@meshconnect/uwc-core 1.9.0 → 1.10.0-snapshot.0112a96

package/src/observability/instrument-handoff.ts

@@ -5,7 +5,7 @@ import type {
   Session
 } from '@meshconnect/uwc-types'
 import type { EventManager } from '../managers/event-manager'
-import type { UWCOperation } from '../events'
+import type { ProviderKind, UWCOperation } from '../events'
 import { generateId } from '../utils/id'
 import {
   classifyError,
@@ -26,19 +26,56 @@ export interface HandoffContext {
   chainId?: NetworkId | undefined
   /** switchNetwork only: target chain already the active one (no-op switch). */
   targetAlreadyActive?: boolean | undefined
+  /** Provider surface used (namespace-parking risk is integratedBrowser-only). */
+  providerKind?: ProviderKind | undefined
+  /** Session-level: running inside the wallet's own in-app browser. */
+  usingIntegratedBrowser?: boolean | undefined
+  /** Active wallet's legacy `solana.injectedId` (e.g. coinbaseSolana), when set. */
+  injectedId?: string | undefined
+  /** Last namespace actually signed/sent before this op — the parking proxy. */
+  lastSignedNamespace?: Namespace | undefined
+  /** switchNetwork only: namespace active BEFORE the switch (cross-namespace detection). */
+  previousNamespace?: Namespace | undefined
 }
 
-/** Build handoff routing facets from the active session (no address). */
+/** Which provider surface a namespace/mode maps to (parking risk = integratedBrowser). */
+export function deriveProviderKind(
+  connectionMode: ConnectionMode,
+  usingIntegratedBrowser: boolean
+): ProviderKind {
+  if (connectionMode === 'walletConnect') return 'walletConnect'
+  if (connectionMode === 'tonConnect') return 'tonConnect'
+  return usingIntegratedBrowser ? 'integratedBrowser' : 'extension'
+}
+
+/**
+ * Build handoff routing facets from the active session (no address). Enriched
+ * with the namespace-parking triage facets — provider surface, in-app-browser,
+ * the wallet's legacy `solana.injectedId`, and the last-signed namespace — so a
+ * send/sign handoff self-describes the parking setup without a session join.
+ * `usingIntegratedBrowser` is connector-level state, so callers pass it in.
+ */
 export function sessionHandoffContext(
   operation: UWCOperation,
-  session: Session
+  session: Session,
+  usingIntegratedBrowser = false
 ): HandoffContext {
+  const connectionMode = session.connectionMode ?? 'injected'
+  // `namespaceMetaData` (with the legacy `solana.injectedId`) lives on the
+  // injected provider, not the wallet — pick the surface in use.
+  const injectedProvider = usingIntegratedBrowser
+    ? session.activeWallet?.integratedBrowserInjectedProvider
+    : session.activeWallet?.extensionInjectedProvider
   return {
     operation,
-    connectionMode: session.connectionMode ?? 'injected',
+    connectionMode,
     walletId: session.activeWallet?.id,
     namespace: session.activeNetwork?.namespace,
-    chainId: session.activeNetwork?.id ?? undefined
+    chainId: session.activeNetwork?.id ?? undefined,
+    providerKind: deriveProviderKind(connectionMode, usingIntegratedBrowser),
+    usingIntegratedBrowser,
+    injectedId: injectedProvider?.namespaceMetaData?.solana?.injectedId,
+    lastSignedNamespace: session.lastSignedNamespace ?? undefined
   }
 }
 
@@ -134,6 +171,11 @@ export async function instrumentHandoff<T>(
     handoffId,
     walletFlowType: deriveWalletFlowType(context.connectionMode, platform),
     platform,
+    providerKind: context.providerKind,
+    usingIntegratedBrowser: context.usingIntegratedBrowser,
+    injectedId: context.injectedId,
+    lastSignedNamespace: context.lastSignedNamespace,
+    previousNamespace: context.previousNamespace,
     ...(context.targetAlreadyActive !== undefined && {
       targetAlreadyActive: context.targetAlreadyActive
     })
@@ -176,6 +218,11 @@ export async function instrumentHandoff<T>(
     walletId: context.walletId,
     namespace: context.namespace,
     chainId: context.chainId,
+    providerKind: context.providerKind,
+    usingIntegratedBrowser: context.usingIntegratedBrowser,
+    injectedId: context.injectedId,
+    lastSignedNamespace: context.lastSignedNamespace,
+    previousNamespace: context.previousNamespace,
     ...(context.targetAlreadyActive !== undefined && {
       targetAlreadyActive: context.targetAlreadyActive
     })

package/src/observability/telemetry.test.ts

@@ -546,6 +546,41 @@ describe('normalizeEvent', () => {
     expect(capped.runtime).toBe('iframe')
   })
 
