@meshconnect/uwc-core 1.10.3 → 2.0.0

package/src/services/connection-service.ts

@@ -22,10 +22,23 @@ export interface ServiceOptions {
   signal?: AbortSignal
 }
 
+/** Sibling-namespace live-account re-read poll: absorbs the lag while a wallet
+ *  re-derives a sibling namespace's address (e.g. MetaMask's Solana Snap) after
+ *  an account switch on another namespace. Bounded so a genuinely-unchanged
+ *  sibling gives up quickly. */
+export const SIBLING_REFRESH_MAX_ATTEMPTS = 5
+export const SIBLING_REFRESH_DELAY_MS = 200
+
 export class ConnectionService {
   private activeConnector: Connector | null = null
   /** Tears down the post-connect lifecycle subscription; set while connected. */
   private lifecycleTeardown: (() => void) | undefined
+  /**
+   * Teardowns for the accounts-sync attachments of the session's SECONDARY
+   * namespaces (see `attachSecondaryAccountSync`); set while connected,
+   * cleared together with `lifecycleTeardown`.
+   */
+  private secondaryAccountSyncTeardowns: Array<() => void> = []
   /**
    * Abort handle for the CURRENT in-flight connect attempt. A re-entrant
    * connect() aborts this before starting, so a superseded attempt's URI poll
@@ -34,6 +47,13 @@ export class ConnectionService {
    * each reading the shared activeConnector, and flood telemetry).
    */
   private inFlightAbort: AbortController | null = null
+  /**
+   * Monotonic token for the in-flight cross-namespace sibling refresh (see
+   * `refreshSiblingNamespaces`). A newer account switch, a teardown, or a
+   * disconnect bumps it so a still-polling older refresh aborts before it
+   * writes a now-stale sibling address into the session.
+   */
+  private siblingRefreshGeneration = 0
 
   constructor(
     private networks: Network[],
@@ -200,6 +220,11 @@ export class ConnectionService {
     // disconnect, expiry) from the live provider — telemetry only, never changes
     // connection behaviour. Torn down on disconnect.
     this.attachLifecycle(connectionMode, wallet.id, network.namespace)
+    this.attachSecondaryAccountSync(
+      connectionMode,
+      wallet.id,
+      network.namespace
+    )
   }
 
   /** Wire the active connector's lifecycle stream onto the bus (or signal absence). */
@@ -207,7 +232,7 @@ export class ConnectionService {
     connectionMode: ConnectionMode,
     walletId: string,
     namespace: Namespace,
-    initialSwitch?: { chainId: NetworkId; at: number }
+    initialSwitch?: { chainId: NetworkId; address?: string; at: number }
   ): void {
     this.teardownLifecycle()
     const connector = this.activeConnector
@@ -227,6 +252,16 @@ export class ConnectionService {
               walletId
             })
         : undefined,
+      subscribeAccounts: connector?.onAccountsChanged
+        ? listener =>
+            connector.onAccountsChanged!(listener, {
+              connectionMode,
+              namespace,
+              walletId
+            })
+        : undefined,
+      onAccountsChanged: accounts =>
+        this.handleAccountsChanged(accounts, namespace),
       getRouting: () => {
         const s = this.sessionManager.getSession()
         return {
@@ -249,6 +284,71 @@ export class ConnectionService {
     })
   }
 
