@dynamic-labs-wallet/browser 0.0.260 → 0.0.261

package/index.esm.js

@@ -1,4 +1,4 @@
-import { BitcoinAddressType, SigningAlgorithm, MPC_RELAY_PROD_API_URL, getMPCChainConfig, AuthMode, BackupLocation, WalletOperation, WalletReadyState, parseNamespacedVersion, FEATURE_FLAGS, ThresholdSignatureScheme, getClientThreshold, MPC_CONFIG, getTSSConfig, serializeMessageForForwardMPC, getReshareConfig, verifiedCredentialNameToChainEnum, ENCRYPTED_SHARES_STORAGE_SUFFIX, DynamicApiClient, getEnvironmentFromUrl, IFRAME_DOMAIN_MAP } from '@dynamic-labs-wallet/core';
+import { BitcoinAddressType, SigningAlgorithm, MPC_RELAY_PROD_API_URL, getMPCChainConfig, AuthMode, BackupLocation, ENCRYPTED_SHARES_STORAGE_SUFFIX, WalletOperation, WalletReadyState, parseNamespacedVersion, FEATURE_FLAGS, ThresholdSignatureScheme, getClientThreshold, MPC_CONFIG, getTSSConfig, serializeMessageForForwardMPC, getReshareConfig, verifiedCredentialNameToChainEnum, DynamicApiClient, getEnvironmentFromUrl, IFRAME_DOMAIN_MAP } from '@dynamic-labs-wallet/core';
 export * from '@dynamic-labs-wallet/core';
 import { BIP340, ExportableEd25519, Ecdsa, MessageHash, EcdsaSignature, EcdsaKeygenResult, ExportableEd25519KeygenResult, BIP340KeygenResult } from '#internal/web';
 export { BIP340, BIP340InitKeygenResult, BIP340KeygenResult, Ecdsa, EcdsaInitKeygenResult, EcdsaKeygenResult, EcdsaPublicKey, EcdsaSignature, Ed25519, Ed25519InitKeygenResult, Ed25519KeygenResult, MessageHash } from '#internal/web';
@@ -222,6 +222,11 @@ const ensureBase64Padding = (str)=>{
     ]);
 };
 
+const INVALID_PASSWORD_ERROR = 'Decryption failed: Invalid password. Please check your password and try again.';
+/**
+ * Check if an error is an OperationError from SubtleCrypto.decrypt,
+ * which indicates authentication failure (wrong password/derived key)
+ */ const isInvalidPasswordError = (error)=>error instanceof Error && error.name === 'OperationError';
 /**
  * Get the appropriate key derivation function based on the encryption config
  */ const getKey = async (params, encryptionConfig)=>{
@@ -310,10 +315,15 @@ const ensureBase64Padding = (str)=>{
                 }, key, cipherBytes);
                 return new TextDecoder().decode(decryptedData);
             } catch (retryError) {
-                // If retry also fails, throw the original error with additional context
+                if (isInvalidPasswordError(retryError)) {
+                    throw new Error(INVALID_PASSWORD_ERROR);
+                }
                 throw new Error(`Decryption failed after retry with parallelism=1: ${retryError}`);
             }
         }
+        if (isInvalidPasswordError(error)) {
+            throw new Error(INVALID_PASSWORD_ERROR);
+        }
         throw new Error('Decryption failed: ' + error);
     }
 };
@@ -506,6 +516,12 @@ const ERROR_EXPORT_PRIVATE_KEY = '[DynamicWaasWalletClient]: Error exporting pri
 const ERROR_IMPORT_PRIVATE_KEY = '[DynamicWaasWalletClient]: Error importing private key';
 const ERROR_PUBLIC_KEY_MISMATCH = 'Mismatch between the public keys of the server and the ones provided';
 
+/**
+ * Normalizes an address to lowercase for consistent map key lookups.
+ * This ensures that addresses with different casing (e.g., EIP-55 checksummed vs lowercase)
+ * resolve to the same wallet entry.
+ */ const normalizeAddress = (address)=>address.toLowerCase();
+
 // eslint-disable-next-line @nx/enforce-module-boundaries
 const isBrowser = ()=>typeof window !== 'undefined';
 /**
@@ -696,6 +712,16 @@ const downloadStringAsFile = ({ filename, content, mimeType = 'application/json'
     a.click();
     URL.revokeObjectURL(url);
 };
+/**
+ * Checks if a wallet has cached encrypted shares in storage.
+ */ const hasEncryptedSharesCached = async ({ accountAddress, backupInfo, storage })=>{
+    if (!(backupInfo == null ? void 0 : backupInfo.passwordEncrypted)) {
+        return false;
+    }
+    const encryptedStorageKey = `${normalizeAddress(accountAddress)}${ENCRYPTED_SHARES_STORAGE_SUFFIX}`;
+    const encryptedData = await storage.getItem(encryptedStorageKey);
+    return !!encryptedData;
+};
 /**
  * Checks if an error is a public key mismatch error that can be recovered
  * by re-fetching the client key share from backup.
@@ -1240,6 +1266,7 @@ const hasDelegatedBackup = (backupInfo)=>{
    * Get or create the heavy operation queue for a wallet.
    * Heavy operations (refresh/reshare/recover) run with concurrency=1.
    */ static getHeavyOpQueue(accountAddress) {
+        accountAddress = normalizeAddress(accountAddress);
         if (!this.heavyOpQueues.has(accountAddress)) {
             const queue = new PQueue({
                 concurrency: 1,
@@ -1259,6 +1286,7 @@ const hasDelegatedBackup = (backupInfo)=>{
    * Get or create the sign queue for a wallet.
    * Sign operations run with unlimited concurrency (they're read-only on key shares).
