@dynamic-labs-wallet/node 1.1.34 → 1.1.36

package/index.cjs

@@ -10,6 +10,13 @@ var crypto = require('node:crypto');
 var logger = require('@dynamic-labs/logger');
 var sdkApiCore = require('@dynamic-labs/sdk-api-core');
 
+class ClientValidationError extends TypeError {
+    constructor(message, options){
+        super(message, options);
+        this.name = 'ClientValidationError';
+    }
+}
+
 // Removed duplicate exports - these are already exported from #internal/core
 const getMPCSignatureScheme = ({ signingAlgorithm, baseRelayUrl = core$1.MPC_RELAY_PROD_API_URL, variant = core$1.DEFAULT_ED25519_VARIANT })=>{
     switch(signingAlgorithm){
@@ -81,6 +88,180 @@ function _object_without_properties_loose(source, excluded) {
     }
 }
 
+var version = "1.1.36";
+
+const MAX_CAUSE_CHAIN_LENGTH = 4;
+const SAFE_ERROR_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/;
+const TRANSPORT_ERROR_CODES = new Set([
+    'EAI_AGAIN',
+    'ECONNREFUSED',
+    'ECONNRESET',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'ETIMEDOUT',
+    'UND_ERR_CONNECT_TIMEOUT'
+]);
+const getSafeErrorName = (error)=>SAFE_ERROR_NAME_PATTERN.test(error.name) ? error.name : 'Error';
+const normalizeContext = (context)=>{
+    const backendReached = context == null ? void 0 : context['backendReached'];
+    const dynamicRequestId = context == null ? void 0 : context['dynamicRequestId'];
+    const failurePhase = context == null ? void 0 : context['failurePhase'];
+    const traceId = context == null ? void 0 : context['traceId'];
+    return _extends({}, typeof backendReached === 'boolean' ? {
+        backendReached
+    } : {}, typeof dynamicRequestId === 'string' ? {
+        dynamicRequestId
+    } : {}, typeof failurePhase === 'string' ? {
+        failurePhase
+    } : {}, typeof traceId === 'string' ? {
+        traceId
+    } : {});
+};
+const getHeader = (error, name)=>{
+    var _error_config;
+    const headers = (_error_config = error.config) == null ? void 0 : _error_config.headers;
+    if (!headers) {
+        return undefined;
+    }
+    const get = headers.get;
+    let value;
+    if (typeof get === 'function') {
+        value = get.call(headers, name);
+    } else {
+        const headerRecord = headers;
+        const matchingKey = Object.keys(headerRecord).find((key)=>key.toLowerCase() === name.toLowerCase());
+        value = matchingKey ? headerRecord[matchingKey] : undefined;
+    }
+    return typeof value === 'string' ? value : undefined;
+};
+const getSafeRequestUrl = (error)=>{
+    var _error_config;
+    const requestUrl = (_error_config = error.config) == null ? void 0 : _error_config.url;
+    if (!requestUrl) {
+        return undefined;
+    }
+    try {
+        var _error_config1;
+        const url = new URL(requestUrl, (_error_config1 = error.config) == null ? void 0 : _error_config1.baseURL);
+        return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : undefined;
+    } catch (e) {
+        return undefined;
+    }
+};
+const getErrorCauseChain = (error)=>{
+    const chain = [];
+    const visited = new Set();
+    let current = error instanceof Error ? error : undefined;
+    while(current && chain.length < MAX_CAUSE_CHAIN_LENGTH && !visited.has(current)){
+        chain.push(current);
+        visited.add(current);
+        current = current.cause instanceof Error ? current.cause : undefined;
+    }
+    return chain;
+};
+const serializeError = (error)=>{
+    let serialized;
+    for (const current of getErrorCauseChain(error).reverse()){
+        serialized = _extends({
+            name: getSafeErrorName(current)
+        }, serialized ? {
+            cause: serialized
+        } : {});
+    }
+    return serialized != null ? serialized : {
+        name: 'Error'
+    };
+};
+const findErrorInCauseChain = (error, predicate)=>getErrorCauseChain(error).find(predicate);