+  /**
+   * Apply a REAL account-list change (from `Connector.onAccountsChanged`, via
+   * the lifecycle bridge's second stream) to the session. `namespace` is the
+   * namespace of the provider that reported the change — `activeAddress`
+   * only moves when that matches the session's currently active network; an
+   * empty list is a full, wallet-initiated disconnect.
+   */
+  private handleAccountsChanged(
+    accounts: string[],
+    namespace: Namespace
+  ): void {
+    if (accounts.length === 0) {
+      // Idempotency guard: this runs synchronously FROM INSIDE the
+      // connector's own accountsChanged dispatch — finishDisconnect() below
+      // tears down (among other things) the very subscription that is
+      // currently delivering this callback. If a wallet double-fires the
+      // empty-array disconnect signal (or one slips through before teardown
+      // takes effect), `activeConnector` is already null from the first call
+      // — skip re-clearing an already-cleared session and re-emitting
+      // disconnected/sessionChanged a second time. Scoped to THIS wallet-
+      // initiated path only; the public disconnect() below still always
+      // runs finishDisconnect() defensively, even with no active connector.
+      if (this.activeConnector === null) return
+      // The wallet ended the session on its own side, but the connector's
+      // OWN local state (e.g. EthereumWalletService's cached account/
+      // provider/uuid) is never cleared by finishDisconnect() below — it
+      // only clears core's sessionManager. Left uncleared, a later connect
+      // to a DIFFERENT wallet reads that stale cached account via
+      // checkExistingConnections() and never rebinds to the new wallet's
+      // provider/uuid, silently keeping the old wallet's address live under
+      // the new wallet's session. disconnect() is fire-and-forget and
+      // error-swallowed here: for injected connectors it's local-only
+      // cleanup (safe to call any number of times), and for protocol-based
+      // connectors that might reject on an already-closed session, there is
+      // no caller to propagate that error to anyway.
+      this.activeConnector?.disconnect?.().catch(() => {})
+      this.finishDisconnect()
+      return
+    }
+    const newAddress = accounts[0]!
+    const session = this.sessionManager.getSession()
+    const availableAddresses = session.availableAddresses.map(addr => {
+      const network = this.networks.find(n => n.id === addr.networkId)
+      return network?.namespace === namespace
+        ? { ...addr, address: newAddress }
+        : addr
+    })
+    const activeAddress =
+      session.activeNetwork?.namespace === namespace
+        ? newAddress
+        : session.activeAddress
+    this.sessionManager.updateSession({ activeAddress, availableAddresses })
+    this.eventManager.emit('sessionChanged', {
+      session: this.sessionManager.getSession()
+    })
+
+    // A single wallet account drives ALL its namespaces (e.g. MetaMask's Solana
+    // Snap derives its key from the selected EVM account). The wallet only fired
+    // an accountsChanged for THIS namespace; refresh the live account of every
+    // other connected namespace so the session doesn't serve a stale sibling
+    // address. Fire-and-forget: we're inside the wallet's synchronous event
+    // dispatch and must not await.
+    void this.refreshSiblingNamespaces(namespace)
+  }
+
   /**
    * Remove the active provider-lifecycle subscription (EIP-1193 `.on` / wallet-
    * adapter / SignClient listeners) WITHOUT disconnecting the wallet. Idempotent.
@@ -259,6 +359,13 @@ export class ConnectionService {
   teardownLifecycle(): void {
     this.lifecycleTeardown?.()
     this.lifecycleTeardown = undefined
+    for (const teardown of this.secondaryAccountSyncTeardowns) teardown()
+    this.secondaryAccountSyncTeardowns = []
+    // Supersede any in-flight sibling-namespace refresh (see
+    // `refreshSiblingNamespaces`) — a still-polling refresh must not write a
+    // now-stale address after teardown/disconnect. `finishDisconnect()` calls
+    // this too, so one bump here covers both paths.
+    this.siblingRefreshGeneration++
   }
 
