@dynamic-labs-wallet/browser 1.0.80 → 1.0.81

package/index.cjs

@@ -2651,12 +2651,20 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
 }
 
 /**
- * Datadog event name emitted on every signed-session nonce rejection (a 400
- * from the backup/recovery endpoints). Log-only: lets us split the failure
+ * Datadog event name emitted on every signed-session nonce rejection (a 400 or
+ * 401 from the backup/recovery endpoints). Log-only: lets us split the failure
  * bucket by `reason` and measure the true per-wallet unrecoverable rate
  * without changing any retry behavior. See DYNT-1599.
  */ const NONCE_FAILURE_EVENT = 'waas.signed_session.nonce_failure';
-/** Best-effort extraction of the server error `code`/`message` from a 400 body. */ const readErrorBody = (error)=>{
+/**
+ * Reasons that represent a genuine session-key signature mismatch (the 401 the
+ * server returns per DYNT-1282). Used to gate 401 instrumentation so callers
+ * that reuse 401 for unrelated rejections don't pollute the failure metric.
+ */ const SESSION_SIGNATURE_FAILURE_REASONS = new Set([
+    'invalid_nonce_signature',
+    'invalid_session_signature'
+]);
+/** Best-effort extraction of the server error `code`/`message` from a 4xx body. */ const readErrorBody = (error)=>{
     var _error_response;
     if (!(error instanceof axios.AxiosError)) {
         return {};
@@ -2671,9 +2679,11 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
         return {};
     }
     const record = data;
-    // Prefer a string `code`, else fall back to a string `error`.
+    // Prefer a string `code`, else fall back to `error_code` (the field the Key
+    // Share Service emits, see KSS #271) or a bare `error`.
     const code = [
         record['code'],
+        record['error_code'],
         record['error']
     ].find((value)=>typeof value === 'string');
     const message = typeof record['message'] === 'string' ? record['message'] : undefined;
@@ -2690,6 +2700,9 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
     if (haystack.includes('invalid_nonce_signature') || haystack.includes('invalid nonce signature')) {
         return 'invalid_nonce_signature';
     }
+    if (haystack.includes('invalid_session_signature') || haystack.includes('invalid session public key') || haystack.includes('invalid session signature')) {
+        return 'invalid_session_signature';
+    }
     return 'other';
 };
 /**
@@ -2734,29 +2747,37 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
    */ refreshShouldRetry({ onRefreshed, operationName, logContext, alsoRetry }) {
         return async (error, attempt)=>{
             const status = getHttpStatus(error);
-            if (status === 400) {
-                const willRefresh = attempt === 1 && this.canRefresh && this.supportsReverseChannel();
+            // A 400 is a refreshable replay nonce; a 401 is a session-key mismatch the
+            // server returns to break the refresh loop (DYNT-1282) — logged only when the
+            // body classifies as a genuine session-signature failure so unrelated 401s
+            // (e.g. an exhausted add-signer grant) don't pollute the DYNT-1599 metric.
+            // Only the 400 can actually refresh.
+            const isSessionSignatureFailure = status === 401 && SESSION_SIGNATURE_FAILURE_REASONS.has(classifyNonceFailure(readErrorBody(error)));
+            const shouldInstrument = status === 400 || isSessionSignatureFailure;
+            if (shouldInstrument) {
+                const willRefresh = status === 400 && attempt === 1 && this.canRefresh && this.supportsReverseChannel();
                 this.instrumentNonceFailure({
                     error,
                     attempt,
+                    status,
                     operationName,
                     willRefresh,
                     logContext
                 });
-                if (attempt === 1 && this.canRefresh) {
-                    // canRefresh only proves a local callback exists, not that the host answers it.
-                    if (!this.supportsReverseChannel()) {
-                        this.logger.warn(`[${operationName}] host SDK version predates the signed-session reverse channel, declining nonce refresh`, _extends({
-                            status
-                        }, logContext));
-                        return alsoRetry ? alsoRetry(status) : false;
-                    }
-                    onRefreshed(await this.resolve());
-                    this.logger.info(`[${operationName}] refreshed signed session, retrying`, _extends({
+            }
+            if (status === 400 && attempt === 1 && this.canRefresh) {
+                // canRefresh only proves a local callback exists, not that the host answers it.
+                if (!this.supportsReverseChannel()) {
+                    this.logger.warn(`[${operationName}] host SDK version predates the signed-session reverse channel, declining nonce refresh`, _extends({
                         status
                     }, logContext));
-                    return true;
+                    return alsoRetry ? alsoRetry(status) : false;
                 }
+                onRefreshed(await this.resolve());
+                this.logger.info(`[${operationName}] refreshed signed session, retrying`, _extends({
+                    status
+                }, logContext));
+                return true;
             }
             return alsoRetry ? alsoRetry(status) : false;
         };
@@ -2765,12 +2786,12 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
    * Emits a single Datadog log per signed-session nonce rejection so the
    * failure bucket can be split by `reason` and correlated per wallet/request.
    * Purely observational — it never alters the retry decision.
-   */ instrumentNonceFailure({ error, attempt, operationName, willRefresh, logContext }) {
+   */ instrumentNonceFailure({ error, attempt, status, operationName, willRefresh, logContext }) {
         const body = readErrorBody(error);
         this.logger.info(NONCE_FAILURE_EVENT, _extends({}, logContext, {
             operationName,
             attempt,
-            status: 400,
+            status,
             reason: classifyNonceFailure(body),
             errorCode: body.code,
             errorMessage: body.message,

