@dynamic-labs-wallet/core 1.0.56 → 1.0.58

package/index.cjs

@@ -437,17 +437,17 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
         // 2-of-2 -> 2-of-2: same-parties refresh — server + rootUser-client both
         // call `reshareRemainingParty`. Share-set delegation lands here too; the
         // delegated share is delivered out-of-band, not via the MPC ceremony.
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
             return {
                 existingClientShareCount: 1,
                 newClientShareCount: 0,
                 existingServerShareCount: 1,
                 newServerShareCount: 0
             };
-        // 2-of-3 -> 2-of-3:
+        // 2-of-3 -> 2-of-3 and 2-of-2 -> 2-of-3:
         // -- dynamic server shares: 1 existing, 0 new
         // -- client shares: 1 existing, 1 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
             return {
                 existingClientShareCount: 1,
                 newClientShareCount: 1,
@@ -464,46 +464,16 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
                 existingServerShareCount: 2,
                 newServerShareCount: 0
             };
-        // 2-of-2 -> 2-of-3:
-        // -- dynamic server shares: 1 existing, 0 new
-        // -- client shares: 1 existing, 1 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
-            return {
-                existingClientShareCount: 1,
-                newClientShareCount: 1,
-                existingServerShareCount: 1,
-                newServerShareCount: 0
-            };
-        // 2-of-2 -> 3-of-5:
+        // 2-of-2 -> 3-of-5 and 2-of-3 -> 3-of-5:
         // -- dynamic server shares: 1 existing, 1 new
         // -- client shares: 1 existing, 2 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
             return {
                 existingClientShareCount: 1,
                 newClientShareCount: 2,
                 existingServerShareCount: 1,
                 newServerShareCount: 1
             };
-        // 2-of-3 -> 3-of-5:
-        // -- dynamic server shares: 1 existing, 1 new
-        // -- client shares: 1 existing, 2 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
-            return {
-                existingClientShareCount: 1,
-                newClientShareCount: 2,
-                existingServerShareCount: 1,
-                newServerShareCount: 1
-            };
-        // 2-of-3 -> 2-of-2:
-        // -- dynamic server shares: 1 existing, 0 new
-        // -- client shares: 1 existing, 0 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
-            return {
-                existingClientShareCount: 1,
-                newClientShareCount: 0,
-                existingServerShareCount: 1,
-                newServerShareCount: 0
-            };
         // 3-of-5 -> 2-of-3:
         // -- dynamic server shares: 1 existing, 0 new
         // -- client shares: 2 existing, 0 new
@@ -530,20 +500,20 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
  * }} The number of existing and new client and server shares needed
  */ const getServerWalletReshareConfig = ({ oldThresholdSignatureScheme, newThresholdSignatureScheme })=>{
     switch(true){
-        // 2-of-2 -> 2-of-2:
-        // -- dyanmic server shares: 1 existing, 0 new
+        // 2-of-2 -> 2-of-2 and 2-of-3 -> 2-of-2:
+        // -- dynamic server shares: 1 existing, 0 new
         // -- external server shares: 1 existing, 0 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
             return {
                 existingExternalServerShareCount: 1,
                 newExternalServerShareCount: 0,
                 existingDynamicServerShareCount: 1,
                 newDynamicServerShareCount: 0
             };
-        // 2-of-3 -> 2-of-3:
-        // -- dyanmic server shares: 1 existing, 0 new
+        // 2-of-3 -> 2-of-3 and 2-of-2 -> 2-of-3:
+        // -- dynamic server shares: 1 existing, 0 new
         // -- external server shares: 1 existing, 1 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
             return {
                 existingExternalServerShareCount: 1,
                 newExternalServerShareCount: 1,
@@ -551,7 +521,7 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
                 newDynamicServerShareCount: 0
             };
         // 3-of-5 -> 3-of-5:
-        // -- dyanmic server shares: 2 existing, 0 new
+        // -- dynamic server shares: 2 existing, 0 new
         // -- external server shares: 1 existing, 2 new
         case oldThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
             return {
@@ -560,46 +530,16 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
                 existingDynamicServerShareCount: 2,
                 newDynamicServerShareCount: 0
             };
-        // 2-of-2 -> 2-of-3:
-        // -- dyanmic server shares: 1 existing, 0 new
-        // -- external server shares: 1 existing, 1 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
-            return {
-                existingExternalServerShareCount: 1,
-                newExternalServerShareCount: 1,
-                existingDynamicServerShareCount: 1,
-                newDynamicServerShareCount: 0
-            };
-        // 2-of-2 -> 3-of-5:
-        // -- dyanmic server shares: 1 existing, 1 new
-        // -- external server shares: 1 existing, 2 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
-            return {
-                existingExternalServerShareCount: 1,
-                newExternalServerShareCount: 2,
-                existingDynamicServerShareCount: 1,
-                newDynamicServerShareCount: 1
-            };
-        // 2-of-3 -> 3-of-5:
-        // -- dyanmic server shares: 1 existing, 1 new
+        // 2-of-2 -> 3-of-5 and 2-of-3 -> 3-of-5:
+        // -- dynamic server shares: 1 existing, 1 new
         // -- external server shares: 1 existing, 2 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
             return {
                 existingExternalServerShareCount: 1,
                 newExternalServerShareCount: 2,
                 existingDynamicServerShareCount: 1,
                 newDynamicServerShareCount: 1
             };
-        // 2-of-3 -> 2-of-2:
-        // -- dyanmic server shares: 1 existing, 0 new
-        // -- external server shares: 1 existing, 0 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
-            return {
-                existingExternalServerShareCount: 1,
-                newExternalServerShareCount: 0,
-                existingDynamicServerShareCount: 1,
-                newDynamicServerShareCount: 0
-            };
         // 3-of-5 -> 2-of-3:
         // -- dyanmic server shares: 1 existing, 0 new
         // -- external server shares: 2 existing, 0 new
@@ -982,7 +922,7 @@ const getRequiredExternalKeyShareId = (ks)=>{
  * before it is posted and surfaces in Datadog exactly as the recovery path does.
  */ const assertDynamicLocationsHaveExternalKeyShareId = (locations)=>locations.filter((location)=>location.location === BackupLocation.DYNAMIC).forEach((location)=>getRequiredExternalKeyShareId(location));
 