+const isWalletApiError = (error)=>error instanceof core$1.WalletApiError;
+const isClientValidationErrorInstance = (error)=>error instanceof ClientValidationError;
+const isAxiosErrorInstance = (error)=>core$1.isAxiosError(error);
+const hasTransportErrorCode = (error)=>{
+    const code = error.code;
+    return typeof code === 'string' && TRANSPORT_ERROR_CODES.has(code);
+};
+const getHttpFailureCategory = (statusCode, isServerFailure)=>{
+    if (statusCode === undefined) {
+        return 'transport';
+    }
+    return isServerFailure ? 'backend' : 'unknown';
+};
+const getFailureCategory = (isClientValidation, isNetworkFailure, phase)=>{
+    if (isClientValidation) {
+        return 'client_validation';
+    }
+    if (isNetworkFailure) {
+        return 'transport';
+    }
+    return (phase == null ? void 0 : phase.startsWith('mpc_')) ? 'mpc_protocol' : 'unknown';
+};
+const classifyAxiosError = (error, context, outerError)=>{
+    var _error_response, _error_config_method, _error_config;
+    const statusCode = (_error_response = error.response) == null ? void 0 : _error_response.status;
+    var _context_backendReached;
+    const backendReached = (_context_backendReached = context.backendReached) != null ? _context_backendReached : statusCode !== undefined;
+    const isServerFailure = statusCode !== undefined && statusCode >= 500;
+    const category = getHttpFailureCategory(statusCode, isServerFailure);
+    const requestUrl = getSafeRequestUrl(error);
+    const requestMethod = (_error_config = error.config) == null ? void 0 : (_error_config_method = _error_config.method) == null ? void 0 : _error_config_method.toUpperCase();
+    const http = _extends({}, requestMethod ? {
+        method: requestMethod
+    } : {}, statusCode !== undefined ? {
+        status_code: statusCode
+    } : {}, requestUrl ? {
+        url: requestUrl
+    } : {});
+    var _getHeader, _getHeader1;
+    return _extends({
+        dynRequestId: (_getHeader = getHeader(error, 'x-dyn-request-id')) != null ? _getHeader : context.dynamicRequestId,
+        error: serializeError(outerError),
+        failure: {
+            actionable: statusCode === undefined || isServerFailure,
+            backendReached,
+            category,
+            phase: context.failurePhase,
+            retryable: statusCode === undefined || statusCode === 429 || isServerFailure
+        }
+    }, Object.keys(http).length > 0 ? {
+        http
+    } : {}, {
+        sdkVersion: version,
+        traceId: (_getHeader1 = getHeader(error, 'x-dyn-trace-id')) != null ? _getHeader1 : context.traceId
+    });
+};
+const buildForwardedErrorTelemetry = (error, context)=>{
+    const normalizedError = error instanceof Error ? error : undefined;
+    const telemetryContext = normalizeContext(context);
+    const axiosError = findErrorInCauseChain(normalizedError, isAxiosErrorInstance);
+    if (normalizedError && axiosError) {
+        return classifyAxiosError(axiosError, telemetryContext, normalizedError);
+    }
+    const { backendReached: contextBackendReached, dynamicRequestId, failurePhase: phase, traceId } = telemetryContext;
+    const isClientValidation = Boolean(findErrorInCauseChain(normalizedError, isClientValidationErrorInstance));
+    const walletApiError = findErrorInCauseChain(normalizedError, isWalletApiError);
+    const isNetworkFailure = (walletApiError == null ? void 0 : walletApiError.code) === core$1.NETWORK_ERROR_CODE || Boolean(findErrorInCauseChain(normalizedError, hasTransportErrorCode));
+    const category = getFailureCategory(isClientValidation, isNetworkFailure, phase);
+    return _extends({}, dynamicRequestId ? {
+        dynRequestId: dynamicRequestId
+    } : {}, normalizedError ? {
+        error: serializeError(normalizedError)
+    } : {}, {