   /**
@@ -283,11 +390,286 @@ export class ConnectionService {
       session.connectionMode,
       session.activeWallet.id,
       session.activeNetwork.namespace,
-      // The reattach follows a JUST-completed switch to the now-active chain —
-      // arm echo suppression for it so the new provider's echo isn't mistaken
-      // for a wallet-initiated change (one-shot, same as bus-armed switches).
-      { chainId: session.activeNetwork.id, at: Date.now() }
+      // The reattach follows a JUST-completed switch to the now-active chain
+      // (and address) — arm echo suppression for both so the new provider's
+      // echo isn't mistaken for a wallet-initiated change (one-shot, same as
+      // bus-armed switches).
+      {
+        chainId: session.activeNetwork.id,
+        ...(session.activeAddress && { address: session.activeAddress }),
+        at: Date.now()
+      }
+    )
+    // Re-derive the secondary set against the NOW-active namespace — a
+    // cross-namespace switch swaps which namespace is "secondary" (the
+    // attachLifecycle above already tore the previous set down via
+    // teardownLifecycle).
+    this.attachSecondaryAccountSync(
+      session.connectionMode,
+      session.activeWallet.id,
+      session.activeNetwork.namespace
+    )
+  }
+
+  /**
+   * Attach account-sync for every OTHER namespace the session's
+   * `availableAddresses` span. `attachLifecycle` observes only the ACTIVE
+   * network's namespace, but the cross-namespace gather seeds addresses from
+   * other namespaces' live surfaces at connect time — without their own
+   * subscription, a wallet-side account switch on such a namespace is never
+   * observed and the session serves the connect-time addresses forever (e.g.
+   * a Solana-active MetaMask session whose eip155 addresses never follow the
+   * extension's account switch).
+   *
+   * Accounts-sync ONLY, no lifecycle-telemetry stream: the active namespace
+   * stays the single source of wallet* telemetry and of the wallet-initiated
+   * disconnect signal.
+   */
+  private attachSecondaryAccountSync(
+    connectionMode: ConnectionMode,
+    walletId: string,
+    activeNamespace: Namespace
+  ): void {
+    const connector = this.activeConnector
+    if (!connector?.onAccountsChanged) return
+
+    const session = this.sessionManager.getSession()
+    const secondaryNamespaces = new Set<Namespace>()
+    for (const addr of session.availableAddresses) {
+      const namespace = this.networks.find(
+        n => n.id === addr.networkId
+      )?.namespace
+      if (namespace && namespace !== activeNamespace) {
+        secondaryNamespaces.add(namespace)
+      }
+    }
+
+    const runtime =
+      (globalThis as { UWCBridgeChildInitialized?: boolean })
+        .UWCBridgeChildInitialized === true
+        ? ('iframe' as const)
+        : ('direct' as const)
+
+    for (const namespace of secondaryNamespaces) {
+      this.secondaryAccountSyncTeardowns.push(
+        attachLifecycle({
+          eventManager: this.eventManager,
+          subscribe: undefined,
+          subscribeAccounts: listener =>
+            connector.onAccountsChanged!(listener, {
+              connectionMode,
+              namespace,
+              walletId
+            }),
+          onAccountsChanged: accounts => {
+            // An empty list from a SECONDARY namespace is USUALLY just that
+            // namespace's own de-auth, not the whole session — so we don't
+            // clobber the session on a partial change. BUT some wallets emit a
+            // disconnect ONLY on a secondary namespace: e.g. MetaMask (EVM +
+            // Solana Snap) fires `accountsChanged([])` on its eip155 leg but its
+            // Snap-derived active (solana) namespace emits nothing on a full
+            // wallet disconnect. Relying on the active namespace's stream alone
+            // then never sees the disconnect. So on a secondary empty, verify
+            // whether the wallet is FULLY gone (active namespace has no live
+            // account either) and, if so, clear the session.
+            if (accounts.length === 0) {
+              void this.clearSessionIfWalletFullyDisconnected(
+                activeNamespace,
+                connectionMode,
+                walletId
+              )
+              return
+            }
+            // Surface the secondary-namespace switch for observability. The
+            // ACTIVE namespace's switch already emits `walletAccountChanged` via
+            // the lifecycle bridge; secondary namespaces have accounts-sync only
+            // (no lifecycle stream), so emit it here for parity → `uwcObserver`
+            // forwards it to RUM as `uwc.walletAccountChanged`. Secondary-only,
+            // so it never double-counts the active namespace's emit.
+            this.eventManager.emit('walletAccountChanged', {
+              connectionMode,
+              walletId,
+              namespace
+            })
+            this.handleAccountsChanged(accounts, namespace)
+          },
+          getRouting: () => ({ connectionMode, walletId, namespace }),
+          connectionMode,
+          walletId,
+          namespace,
+          runtime
+        })
+      )
+    }
+  }
+
+  /**
+   * A SECONDARY namespace just reported an empty account list. Determine whether
+   * this is a full wallet-initiated disconnect (vs. only that namespace losing
+   * authorization) by reading the ACTIVE namespace's LIVE account: if it's also
+   * gone, the whole wallet disconnected — clear the session via the active
+   * namespace's empty-list path. If the active namespace still has an account
+   * (a genuine partial change) or we can't tell, keep the conservative no-op.
+   *
+   * Motivating case: MetaMask's Solana-Snap active namespace emits no disconnect
+   * signal, while its eip155 (secondary) leg does — so the secondary empty is the
+   * only signal the wallet is gone.
+   */
+  private async clearSessionIfWalletFullyDisconnected(
+    activeNamespace: Namespace,
+    connectionMode: ConnectionMode,
+    walletId: string
+  ): Promise<void> {