-var version = "1.0.56";
+var version = "1.0.58";
 
 class BaseClient {
     /**
@@ -2150,6 +2090,33 @@ const serializeMessageForForwardMPC = ({ message, isFormatted = false, chainName
     return serializedMessage;
 };
 
+// Mirrors forward-mpc-client's ErrorCode values (the /utils subpath does not
+// export the ErrorCode const, so the codes are inlined here).
+const RECOVERED_CONNECTION_CHURN_CODES = new Set([
+    'CONNECTION_FAILED',
+    'CONNECTION_TIMEOUT',
+    'NOT_CONNECTED',
+    'TRANSPORT_CLOSED',
+    'HANDSHAKE_FAILED'
+]);
+/**
+ * Returns true when a classified Forward MPC error is recovered connection
+ * churn that should be logged at `warn` rather than `error`.
+ *
+ * The Forward MPC enclave is an optimization side-channel: the client retries
+ * connections internally, and `shouldFallback` is true for every Forward MPC
+ * failure mode — relay-based MPC is a fully functional safety net, so a
+ * connection-lifecycle failure never blocks a user operation on its own.
+ * Terminal failures (both paths failing) are logged at the operation sites.
+ *
+ * Churn covers rate-limited upgrades and the transport-lifecycle error codes
+ * (connect/reconnect failures, timeouts, socket closes, and handshake-request
+ * timeouts — production evidence shows these concentrate on hostile/flaky
+ * networks). Attestation failures, HANDSHAKE_INVALID_RESPONSE, SERVER_ERROR,
+ * and unclassified errors are NOT churn: they indicate enclave tampering or
+ * protocol breakage and must stay at `error` so monitors can page on them.
+ */ const isRecoveredForwardMpcConnectionChurn = (classification)=>classification.errorType === 'RATE_LIMITED' || classification.errorCode !== undefined && RECOVERED_CONNECTION_CHURN_CODES.has(classification.errorCode);
+
 /**
  * Normalizes an unknown thrown value into flat, log-friendly fields.
  *
@@ -2398,6 +2365,7 @@ exports.getVersionNamespace = getVersionNamespace;
 exports.getVersionWithoutNamespace = getVersionWithoutNamespace;
 exports.handleAxiosError = handleAxiosError;
 exports.isEvmCompatibleChain = isEvmCompatibleChain;
+exports.isRecoveredForwardMpcConnectionChurn = isRecoveredForwardMpcConnectionChurn;
 exports.parseNamespacedVersion = parseNamespacedVersion;
 exports.serializeError = serializeError;
 exports.serializeMessageForForwardMPC = serializeMessageForForwardMPC;

