@dynamic-labs-wallet/browser 1.1.28 → 1.1.30

package/index.cjs

@@ -10,6 +10,7 @@ var axios = require('axios');
 var gte = require('semver/functions/gte');
 var ProviderEnum = require('@dynamic-labs/sdk-api-core/models/ProviderEnum');
 var PQueue = require('p-queue');
+var redaction = require('@dynamic-labs/redaction');
 var ed25519 = require('@noble/curves/ed25519');
 var utils = require('@noble/curves/abstract/utils');
 
@@ -776,6 +777,7 @@ const ERROR_INCORRECT_PASSWORD = '[DynamicWaasWalletClient]: Incorrect password
 const ERROR_PASSWORD_REQUIRED_FOR_ENCRYPTED_WALLET = '[DynamicWaasWalletClient]: Password is required for refresh/reshare of a password-encrypted wallet.';
 const ERROR_EXISTING_PASSWORD_REQUIRED = '[DynamicWaasWalletClient]: Existing password is required to update the password for encrypted wallets.';
 const ERROR_WALLETS_ALREADY_ENCRYPTED = '[DynamicWaasWalletClient]: Cannot set password: wallets are already password-encrypted. Use updatePassword instead.';
+const ERROR_EXISTING_WALLETS_NOT_ENCRYPTED = '[DynamicWaasWalletClient]: Cannot create a wallet with a password: existing wallets are not password-encrypted. Call setPassword first so all wallets share one password.';
 /**
  * Checks if password consistency validation is needed.
  * Returns false if no password provided or password is the environmentId default.
@@ -800,6 +802,18 @@ const ERROR_WALLETS_ALREADY_ENCRYPTED = '[DynamicWaasWalletClient]: Cannot set p
     }
     return undefined;
 }
+/**
+ * Checks if the walletMap has a wallet with a recorded backup that is not password-encrypted.
+ * Wallets with no recorded backup are ignored: getWallets reports them as not
+ * password-encrypted, but their encryption state is unknown.
+ */ function hasPasswordlessWallet(walletMap) {
+    return Object.values(walletMap).some((wallet)=>{
+        const backupInfo = wallet.clientKeySharesBackupInfo;
+        if (!backupInfo || backupInfo.passwordEncrypted) return false;
+        var _backupInfo_backups;
+        return Object.values((_backupInfo_backups = backupInfo.backups) != null ? _backupInfo_backups : {}).some((locations)=>locations.length > 0);
+    });
+}
 /**
  * Extracts the first encrypted key share credential from cached encrypted data.
  * Returns the base64-encoded encrypted credential string, or undefined if none found.
@@ -1634,6 +1648,7 @@ const NON_RETRYABLE_CEREMONY_ERROR_MESSAGES = [
     ERROR_PUBLIC_KEY_MISMATCH,
     ERROR_PASSWORD_MISMATCH,
     ERROR_INCORRECT_PASSWORD,
+    ERROR_EXISTING_WALLETS_NOT_ENCRYPTED,
     ERROR_MULTIPLE_WALLETS_PER_CHAIN
 ];
 /**
@@ -2365,6 +2380,132 @@ const buildHttpCeremonyMeta = (fields)=>_extends({
         transport: WAAS_HTTPS_TRANSPORT
     }, Object.fromEntries(Object.entries(fields).filter(([, value])=>value !== undefined && value !== null)));
 
+/**
+ * Lets a client-side ceremony fail as soon as the server's create stream
+ * reports an error. The stream resolves early on `keygen_complete`, so a later
+ * `error` event (e.g. a lock-contention 429) only reaches `onError`; without
+ * this the client keeps waiting in a relay room the server never joined, or
+ * (after the relay keygen) for a `ceremony_complete` that will never arrive.