+  it('carries injectedId + gatherSource + runtime for secondarySolanaConnectGathered, length-capped (ONC-231)', () => {
+    const out = normalizeEvent(
+      'secondarySolanaConnectGathered',
+      {
+        injectedId: 'coinbaseSolana',
+        source: 'connect',
+        legacyInjected: true,
+        framed: true
+      },
+      SDK_SESSION,
+      NOW
+    )
+    expect(out.injectedId).toBe('coinbaseSolana')
+    expect(out.legacyInjected).toBe(true)
+    expect(out.gatherSource).toBe('connect')
+    expect(out.runtime).toBe('iframe')
+    // never leaks a gateOutcome (that's the skip event's field)
+    expect(out.gateOutcome).toBeUndefined()
+
+    const capped = normalizeEvent(
+      'secondarySolanaConnectGathered',
+      {
+        injectedId: 'y'.repeat(200),
+        source: 'existing',
+        legacyInjected: false,
+        framed: false
+      },
+      SDK_SESSION,
+      NOW
+    )
+    expect(capped.injectedId).toHaveLength(64)
+    expect(capped.gatherSource).toBe('existing')
+    expect(capped.runtime).toBe('direct')
+  })
+
   it('normalizes lifecycle events with routing only, no address (P2)', () => {
     const acct = normalizeEvent(
       'walletAccountChanged',
@@ -697,4 +732,80 @@ describe('normalizeEvent', () => {
     )
     expect('handoffCovered' in out).toBe(false)
   })
+
+  it('normalizes namespaceReassert(succeeded), mapping every field onto its reassert* facet', () => {
+    const out = normalizeEvent(
+      'namespaceReassert',
+      {
+        phase: 'succeeded',
+        lever: 'eth_requestAccounts',
+        connectionMode: 'injected',
+        walletId: 'coinbase',
+        injectedId: 'coinbaseSolana',
+        fromNamespace: 'solana',
+        toNamespace: 'eip155',
+        durationMs: 42
+      },
+      SDK_SESSION,
+      NOW
+    )
+    expect(out.reassertPhase).toBe('succeeded')
+    expect(out.reassertLever).toBe('eth_requestAccounts')
+    expect(out.connectionMode).toBe('injected')
+    expect(out.walletId).toBe('coinbase')
+    expect(out.injectedId).toBe('coinbaseSolana')
+    expect(out.fromNamespace).toBe('solana')
+    expect(out.toNamespace).toBe('eip155')
+    expect(out.durationMs).toBe(42)
+    expect(out.error).toBeUndefined()
+  })
+
+  it('normalizes namespaceReassert(failed), capping injectedId and scrubbing the error message', () => {
+    const addr = '0x' + 'a'.repeat(40)
+    const out = normalizeEvent(
+      'namespaceReassert',
+      {
+        phase: 'failed',
+        lever: 'eth_requestAccounts',
+        connectionMode: 'injected',
+        walletId: 'coinbase',
+        injectedId: 'x'.repeat(200),
+        fromNamespace: 'solana',
+        toNamespace: 'eip155',
+        durationMs: 12,
+        error: { type: 'unknown', message: `declined for ${addr}` }
+      },
+      SDK_SESSION,
+      NOW
+    )
+    expect(out.reassertPhase).toBe('failed')
+    expect(out.injectedId).toHaveLength(64)
+    expect(out.error?.message).not.toContain(addr)
+    expect(out.error?.message).toContain('[redacted-hex]')
+  })
+
+  it('carries parkingFacets (providerKind, usingIntegratedBrowser, injectedId capped, lastSignedNamespace, previousNamespace) on a handoff terminal', () => {
+    const out = normalizeEvent(
+      'walletTimedOut',
+      {
+        handoffId: 'h-1',
+        operation: 'sendTransaction',
+        durationMs: 1000,
+        connectionMode: 'injected',
+        timeoutMs: 1000,
+        providerKind: 'integratedBrowser',
+        usingIntegratedBrowser: true,
+        injectedId: 'y'.repeat(200),
+        lastSignedNamespace: 'solana',
+        previousNamespace: 'solana'
+      },
+      SDK_SESSION,
+      NOW
+    )
+    expect(out.providerKind).toBe('integratedBrowser')
+    expect(out.usingIntegratedBrowser).toBe(true)
+    expect(out.injectedId).toHaveLength(64)
+    expect(out.lastSignedNamespace).toBe('solana')
+    expect(out.previousNamespace).toBe('solana')
+  })
 })