package/index.esm.js

@@ -437,17 +437,17 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
         // 2-of-2 -> 2-of-2: same-parties refresh — server + rootUser-client both
         // call `reshareRemainingParty`. Share-set delegation lands here too; the
         // delegated share is delivered out-of-band, not via the MPC ceremony.
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
             return {
                 existingClientShareCount: 1,
                 newClientShareCount: 0,
                 existingServerShareCount: 1,
                 newServerShareCount: 0
             };
-        // 2-of-3 -> 2-of-3:
+        // 2-of-3 -> 2-of-3 and 2-of-2 -> 2-of-3:
         // -- dynamic server shares: 1 existing, 0 new
         // -- client shares: 1 existing, 1 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
             return {
                 existingClientShareCount: 1,
                 newClientShareCount: 1,
@@ -464,46 +464,16 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
                 existingServerShareCount: 2,
                 newServerShareCount: 0
             };
-        // 2-of-2 -> 2-of-3:
-        // -- dynamic server shares: 1 existing, 0 new
-        // -- client shares: 1 existing, 1 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
-            return {
-                existingClientShareCount: 1,
-                newClientShareCount: 1,
-                existingServerShareCount: 1,
-                newServerShareCount: 0
-            };
-        // 2-of-2 -> 3-of-5:
+        // 2-of-2 -> 3-of-5 and 2-of-3 -> 3-of-5:
         // -- dynamic server shares: 1 existing, 1 new
         // -- client shares: 1 existing, 2 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
             return {
                 existingClientShareCount: 1,
                 newClientShareCount: 2,
                 existingServerShareCount: 1,
                 newServerShareCount: 1
             };
-        // 2-of-3 -> 3-of-5:
-        // -- dynamic server shares: 1 existing, 1 new
-        // -- client shares: 1 existing, 2 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
-            return {
-                existingClientShareCount: 1,
-                newClientShareCount: 2,
-                existingServerShareCount: 1,
-                newServerShareCount: 1
-            };
-        // 2-of-3 -> 2-of-2:
-        // -- dynamic server shares: 1 existing, 0 new
-        // -- client shares: 1 existing, 0 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
-            return {
-                existingClientShareCount: 1,
-                newClientShareCount: 0,
-                existingServerShareCount: 1,
-                newServerShareCount: 0
-            };
         // 3-of-5 -> 2-of-3:
         // -- dynamic server shares: 1 existing, 0 new
         // -- client shares: 2 existing, 0 new
@@ -530,20 +500,20 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
  * }} The number of existing and new client and server shares needed
  */ const getServerWalletReshareConfig = ({ oldThresholdSignatureScheme, newThresholdSignatureScheme })=>{
     switch(true){
-        // 2-of-2 -> 2-of-2:
-        // -- dyanmic server shares: 1 existing, 0 new
+        // 2-of-2 -> 2-of-2 and 2-of-3 -> 2-of-2:
+        // -- dynamic server shares: 1 existing, 0 new
         // -- external server shares: 1 existing, 0 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
             return {
                 existingExternalServerShareCount: 1,
                 newExternalServerShareCount: 0,
                 existingDynamicServerShareCount: 1,
                 newDynamicServerShareCount: 0
             };
-        // 2-of-3 -> 2-of-3:
-        // -- dyanmic server shares: 1 existing, 0 new
+        // 2-of-3 -> 2-of-3 and 2-of-2 -> 2-of-3:
+        // -- dynamic server shares: 1 existing, 0 new
         // -- external server shares: 1 existing, 1 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
             return {
                 existingExternalServerShareCount: 1,
                 newExternalServerShareCount: 1,
@@ -551,7 +521,7 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
                 newDynamicServerShareCount: 0
             };
         // 3-of-5 -> 3-of-5:
-        // -- dyanmic server shares: 2 existing, 0 new
+        // -- dynamic server shares: 2 existing, 0 new
         // -- external server shares: 1 existing, 2 new
         case oldThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
             return {
@@ -560,46 +530,16 @@ const getDynamicServerThreshold = (thresholdSignatureScheme)=>{
                 existingDynamicServerShareCount: 2,
                 newDynamicServerShareCount: 0
             };
-        // 2-of-2 -> 2-of-3:
-        // -- dyanmic server shares: 1 existing, 0 new
-        // -- external server shares: 1 existing, 1 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE:
-            return {
-                existingExternalServerShareCount: 1,
-                newExternalServerShareCount: 1,
-                existingDynamicServerShareCount: 1,
-                newDynamicServerShareCount: 0
-            };
-        // 2-of-2 -> 3-of-5:
-        // -- dyanmic server shares: 1 existing, 1 new
-        // -- external server shares: 1 existing, 2 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
-            return {
-                existingExternalServerShareCount: 1,
-                newExternalServerShareCount: 2,
-                existingDynamicServerShareCount: 1,
-                newDynamicServerShareCount: 1
-            };
-        // 2-of-3 -> 3-of-5:
-        // -- dyanmic server shares: 1 existing, 1 new
+        // 2-of-2 -> 3-of-5 and 2-of-3 -> 3-of-5:
+        // -- dynamic server shares: 1 existing, 1 new
         // -- external server shares: 1 existing, 2 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
+        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE || oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.THREE_OF_FIVE:
             return {
                 existingExternalServerShareCount: 1,
                 newExternalServerShareCount: 2,
                 existingDynamicServerShareCount: 1,
                 newDynamicServerShareCount: 1
             };
-        // 2-of-3 -> 2-of-2:
-        // -- dyanmic server shares: 1 existing, 0 new
-        // -- external server shares: 1 existing, 0 new
-        case oldThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_THREE && newThresholdSignatureScheme === ThresholdSignatureScheme.TWO_OF_TWO:
-            return {
-                existingExternalServerShareCount: 1,
-                newExternalServerShareCount: 0,
-                existingDynamicServerShareCount: 1,
-                newDynamicServerShareCount: 0
-            };
         // 3-of-5 -> 2-of-3:
         // -- dyanmic server shares: 1 existing, 0 new
         // -- external server shares: 2 existing, 0 new
@@ -982,7 +922,7 @@ const getRequiredExternalKeyShareId = (ks)=>{
  * before it is posted and surfaces in Datadog exactly as the recovery path does.
  */ const assertDynamicLocationsHaveExternalKeyShareId = (locations)=>locations.filter((location)=>location.location === BackupLocation.DYNAMIC).forEach((location)=>getRequiredExternalKeyShareId(location));
 