+ *
+ * Usage:
+ *   1. `watchStream()` for every create stream  -> pass the result as its `onError`
+ *   2. `watchCompletion(cb)` once               -> pass the result as `onCeremonyComplete`
+ *   3. `raceAgainstStreamError(work)`           -> rejects early if a stream errors mid-work
+ *   4. `waitForCompletion()`                    -> resolves on `ceremony_complete`
+ */ const createCeremonyErrorWatch = ()=>{
+    const streamError = core.createRejectablePromise();
+    const completion = createResolvablePromise();
+    const streams = {
+        latestId: 0
+    };
+    return {
+        /**
+     * Registers a new create stream and returns its `onError` handler.
+     * A fallback re-creates the stream, so only the newest stream's errors count.
+     */ watchStream: ()=>{
+            streams.latestId += 1;
+            const streamId = streams.latestId;
+            return (error)=>{
+                if (streamId === streams.latestId) {
+                    streamError.reject(error);
+                }
+            };
+        },
+        /** Wraps the caller's `onCeremonyComplete` so `waitForCompletion` can observe it. */ watchCompletion: (onCeremonyComplete)=>onCeremonyComplete && ((...args)=>{
+                onCeremonyComplete(...args);
+                completion.resolve();
+            }),
+        /** Settles like `work`, but rejects early if the current stream errors first. */ raceAgainstStreamError: (work)=>Promise.race([
+                work,
+                streamError.promise
+            ]),
+        /** Resolves on `ceremony_complete`; rejects if the current stream errors first. */ waitForCompletion: ()=>Promise.race([
+                completion.promise,
+                streamError.promise
+            ])
+    };
+};
+const createResolvablePromise = ()=>{
+    const handle = {
+        resolve: ()=>undefined
+    };
+    const promise = new Promise((resolve)=>{
+        handle.resolve = resolve;
+    });
+    return {
+        promise,
+        resolve: ()=>handle.resolve()
+    };
+};
+
+/** Bounded so a self-referencing or cyclic `cause` chain cannot spin. */ const MAX_CAUSE_DEPTH = 5;
+const MAX_DESCRIBED_LENGTH = 200;
+const redactErrorMessage = (message)=>redaction.redactSecretsFromText(message, redaction.KEY_MATERIAL_TEXT_PATTERNS).slice(0, MAX_DESCRIBED_LENGTH);
+/**
+ * Keys safe to echo when a thrown object exposes no recognised message field.
+ * Deliberately an allowlist: the alternative — serialising the whole object —
+ * cannot be made safe, because a thrown MPC signer rejection or API body may
+ * carry key-share material, a raw transaction body or an auth token.
+ */ const SAFE_DETAIL_KEYS = [
+    'status',
+    'statusCode',
+    'code',
+    'error_code',
+    'errorCode',
+    'name',
+    'type'
+];
+const isScalar = (value)=>typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean';
+/**
+ * Builds a human-readable message for a thrown value that is not an `Error` —
+ * most often an API response body, e.g.
+ * `{ existingWalletId, error: 'Multiple wallets per chain not allowed' }`.
+ *
+ * `String(value)` would collapse that to `[object Object]`, losing the only
+ * diagnostic content it had, so a recognised message field is preferred.
+ *
+ * Never serialises an unrecognised object wholesale. Where no message field
+ * exists, only `SAFE_DETAIL_KEYS` scalars are echoed, and failing that a fixed
+ * placeholder — so a value carrying secrets can never reach the logging backend
+ * just because it lacked a `message`.
+ */ const describeNonError = (value)=>{
+    if (typeof value === 'string') return value.slice(0, MAX_DESCRIBED_LENGTH);
+    if (value !== null && typeof value === 'object') {
+        const record = value;
+        const named = [
+            record['error'],
+            record['message'],
+            record['detail']
+        ].find((candidate)=>typeof candidate === 'string' && candidate.length > 0);
+        if (named) return named.slice(0, MAX_DESCRIBED_LENGTH);
+        const safeDetails = SAFE_DETAIL_KEYS.filter((key)=>isScalar(record[key])).map((key)=>`${key}=${String(record[key])}`);
+        return safeDetails.length > 0 ? safeDetails.join(' ').slice(0, MAX_DESCRIBED_LENGTH) : 'Non-Error value thrown with no recognised message field';
+    }
+    return String(value).slice(0, MAX_DESCRIBED_LENGTH);
+};
+/**
+ * `{ name, message }` for each link of an error's `cause` chain, outermost
+ * first, so a wrapper like `new Error(ERROR_SIGN_MESSAGE, { cause })` still
+ * shows the failure it wraps. Bounded in depth and length, and never echoes
+ * raw fields (they may carry key material); non-Errors use `describeNonError`.