package/src/observability/telemetry.ts

@@ -11,7 +11,12 @@ import type {
   LifecycleUnavailableReason,
   Session
 } from '@meshconnect/uwc-types'
-import type { UWCEventName, UWCEventMap, UWCOperation } from '../events'
+import type {
+  UWCEventName,
+  UWCEventMap,
+  UWCOperation,
+  ProviderKind
+} from '../events'
 import { UWC_CORE_VERSION } from '../version'
 import { scrubMessage } from './scrub'
 
@@ -50,6 +55,29 @@ function capNetworkMismatch(
   }
 }
 
+/**
+ * Namespace-parking triage facets carried on every wallet-boundary handoff so a
+ * single event answers "which provider surface, in-app browser?, legacy Solana
+ * wallet?, and what namespace did we last sign on before this op?" — the inputs
+ * needed to spot the Coinbase/Base sequential Solana→EVM parking bug in RUM.
+ * `injectedId` is length-capped (catalog-metadata origin), the rest are enums/bools.
+ */
+function parkingFacets(d: {
+  providerKind?: ProviderKind | undefined
+  usingIntegratedBrowser?: boolean | undefined
+  injectedId?: string | undefined
+  lastSignedNamespace?: Namespace | undefined
+  previousNamespace?: Namespace | undefined
+}) {
+  return {
+    providerKind: d.providerKind,
+    usingIntegratedBrowser: d.usingIntegratedBrowser,
+    injectedId: d.injectedId?.slice(0, MAX_INJECTED_ID_LENGTH),
+    lastSignedNamespace: d.lastSignedNamespace,
+    previousNamespace: d.previousNamespace
+  }
+}
+
 /**
  * A normalized, PII-safe telemetry record derived from a `UWCEventMap` event.
  *
@@ -193,17 +221,17 @@ export interface UWCTelemetryEvent {
   /** Handoff terminals, WalletConnect only: relay-socket drops seen while the handoff was pending. */
   relayDropCount?: number | undefined
   /**
-   * `secondarySolanaConnectSkipped` only: the `solana.injectedId` metadata key
-   * whose secondary gather the gate acted on (e.g. `coinbaseSolana`) — fires
-   * framed or top-level in-app (`runtime` distinguishes). A consumer-configured
-   * metadata key, never an address. Length-capped as defense-in-depth since
-   * the value originates in catalog metadata.
+   * `secondarySolanaConnectSkipped` / `secondarySolanaConnectGathered`: the
+   * `solana.injectedId` metadata key the secondary gather acted on (e.g.
+   * `coinbaseSolana`). A consumer-configured metadata key, never an address.
+   * Length-capped as defense-in-depth since the value originates in catalog
+   * metadata.
    */
   injectedId?: string | undefined
   /**
-   * `secondarySolanaConnectSkipped` only: true when the skipped wallet was
-   * discovered via the legacy injected-Solana fallback (true "Legacy mode")
-   * rather than the Wallet Standard registry.
+   * `secondarySolanaConnectSkipped` / `secondarySolanaConnectGathered`: true
+   * when the wallet was discovered via the legacy injected-Solana fallback
+   * (true "Legacy mode") rather than the Wallet Standard registry.
    */
   legacyInjected?: boolean | undefined
   /**
@@ -213,6 +241,36 @@ export interface UWCTelemetryEvent {
    * wallet-side state, not the gather.
    */
   gateOutcome?: 'connectSuppressed' | 'alreadyConnected' | undefined
+  /**
+   * `secondarySolanaConnectGathered` only (ONC-231): `existing` = the address
+   * surfaced via the passive/silent check; `connect` = a fresh connect was made.
+   */
+  gatherSource?: 'existing' | 'connect' | undefined
+  /**
+   * Handoff events: which provider surface the op used. Namespace parking
+   * (Coinbase/Base legacy Solana → EVM in-app) is observed only on
+   * `integratedBrowser`; riding it on every handoff separates that surface.
+   */
+  providerKind?: ProviderKind | undefined
+  /** Handoff events: the session runs inside the wallet's own in-app browser. */
+  usingIntegratedBrowser?: boolean | undefined
+  /**
+   * Handoff events: the last namespace actually signed/sent before this op — the
+   * parking proxy. A switch/send to `eip155` following `lastSignedNamespace:
+   * solana` on a legacy-injectedId wallet in an integrated browser is the
+   * fingerprint of the no-approval-sheet parking bug.
+   */
+  lastSignedNamespace?: Namespace | undefined
+  /** switchNetwork handoffs: the namespace active BEFORE the switch. */
+  previousNamespace?: Namespace | undefined
+  /** `namespaceReassert` only: lever attempt phase. */
+  reassertPhase?: 'fired' | 'succeeded' | 'failed' | undefined
+  /** `namespaceReassert` only: the wallet request used to re-assert the namespace. */
+  reassertLever?: 'eth_requestAccounts' | undefined
+  /** `namespaceReassert` only: the namespace the wallet was parked on (parking cause). */
+  fromNamespace?: Namespace | undefined
+  /** `namespaceReassert` only: the namespace being re-asserted (switch target). */
+  toNamespace?: Namespace | undefined
 }
 