-var version = "1.0.56";
+var version = "1.0.58";
 
 class BaseClient {
     /**
@@ -2150,6 +2090,33 @@ const serializeMessageForForwardMPC = ({ message, isFormatted = false, chainName
     return serializedMessage;
 };
 
+// Mirrors forward-mpc-client's ErrorCode values (the /utils subpath does not
+// export the ErrorCode const, so the codes are inlined here).
+const RECOVERED_CONNECTION_CHURN_CODES = new Set([
+    'CONNECTION_FAILED',
+    'CONNECTION_TIMEOUT',
+    'NOT_CONNECTED',
+    'TRANSPORT_CLOSED',
+    'HANDSHAKE_FAILED'
+]);
+/**
+ * Returns true when a classified Forward MPC error is recovered connection
+ * churn that should be logged at `warn` rather than `error`.
+ *
+ * The Forward MPC enclave is an optimization side-channel: the client retries
+ * connections internally, and `shouldFallback` is true for every Forward MPC
+ * failure mode — relay-based MPC is a fully functional safety net, so a
+ * connection-lifecycle failure never blocks a user operation on its own.
+ * Terminal failures (both paths failing) are logged at the operation sites.
+ *
+ * Churn covers rate-limited upgrades and the transport-lifecycle error codes
+ * (connect/reconnect failures, timeouts, socket closes, and handshake-request
+ * timeouts — production evidence shows these concentrate on hostile/flaky
+ * networks). Attestation failures, HANDSHAKE_INVALID_RESPONSE, SERVER_ERROR,
+ * and unclassified errors are NOT churn: they indicate enclave tampering or
+ * protocol breakage and must stay at `error` so monitors can page on them.
+ */ const isRecoveredForwardMpcConnectionChurn = (classification)=>classification.errorType === 'RATE_LIMITED' || classification.errorCode !== undefined && RECOVERED_CONNECTION_CHURN_CODES.has(classification.errorCode);
+
 /**
  * Normalizes an unknown thrown value into flat, log-friendly fields.
  *
@@ -2297,4 +2264,4 @@ const handleAxiosError = (error, message, context, _logger)=>{
     throw new WalletApiError(resolvedStatus, STATUS_MESSAGES[resolvedStatus]);
 };
 