    */ static getSignQueue(accountAddress) {
+        accountAddress = normalizeAddress(accountAddress);
         if (!this.signQueues.has(accountAddress)) {
             const queue = new PQueue({
                 concurrency: Infinity,
@@ -1277,12 +1305,14 @@ const hasDelegatedBackup = (backupInfo)=>{
     /**
    * Check if wallet has heavy operations in progress
    */ static isHeavyOpInProgress(accountAddress) {
+        accountAddress = normalizeAddress(accountAddress);
         const queue = this.heavyOpQueues.get(accountAddress);
         return queue ? queue.size > 0 || queue.pending > 0 : false;
     }
     /**
    * Check if wallet has operations in any queue (heavy or sign)
    */ static isWalletBusy(accountAddress) {
+        accountAddress = normalizeAddress(accountAddress);
         const heavyQueue = this.heavyOpQueues.get(accountAddress);
         const signQueue = this.signQueues.get(accountAddress);
         const heavyBusy = heavyQueue ? heavyQueue.size > 0 || heavyQueue.pending > 0 : false;
@@ -1292,22 +1322,22 @@ const hasDelegatedBackup = (backupInfo)=>{
     /**
    * Check if recovery is in progress for a wallet
    */ static isRecoveryInProgress(accountAddress) {
-        return this.pendingRecoveryPromises.has(accountAddress);
+        return this.pendingRecoveryPromises.has(normalizeAddress(accountAddress));
     }
     /**
    * Get existing pending recovery promise if one exists
    */ static getPendingRecoveryPromise(accountAddress) {
-        return this.pendingRecoveryPromises.get(accountAddress);
+        return this.pendingRecoveryPromises.get(normalizeAddress(accountAddress));
     }
     /**
    * Track a pending recovery promise
    */ static setPendingRecoveryPromise(accountAddress, promise) {
-        this.pendingRecoveryPromises.set(accountAddress, promise);
+        this.pendingRecoveryPromises.set(normalizeAddress(accountAddress), promise);
     }
     /**
    * Clear pending recovery promise for a wallet
    */ static clearPendingRecoveryPromise(accountAddress) {
-        this.pendingRecoveryPromises.delete(accountAddress);
+        this.pendingRecoveryPromises.delete(normalizeAddress(accountAddress));
     }
     /**
    * Queue a heavy operation with type validation.
@@ -1319,6 +1349,7 @@ const hasDelegatedBackup = (backupInfo)=>{
    * @param callback - The operation to execute
    * @throws Error if operation is not a valid heavy queue operation
    */ static async queueHeavyOperation(accountAddress, operation, callback) {
+        accountAddress = normalizeAddress(accountAddress);
         // Runtime validation to catch any type assertion bypasses
         if (!isHeavyQueueOperation(operation)) {
             throw new Error(`Invalid heavy queue operation: ${operation}. Must be REFRESH, RESHARE, or RECOVER.`);
@@ -1349,6 +1380,7 @@ const hasDelegatedBackup = (backupInfo)=>{
    * @throws Error if operation is not a valid sign queue operation
    * @returns Promise resolving to the sign result
    */ static async queueSignOperation(accountAddress, operation, callback) {
+        accountAddress = normalizeAddress(accountAddress);
         // Runtime validation to catch any type assertion bypasses
         if (!isSignQueueOperation(operation)) {
             throw new Error(`Invalid sign queue operation: ${operation}. Must be SIGN_MESSAGE or SIGN_TRANSACTION.`);
@@ -1384,6 +1416,7 @@ const hasDelegatedBackup = (backupInfo)=>{
    * @throws Error if operation is not a valid recover queue operation
    * @returns Promise resolving to the recovery result
    */ static async queueRecoverOperation(accountAddress, operation, callback) {
+        accountAddress = normalizeAddress(accountAddress);
         // Runtime validation to catch any type assertion bypasses
         if (!isRecoverQueueOperation(operation)) {
             throw new Error(`Invalid recover queue operation: ${operation}. Must be RECOVER.`);
@@ -1668,6 +1701,19 @@ class DynamicWalletClient {
    */ static resetStaticState() {
         WalletQueueManager.resetForTesting();
     }
+    /**
+   * Get wallet properties from the wallet map using normalized address.
+   * Normalizes the address to lowercase for consistent lookups regardless of input casing.
+   */ getWalletFromMap(accountAddress) {
+        return this.walletMap[normalizeAddress(accountAddress)];
+    }
+    /**
+   * Update wallet properties in the wallet map using normalized address.
+   * Normalizes the address to lowercase for consistent storage regardless of input casing.
+   */ updateWalletMap(accountAddress, updates) {
+        const normalizedAddr = normalizeAddress(accountAddress);
+        this.walletMap[normalizedAddr] = _extends({}, this.walletMap[normalizedAddr], updates);
+    }
     getAuthMode() {
         return this.authMode;
     }
@@ -2366,7 +2412,7 @@ class DynamicWalletClient {
    * from walletMap, with fallback to deriving it from derivationPath.