 /**
@@ -405,7 +463,8 @@ function buildTelemetryEvent<K extends UWCEventName>(
         handoffId: d.handoffId,
         walletFlowType: d.walletFlowType,
         platform: d.platform,
-        targetAlreadyActive: d.targetAlreadyActive
+        targetAlreadyActive: d.targetAlreadyActive,
+        ...parkingFacets(d)
       }
     }
     case 'walletSucceeded': {
@@ -424,7 +483,8 @@ function buildTelemetryEvent<K extends UWCEventName>(
         targetAlreadyActive: d.targetAlreadyActive,
         backgroundedMs: d.backgroundedMs,
         backgroundCount: d.backgroundCount,
-        relayDropCount: d.relayDropCount
+        relayDropCount: d.relayDropCount,
+        ...parkingFacets(d)
       }
     }
     case 'walletRejected': {
@@ -449,7 +509,8 @@ function buildTelemetryEvent<K extends UWCEventName>(
           : undefined,
         backgroundedMs: d.backgroundedMs,
         backgroundCount: d.backgroundCount,
-        relayDropCount: d.relayDropCount
+        relayDropCount: d.relayDropCount,
+        ...parkingFacets(d)
       }
     }
     case 'walletTimedOut': {
@@ -467,7 +528,8 @@ function buildTelemetryEvent<K extends UWCEventName>(
         targetAlreadyActive: d.targetAlreadyActive,
         backgroundedMs: d.backgroundedMs,
         backgroundCount: d.backgroundCount,
-        relayDropCount: d.relayDropCount
+        relayDropCount: d.relayDropCount,
+        ...parkingFacets(d)
       }
     }
     case 'walletFailed': {
@@ -490,7 +552,8 @@ function buildTelemetryEvent<K extends UWCEventName>(
         error: { type: d.error.type, message: scrubMessage(d.error.message) },
         backgroundedMs: d.backgroundedMs,
         backgroundCount: d.backgroundCount,
-        relayDropCount: d.relayDropCount
+        relayDropCount: d.relayDropCount,
+        ...parkingFacets(d)
       }
     }
     case 'capabilitiesUpdated': {
@@ -539,6 +602,33 @@ function buildTelemetryEvent<K extends UWCEventName>(
         runtime: d.framed ? 'iframe' : 'direct'
       }
     }
+    case 'secondarySolanaConnectGathered': {
+      const d = data as UWCEventMap['secondarySolanaConnectGathered']
+      return {
+        ...base,
+        injectedId: d.injectedId.slice(0, MAX_INJECTED_ID_LENGTH),
+        legacyInjected: d.legacyInjected,
+        gatherSource: d.source,
+        runtime: d.framed ? 'iframe' : 'direct'
+      }
+    }
+    case 'namespaceReassert': {
+      const d = data as UWCEventMap['namespaceReassert']
+      return {
+        ...base,
+        reassertPhase: d.phase,
+        reassertLever: d.lever,
+        connectionMode: d.connectionMode,
+        walletId: d.walletId,
+        injectedId: d.injectedId?.slice(0, MAX_INJECTED_ID_LENGTH),
+        fromNamespace: d.fromNamespace,
+        toNamespace: d.toNamespace,
+        durationMs: d.durationMs,
+        error: d.error
+          ? { type: d.error.type, message: scrubMessage(d.error.message) }
+          : undefined
+      }
+    }
     case 'pageHiddenDuringHandoff':
     case 'pageVisibleDuringHandoff': {
       // Cast to the visible shape (superset). `hiddenMs` is absent on the hidden