+        failure: _extends({
+            actionable: !isClientValidation,
+            backendReached: isClientValidation ? false : contextBackendReached != null ? contextBackendReached : false,
+            category
+        }, phase ? {
+            phase
+        } : {}, {
+            retryable: isNetworkFailure
+        }),
+        sdkVersion: version
+    }, traceId ? {
+        traceId
+    } : {});
+};
+const isClientValidationError = (error)=>Boolean(findErrorInCauseChain(error instanceof Error ? error : undefined, isClientValidationErrorInstance));
+
 const createLogError = (clientTag)=>({ message, error, context })=>logError({
             message,
             error,
@@ -92,11 +273,18 @@ const logError = ({ message, error, context, clientTag = 'node' })=>{
         core$1.handleAxiosError(error, message, context);
         return;
     }
-    core$1.Logger.error(`[DynamicWaasWalletClient] Error in ${clientTag} client`, {
+    const logMessage = `[DynamicWaasWalletClient] Error in ${clientTag} client`;
+    if (isClientValidationError(error)) {
+        core$1.Logger.warn(logMessage, _extends({
+            message,
+            context
+        }, buildForwardedErrorTelemetry(error, context)));
+        return;
+    }
+    core$1.Logger.error(logMessage, {
         message,
-        error: error instanceof Error ? error.message : String(error),
         context
-    });
+    }, error);
 };
 const bytesToBase64 = (arr)=>{
     return Buffer.from(arr).toString('base64');
@@ -409,24 +597,28 @@ const getKey = async ({ password, salt, encryptionConfig })=>{
 // walletId resolution server-side.
 const CEREMONY_COMPLETE_WAIT_MS = 5000;
 
-// Shared across all server-side WaaS SDKs (Node, Python, Rust, ...) — matches
-// cf-worker-log-ingestion's allowlisted `service` override (dynamic-labs/cf-worker-log-ingestion#13).
+// Matches the ingestion worker's allowlisted server-SDK service override.
 const SERVICE_NAME = 'waas-server-sdk';
 const SDK_NAME = 'node';
-// A dedicated instance used only to reuse @dynamic-labs/logger's own HTTP
-// transport to logs.dynamicauth.com — never for console output. We call
-// `emitHttpLogs` directly rather than `.error()`, so the wrapped logger below
-// (the customer's own, or the default one) is the only thing that ever prints
-// to the local console; this instance's console output is simply unused.
-const forwardingLogger = new logger.Logger('waas-server-sdk');
+const ScopedLogger = logger.Logger;
+const forwardingLogger = new ScopedLogger(SERVICE_NAME, undefined, {
+    emitErrors: false
+});
 const extractErrorAndContext = (args)=>{
     let error;
     let context;
-    for (const arg of args){
+    for (const _ref of args){
+        let arg = _ref;
         if (arg instanceof Error) {
             error = arg;
         } else if (arg && typeof arg === 'object') {
-            context = _extends({}, context, arg);
+            const { error: contextError } = arg, safeContext = _object_without_properties_loose(arg, [
+                "error"
+            ]);
+            if (contextError instanceof Error) {
+                error = contextError;
+            }
+            context = _extends({}, context, safeContext);
         }
     }
     return {
@@ -434,52 +626,39 @@ const extractErrorAndContext = (args)=>{
         context
     };
 };
-/**
- * Wraps an ILogger so `.error()` calls are also forwarded to Dynamic's
- * log-ingestion endpoint via `@dynamic-labs/logger`'s own HTTP transport
- * (dynamic-labs/dynamic-auth#12443 makes that transport Node-safe), in
- * addition to whatever the wrapped logger already does. Every other level
- * passes through untouched. Credential/key-material redaction is not
- * duplicated here — `emitHttpLogs` already runs every forwarded field through
- * `@dynamic-labs/redaction` before it leaves the process.