    */ getBitcoinConfigForChain(chainName, accountAddress) {
         if (chainName !== 'BTC') return undefined;
-        const walletProperties = this.walletMap[accountAddress];
+        const walletProperties = this.getWalletFromMap(accountAddress);
         let addressType = walletProperties == null ? void 0 : walletProperties.addressType;
         // Fallback: derive addressType from derivationPath if not explicitly set
         if (!addressType && (walletProperties == null ? void 0 : walletProperties.derivationPath)) {
@@ -2685,7 +2731,7 @@ class DynamicWalletClient {
                     allShares: allClientShares
                 });
             }
-            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+            this.updateWalletMap(accountAddress, {
                 thresholdSignatureScheme: newThresholdSignatureScheme
             });
             // store client key shares to storage (localStorage or secureStorage)
@@ -2714,7 +2760,7 @@ class DynamicWalletClient {
                 }
             });
             // reset user wallet when reshare fails, this would allow the client to recover wallets from an active state
-            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+            this.updateWalletMap(accountAddress, {
                 thresholdSignatureScheme: oldThresholdSignatureScheme
             });
             await this.setClientKeySharesToStorage({
@@ -2727,7 +2773,6 @@ class DynamicWalletClient {
     }
     async performDelegationOperation({ accountAddress, password, signedSessionId, mfaToken, newThresholdSignatureScheme, revokeDelegation = false, operationName }) {
         try {
-            var _this_walletMap_accountAddress;
             const delegateToProjectEnvironment = this.featureFlags && this.featureFlags[FEATURE_FLAGS.ENABLE_DELEGATED_KEY_SHARES_FLAG] === true;
             if (!delegateToProjectEnvironment) {
                 throw new Error('Delegation is not allowed for this project environment');
@@ -2741,11 +2786,12 @@ class DynamicWalletClient {
             if (wallet.chainName === 'SUI') {
                 throw new Error('Delegation is not allowed for SUI');
             }
-            const currentThresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
+            const walletData = this.getWalletFromMap(accountAddress);
+            const currentThresholdSignatureScheme = walletData.thresholdSignatureScheme;
             // Get active cloud providers to maintain existing backups
-            const activeProviders = getActiveCloudProviders((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.clientKeySharesBackupInfo);
+            const activeProviders = getActiveCloudProviders(walletData == null ? void 0 : walletData.clientKeySharesBackupInfo);
             await this.reshare({
-                chainName: this.walletMap[accountAddress].chainName,
+                chainName: walletData.chainName,
                 accountAddress,
                 oldThresholdSignatureScheme: currentThresholdSignatureScheme,
                 newThresholdSignatureScheme,
@@ -2776,7 +2822,7 @@ class DynamicWalletClient {
             newThresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_THREE,
             operationName: 'delegateKeyShares'
         });
-        const backupInfo = this.walletMap[accountAddress].clientKeySharesBackupInfo;
+        const backupInfo = this.getWalletFromMap(accountAddress).clientKeySharesBackupInfo;
         const delegatedKeyShares = backupInfo.backups[BackupLocation.DELEGATED] || [];
         return delegatedKeyShares;
     }
@@ -2975,6 +3021,7 @@ class DynamicWalletClient {
     /**
    * helper function to store encrypted backup by wallet from iframe local storage
    */ async getClientKeySharesFromLocalStorage({ accountAddress }) {
+        accountAddress = normalizeAddress(accountAddress);
         const walletObject = await this.storage.getItem(accountAddress);
         if (!walletObject) {
             this.logger.debug(`[DynamicWaasWalletClient] No item found in iframe local storage for accountAddress: ${accountAddress}`);
@@ -3003,6 +3050,7 @@ class DynamicWalletClient {
    * Helper function to get client key shares from storage.
    * Uses secureStorage when available (mobile), otherwise falls back to localStorage (browser).
    */ async getClientKeySharesFromStorage({ accountAddress }) {
+        accountAddress = normalizeAddress(accountAddress);
         // Use secure storage if available (mobile)
         if (this.secureStorage) {
             try {
@@ -3035,7 +3083,7 @@ class DynamicWalletClient {
    * @param derivationPath - Optional derivation path (will be computed from chainConfig if not provided)
    * @param additionalProps - Any chain-specific additional properties to merge
    */ initializeWalletMapEntry({ accountAddress, walletId, chainName, thresholdSignatureScheme, derivationPath, additionalProps = {} }) {
-        this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+        this.updateWalletMap(accountAddress, _extends({
             accountAddress,
             walletId,
             chainName,
@@ -3044,7 +3092,7 @@ class DynamicWalletClient {
             derivationPath
         } : {}, {
             clientKeySharesBackupInfo: getClientKeyShareBackupInfo()
-        }, additionalProps);
+        }, additionalProps));
         this.logger.debug('walletMap initialized for wallet', {
             context: {
                 accountAddress,
@@ -3058,6 +3106,7 @@ class DynamicWalletClient {
    * Helper function to store client key shares in storage.
    * Uses secureStorage when available (mobile), otherwise falls back to localStorage (browser).
    */ async setClientKeySharesToLocalStorage({ accountAddress, clientKeyShares, overwriteOrMerge = 'merge' }) {
+        accountAddress = normalizeAddress(accountAddress);
         const stringifiedClientKeyShares = JSON.stringify({
             clientKeyShares: overwriteOrMerge === 'overwrite' ? clientKeyShares : mergeUniqueKeyShares(await this.getClientKeySharesFromLocalStorage({
                 accountAddress
@@ -3069,6 +3118,7 @@ class DynamicWalletClient {
    * Helper function to store client key shares in storage.
    * Uses secureStorage when available (mobile), otherwise falls back to localStorage (browser).