package/index.esm.js

@@ -2652,12 +2652,20 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
 }
 
 /**
- * Datadog event name emitted on every signed-session nonce rejection (a 400
- * from the backup/recovery endpoints). Log-only: lets us split the failure
+ * Datadog event name emitted on every signed-session nonce rejection (a 400 or
+ * 401 from the backup/recovery endpoints). Log-only: lets us split the failure
  * bucket by `reason` and measure the true per-wallet unrecoverable rate
  * without changing any retry behavior. See DYNT-1599.
  */ const NONCE_FAILURE_EVENT = 'waas.signed_session.nonce_failure';
-/** Best-effort extraction of the server error `code`/`message` from a 400 body. */ const readErrorBody = (error)=>{
+/**
+ * Reasons that represent a genuine session-key signature mismatch (the 401 the
+ * server returns per DYNT-1282). Used to gate 401 instrumentation so callers
+ * that reuse 401 for unrelated rejections don't pollute the failure metric.
+ */ const SESSION_SIGNATURE_FAILURE_REASONS = new Set([
+    'invalid_nonce_signature',
+    'invalid_session_signature'
+]);
+/** Best-effort extraction of the server error `code`/`message` from a 4xx body. */ const readErrorBody = (error)=>{
     var _error_response;
     if (!(error instanceof AxiosError)) {
         return {};
@@ -2672,9 +2680,11 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
         return {};
     }
     const record = data;
-    // Prefer a string `code`, else fall back to a string `error`.
+    // Prefer a string `code`, else fall back to `error_code` (the field the Key
+    // Share Service emits, see KSS #271) or a bare `error`.
     const code = [
         record['code'],
+        record['error_code'],
         record['error']
     ].find((value)=>typeof value === 'string');
     const message = typeof record['message'] === 'string' ? record['message'] : undefined;
@@ -2691,6 +2701,9 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
     if (haystack.includes('invalid_nonce_signature') || haystack.includes('invalid nonce signature')) {
         return 'invalid_nonce_signature';
     }
+    if (haystack.includes('invalid_session_signature') || haystack.includes('invalid session public key') || haystack.includes('invalid session signature')) {
+        return 'invalid_session_signature';
+    }
     return 'other';
 };
 /**
@@ -2735,29 +2748,37 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
    */ refreshShouldRetry({ onRefreshed, operationName, logContext, alsoRetry }) {
         return async (error, attempt)=>{
             const status = getHttpStatus(error);
-            if (status === 400) {
-                const willRefresh = attempt === 1 && this.canRefresh && this.supportsReverseChannel();
+            // A 400 is a refreshable replay nonce; a 401 is a session-key mismatch the
+            // server returns to break the refresh loop (DYNT-1282) — logged only when the
+            // body classifies as a genuine session-signature failure so unrelated 401s
+            // (e.g. an exhausted add-signer grant) don't pollute the DYNT-1599 metric.
+            // Only the 400 can actually refresh.
+            const isSessionSignatureFailure = status === 401 && SESSION_SIGNATURE_FAILURE_REASONS.has(classifyNonceFailure(readErrorBody(error)));
+            const shouldInstrument = status === 400 || isSessionSignatureFailure;
+            if (shouldInstrument) {