+ */ const describeCauseChain = (error, depth = 0)=>{
+    if (error === undefined || error === null || depth >= MAX_CAUSE_DEPTH) return [];
+    const link = error instanceof Error ? {
+        name: error.name,
+        message: redactErrorMessage(error.message)
+    } : {
+        name: typeof error,
+        message: describeNonError(error)
+    };
+    const next = error instanceof Error ? error.cause : undefined;
+    return next === error ? [
+        link
+    ] : [
+        link,
+        ...describeCauseChain(next, depth + 1)
+    ];
+};
+
 /**
  * Returns true for errors that represent expected user-facing conditions
  * (e.g. wrong password). These are logged at `info` instead of `error`
@@ -2429,7 +2570,6 @@ const classifyOne = (error)=>{
     }
     return undefined;
 };
-/** Bounded so a self-referencing or cyclic `cause` chain cannot spin. */ const MAX_CAUSE_DEPTH = 5;
 /**
  * Single source of truth for "how bad is this error". Exported so callers
  * classify identically instead of hard-coding `logger.error` for every failure.
@@ -2454,49 +2594,6 @@ const classifyOne = (error)=>{
     }
     return fallback;
 };
-const MAX_DESCRIBED_LENGTH = 200;
-/**
- * Keys safe to echo when a thrown object exposes no recognised message field.
- * Deliberately an allowlist: the alternative — serialising the whole object —
- * cannot be made safe, because a thrown MPC signer rejection or API body may
- * carry key-share material, a raw transaction body or an auth token.
- */ const SAFE_DETAIL_KEYS = [
-    'status',
-    'statusCode',
-    'code',
-    'error_code',
-    'errorCode',
-    'name',
-    'type'
-];
-const isScalar = (value)=>typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean';
-/**
- * Builds a human-readable message for a thrown value that is not an `Error` —
- * most often an API response body, e.g.
- * `{ existingWalletId, error: 'Multiple wallets per chain not allowed' }`.
- *
- * `String(value)` would collapse that to `[object Object]`, losing the only
- * diagnostic content it had, so a recognised message field is preferred.
- *
- * Never serialises an unrecognised object wholesale. Where no message field
- * exists, only `SAFE_DETAIL_KEYS` scalars are echoed, and failing that a fixed
- * placeholder — so a value carrying secrets can never reach the logging backend
- * just because it lacked a `message`.
- */ const describeNonError = (value)=>{
-    if (typeof value === 'string') return value.slice(0, MAX_DESCRIBED_LENGTH);
-    if (value !== null && typeof value === 'object') {
-        const record = value;
-        const named = [
-            record['error'],
-            record['message'],
-            record['detail']
-        ].find((candidate)=>typeof candidate === 'string' && candidate.length > 0);
-        if (named) return named.slice(0, MAX_DESCRIBED_LENGTH);
-        const safeDetails = SAFE_DETAIL_KEYS.filter((key)=>isScalar(record[key])).map((key)=>`${key}=${String(record[key])}`);
-        return safeDetails.length > 0 ? safeDetails.join(' ').slice(0, MAX_DESCRIBED_LENGTH) : 'Non-Error value thrown with no recognised message field';
-    }
-    return String(value).slice(0, MAX_DESCRIBED_LENGTH);
-};
 /**
  * Decides how an operation failure reaches the Datadog logger, whose signature
  * is `(message, context, error)`.