-export { AuthMode, BITCOIN_ADDRESS_TYPE_CONFIG, BITCOIN_DERIVATION_PATHS, BROWSER_SDK_ROUTE_PREFIX, BackupLocation, BitcoinAddressType, BitcoinNetwork, BusinessAccountClient, BusinessAccountMemberRole, BusinessAccountSignerType, CreateRoomPartiesOptions, DELEGATED_SHARE_COUNT, DYNAMIC_AUTH_BASE_API_URL_MAP, DYNAMIC_AUTH_DEV_BASE_API_URL, DYNAMIC_AUTH_PREPROD_BASE_API_URL, DYNAMIC_AUTH_PROD_BASE_API_URL, DYNAMIC_CLIENT_RELAY_REDCOAST_API_KEY_MAP, DYNAMIC_CLIENT_RELAY_REDCOAST_APP_ID_MAP, DYNAMIC_FORWARD_MPC_DEV_ENCLAVE_URL, DYNAMIC_FORWARD_MPC_ENCLAVE_ATTESTATION_CONFIG_MAP, DYNAMIC_FORWARD_MPC_ENCLAVE_URL_MAP, DYNAMIC_FORWARD_MPC_PREPROD_ENCLAVE_URL, DYNAMIC_FORWARD_MPC_PROD_ENCLAVE_URL, DYNAMIC_KEYSHARES_RELAY_MAP, DYNAMIC_KEYSHARES_RELAY_PREPROD_BASE_API_URL, DYNAMIC_KEYSHARES_RELAY_PROD_BASE_API_URL, DynamicApiClient, DynamicClientSessionSignature, DynamicElevatedAccessTokenHeader, DynamicForwardMPCHeader, DynamicMfaTokenHeader, DynamicRequestIdHeader, DynamicSessionPublicKeyHeader, DynamicTraceElapsedTimeHeader, DynamicTraceIdHeader, ENCRYPTED_SHARES_STORAGE_SUFFIX, ENVIRONMENT_ENUM, EVM_COMPATIBLE_CHAINS, FEATURE_FLAGS, IFRAME_DOMAIN_MAP, Logger, MIDNIGHT_DERIVATION_PATHS, MPC_CHAIN_CONFIG, MPC_CONFIG, MPC_RELAY_DEV_API_URL, MPC_RELAY_PREPROD_API_URL, MPC_RELAY_PROD_API_URL, MPC_RELAY_URL_MAP, NoopLogger, PREPROD_RELAY_API_KEY, PREPROD_RELAY_APP_ID, PROD_RELAY_API_KEY, PROD_RELAY_APP_ID, RELAY_API_KEY_HEADER, RELAY_APP_ID_HEADER, SDK_NAMESPACE, SERVER_SDK_ROUTE_PREFIX, SOLANA_RPC_URL, SuccessEventType, ThresholdSignatureScheme, URL_PATTERNS, WalletApiError, WalletOperation, WalletReadyState, assertDynamicLocationsHaveExternalKeyShareId, chain, chainEnumToVerifiedCredentialName, formatNamespacedVersion, getBitcoinChainConfig, getClientThreshold, getDynamicServerThreshold, getEnvironmentFromUrl, getMPCChainConfig, getRequiredExternalKeyShareId, getReshareConfig, getServerWalletReshareConfig, getTSSConfig, getVersionNamespace, getVersionWithoutNamespace, handleAxiosError, isEvmCompatibleChain, parseNamespacedVersion, serializeError, serializeMessageForForwardMPC, verifiedCredentialNameToChainEnum };