+                const willRefresh = status === 400 && attempt === 1 && this.canRefresh && this.supportsReverseChannel();
                 this.instrumentNonceFailure({
                     error,
                     attempt,
+                    status,
                     operationName,
                     willRefresh,
                     logContext
                 });
-                if (attempt === 1 && this.canRefresh) {
-                    // canRefresh only proves a local callback exists, not that the host answers it.
-                    if (!this.supportsReverseChannel()) {
-                        this.logger.warn(`[${operationName}] host SDK version predates the signed-session reverse channel, declining nonce refresh`, _extends({
-                            status
-                        }, logContext));
-                        return alsoRetry ? alsoRetry(status) : false;
-                    }
-                    onRefreshed(await this.resolve());
-                    this.logger.info(`[${operationName}] refreshed signed session, retrying`, _extends({
+            }
+            if (status === 400 && attempt === 1 && this.canRefresh) {
+                // canRefresh only proves a local callback exists, not that the host answers it.
+                if (!this.supportsReverseChannel()) {
+                    this.logger.warn(`[${operationName}] host SDK version predates the signed-session reverse channel, declining nonce refresh`, _extends({
                         status
                     }, logContext));
-                    return true;
+                    return alsoRetry ? alsoRetry(status) : false;
                 }
+                onRefreshed(await this.resolve());
+                this.logger.info(`[${operationName}] refreshed signed session, retrying`, _extends({
+                    status
+                }, logContext));
+                return true;
             }
             return alsoRetry ? alsoRetry(status) : false;
         };
@@ -2766,12 +2787,12 @@ function meetsMinVersion(sdkVersion, { minVersionByNamespace, fallbackMinVersion
    * Emits a single Datadog log per signed-session nonce rejection so the
    * failure bucket can be split by `reason` and correlated per wallet/request.
    * Purely observational — it never alters the retry decision.
-   */ instrumentNonceFailure({ error, attempt, operationName, willRefresh, logContext }) {
+   */ instrumentNonceFailure({ error, attempt, status, operationName, willRefresh, logContext }) {
         const body = readErrorBody(error);
         this.logger.info(NONCE_FAILURE_EVENT, _extends({}, logContext, {
             operationName,
             attempt,
-            status: 400,
+            status,
             reason: classifyNonceFailure(body),
             errorCode: body.code,
             errorMessage: body.message,

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@dynamic-labs-wallet/browser",
-  "version": "1.0.80",
+  "version": "1.0.81",
   "license": "Licensed under the Dynamic Labs, Inc. Terms Of Service (https://www.dynamic.xyz/terms-conditions)",
   "type": "module",
   "dependencies": {
-    "@dynamic-labs-wallet/core": "1.0.80",
+    "@dynamic-labs-wallet/core": "1.0.81",
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
-    "@dynamic-labs-wallet/primitives": "1.0.80",
+    "@dynamic-labs-wallet/primitives": "1.0.81",
     "@dynamic-labs/sdk-api-core": "^0.0.1083",
     "argon2id": "1.0.1",
     "axios": "1.16.0",