+    const connector = this.activeConnector
+    // Already torn down, or the connector can't report a live account — keep the
+    // conservative no-op (never risk a spurious disconnect).
+    if (!connector?.getLiveAccount) return
+    // The active namespace must still be the one we captured; a switch/teardown
+    // in flight supersedes this check.
+    if (
+      this.sessionManager.getSession().activeNetwork?.namespace !==
+      activeNamespace
+    ) {
+      return
+    }
+    let liveActiveAccount: string | null
+    try {
+      liveActiveAccount = await connector.getLiveAccount(activeNamespace)
+    } catch {
+      return
+    }
+    // Active namespace still connected → genuine partial change → leave session.
+    if (liveActiveAccount) return
+    // Re-check the connector is still live after the await (guards a race with a
+    // concurrent teardown/disconnect that already cleared it).
+    if (this.activeConnector === null) return
+    // Surface the wallet-initiated disconnect for observability BEFORE clearing:
+    // the active namespace here emits no disconnect of its own (that's the whole
+    // reason we detect it from a secondary namespace), so without this the
+    // `walletDisconnected` telemetry the observer forwards to RUM would never
+    // fire for these wallets. Mirrors the lifecycle-bridge's emit for wallets
+    // whose active namespace DOES signal a disconnect.
+    this.eventManager.emit('walletDisconnected', {
+      connectionMode,
+      walletId,
+      namespace: activeNamespace
+    })
+    // Whole wallet is gone → run the wallet-initiated disconnect path.
+    this.handleAccountsChanged([], activeNamespace)
+  }
+
+  /**
+   * After a real account switch on `changedNamespace`, re-read the LIVE account
+   * of every OTHER connected namespace and fold any that changed into the
+   * session in ONE update. Sibling namespaces (e.g. a MetaMask Solana Snap
+   * address derived from the EVM account) change with the underlying account but
+   * emit no `accountsChanged`, and their live read can LAG the firing namespace's
+   * event while the wallet re-derives — so poll each sibling up to
+   * `SIBLING_REFRESH_MAX_ATTEMPTS` times, `SIBLING_REFRESH_DELAY_MS` apart,
+   * stopping a sibling the moment its live address differs from the stored one.
+   *
+   * Loop-safe: writes addresses DIRECTLY via the session manager (never
+   * re-dispatches a per-namespace accountsChanged), and only emits when at least
+   * one sibling actually changed — so refreshing B here cannot re-enter this for
+   * A and recurse. Generation-guarded so a newer switch / teardown / disconnect
+   * supersedes an older still-polling refresh before it writes.
+   */
+  private async refreshSiblingNamespaces(
+    changedNamespace: Namespace
+  ): Promise<void> {
+    const connector = this.activeConnector
+    if (!connector?.getLiveAccount) return
+    const gen = ++this.siblingRefreshGeneration
+
+    const namespaceForNetworkId = (
+      networkId: NetworkId
+    ): Namespace | undefined =>
+      this.networks.find(n => n.id === networkId)?.namespace
+
+    // Sibling = every connected namespace except the one that just fired.
+    const initial = this.sessionManager.getSession()
+    const siblings = new Set<Namespace>()
+    for (const addr of initial.availableAddresses) {
+      const ns = namespaceForNetworkId(addr.networkId)
+      if (ns && ns !== changedNamespace) siblings.add(ns)
+    }
+    if (siblings.size === 0) return
+
+    const equal = (ns: Namespace, a: string, b: string): boolean =>
+      ns === 'eip155' ? a.toLowerCase() === b.toLowerCase() : a === b
+
+    const storedFor = (ns: Namespace): string | undefined => {
+      const s = this.sessionManager.getSession()
+      for (const addr of s.availableAddresses) {
+        if (namespaceForNetworkId(addr.networkId) === ns) return addr.address
+      }
+      return undefined
+    }
+
+    const resolved = new Map<Namespace, string>()
+    const pending = new Set(siblings)
+
+    for (
+      let attempt = 0;
+      attempt < SIBLING_REFRESH_MAX_ATTEMPTS && pending.size > 0;
+      attempt++
+    ) {
+      // Superseded (newer switch), disconnected, or connector swapped → abandon.
+      if (
+        gen !== this.siblingRefreshGeneration ||
+        this.activeConnector !== connector
+      )
+        return
+      for (const ns of [...pending]) {
+        let live: string | null = null
+        try {
+          live = await connector.getLiveAccount!(ns)
+        } catch {
+          live = null
+        }
+        if (
+          gen !== this.siblingRefreshGeneration ||
+          this.activeConnector !== connector
+        )
+          return
+        if (!live) continue
+        const stored = storedFor(ns)
+        if (stored != null && !equal(ns, stored, live)) {
+          resolved.set(ns, live)
+          pending.delete(ns)
+        }
+        // stored == live (not yet re-derived) → keep polling until the cap.
+      }
+      if (pending.size === 0) break
+      await new Promise<void>(r => setTimeout(r, SIBLING_REFRESH_DELAY_MS))
+    }
+
+    if (resolved.size === 0) return
+    if (
+      gen !== this.siblingRefreshGeneration ||
+      this.activeConnector !== connector
     )
+      return
+
+    const session = this.sessionManager.getSession()
+    const availableAddresses = session.availableAddresses.map(addr => {
+      const ns = namespaceForNetworkId(addr.networkId)
+      const next = ns ? resolved.get(ns) : undefined
+      return next ? { ...addr, address: next } : addr
+    })
+    // If the ACTIVE network's namespace was among the refreshed siblings, move
+    // activeAddress too (e.g. a Solana-active session whose Solana address just
+    // followed an EVM switch).
+    const activeNs = session.activeNetwork?.namespace
+    const activeAddress =
+      activeNs && resolved.has(activeNs)
+        ? resolved.get(activeNs)!
+        : session.activeAddress
+
+    this.sessionManager.updateSession({ activeAddress, availableAddresses })
+    this.eventManager.emit('sessionChanged', {
+      session: this.sessionManager.getSession()
+    })
   }
 