- *
- * Deliberately does NOT call `DynamicLogger.setEmitErrors(true)`: that flag is
- * static and process-global, so flipping it would make the *wrapped* logger's
- * own `.error()` call (two lines below) auto-forward too — double-sending
- * every error, and breaking a later client's `errorLogging: false` opt-out
- * for as long as any other client in the process has forwarding enabled.
- * `emitHttpLogs` below is a direct call and works regardless of that flag.
- *
- * IMPORTANT — process-global state: `environmentId` IS still static/shared
- * (`DynamicLogger.setEnvironmentId`), so a process that constructs multiple
- * `DynamicWalletClient`s for *different* `environmentId`s will have every one
- * of them forward under whichever environmentId was set last — there is no
- * per-instance scoping. This is a real regression versus the fetch-based
- * implementation, which threads `environmentId` through every call explicitly.
- */ const createErrorForwardingLogger = (logger$1, { environmentId })=>{
+const disableAutomaticErrorForwarding = (logger)=>{
+    const configurableLogger = logger;
+    configurableLogger.setEmitErrors == null ? void 0 : configurableLogger.setEmitErrors.call(configurableLogger, false);
+};
+/** Adds one redacted server event per root error while preserving local logger output. */ const createErrorForwardingLogger = (logger$1, { environmentId })=>{
+    disableAutomaticErrorForwarding(logger$1);
+    const forwardedErrors = new WeakSet();
     return {
         debug: logger$1.debug.bind(logger$1),
         info: logger$1.info.bind(logger$1),
         warn: logger$1.warn.bind(logger$1),
         error: (message, ...args)=>{
-            logger$1.error(message, ...args);
             const { error, context } = extractErrorAndContext(args);
-            logger.Logger.setEnvironmentId(environmentId);
-            // `service`/`sdk` are passed as call-level args (merged onto the
-            // top-level forwarded body by emitHttpLogs), not via `.metaData.set()`
-            // (which nests under `meta.*`) — cf-worker-log-ingestion's `service`
-            // override only checks the top-level field. Spread after, not before,
-            // so a caller-supplied context field named `service`/`sdk` can't
-            // override the trusted tag the ingestion worker relies on.
+            const telemetry = buildForwardedErrorTelemetry(error, context);
+            if (telemetry.failure.category === 'client_validation') {
+                logger$1.warn(message, _extends({}, context, telemetry), error);
+                return;
+            }
+            logger$1.error(message, ...args);
+            const errorChain = getErrorCauseChain(error);
+            if (errorChain.some((candidate)=>forwardedErrors.has(candidate))) {
+                return;
+            }
+            errorChain.forEach((candidate)=>forwardedErrors.add(candidate));
             forwardingLogger.emitHttpLogs(logger.LogLevel.ERROR, message, {
                 args: [
                     _extends({}, context, {
                         service: SERVICE_NAME,
                         sdk: SDK_NAME
-                    }, (error == null ? void 0 : error.stack) ? {
-                        originalStack: error.stack
-                    } : {})
-                ]
+                    }, telemetry)
+                ],
+                environmentId,
+                stackField: 'callsiteStack'
             });
         }
     };
@@ -843,11 +1022,18 @@ class DynamicWalletClient {
             }));
             return data;
         } catch (error) {
-            this.logger.error('Error in dynamicServerInitializeKeyGen', error);
-            throw new Error('Error creating wallet account in dynamicServerInitializeKeyGen');
+            this.logger.error('Error in dynamicServerInitializeKeyGen', {
+                backendReached: true,
+                dynamicRequestId: createWalletAccountRequest.dynamicRequestId,
+                failurePhase: 'backend_keygen',
+                operation: 'keygen'
+            }, error);
+            throw new Error('Error creating wallet account in dynamicServerInitializeKeyGen', {
+                cause: error
+            });
         }
     }
-    async externalServerInitializeKeyGen({ chainName, thresholdSignatureScheme, bitcoinConfig }) {
+    async externalServerInitializeKeyGen({ chainName, dynamicRequestId, thresholdSignatureScheme, bitcoinConfig }) {
         try {
             // Get the mpc signer
             const mpcSigner = getMPCSigner({
@@ -859,11 +1045,19 @@ class DynamicWalletClient {