@@ -2956,6 +3053,7 @@ const createDynamicOnlyDistribution = ({ allShares })=>({
         // queue timeout to attribute the budget to the phase that consumed it.
         let currentPhase = 'queued';
         let phaseStartedAt = Date.now();
+        const signDetails = {};
         // The task keeps running after the queue timeout rejects `add()`, so keep
         // a reference to observe how it eventually settles.
         let taskPromise;
@@ -2967,6 +3065,16 @@ const createDynamicOnlyDistribution = ({ allShares })=>({
                 reportPhase: (phase)=>{
                     currentPhase = phase;
                     phaseStartedAt = Date.now();
+                },
+                reportDetails: (details)=>{
+                    if (details.dynamicRequestId && details.dynamicRequestId !== signDetails.dynamicRequestId) {
+                        if (details.forwardMpcFailure) {
+                            return;
+                        }
+                        signDetails.dynamicRequestId = details.dynamicRequestId;
+                        delete signDetails.forwardMpcFailure;
+                    }
+                    Object.assign(signDetails, details);
                 }
             };
             taskPromise = (async ()=>{
@@ -2990,7 +3098,7 @@ const createDynamicOnlyDistribution = ({ allShares })=>({
             logError({
                 message: '[WalletQueueManager] Sign queue timed out',
                 error: error,
-                context: {
+                context: _extends({
                     accountAddress,
                     operation,
                     phase: currentPhase,
@@ -3001,7 +3109,7 @@ const createDynamicOnlyDistribution = ({ allShares })=>({
                     signQueuePending: signQueue.pending,
                     signQueueSize: signQueue.size,
                     recoveryInProgress: this.isRecoveryInProgress(accountAddress)
-                },
+                }, signDetails),
                 level: 'warn'
             });
             // The caller already saw an error; record how the orphaned ceremony
@@ -3014,24 +3122,25 @@ const createDynamicOnlyDistribution = ({ allShares })=>({
                 logError({
                     message: '[SignLateResult] Sign settled after queue timeout',
                     error: new Error('signature produced after the caller saw a timeout'),
-                    context: {
+                    context: _extends({
                         accountAddress,
                         operation,
                         outcome: 'resolved',
                         settledMs: Date.now() - timedOutAt
-                    },
+                    }, signDetails),
                     level: 'warn'
                 });
             }, (lateError)=>{
                 logError({
                     message: '[SignLateResult] Sign settled after queue timeout',
                     error: lateError instanceof Error ? lateError : new Error(String(lateError)),
-                    context: {
+                    context: _extends({
                         accountAddress,
                         operation,
                         outcome: 'rejected',
-                        settledMs: Date.now() - timedOutAt
-                    },
+                        settledMs: Date.now() - timedOutAt,
+                        causes: describeCauseChain(lateError)
+                    }, signDetails),
                     level: 'warn'
                 });
             });
@@ -4280,6 +4389,8 @@ class DynamicWalletClient {
                 durationMs: Date.now() - clientInitStartedAt
             }, this.getTraceContext(traceContext)));
             const serverInitStartedAt = Date.now();
+            const ceremonyWatch = createCeremonyErrorWatch();
+            const watchedOnCeremonyComplete = ceremonyWatch.watchCompletion(onCeremonyComplete);
             const serverKeygenInit = await this.serverInitializeKeyGen({
                 chainName,
                 clientKeygenIds,
@@ -4289,7 +4400,8 @@ class DynamicWalletClient {
                 businessAccountId,
                 idempotencyKey,
                 traceContext,
-                onCeremonyComplete
+                onCeremonyComplete: watchedOnCeremonyComplete,
+                onError: ceremonyWatch.watchStream()
             });
             const emittedAtMs = serverKeygenInit.emittedAtMs;
             let roomId = serverKeygenInit.roomId;
@@ -4308,7 +4420,7 @@ class DynamicWalletClient {
             } : {}, this.getTraceContext(traceContext)));
             const clientKeyGenStartedAt = Date.now();
             let refreshRoomInvoked = false;
-            const { rawPublicKey, clientKeygenResults: clientKeyShares, operationSource } = await this.clientKeyGen({
+            const { rawPublicKey, clientKeygenResults: clientKeyShares, operationSource } = await ceremonyWatch.raceAgainstStreamError(this.clientKeyGen({
                 chainName,
                 roomId,
                 serverKeygenIds,
@@ -4331,7 +4443,8 @@ class DynamicWalletClient {
                         bitcoinConfig,
                         businessAccountId,
                         traceContext,
-                        onCeremonyComplete
+                        onCeremonyComplete: watchedOnCeremonyComplete,
+                        onError: ceremonyWatch.watchStream()
                     });
                     // Track the relay ceremony's room and keygen ids so the logs below
                     // report the ceremony that actually produced the wallet.