   private async connectWithURIPoll(
@@ -486,14 +868,32 @@ export class ConnectionService {
         await this.activeConnector.disconnect()
       }
     } finally {
-      this.activeConnector = null
-      this.sessionManager.clearSession()
-      const session = this.sessionManager.getSession()
-      this.eventManager.emit('disconnected', undefined)
-      this.eventManager.emit('sessionChanged', { session })
+      this.finishDisconnect()
     }
   }
 
+  /**
+   * Clears core's own local state (session, active connector reference,
+   * lifecycle subscription) and emits the disconnect events. Does NOT itself
+   * call the connector's `disconnect()` — that happens in each CALLER,
+   * because the two callers need different semantics: the public
+   * `disconnect()` above awaits it (the caller may care whether the wallet
+   * side actually tore down); the wallet-initiated path in
+   * `handleAccountsChanged` fires it and swallows the result (the wallet
+   * already ended the session on its own side, but the connector's own
+   * LOCAL state — e.g. a cached account/uuid — still needs clearing, or a
+   * later connect to a different wallet reads it as stale and never
+   * rebinds).
+   */
+  private finishDisconnect(): void {
+    this.teardownLifecycle()
+    this.activeConnector = null
+    this.sessionManager.clearSession()
+    const session = this.sessionManager.getSession()
+    this.eventManager.emit('disconnected', undefined)
+    this.eventManager.emit('sessionChanged', { session })
+  }
+
   getConnectionURI(): string | undefined {
     if (
       this.activeConnector &&

package/src/services/network-switch-service.test.ts

@@ -234,4 +234,37 @@ describe('NetworkSwitchService', () => {
     expect(events[0].data.operation).toBe('switchNetwork')
     expect(events[0].data.chainId).toBe('eip155:137')
   })
+
+  it('includes the new address on the emitted networkSwitched event', async () => {
+    sessionManager.updateSession({
+      connectionMode: 'injected',
+      activeWallet: {
+        id: 'metamask',
+        name: 'MetaMask',
+        metadata: {
+          icon: 'test',
+          downloadUrl: 'test',
+          supportedChains: ['eip155:1', 'eip155:137']
+        },
+        extensionInjectedProvider: {
+          supportedNetworkIds: ['eip155:1', 'eip155:137']
+        }
+      } as any
+    })
+    mockConnector.switchNetwork = vi.fn().mockResolvedValue({
+      address: '0xabc',
+      availableAddresses: [{ address: '0xabc', networkId: 'eip155:137' }]
+    })
+    const switched: Array<{ network: unknown; address?: string }> = []
+    eventManager.on('networkSwitched', d => switched.push(d))
+
+    await networkSwitchService.switchNetwork('eip155:137')
+
+    expect(switched).toEqual([
+      {
+        network: expect.objectContaining({ id: 'eip155:137' }),
+        address: '0xabc'
+      }
+    ])
+  })
 })