    */ async setClientKeySharesToStorage({ accountAddress, clientKeyShares, overwriteOrMerge = 'merge' }) {
+        accountAddress = normalizeAddress(accountAddress);
         // Use secure storage if available (mobile)
         if (this.secureStorage) {
             try {
@@ -3114,8 +3164,8 @@ class DynamicWalletClient {
     async backupSharesWithDistribution({ accountAddress, password, signedSessionId, distribution, preserveDelegatedLocation = false }) {
         const dynamicRequestId = v4();
         try {
-            var _this_walletMap_accountAddress;
-            if (!((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.walletId)) {
+            const walletData = this.getWalletFromMap(accountAddress);
+            if (!(walletData == null ? void 0 : walletData.walletId)) {
                 const error = new Error(`WalletId not found for accountAddress ${accountAddress}`);
                 logError({
                     message: 'Error in backupSharesWithDistribution, wallet or walletId not found from the wallet map',
@@ -3135,7 +3185,7 @@ class DynamicWalletClient {
                         password
                     })));
                 const data = await this.apiClient.storeEncryptedBackupByWallet({
-                    walletId: this.walletMap[accountAddress].walletId,
+                    walletId: walletData.walletId,
                     encryptedKeyShares: encryptedDynamicShares,
                     passwordEncrypted: isPasswordEncrypted,
                     encryptionVersion: ENCRYPTION_VERSION_CURRENT,
@@ -3181,7 +3231,7 @@ class DynamicWalletClient {
                 var _publicKey_key_keyId;
                 const encryptedDelegatedKeyShareEnvelope = await encryptDelegatedKeyShare(JSON.stringify(distribution.delegatedShare), publicKey == null ? void 0 : (_publicKey_key1 = publicKey.key) == null ? void 0 : _publicKey_key1.publicKeyPemB64, (_publicKey_key_keyId = publicKey == null ? void 0 : (_publicKey_key2 = publicKey.key) == null ? void 0 : _publicKey_key2.keyId) != null ? _publicKey_key_keyId : publicKey == null ? void 0 : publicKey.keyId);
                 const { status } = await this.apiClient.publishDelegatedKeyShare({
-                    walletId: this.walletMap[accountAddress].walletId,
+                    walletId: walletData.walletId,
                     encryptedKeyShare: encryptedDelegatedKeyShareEnvelope,
                     signedSessionId,
                     requiresSignedSessionId: this.requiresSignedSessionId(),
@@ -3203,23 +3253,23 @@ class DynamicWalletClient {
                 });
             }
             const backupData = await this.apiClient.markKeySharesAsBackedUp({
-                walletId: this.walletMap[accountAddress].walletId,
+                walletId: walletData.walletId,
                 locations,
                 dynamicRequestId
             });
             const updatedBackupInfo = getClientKeyShareBackupInfo({
                 walletProperties: {
-                    derivationPath: this.walletMap[accountAddress].derivationPath,
+                    derivationPath: walletData.derivationPath,
                     keyShares: backupData.locationsWithKeyShares.map((ks)=>({
                             id: ks.keyShareId,
                             backupLocation: ks.location,
                             externalKeyShareId: ks.externalKeyShareId,
                             passwordEncrypted: isPasswordEncrypted
                         })),
-                    thresholdSignatureScheme: this.walletMap[accountAddress].thresholdSignatureScheme
+                    thresholdSignatureScheme: walletData.thresholdSignatureScheme
                 }
             });
-            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
+            this.updateWalletMap(accountAddress, {
                 clientKeySharesBackupInfo: updatedBackupInfo
             });
             await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
@@ -3267,16 +3317,17 @@ class DynamicWalletClient {
    * @param params.backupToGoogleDrive - Whether to backup to Google Drive (defaults to false)
    * @returns Promise with backup metadata including share locations and IDs
    */ async storeEncryptedBackupByWallet({ accountAddress, clientKeyShares = undefined, password = undefined, signedSessionId, cloudProviders = [], delegatedKeyshare = undefined }) {
-        var _this_walletMap_accountAddress, _this_walletMap_accountAddress1;
+        var _this_getWalletFromMap;
         const keySharesToBackup = clientKeyShares != null ? clientKeyShares : await this.getClientKeySharesFromStorage({
             accountAddress
         });
         // Check if we should backup to cloud providers (either requested or already exists)
-        const activeCloudProviders = getActiveCloudProviders((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress.clientKeySharesBackupInfo);
+        const walletBackupInfo = (_this_getWalletFromMap = this.getWalletFromMap(accountAddress)) == null ? void 0 : _this_getWalletFromMap.clientKeySharesBackupInfo;
+        const activeCloudProviders = getActiveCloudProviders(walletBackupInfo);
         const shouldBackupToCloudProviders = cloudProviders.length > 0 || activeCloudProviders.length > 0;
         // Use requested providers, or fall back to existing active providers
         const providersToBackup = cloudProviders.length > 0 ? cloudProviders : activeCloudProviders;
-        const hasExistingDelegation = hasDelegatedBackup((_this_walletMap_accountAddress1 = this.walletMap[accountAddress]) == null ? void 0 : _this_walletMap_accountAddress1.clientKeySharesBackupInfo);
+        const hasExistingDelegation = hasDelegatedBackup(walletBackupInfo);
         let distribution;
         let preserveDelegatedLocation = false;
         // Generic distribution logic - works with any cloud providers
@@ -3440,7 +3491,7 @@ class DynamicWalletClient {
     }
     async internalRecoverEncryptedBackupByWallet({ accountAddress, password, walletOperation, signedSessionId, shareCount = undefined, storeRecoveredShares = true, mfaToken }) {
         try {
-            const wallet = this.walletMap[accountAddress];
+            const wallet = this.getWalletFromMap(accountAddress);
             this.logger.debug(`recoverEncryptedBackupByWallet wallet: ${walletOperation}`, wallet);
             const { shares } = this.recoverStrategy({
                 clientKeyShareBackupInfo: wallet.clientKeySharesBackupInfo,
@@ -3488,7 +3539,12 @@ class DynamicWalletClient {
         if (!wallets) {
             return;
         }
-        this.walletMap = JSON.parse(wallets);
+        const parsedWallets = JSON.parse(wallets);
+        this.walletMap = Object.keys(parsedWallets).reduce((acc, key)=>{
+            const normalizedKey = normalizeAddress(key);
+            acc[normalizedKey] = parsedWallets[key];
+            return acc;
+        }, {});
     }
     /**
    * Internal helper method that handles the complete flow for ensuring wallet key shares are backed up to a cloud provider.