+export { AuthMode, BITCOIN_ADDRESS_TYPE_CONFIG, BITCOIN_DERIVATION_PATHS, BROWSER_SDK_ROUTE_PREFIX, BackupLocation, BitcoinAddressType, BitcoinNetwork, BusinessAccountClient, BusinessAccountMemberRole, BusinessAccountSignerType, CreateRoomPartiesOptions, DELEGATED_SHARE_COUNT, DYNAMIC_AUTH_BASE_API_URL_MAP, DYNAMIC_AUTH_DEV_BASE_API_URL, DYNAMIC_AUTH_PREPROD_BASE_API_URL, DYNAMIC_AUTH_PROD_BASE_API_URL, DYNAMIC_CLIENT_RELAY_REDCOAST_API_KEY_MAP, DYNAMIC_CLIENT_RELAY_REDCOAST_APP_ID_MAP, DYNAMIC_FORWARD_MPC_DEV_ENCLAVE_URL, DYNAMIC_FORWARD_MPC_ENCLAVE_ATTESTATION_CONFIG_MAP, DYNAMIC_FORWARD_MPC_ENCLAVE_URL_MAP, DYNAMIC_FORWARD_MPC_PREPROD_ENCLAVE_URL, DYNAMIC_FORWARD_MPC_PROD_ENCLAVE_URL, DYNAMIC_KEYSHARES_RELAY_MAP, DYNAMIC_KEYSHARES_RELAY_PREPROD_BASE_API_URL, DYNAMIC_KEYSHARES_RELAY_PROD_BASE_API_URL, DynamicApiClient, DynamicClientSessionSignature, DynamicElevatedAccessTokenHeader, DynamicForwardMPCHeader, DynamicMfaTokenHeader, DynamicRequestIdHeader, DynamicSessionPublicKeyHeader, DynamicTraceElapsedTimeHeader, DynamicTraceIdHeader, ENCRYPTED_SHARES_STORAGE_SUFFIX, ENVIRONMENT_ENUM, EVM_COMPATIBLE_CHAINS, FEATURE_FLAGS, IFRAME_DOMAIN_MAP, Logger, MIDNIGHT_DERIVATION_PATHS, MPC_CHAIN_CONFIG, MPC_CONFIG, MPC_RELAY_DEV_API_URL, MPC_RELAY_PREPROD_API_URL, MPC_RELAY_PROD_API_URL, MPC_RELAY_URL_MAP, NoopLogger, PREPROD_RELAY_API_KEY, PREPROD_RELAY_APP_ID, PROD_RELAY_API_KEY, PROD_RELAY_APP_ID, RELAY_API_KEY_HEADER, RELAY_APP_ID_HEADER, SDK_NAMESPACE, SERVER_SDK_ROUTE_PREFIX, SOLANA_RPC_URL, SuccessEventType, ThresholdSignatureScheme, URL_PATTERNS, WalletApiError, WalletOperation, WalletReadyState, assertDynamicLocationsHaveExternalKeyShareId, chain, chainEnumToVerifiedCredentialName, formatNamespacedVersion, getBitcoinChainConfig, getClientThreshold, getDynamicServerThreshold, getEnvironmentFromUrl, getMPCChainConfig, getRequiredExternalKeyShareId, getReshareConfig, getServerWalletReshareConfig, getTSSConfig, getVersionNamespace, getVersionWithoutNamespace, handleAxiosError, isEvmCompatibleChain, isRecoveredForwardMpcConnectionChurn, parseNamespacedVersion, serializeError, serializeMessageForForwardMPC, verifiedCredentialNameToChainEnum };