package/src/services/network-switch-service.ts

@@ -188,7 +188,10 @@ export class NetworkSwitchService {
         })
       })
 
-      this.eventManager.emit('networkSwitched', { network })
+      this.eventManager.emit('networkSwitched', {
+        network,
+        address: result.address
+      })
       this.eventManager.emit('sessionChanged', {
         session: this.sessionManager.getSession()
       })

package/src/services/signature-service.test.ts

@@ -58,7 +58,10 @@ describe('SignatureService.signMessage', () => {
     mockConnector = {
       connect: vi.fn(),
       disconnect: vi.fn(),
-      signMessage: vi.fn().mockResolvedValue('0xsignature'),
+      signMessage: vi.fn().mockResolvedValue({
+        signature: { type: 'standard', signature: '0xsignature' },
+        address: '0x123'
+      }),
       sendTransaction: vi.fn(),
       switchNetwork: vi.fn()
     }
@@ -168,7 +171,11 @@ describe('SignatureService.signMessage', () => {
 
     const result = await signatureService.signMessage('test message')
 
-    expect(result).toBe('0xsignature')
+    // Core is a passthrough — the connector's full SignatureResult surfaces.
+    expect(result).toEqual({
+      signature: { type: 'standard', signature: '0xsignature' },
+      address: '0x123'
+    })
     // The resolved session provider is threaded to the connector.
     expect(mockConnector.signMessage).toHaveBeenCalledWith(
       'test message',

package/src/services/signature-service.ts

@@ -4,7 +4,7 @@ import type {
   ExtensionInjectedProvider,
   IntegratedBrowserInjectedProvider,
   SupportedProvider,
-  SignatureType,
+  SignatureResult,
   EIP712TypedData
 } from '@meshconnect/uwc-types'
 import type { SessionManager } from '../managers/session-manager'
@@ -42,12 +42,13 @@ export class SignatureService {
    * Sign a message with the currently connected wallet
    * @param message The message to sign
    * @param options Optional cancellation signal
-   * @returns A promise that resolves to the signature
+   * @returns A promise resolving to a {@link SignatureResult} carrying both the
+   *   signature and the EXACT address it was signed with.
    */
   async signMessage(
     message: string,
     options?: ServiceOptions
-  ): Promise<SignatureType> {
+  ): Promise<SignatureResult> {
     options?.signal?.throwIfAborted()
     const session = validateWalletSession(this.sessionManager, {
       requireAddress: true

package/src/universal-wallet-connector.ts

@@ -16,7 +16,7 @@ import type {
   TransactionResult,
   NetworkRpcMap,
   EVMCapabilities,
-  SignatureType,
+  SignatureResult,
   EIP712TypedData,
   LogLevel,
   Logger
@@ -846,12 +846,14 @@ export class UniversalWalletConnector {
    * Sign a message with the connected wallet
    * @param message The message to sign
    * @param options Optional cancellation signal
-   * @returns A promise that resolves to the signature
+   * @returns A promise resolving to a {@link SignatureResult} carrying both the
+   *   signature and the EXACT address it was signed with. Consumers verifying
+   *   ownership MUST claim `result.address` rather than a stale session address.
    */
   async signMessage(
     message: string,
     options?: OperationOptions
-  ): Promise<SignatureType> {
+  ): Promise<SignatureResult> {
     try {
       // Validation + funnel instrumentation live in SignatureService (after
       // validation, at the real wallet boundary) — same layering as connect.

package/src/version.ts

@@ -1,2 +1,2 @@
 // Generated from package.json by scripts/generate-version.mjs — do not edit.
-export const UWC_CORE_VERSION = '1.10.3'
+export const UWC_CORE_VERSION = '2.0.0'