const assertion = await getSigningAssertion(challenge, options);
+  return { type: "passkey", token: JSON.stringify(assertion) };
+}
+
 // src/mpc/wasm-core.ts
 var WasmMpcCore = class {
   constructor(load) {
@@ -2234,7 +2435,10 @@ var WasmMpcCore = class {
         new_threshold: params.newThreshold,
         wallet: params.wallet,
         commitments: params.commitments,
-        sub_shares: params.subShares
+        sub_shares: params.subShares,
+        // The core opens the SEALED sub-shares with this before it can verify or assemble anything;
+        // omitting it (as this did until #488) makes the call fail on its own parameter parse.
+        encryption_secret: params.encryptionSecret
       })
     );
     if (!raw || typeof raw.core_json !== "string") {
@@ -2242,6 +2446,26 @@ var WasmMpcCore = class {
     }
     return { core: raw.core_json, sharedPublicKey: decodePublicKey(raw.shared_public_key_json) };
   }
+  async runReshareDeal(params) {
+    const wasm = await this.init();
+    if (!wasm.reshareDeal) {
+      throw new Error(reshareFeatureHint("reshareDeal"));
+    }
+    const raw = await wasm.reshareDeal(
+      JSON.stringify({
+        curve: params.curve,
+        share: JSON.parse(params.share),
+        quorum_indices: params.quorumIndices,
+        new_preimages: params.newPreimages,
+        new_threshold: params.newThreshold,
+        recipient_pubkeys: params.recipientPubkeys
+      })
+    );
+    if (!raw || !Array.isArray(raw.sealed_sub_shares_hex)) {
+      throw new Error("client-wasm returned an unexpected reshareDeal result");
+    }
+    return { commitments: raw.commitments_json, sealedSubShares: raw.sealed_sub_shares_hex };
+  }
   async runCompleteReshare(params) {
     const wasm = await this.init();
     if (!wasm.completeReshare) {
@@ -2942,6 +3166,10 @@ exports.isPasskeySupported = isPasskeySupported;
 exports.isPrfSupported = isPrfSupported;
 exports.loadClientWasm = loadClientWasm;
 exports.memberShareKey = memberShareKey;
+exports.openRecoveryBackup = openRecoveryBackup;
+exports.passkeyFactorEnrollment = passkeyFactorEnrollment;
+exports.passkeyFactorVerification = passkeyFactorVerification;
+exports.sealRecoveryBackup = sealRecoveryBackup;
 exports.userBackupPendingKey = userBackupPendingKey;
 exports.validateCustodyPolicy = validateCustodyPolicy;
 exports.verifyWasmIntegrity = verifyWasmIntegrity;