@@ -4339,7 +4452,7 @@ class DynamicWalletClient {
                     serverKeygenIds = refreshed.serverKeygenIds;
                     return refreshed;
                 }
-            });
+            }));
             this.logger.info('[DynamicWaasWalletClient] Client key generation completed', _extends({
                 roomId,
                 serverKeygenIds: serverKeygenIds.join(', '),
@@ -4359,7 +4472,8 @@ class DynamicWalletClient {
             // the wallet, then fire onCeremonyComplete manually.
             // Skip when refreshRoom was invoked: the SSE fallback already delivered
             // onCeremonyComplete via the event stream.
-            if (this.featureFlags[core.FEATURE_FLAGS.ENABLE_HTTP_WAAS_TRANSPORT] === true && idempotencyKey && onCeremonyComplete && !refreshRoomInvoked) {
+            const pollsHttpCompletion = this.featureFlags[core.FEATURE_FLAGS.ENABLE_HTTP_WAAS_TRANSPORT] === true && idempotencyKey && onCeremonyComplete && !refreshRoomInvoked;
+            if (pollsHttpCompletion) {
                 const completion = await this.pollHttpCeremonyCompletion({
                     chainName,
                     clientKeygenIds,
@@ -4371,6 +4485,10 @@ class DynamicWalletClient {
                     traceContext
                 });
                 onCeremonyComplete(completion.accountAddress, completion.walletId, completion.shareSetId);
+            } else if (onCeremonyComplete) {
+                // Wait for the stream's ceremony_complete here (not in each chain client)
+                // so a stream error after the relay keygen rejects instead of hanging.
+                await ceremonyWatch.waitForCompletion();
             }
             return {
                 rawPublicKey,
@@ -4654,7 +4772,7 @@ class DynamicWalletClient {
             throw error;
         }
     }
-    async clientSign({ chainName, message, roomId: initialRoomId, keyShare, derivationPath, isFormatted, dynamicRequestId, traceContext, bitcoinConfig, variant, refreshRoom }) {
+    async clientSign({ chainName, message, roomId: initialRoomId, keyShare, derivationPath, isFormatted, dynamicRequestId, traceContext, bitcoinConfig, variant, refreshRoom, onForwardMpcFailure }) {
         // Reassigned when forward MPC fails and we mint a fresh room for the
         // relay-based fallback below.
         let roomId = initialRoomId;
@@ -4717,6 +4835,14 @@ class DynamicWalletClient {
                     return forwardMPCSignature;
                 } catch (error) {
                     const errorInfo = core.classifyForwardMpcError(error);
+                    try {
+                        onForwardMpcFailure == null ? void 0 : onForwardMpcFailure(errorInfo);
+                    } catch (observerError) {
+                        this.logger.warn('Forward MPC failure observer threw', {
+                            dynamicRequestId,
+                            observerErrorType: observerError instanceof Error ? observerError.name : typeof observerError
+                        });
+                    }
                     this.logger.warn('Forward MPC signing failed', _extends({}, errorInfo, {
                         chainName,
                         environmentId: this.environmentId,
@@ -4983,7 +5109,7 @@ class DynamicWalletClient {
     }
     //todo: need to modify with imported flag
     async sign({ accountAddress, message, chainName, password = undefined, isFormatted = false, signedSessionId, mfaToken, elevatedAccessToken, context, approvalQuorum, onError, traceContext, bitcoinConfig }) {
-        return WalletQueueManager.queueSignOperation(accountAddress, core.WalletOperation.SIGN_MESSAGE, ({ reportPhase })=>this.internalSign({
+        return WalletQueueManager.queueSignOperation(accountAddress, core.WalletOperation.SIGN_MESSAGE, ({ reportPhase, reportDetails })=>this.internalSign({
                 accountAddress,
                 message,
                 chainName,