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@dynamic-labs-wallet/core",
-  "version": "1.0.56",
+  "version": "1.0.58",
   "license": "MIT",
   "type": "module",
   "dependencies": {
     "@dynamic-labs/sdk-api-core": "^0.0.984",
-    "@dynamic-labs-wallet/primitives": "1.0.56",
+    "@dynamic-labs-wallet/primitives": "1.0.58",
     "axios": "1.16.0",
     "uuid": "11.1.0"
   },

package/src/mpc/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/mpc/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,wBAAwB,EAA+B,MAAM,gBAAgB,CAAC;AACrH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAErE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,gBACnB,kBAAkB,KAC9B;IAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,gBAAgB,CAAA;CAQhE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,cAAe,MAAM,kBAAkB,aAAa;oBAhB7D,MAAM,EAAE;sBAAoB,gBAAgB;CA+BhE,CAAC;AAEF,eAAO,MAAM,YAAY,6BAA8B,wBAAwB;;;CAG9E,CAAC;AAEF,eAAO,MAAM,kBAAkB,6BAA8B,wBAAwB,WAEpF,CAAC;AAEF,eAAO,MAAM,yBAAyB,6BAA8B,wBAAwB,WAE3F,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,kEAG1B;IACD,2BAA2B,EAAE,wBAAwB,CAAC;IACtD,2BAA2B,EAAE,wBAAwB,CAAC;IAGtD,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC,KAAG;IACF,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;CAsG7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,kEAGtC;IACD,2BAA2B,EAAE,wBAAwB,CAAC;IACtD,2BAA2B,EAAE,wBAAwB,CAAC;CACvD,KAAG;IACF,gCAAgC,EAAE,MAAM,CAAC;IACzC,2BAA2B,EAAE,MAAM,CAAC;IACpC,+BAA+B,EAAE,MAAM,CAAC;IACxC,0BAA0B,EAAE,MAAM,CAAC;CAsGpC,CAAC;AAEF,eAAO,MAAM,YAAY;;;;CAIxB,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAWpE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/mpc/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,wBAAwB,EAA+B,MAAM,gBAAgB,CAAC;AACrH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAErE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,gBACnB,kBAAkB,KAC9B;IAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,gBAAgB,CAAA;CAQhE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,cAAe,MAAM,kBAAkB,aAAa;oBAhB7D,MAAM,EAAE;sBAAoB,gBAAgB;CA+BhE,CAAC;AAEF,eAAO,MAAM,YAAY,6BAA8B,wBAAwB;;;CAG9E,CAAC;AAEF,eAAO,MAAM,kBAAkB,6BAA8B,wBAAwB,WAEpF,CAAC;AAEF,eAAO,MAAM,yBAAyB,6BAA8B,wBAAwB,WAE3F,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,kEAG1B;IACD,2BAA2B,EAAE,wBAAwB,CAAC;IACtD,2BAA2B,EAAE,wBAAwB,CAAC;IAGtD,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC,KAAG;IACF,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;CAwE7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,kEAGtC;IACD,2BAA2B,EAAE,wBAAwB,CAAC;IACtD,2BAA2B,EAAE,wBAAwB,CAAC;CACvD,KAAG;IACF,gCAAgC,EAAE,MAAM,CAAC;IACzC,2BAA2B,EAAE,MAAM,CAAC;IACpC,+BAA+B,EAAE,MAAM,CAAC;IACxC,0BAA0B,EAAE,MAAM,CAAC;CAwEpC,CAAC;AAEF,eAAO,MAAM,YAAY;;;;CAIxB,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAWpE"}

package/src/utils/forwardMpcErrorHandling.d.ts

@@ -1,7 +1,26 @@
+import type { ForwardMpcErrorClassification } from '@dynamic-labs-wallet/forward-mpc-client/utils';
 /**
  * Re-export error classification utilities from forward-mpc-client.
  * These utilities help standardize Forward MPC error handling across the SDK.
  */
 export { classifyForwardMpcError, isForwardMpcError, isAttestationError, } from '@dynamic-labs-wallet/forward-mpc-client/utils';
 export type { ForwardMpcErrorType, ForwardMpcErrorClassification } from '@dynamic-labs-wallet/forward-mpc-client/utils';
+/**
+ * Returns true when a classified Forward MPC error is recovered connection
+ * churn that should be logged at `warn` rather than `error`.
+ *
+ * The Forward MPC enclave is an optimization side-channel: the client retries
+ * connections internally, and `shouldFallback` is true for every Forward MPC
+ * failure mode — relay-based MPC is a fully functional safety net, so a
+ * connection-lifecycle failure never blocks a user operation on its own.
+ * Terminal failures (both paths failing) are logged at the operation sites.
+ *
+ * Churn covers rate-limited upgrades and the transport-lifecycle error codes
+ * (connect/reconnect failures, timeouts, socket closes, and handshake-request
+ * timeouts — production evidence shows these concentrate on hostile/flaky
+ * networks). Attestation failures, HANDSHAKE_INVALID_RESPONSE, SERVER_ERROR,
+ * and unclassified errors are NOT churn: they indicate enclave tampering or
+ * protocol breakage and must stay at `error` so monitors can page on them.
+ */
+export declare const isRecoveredForwardMpcConnectionChurn: (classification: ForwardMpcErrorClassification) => boolean;
 //# sourceMappingURL=forwardMpcErrorHandling.d.ts.map

package/src/utils/forwardMpcErrorHandling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forwardMpcErrorHandling.d.ts","sourceRoot":"","sources":["../../src/utils/forwardMpcErrorHandling.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AAEvD,YAAY,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"forwardMpcErrorHandling.d.ts","sourceRoot":"","sources":["../../src/utils/forwardMpcErrorHandling.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAEnG;;;GAGG;AACH,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AAEvD,YAAY,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAYxH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oCAAoC,mBAAoB,6BAA6B,KAAG,OAEO,CAAC"}