             const keygenInitResults = await Promise.all(new Array(clientThreshold).fill(null).map(()=>mpcSigner.initKeygen()));
             return keygenInitResults;
         } catch (error) {
-            this.logger.error('Error in externalServerInitializeKeyGen', error);
-            throw new Error('Error initializing keygen in externalServerInitializeKeyGen');
+            this.logger.error('Error in externalServerInitializeKeyGen', {
+                backendReached: false,
+                chain: chainName,
+                dynamicRequestId,
+                failurePhase: 'mpc_keygen',
+                operation: 'keygen'
+            }, error);
+            throw new Error('Error initializing keygen in externalServerInitializeKeyGen', {
+                cause: error
+            });
         }
     }
-    async derivePublicKey({ chainName, keyShare, derivationPath, bitcoinConfig }) {
+    async derivePublicKey({ chainName, keyShare, derivationPath, bitcoinConfig, dynamicRequestId }) {
         try {
             const mpcSigner = getMPCSigner({
                 chainName,
@@ -880,11 +1074,19 @@ class DynamicWalletClient {
             }
             return publicKey;
         } catch (error) {
-            this.logger.error('Error in derivePublicKey', error);
-            throw new Error('Error deriving public key in derivePublicKey');
+            this.logger.error('Error in derivePublicKey', {
+                backendReached: Boolean(dynamicRequestId),
+                chain: chainName,
+                dynamicRequestId,
+                failurePhase: 'mpc_keygen',
+                operation: 'keygen'
+            }, error);
+            throw new Error('Error deriving public key in derivePublicKey', {
+                cause: error
+            });
         }
     }
-    async forwardMPCExternalServerKeyGen({ chainName, roomId, dynamicServerKeygenIds, externalServerInitKeygenResults, thresholdSignatureScheme, bitcoinConfig }) {
+    async forwardMPCExternalServerKeyGen({ chainName, roomId, dynamicServerKeygenIds, externalServerInitKeygenResults, dynamicRequestId, thresholdSignatureScheme, bitcoinConfig }) {
         try {
             const chainConfig = core$1.getMPCChainConfig(chainName, bitcoinConfig);
             const signingAlgo = chainConfig.signingAlgorithm;
@@ -918,7 +1120,8 @@ class DynamicWalletClient {
                 chainName,
                 keyShare: serverKeygenResult,
                 derivationPath,
-                bitcoinConfig
+                bitcoinConfig,
+                dynamicRequestId
             });
             return {
                 rawPublicKey,
@@ -927,6 +1130,7 @@ class DynamicWalletClient {
         } catch (error) {
             this.logger.error('Error during forward MPC external server keygen', error, {
                 chainName,
+                dynamicRequestId,
                 environmentId: this.environmentId
             });
             throw error;
@@ -934,7 +1138,7 @@ class DynamicWalletClient {
             this.apiClient.forwardMPCClient.disconnect();
         }
     }
-    async externalServerKeyGen({ chainName, roomId, dynamicServerKeygenIds, externalServerInitKeygenResults, thresholdSignatureScheme, bitcoinConfig }) {
+    async externalServerKeyGen({ chainName, roomId, dynamicRequestId, dynamicServerKeygenIds, externalServerInitKeygenResults, thresholdSignatureScheme, bitcoinConfig }) {
         // Try forward MPC first if enabled
         if (this.forwardMPCEnabled && !this.shouldSkipForwardMPC(chainName)) {
             try {
@@ -943,6 +1147,7 @@ class DynamicWalletClient {
                     roomId,
                     dynamicServerKeygenIds,
                     externalServerInitKeygenResults,
+                    dynamicRequestId,
                     thresholdSignatureScheme,
                     bitcoinConfig
                 });
@@ -992,15 +1197,24 @@ class DynamicWalletClient {
                 chainName,
                 keyShare: serverKeygenResult,
                 derivationPath,
-                bitcoinConfig
+                bitcoinConfig,
+                dynamicRequestId
             });
             return {
                 rawPublicKey,
                 externalServerKeyGenResults: serverKeygenResults
             };
         } catch (error) {
-            this.logger.error('Error in externalServerKeyGen', error);
-            throw new Error('Error deriving public key in externalServerKeyGen');
+            this.logger.error('Error in externalServerKeyGen', {
+                backendReached: true,
+                chain: chainName,
+                dynamicRequestId,