@@ -3502,11 +3558,12 @@ class DynamicWalletClient {
                 password,
                 signedSessionId
             });
-            const currentThresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
+            const walletData = this.getWalletFromMap(accountAddress);
+            const currentThresholdSignatureScheme = walletData.thresholdSignatureScheme;
             if (currentThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO) {
                 // Reshare to 2-of-3, which will automatically handle the backup distribution
                 await this.reshare({
-                    chainName: this.walletMap[accountAddress].chainName,
+                    chainName: walletData.chainName,
                     accountAddress,
                     oldThresholdSignatureScheme: currentThresholdSignatureScheme,
                     newThresholdSignatureScheme: ThresholdSignatureScheme.TWO_OF_THREE,
@@ -3616,7 +3673,7 @@ class DynamicWalletClient {
             const accessToken = await this.apiClient.getAccessToken({
                 oauthAccountId
             });
-            const thresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
+            const thresholdSignatureScheme = this.getWalletFromMap(accountAddress).thresholdSignatureScheme;
             const fileName = getClientKeyShareExportFileName({
                 thresholdSignatureScheme,
                 accountAddress,
@@ -3656,7 +3713,7 @@ class DynamicWalletClient {
             if (encryptedKeyShares.length === 0) {
                 throw new Error('No key shares found');
             }
-            const thresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
+            const thresholdSignatureScheme = this.getWalletFromMap(accountAddress).thresholdSignatureScheme;
             const backupData = createBackupData({
                 encryptedKeyShares,
                 accountAddress,
@@ -3685,7 +3742,7 @@ class DynamicWalletClient {
             const accessToken = await this.apiClient.getAccessToken({
                 oauthAccountId
             });
-            const thresholdSignatureScheme = this.walletMap[accountAddress].thresholdSignatureScheme;
+            const thresholdSignatureScheme = this.getWalletFromMap(accountAddress).thresholdSignatureScheme;
             const backupFileName = getClientKeyShareExportFileName({
                 thresholdSignatureScheme,
                 accountAddress,
@@ -3761,6 +3818,7 @@ class DynamicWalletClient {
         }
     }
     async exportClientKeyshares({ accountAddress, password, signedSessionId }) {
+        var _this_getWalletFromMap;
         await this.verifyPassword({
             accountAddress,
             password,
@@ -3772,7 +3830,7 @@ class DynamicWalletClient {
         }
         // Ensure client key shares exist before export
         const clientKeyShares = await this.ensureClientShare(accountAddress);
-        const derivationPath = this.walletMap[accountAddress].derivationPath;
+        const derivationPath = (_this_getWalletFromMap = this.getWalletFromMap(accountAddress)) == null ? void 0 : _this_getWalletFromMap.derivationPath;
         const text = JSON.stringify({
             keyShares: clientKeyShares,
             derivationPath
@@ -3805,7 +3863,7 @@ class DynamicWalletClient {
         let thresholdSignatureSchemeCheck = false;
         let derivationPathCheck = false;
         // check if wallet exists
-        const existingWallet = this.walletMap[accountAddress];
+        const existingWallet = this.getWalletFromMap(accountAddress);
         if (existingWallet) {
             walletCheck = true;
         }
@@ -3843,7 +3901,7 @@ class DynamicWalletClient {
    * and decryption without storing the restored key shares. If unsuccessful, it throws an error.
    */ async verifyPassword({ accountAddress, password = undefined, walletOperation = WalletOperation.NO_OPERATION, signedSessionId }) {
         // Only load wallet if it's not already loaded (to avoid double eager loading)
-        if (!this.walletMap[accountAddress]) {
+        if (!this.getWalletFromMap(accountAddress)) {
             await this.getWallet({
                 accountAddress,
                 walletOperation,
@@ -3902,7 +3960,7 @@ class DynamicWalletClient {
         });
         const { requiredShareCount } = this.recoverStrategy({
             clientKeyShareBackupInfo: clientKeySharesBackupInfo,
-            thresholdSignatureScheme: this.walletMap[accountAddress].thresholdSignatureScheme,
+            thresholdSignatureScheme: this.getWalletFromMap(accountAddress).thresholdSignatureScheme,
             walletOperation
         });
         if (clientKeyShares.length >= requiredShareCount) {
@@ -3913,10 +3971,11 @@ class DynamicWalletClient {
     async getWalletClientKeyShareBackupInfo({ accountAddress }) {
         const dynamicRequestId = v4();
         try {
-            var _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC, _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups, _this_walletMap_accountAddress_clientKeySharesBackupInfo, _this_walletMap_accountAddress, _user_verifiedCredentials;
+            var _this_getWalletFromMap, _walletBackupInfo_backups_BackupLocation_DYNAMIC, _walletBackupInfo_backups, _user_verifiedCredentials;
             // Return existing backup info if it exists
-            if (((_this_walletMap_accountAddress = this.walletMap[accountAddress]) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo = _this_walletMap_accountAddress.clientKeySharesBackupInfo) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups = _this_walletMap_accountAddress_clientKeySharesBackupInfo.backups) == null ? void 0 : (_this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC = _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups[BackupLocation.DYNAMIC]) == null ? void 0 : _this_walletMap_accountAddress_clientKeySharesBackupInfo_backups_BackupLocation_DYNAMIC.length) > 0) {
-                return this.walletMap[accountAddress].clientKeySharesBackupInfo;
+            const walletBackupInfo = (_this_getWalletFromMap = this.getWalletFromMap(accountAddress)) == null ? void 0 : _this_getWalletFromMap.clientKeySharesBackupInfo;
+            if (walletBackupInfo && ((_walletBackupInfo_backups = walletBackupInfo.backups) == null ? void 0 : (_walletBackupInfo_backups_BackupLocation_DYNAMIC = _walletBackupInfo_backups[BackupLocation.DYNAMIC]) == null ? void 0 : _walletBackupInfo_backups_BackupLocation_DYNAMIC.length) > 0) {