package/src/services/signedSession.d.ts

@@ -2,19 +2,21 @@ import type { ILogger } from '@dynamic-labs-wallet/core';
 /** Predicate matching `retryPromise`'s `shouldRetry` option. */
 type ShouldRetry = (error: unknown, attempt: number) => boolean | Promise<boolean>;
 /**
- * Datadog event name emitted on every signed-session nonce rejection (a 400
- * from the backup/recovery endpoints). Log-only: lets us split the failure
+ * Datadog event name emitted on every signed-session nonce rejection (a 400 or
+ * 401 from the backup/recovery endpoints). Log-only: lets us split the failure
  * bucket by `reason` and measure the true per-wallet unrecoverable rate
  * without changing any retry behavior. See DYNT-1599.
  */
 export declare const NONCE_FAILURE_EVENT = "waas.signed_session.nonce_failure";
 /**
  * Coarse cause of a signed-session nonce rejection. `invalid_nonce_signature`
- * (a bad/stale signing key) cannot be fixed by refreshing the nonce, whereas
- * `nonce_already_used` (a consumed replay nonce) can — so splitting them tells
- * us whether the refresh-and-retry path can actually help.
+ * and `invalid_session_signature` (a bad/stale signing key that diverged from
+ * the JWT-embedded session key — surfaced as a 401 since DYNT-1282) cannot be
+ * fixed by refreshing the nonce, whereas `nonce_already_used` (a consumed
+ * replay nonce, a 400) can — so splitting them tells us whether the
+ * refresh-and-retry path can actually help.
  */
-export type NonceFailureReason = 'invalid_nonce_signature' | 'nonce_already_used' | 'other';
+export type NonceFailureReason = 'invalid_nonce_signature' | 'invalid_session_signature' | 'nonce_already_used' | 'other';
 /** Maps the server error `code`/`message` onto a {@link NonceFailureReason}. */
 export declare const classifyNonceFailure: ({ code, message }: {
     code?: string;

package/src/services/signedSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signedSession.d.ts","sourceRoot":"","sources":["../../src/services/signedSession.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAIzD,gEAAgE;AAChE,KAAK,WAAW,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,sCAAsC,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,GAAG,oBAAoB,GAAG,OAAO,CAAC;AAqB5F,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,sBAAuB;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,kBAa7F,CAAC;AAEF;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4C;IAGxE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAU;gBAEtC,EACV,MAAM,EACN,UAAU,EACV,WAAW,GACZ,EAAE;QACD,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;KACxD;IAQD,+EAA+E;IAC/E,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;OAGG;IACG,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAaxD,uEAAuE;IACvE,UAAU,IAAI,OAAO;IAIrB,2GAA2G;IAC3G,sBAAsB,IAAI,OAAO;IAIjC;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EACjB,WAAW,EACX,aAAa,EACb,UAAU,EACV,SAAS,GACV,EAAE;QACD,WAAW,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;KACrD,GAAG,WAAW;IAyBf;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;CA6B/B"}
+{"version":3,"file":"signedSession.d.ts","sourceRoot":"","sources":["../../src/services/signedSession.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAIzD,gEAAgE;AAChE,KAAK,WAAW,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,sCAAsC,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAC1B,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,GACpB,OAAO,CAAC;AAkCZ,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,sBAAuB;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,kBAoB7F,CAAC;AAEF;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4C;IAGxE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAU;gBAEtC,EACV,MAAM,EACN,UAAU,EACV,WAAW,GACZ,EAAE;QACD,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;KACxD;IAQD,+EAA+E;IAC/E,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;OAGG;IACG,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAaxD,uEAAuE;IACvE,UAAU,IAAI,OAAO;IAIrB,2GAA2G;IAC3G,sBAAsB,IAAI,OAAO;IAIjC;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EACjB,WAAW,EACX,aAAa,EACb,UAAU,EACV,SAAS,GACV,EAAE;QACD,WAAW,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;KACrD,GAAG,WAAW;IAiCf;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;CA+B/B"}