@@ -4997,7 +5123,8 @@ class DynamicWalletClient {
                 onError,
                 traceContext,
                 bitcoinConfig,
-                onSignPhase: reportPhase
+                onSignPhase: reportPhase,
+                onSignDetails: reportDetails
             }));
     }
     /**
@@ -5105,8 +5232,11 @@ class DynamicWalletClient {
             clearTimeout(warningTimer);
         }
     }
-    async internalSign({ accountAddress, message, chainName, password = undefined, isFormatted = false, signedSessionId, mfaToken, elevatedAccessToken, context, approvalQuorum, onError, traceContext, bitcoinConfig, onSignPhase, staleShareRetry = false, roomIdRetry = false }) {
+    async internalSign({ accountAddress, message, chainName, password = undefined, isFormatted = false, signedSessionId, mfaToken, elevatedAccessToken, context, approvalQuorum, onError, traceContext, bitcoinConfig, onSignPhase, onSignDetails, staleShareRetry = false, roomIdRetry = false }) {
         const dynamicRequestId = uuid.v4();
+        onSignDetails == null ? void 0 : onSignDetails({
+            dynamicRequestId
+        });
         try {
             // Pre-flight phase boundaries. Nothing reaches the network until
             // serverSign below, so a stall here is invisible in server logs — these
@@ -5238,6 +5368,14 @@ class DynamicWalletClient {
                     traceContext,
                     bitcoinConfig,
                     variant: wallet.variant,
+                    onForwardMpcFailure: ({ errorType, errorCode, sessionEstablished })=>onSignDetails == null ? void 0 : onSignDetails({
+                            dynamicRequestId,
+                            forwardMpcFailure: {
+                                errorType,
+                                errorCode,
+                                sessionEstablished
+                            }
+                        }),
                     // On forward-MPC fallback, re-run the server sign with no roomId so a
                     // brand-new server-joined room is created for the relay ceremony.
                     refreshRoom: async ()=>{
@@ -5387,6 +5525,7 @@ class DynamicWalletClient {
                     traceContext,
                     bitcoinConfig,
                     onSignPhase,
+                    onSignDetails,
                     staleShareRetry: true,
                     roomIdRetry
                 });
@@ -5415,6 +5554,7 @@ class DynamicWalletClient {
                     traceContext,
                     bitcoinConfig,
                     onSignPhase,
+                    onSignDetails,
                     staleShareRetry,
                     roomIdRetry: true
                 });
@@ -8484,17 +8624,23 @@ class DynamicWalletClient {
                     sessionPublicKey,
                     passwordUpdateBatchId
                 });
+            let backupData;
             try {
-                await backup();
+                backupData = await backup();
             } catch (error) {
                 if (!(error instanceof StaleLocalSharesError) || !error.localSharesRefreshed) throw error;
-                await backup();
+                backupData = await backup();
             }
+            // Not named passwordUpdateStatus: the logger redacts string values of password* keys.
             this.logPasswordOperationSuccess('updatePassword', {
                 accountAddress,
                 walletId: wallet == null ? void 0 : wallet.walletId,
-                passwordUpdateBatchId
+                passwordUpdateBatchId,
+                batchStatus: backupData.passwordUpdateStatus
             });
+            return {
+                passwordUpdateStatus: backupData.passwordUpdateStatus
+            };
         } catch (error) {
             var _this_storage_removeItem, _this_storage;
             // The pending encrypted-shares cache entry may have been written before the failure.