+                return walletBackupInfo;
             }
             // Get backup info from server
             const user = await this.apiClient.getUser(dynamicRequestId);
@@ -3947,30 +4006,36 @@ class DynamicWalletClient {
             });
             if (existingWalletCheck) {
                 this.logger.debug(`[DynamicWaasWalletClient] Wallet ${accountAddress} already exists`);
-                return this.walletMap[accountAddress];
+                const wallet = this.getWalletFromMap(accountAddress);
+                if (!wallet) {
+                    throw new Error(`Wallet not found for address: ${accountAddress}`);
+                }
+                return wallet;
             }
-            // Fetch and restore wallet from server
+            // Fetch and restore all waas wallets from server
             const user = await this.apiClient.getUser(dynamicRequestId);
-            const wallet = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.find((vc)=>vc.address.toLowerCase() === accountAddress.toLowerCase());
-            this.logger.debug('[DynamicWaasWalletClient] Restoring wallet', wallet);
-            const walletProperties = wallet.walletProperties;
-            this.walletMap[accountAddress] = _extends({}, this.walletMap[accountAddress], {
-                walletId: wallet.id,
-                chainName: verifiedCredentialNameToChainEnum[wallet.chain],
-                accountAddress,
-                thresholdSignatureScheme: walletProperties.thresholdSignatureScheme,
-                derivationPath: walletProperties.derivationPath,
-                clientKeySharesBackupInfo: getClientKeyShareBackupInfo({
-                    walletProperties
-                }),
-                addressType: walletProperties.addressType
-            });
+            const waasWallets = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.filter((vc)=>vc.walletName === 'dynamicwaas');
+            for (const vc of waasWallets != null ? waasWallets : []){
+                const addr = vc.address;
+                const props = vc.walletProperties;
+                this.updateWalletMap(addr, {
+                    walletId: vc.id,
+                    chainName: verifiedCredentialNameToChainEnum[vc.chain],
+                    accountAddress: addr,
+                    thresholdSignatureScheme: props == null ? void 0 : props.thresholdSignatureScheme,
+                    derivationPath: props == null ? void 0 : props.derivationPath,
+                    clientKeySharesBackupInfo: getClientKeyShareBackupInfo({
+                        walletProperties: props
+                    }),
+                    addressType: props == null ? void 0 : props.addressType
+                });
+            }
             if (walletOperation !== WalletOperation.NO_OPERATION && await this.requiresRestoreBackupSharesForOperation({
                 accountAddress,
                 walletOperation
             })) {
                 var _walletData_clientKeySharesBackupInfo;
-                const walletData = this.walletMap[accountAddress];
+                const walletData = this.getWalletFromMap(accountAddress);
                 var _walletData_clientKeySharesBackupInfo_passwordEncrypted;
                 const isPasswordEncrypted = (_walletData_clientKeySharesBackupInfo_passwordEncrypted = (_walletData_clientKeySharesBackupInfo = walletData.clientKeySharesBackupInfo) == null ? void 0 : _walletData_clientKeySharesBackupInfo.passwordEncrypted) != null ? _walletData_clientKeySharesBackupInfo_passwordEncrypted : false;
                 // Password-encrypted wallet without password - fetch and cache for eager loading
@@ -3988,14 +4053,19 @@ class DynamicWalletClient {
                         requiresSignedSessionId: this.requiresSignedSessionId()
                     });
                     // Cache encrypted shares for later decryption by unlockWallet
-                    const encryptedStorageKey = `${accountAddress}${ENCRYPTED_SHARES_STORAGE_SUFFIX}`;
+                    const encryptedStorageKey = `${normalizeAddress(accountAddress)}${ENCRYPTED_SHARES_STORAGE_SUFFIX}`;
                     await this.storage.setItem(encryptedStorageKey, JSON.stringify(data));
                     // Update wallet state to locked
-                    this.walletMap[accountAddress] = _extends({}, walletData, {
+                    this.updateWalletMap(accountAddress, {
                         walletReadyState: WalletReadyState.ENCRYPTED
                     });
+                    await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
                     // Return wallet in locked state (no error for eager loading)
-                    return this.walletMap[accountAddress];
+                    const wallet = this.getWalletFromMap(accountAddress);
+                    if (!wallet) {
+                        throw new Error(`Wallet not found for address: ${accountAddress}`);
+                    }
+                    return wallet;
                 }
                 // TODO(zfaizal2): throw error if signedSessionId is not provided after service deploy
                 const decryptedKeyShares = await this.recoverEncryptedBackupByWallet({
@@ -4022,7 +4092,11 @@ class DynamicWalletClient {
             if (walletCount === 1) {
                 return Object.values(this.walletMap)[0];
             }
-            return this.walletMap[accountAddress];
+            const wallet = this.getWalletFromMap(accountAddress);
+            if (!wallet) {
+                throw new Error(`Wallet not found for address: ${accountAddress}`);
+            }
+            return wallet;
         } catch (error) {
             logError({
                 message: 'Error in getWallet',
@@ -4053,17 +4127,21 @@ class DynamicWalletClient {
    * @returns WalletRecoveryState indicating the wallet's lock state and share availability
    * @throws Error if recovery fails or no shares available after recovery
    */ async getWalletRecoveryState({ accountAddress, signedSessionId, password }) {
-        const walletData = this.walletMap[accountAddress];
+        const walletData = this.getWalletFromMap(accountAddress);
         if (!walletData) {
             throw new Error(`Wallet not found for address: ${accountAddress}`);
         }