+                failurePhase: 'mpc_keygen',
+                operation: 'keygen'
+            }, error);
+            throw new Error('Error deriving public key in externalServerKeyGen', {
+                cause: error
+            });
         }
     }
     validatePasswordForBackup({ password, backUpToDynamic }) {
@@ -1038,9 +1252,11 @@ class DynamicWalletClient {
             backUpToDynamic
         });
         const dynamicRequestId = uuid.v4();
+        let backendReached = false;
         try {
             const externalServerInitKeygenResults = await this.externalServerInitializeKeyGen({
                 chainName,
+                dynamicRequestId,
                 thresholdSignatureScheme,
                 bitcoinConfig
             });
@@ -1053,12 +1269,14 @@ class DynamicWalletClient {
                 skipLock,
                 bitcoinConfig
             };
+            backendReached = true;
             const { roomId, serverKeygenIds: dynamicServerKeygenIds } = await this.dynamicServerInitializeKeyGen(_extends({}, createWalletAccountRequest, {
                 onCeremonyComplete
             }));
             const { rawPublicKey, externalServerKeyGenResults } = await this.externalServerKeyGen({
                 chainName,
                 roomId,
+                dynamicRequestId,
                 dynamicServerKeygenIds,
                 externalServerInitKeygenResults,
                 thresholdSignatureScheme,
@@ -1069,8 +1287,16 @@ class DynamicWalletClient {
                 externalServerKeyShares: externalServerKeyGenResults
             };
         } catch (error) {
-            this.logger.error('Error in keyGen', error);
-            throw new Error('Error creating wallet account in keyGen');
+            this.logger.error('Error in keyGen', {
+                backendReached,
+                chain: chainName,
+                dynamicRequestId,
+                failurePhase: 'keygen',
+                operation: 'keygen'
+            }, error);
+            throw new Error('Error creating wallet account in keyGen', {
+                cause: error
+            });
         }
     }
     async importRawPrivateKey({ chainName, privateKey, thresholdSignatureScheme, bitcoinConfig, password, backUpToDynamic, onError, onCeremonyComplete }) {
@@ -1093,6 +1319,7 @@ class DynamicWalletClient {
         });
         const externalServerKeygenInitResults = await this.externalServerInitializeKeyGen({
             chainName,
+            dynamicRequestId,
             thresholdSignatureScheme,
             bitcoinConfig
         });
@@ -1129,7 +1356,8 @@ class DynamicWalletClient {
             chainName,
             keyShare: externalServerKeygenResult,
             derivationPath: undefined,
-            bitcoinConfig
+            bitcoinConfig,
+            dynamicRequestId
         });
         return {
             rawPublicKey,
@@ -1158,7 +1386,7 @@ class DynamicWalletClient {
             dynamicRequestId
         });
     }
-    async externalServerSign({ chainName, message, roomId, keyShare, derivationPath, isFormatted, bitcoinConfig }) {
+    async externalServerSign({ chainName, message, roomId, keyShare, derivationPath, isFormatted, bitcoinConfig, dynamicRequestId }) {
         try {
             const mpcSigner = getMPCSigner({
                 chainName,
@@ -1170,7 +1398,13 @@ class DynamicWalletClient {
             const signature = await mpcSigner.sign(roomId, keyShare, formattedMessage, derivationPath, tweak);
             return signature;
         } catch (error) {
-            this.logger.error('Error in externalServerSign', error);
+            this.logger.error('Error in externalServerSign', {
+                backendReached: true,
+                chain: chainName,
+                dynamicRequestId,
+                failurePhase: 'mpc_sign',
+                operation: 'sign'
+            }, error);
             throw error;
         }
     }
@@ -1276,6 +1510,8 @@ class DynamicWalletClient {
         }
     }
     async sign({ accountAddress, externalServerKeyShares, message, chainName, password = undefined, isFormatted = false, context, onError, bitcoinConfig, walletMetadata, walletOperation = core$1.WalletOperation.SIGN_MESSAGE, passwordPreVerified = false }) {
+        const dynamicRequestId = uuid.v4();
+        let backendReached = false;
         try {
             this.assertAddressMatchesMetadata(accountAddress, walletMetadata);
             const backupInfo = walletMetadata.externalServerKeySharesBackupInfo;
@@ -1316,6 +1552,7 @@ class DynamicWalletClient {
             // timeout.