@@ -8524,7 +8670,7 @@ class DynamicWalletClient {
             if (isWalletPasswordEncrypted(wallet)) {
                 throw new Error(ERROR_WALLETS_ALREADY_ENCRYPTED);
             }
-            await this.storeEncryptedBackupByWallet({
+            const backupData = await this.storeEncryptedBackupByWallet({
                 accountAddress,
                 password: newPassword,
                 signedSessionId,
@@ -8534,8 +8680,12 @@ class DynamicWalletClient {
             this.logPasswordOperationSuccess('setPassword', {
                 accountAddress,
                 walletId: wallet == null ? void 0 : wallet.walletId,
-                passwordUpdateBatchId
+                passwordUpdateBatchId,
+                batchStatus: backupData.passwordUpdateStatus
             });
+            return {
+                passwordUpdateStatus: backupData.passwordUpdateStatus
+            };
         } catch (error) {
             var _this_storage_removeItem, _this_storage;
             // A pending cache entry may have been written if passwordUpdateBatchId was set.
@@ -8685,7 +8835,12 @@ class DynamicWalletClient {
             // Find first password-encrypted wallet
             const found = findPasswordEncryptedWallet(this.walletMap);
             if (!found) {
-                return; // No existing encrypted wallets
+                // A password-encrypted wallet next to passwordless ones leaves a mixed state that
+                // password updates cannot finish. setPassword encrypts all existing wallets at once.
+                if (hasPasswordlessWallet(this.walletMap)) {
+                    throw new Error(ERROR_EXISTING_WALLETS_NOT_ENCRYPTED);
+                }
+                return; // No existing wallets
             }
             const [address, wallet] = found;
             try {
@@ -10055,6 +10210,41 @@ class DynamicWalletClient {
         }
     }
     /**
+   * Re-locks every unlocked password-encrypted wallet: clears its decrypted
+   * client key shares from storage and flips its ready state back to
+   * ENCRYPTED, so the next operation prompts for the wallet password again.
+   * The cached encrypted-shares blobs are kept, so a later unlockWallet does
+   * not need a server round-trip. Wallets that are not password-encrypted have
+   * no password to re-prompt for and are left untouched.
+   *
+   * When `accountAddress` is given, only that wallet is re-locked.
+   */ async lockWallets(accountAddress) {
+        const normalizedTarget = accountAddress ? normalizeAddress(accountAddress) : undefined;
+        if (normalizedTarget && !this.walletMap[normalizedTarget]) {
+            throw new Error(`Wallet not found for address: ${accountAddress}`);
+        }
+        const walletsToLock = Object.entries(this.walletMap).filter(([address, wallet])=>wallet.walletReadyState === core.WalletReadyState.READY && isWalletPasswordEncrypted(wallet) && (!normalizedTarget || address === normalizedTarget));
+        const results = await Promise.allSettled(walletsToLock.map(async ([accountAddress])=>{
+            await this.setClientKeySharesToStorage({
+                accountAddress,
+                clientKeyShares: []
+            });
+            this.updateWalletMap(accountAddress, {
+                walletReadyState: core.WalletReadyState.ENCRYPTED
+            });
+        }));
+        // Persist even on partial failure so the stored map matches the in-memory
+        // one: a failed wallet stays READY with its shares still in storage.
+        await this.storage.setItem(this.storageKey, JSON.stringify(this.walletMap));
+        this.logger.info('[DynamicWaasWalletClient] lockWallets: re-locked wallets', {
+            lockedCount: walletsToLock.length
+        });
+        const failure = results.find((result)=>result.status === 'rejected');
+        if (failure) {
+            throw failure.reason;
+        }
+    }
+    /**
    * Decrypts cached encrypted key shares for a wallet and stores them locally.
    */ async decryptAndStoreWalletShares({ accountAddress, encryptedData, password }) {
         const data = JSON.parse(encryptedData);
@@ -10562,12 +10752,6 @@ class DynamicWalletClient {
             logger: this.logger,
             onUnauthorized: internalOptions == null ? void 0 : internalOptions.onUnauthorized
         });
-        // `reshare` left unbound until the signer-reshare flavor (reshare into a new
-        // signer's pending share set) exists; addSigner is stubbed until then.
-        this.businessAccounts = new core.BusinessAccountClient({
-            apiClient: this.apiClient,
-            logger: this.logger
-        });
         this.debug = Boolean(debug);
         this.featureFlags = featureFlags || {};
         this.argon2idRebackupTargets = argon2idRebackupTargets || [];