         let clientKeyShares = await this.getClientKeySharesFromStorage({
             accountAddress
         });
-        // If no local shares and signedSessionId provided, trigger recovery via getWallet
+        let hasEncryptedShares = await hasEncryptedSharesCached({
+            accountAddress,
+            backupInfo: walletData.clientKeySharesBackupInfo,
+            storage: this.storage
+        });
+        // If no local shares and no cached encrypted shares, trigger recovery via getWallet
         // getWallet -> recoverEncryptedBackupByWallet handles deduplication via inFlightRecovery
-        if (clientKeyShares.length === 0 && signedSessionId) {
-            var _walletData_clientKeySharesBackupInfo;
+        if (clientKeyShares.length === 0 && !hasEncryptedShares && signedSessionId) {
             await this.getWallet({
                 accountAddress,
                 walletOperation: WalletOperation.RECOVER,
@@ -4074,15 +4152,11 @@ class DynamicWalletClient {
             clientKeyShares = await this.getClientKeySharesFromStorage({
                 accountAddress
             });
-            var _walletData_clientKeySharesBackupInfo_passwordEncrypted;
-            // For password-encrypted wallets, also check for cached encrypted shares
-            const isPasswordEncrypted = (_walletData_clientKeySharesBackupInfo_passwordEncrypted = (_walletData_clientKeySharesBackupInfo = walletData.clientKeySharesBackupInfo) == null ? void 0 : _walletData_clientKeySharesBackupInfo.passwordEncrypted) != null ? _walletData_clientKeySharesBackupInfo_passwordEncrypted : false;
-            let hasEncryptedShares = false;
-            if (isPasswordEncrypted && clientKeyShares.length === 0) {
-                const encryptedStorageKey = `${accountAddress}${ENCRYPTED_SHARES_STORAGE_SUFFIX}`;
-                const encryptedData = await this.storage.getItem(encryptedStorageKey);
-                hasEncryptedShares = !!encryptedData;
-            }
+            hasEncryptedShares = await hasEncryptedSharesCached({
+                accountAddress,
+                backupInfo: walletData.clientKeySharesBackupInfo,
+                storage: this.storage
+            });
             if (clientKeyShares.length === 0 && !hasEncryptedShares) {
                 throw new Error(`No key shares available for wallet ${accountAddress} after recovery`);
             }
@@ -4103,15 +4177,15 @@ class DynamicWalletClient {
    */ async unlockWallet({ accountAddress, password, signedSessionId }) {
         const dynamicRequestId = v4();
         try {
-            if (!this.walletMap[accountAddress]) {
+            if (!this.getWalletFromMap(accountAddress)) {
                 await this.getWallet({
                     accountAddress,
                     walletOperation: WalletOperation.NO_OPERATION,
                     signedSessionId
                 });
             }
-            const wallet = this.walletMap[accountAddress];
-            const encryptedStorageKey = `${accountAddress}${ENCRYPTED_SHARES_STORAGE_SUFFIX}`;
+            const normalizedAccountAddress = normalizeAddress(accountAddress);
+            const encryptedStorageKey = `${normalizedAccountAddress}${ENCRYPTED_SHARES_STORAGE_SUFFIX}`;
             let encryptedData = await this.storage.getItem(encryptedStorageKey);
             // If no cached encrypted shares, fetch via getWallet with RECOVER
             if (!encryptedData) {
@@ -4125,24 +4199,41 @@ class DynamicWalletClient {
             if (!encryptedData) {
                 throw new Error('No encrypted shares found for wallet');
             }
-            const data = JSON.parse(encryptedData);
-            // Decrypt the key shares
-            const decryptedKeyShares = await Promise.all(data.keyShares.map((keyShare)=>this.decryptKeyShare({
-                    keyShare: keyShare.encryptedAccountCredential,
-                    password
-                })));
-            await this.setClientKeySharesToStorage({
+            // Decrypt the requested wallet
+            await this.decryptAndStoreWalletShares({
                 accountAddress,
-                clientKeyShares: decryptedKeyShares
+                encryptedData,
+                password
             });
-            this.walletMap[accountAddress] = _extends({}, wallet, {
-                walletReadyState: WalletReadyState.READY
+            // Decrypt all other password-encrypted wallets with the same password
+            const otherEncryptedWallets = Object.entries(this.walletMap).filter(([addr, w])=>{
+                var _w_clientKeySharesBackupInfo;
+                return addr !== normalizedAccountAddress && w.walletReadyState !== WalletReadyState.READY && ((_w_clientKeySharesBackupInfo = w.clientKeySharesBackupInfo) == null ? void 0 : _w_clientKeySharesBackupInfo.passwordEncrypted);
             });
+            await Promise.all(otherEncryptedWallets.map(async ([otherAddr])=>{
+                try {
+                    const otherEncryptedStorageKey = `${otherAddr}${ENCRYPTED_SHARES_STORAGE_SUFFIX}`;
+                    const otherEncryptedData = await this.storage.getItem(otherEncryptedStorageKey);
+                    if (!otherEncryptedData) {
+                        return;
+                    }
+                    await this.decryptAndStoreWalletShares({
+                        accountAddress: otherAddr,
+                        encryptedData: otherEncryptedData,
+                        password
+                    });
+                } catch (err) {
+                    this.logger.debug('[DynamicWaasWalletClient] Failed to unlock additional wallet', {
+                        accountAddress: otherAddr,
+                        error: err
+                    });
+                }
+            }));
             await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
             this.logger.debug('[DynamicWaasWalletClient] Wallet unlocked successfully', {
                 accountAddress
             });
-            return this.walletMap[accountAddress];
+            return this.getWalletFromMap(accountAddress);
         } catch (error) {
             logError({
                 message: 'Error in unlockWallet',
@@ -4155,6 +4246,22 @@ class DynamicWalletClient {
             throw error;
         }
     }
+    /**
+   * Decrypts cached encrypted key shares for a wallet and stores them locally.