             const sseErrorGate = core$1.createRejectablePromise();
             // Perform the dynamic server sign
+            backendReached = true;
             const data = await this.dynamicServerSign({
                 walletId,
                 message,
@@ -1326,7 +1563,8 @@ class DynamicWalletClient {
                     sseErrorGate.reject(error);
                     onError == null ? void 0 : onError(error);
                 },
-                shareSetId: walletMetadata.shareSetId
+                shareSetId: walletMetadata.shareSetId,
+                dynamicRequestId
             });
             const derivationPath = derivationPathStr && derivationPathStr != '' ? new Uint32Array(Object.values(JSON.parse(derivationPathStr))) : undefined;
             // Try forward MPC first if enabled, with fallback to relay-based signing on attestation failure
@@ -1353,7 +1591,8 @@ class DynamicWalletClient {
                     keyShare: resolvedShares[0],
                     derivationPath,
                     isFormatted,
-                    bitcoinConfig
+                    bitcoinConfig,
+                    dynamicRequestId
                 });
             })();
             // The losing branch's rejection (e.g. the relay timeout after a policy
@@ -1366,7 +1605,13 @@ class DynamicWalletClient {
             ]);
         } catch (error) {
             if (!(error instanceof Error && error.message === 'External server key shares are required to sign a message')) {
-                this.logger.error('Error in sign', error);
+                this.logger.error('Error in sign', {
+                    backendReached,
+                    chain: chainName,
+                    dynamicRequestId,
+                    failurePhase: 'sign',
+                    operation: 'sign'
+                }, error);
             }
             throw error;
         }
@@ -2197,7 +2442,9 @@ class DynamicWalletClient {
             // We can't distinguish wrong-password from stale-metadata without a
             // server-side backupInfo lookup (fetchWalletMetadata returns identity
             // only). Surface both possibilities so customers know where to look.
-            throw new Error('Failed to verify password. Either the password is incorrect, or the cached `walletMetadata.externalServerKeySharesBackupInfo` is stale ' + '(merge the `backupInfo` returned from updatePassword/refreshWalletAccountShares/reshare into your cached walletMetadata).');
+            throw new Error('Failed to verify password. Either the password is incorrect, or the cached `walletMetadata.externalServerKeySharesBackupInfo` is stale ' + '(merge the `backupInfo` returned from updatePassword/refreshWalletAccountShares/reshare into your cached walletMetadata).', {
+                cause: error
+            });
         }
     }
     async isPasswordEncrypted({ accountAddress, walletMetadata, backupInfo }) {
@@ -2979,6 +3226,7 @@ Object.defineProperty(exports, "SignMessageRawSignHashFunctionEnum", {
   enumerable: true,
   get: function () { return sdkApiCore.SignMessageRawSignHashFunctionEnum; }
 });
+exports.ClientValidationError = ClientValidationError;
 exports.DynamicServerApiClient = DynamicServerApiClient;
 exports.DynamicWalletClient = DynamicWalletClient;
 exports.ERROR_RAW_SIGN_CONTEXT_REQUIRED = ERROR_RAW_SIGN_CONTEXT_REQUIRED;