+   */ async decryptAndStoreWalletShares({ accountAddress, encryptedData, password }) {
+        const data = JSON.parse(encryptedData);
+        const decryptedKeyShares = await Promise.all(data.keyShares.map((keyShare)=>this.decryptKeyShare({
+                keyShare: keyShare.encryptedAccountCredential,
+                password
+            })));
+        await this.setClientKeySharesToStorage({
+            accountAddress,
+            clientKeyShares: decryptedKeyShares
+        });
+        this.updateWalletMap(accountAddress, {
+            walletReadyState: WalletReadyState.READY
+        });
+    }
     async getWallets() {
         const dynamicRequestId = v4();
         try {
@@ -4163,8 +4270,8 @@ class DynamicWalletClient {
             this.userId = user.id;
             const waasWallets = (_user_verifiedCredentials = user.verifiedCredentials) == null ? void 0 : _user_verifiedCredentials.filter((vc)=>vc.walletName === 'dynamicwaas');
             const wallets = waasWallets.map((vc)=>{
-                var _this_walletMap_vc_address, _vc_walletProperties, _vc_walletProperties1;
-                var _this_walletMap_vc_address_derivationPath;
+                var _this_getWalletFromMap, _vc_walletProperties, _vc_walletProperties1;
+                var _this_getWalletFromMap_derivationPath;
                 return {
                     walletId: vc.id,
                     chainName: vc.chain,
@@ -4172,23 +4279,24 @@ class DynamicWalletClient {
                     clientKeySharesBackupInfo: getClientKeyShareBackupInfo({
                         walletProperties: vc.walletProperties || {}
                     }),
-                    derivationPath: (_this_walletMap_vc_address_derivationPath = (_this_walletMap_vc_address = this.walletMap[vc.address]) == null ? void 0 : _this_walletMap_vc_address.derivationPath) != null ? _this_walletMap_vc_address_derivationPath : undefined,
+                    derivationPath: (_this_getWalletFromMap_derivationPath = (_this_getWalletFromMap = this.getWalletFromMap(vc.address)) == null ? void 0 : _this_getWalletFromMap.derivationPath) != null ? _this_getWalletFromMap_derivationPath : undefined,
                     thresholdSignatureScheme: (_vc_walletProperties = vc.walletProperties) == null ? void 0 : _vc_walletProperties.thresholdSignatureScheme,
                     addressType: (_vc_walletProperties1 = vc.walletProperties) == null ? void 0 : _vc_walletProperties1.addressType
                 };
             });
+            const existingWalletMap = this.walletMap;
             this.walletMap = wallets.reduce((acc, wallet)=>{
-                var _acc_accountAddress;
-                const accountAddress = wallet.accountAddress;
-                acc[wallet.accountAddress] = {
+                const normalizedAddress = normalizeAddress(wallet.accountAddress);
+                const existingWallet = existingWalletMap[normalizedAddress];
+                acc[normalizedAddress] = {
                     walletId: wallet.walletId,
                     chainName: wallet.chainName,
                     accountAddress: wallet.accountAddress,
                     clientKeySharesBackupInfo: wallet.clientKeySharesBackupInfo,
-                    derivationPath: ((_acc_accountAddress = acc[accountAddress]) == null ? void 0 : _acc_accountAddress.derivationPath) || undefined,
+                    derivationPath: existingWallet == null ? void 0 : existingWallet.derivationPath,
                     thresholdSignatureScheme: wallet.thresholdSignatureScheme,
                     addressType: wallet.addressType,
-                    walletReadyState: WalletReadyState.READY
+                    walletReadyState: existingWallet == null ? void 0 : existingWallet.walletReadyState
                 };
                 return acc;
             }, {});
@@ -4383,4 +4491,4 @@ class DynamicWalletClient {
 DynamicWalletClient.rooms = {};
 DynamicWalletClient.roomsInitializing = {};
 
-export { DynamicWalletClient, ERROR_ACCOUNT_ADDRESS_REQUIRED, ERROR_CREATE_WALLET_ACCOUNT, ERROR_EXPORT_PRIVATE_KEY, ERROR_IMPORT_PRIVATE_KEY, ERROR_KEYGEN_FAILED, ERROR_PUBLIC_KEY_MISMATCH, ERROR_SIGN_MESSAGE, ERROR_SIGN_TYPED_DATA, ERROR_VERIFY_MESSAGE_SIGNATURE, ERROR_VERIFY_TRANSACTION_SIGNATURE, HEAVY_QUEUE_OPERATIONS, RECOVER_QUEUE_OPERATIONS, SIGN_QUEUE_OPERATIONS, WalletBusyError, WalletNotReadyError, cancelICloudAuth, createAddCloudProviderToExistingDelegationDistribution, createBackupData, createCloudProviderDistribution, createDelegationOnlyDistribution, createDelegationWithCloudProviderDistribution, createDynamicOnlyDistribution, deleteICloudBackup, downloadStringAsFile, extractPubkey, formatEvmMessage, formatMessage, getActiveCloudProviders, getBitcoinAddressTypeFromDerivationPath, getClientKeyShareBackupInfo, getClientKeyShareExportFileName, getGoogleOAuthAccountId, getICloudBackup, getMPCSignatureScheme, getMPCSigner, hasCloudProviderBackup, hasDelegatedBackup, initializeCloudKit, isBrowser, isHeavyQueueOperation, isHexString, isICloudAuthenticated, isPublicKeyMismatchError, isRecoverQueueOperation, isSignQueueOperation, listICloudBackups, mergeUniqueKeyShares, retryPromise, timeoutPromise };
+export { DynamicWalletClient, ERROR_ACCOUNT_ADDRESS_REQUIRED, ERROR_CREATE_WALLET_ACCOUNT, ERROR_EXPORT_PRIVATE_KEY, ERROR_IMPORT_PRIVATE_KEY, ERROR_KEYGEN_FAILED, ERROR_PUBLIC_KEY_MISMATCH, ERROR_SIGN_MESSAGE, ERROR_SIGN_TYPED_DATA, ERROR_VERIFY_MESSAGE_SIGNATURE, ERROR_VERIFY_TRANSACTION_SIGNATURE, HEAVY_QUEUE_OPERATIONS, RECOVER_QUEUE_OPERATIONS, SIGN_QUEUE_OPERATIONS, WalletBusyError, WalletNotReadyError, cancelICloudAuth, createAddCloudProviderToExistingDelegationDistribution, createBackupData, createCloudProviderDistribution, createDelegationOnlyDistribution, createDelegationWithCloudProviderDistribution, createDynamicOnlyDistribution, deleteICloudBackup, downloadStringAsFile, extractPubkey, formatEvmMessage, formatMessage, getActiveCloudProviders, getBitcoinAddressTypeFromDerivationPath, getClientKeyShareBackupInfo, getClientKeyShareExportFileName, getGoogleOAuthAccountId, getICloudBackup, getMPCSignatureScheme, getMPCSigner, hasCloudProviderBackup, hasDelegatedBackup, hasEncryptedSharesCached, initializeCloudKit, isBrowser, isHeavyQueueOperation, isHexString, isICloudAuthenticated, isPublicKeyMismatchError, isRecoverQueueOperation, isSignQueueOperation, listICloudBackups, mergeUniqueKeyShares, retryPromise, timeoutPromise };