package/src/services/network-switch-service.ts

@@ -11,6 +11,7 @@ import type {
 } from '@meshconnect/uwc-types'
 import type { SessionManager } from '../managers/session-manager'
 import type { EventManager } from '../managers/event-manager'
+import type { ProviderKind } from '../events'
 import type { ServiceOptions } from './connection-service'
 import { instrumentHandoff } from '../observability/instrument-handoff'
 
@@ -97,6 +98,30 @@ export class NetworkSwitchService {
       )
     }
 
+    // Namespace-parking triage facets (rides the switch handoff). The parking bug
+    // (Coinbase/Base legacy Solana leaves the wallet's active namespace on Solana
+    // so the next EVM send shows no approval sheet) only occurs on the
+    // integratedBrowser surface for a wallet that declares a `solana.injectedId`.
+    const providerKind: ProviderKind =
+      session.connectionMode === 'walletConnect'
+        ? 'walletConnect'
+        : session.connectionMode === 'tonConnect'
+          ? 'tonConnect'
+          : this.usingIntegratedBrowser
+            ? 'integratedBrowser'
+            : 'extension'
+    const solanaInjectedId =
+      session.connectionMode === 'injected' ||
+      session.connectionMode === 'tonConnect'
+        ? (
+            provider as
+              | ExtensionInjectedProvider
+              | IntegratedBrowserInjectedProvider
+          ).namespaceMetaData?.solana?.injectedId
+        : undefined
+    // Captured BEFORE the switch mutates the session — the cross-namespace signal.
+    const previousNamespace = session.activeNetwork?.namespace
+
     // Get the active connector
     const activeConnector = this.connectors.get(session.connectionMode)
 
@@ -145,7 +170,11 @@ export class NetworkSwitchService {
           walletId: currentWallet.id,
           namespace: network.namespace,
           chainId: network.id,
-          targetAlreadyActive
+          targetAlreadyActive,
+          providerKind,
+          usingIntegratedBrowser: this.usingIntegratedBrowser,
+          injectedId: solanaInjectedId,
+          previousNamespace
         },
         async () => {
           if (
@@ -172,6 +201,24 @@ export class NetworkSwitchService {
 
       options?.signal?.throwIfAborted()
 
+      // Surface the POC un-park lever (if the injected connector fired it) as a
+      // queryable telemetry event — the "did re-assert fix the parking?" signal.
+      if (result.reassert?.fired) {
+        this.eventManager.emit('namespaceReassert', {
+          phase: result.reassert.ok ? 'succeeded' : 'failed',
+          lever: result.reassert.lever,
+          connectionMode: session.connectionMode,
+          walletId: currentWallet.id,
+          injectedId: solanaInjectedId,
+          fromNamespace: previousNamespace,
+          toNamespace: network.namespace,
+          durationMs: result.reassert.durationMs,
+          ...(result.reassert.error && {
+            error: { type: 'unknown' as const, message: result.reassert.error }
+          })
+        })
+      }
+
       // Filter available addresses to only include those for configured networks
       const filteredAvailableAddresses = result.availableAddresses
         ? result.availableAddresses.filter(addr =>

package/src/services/signature-service.ts

@@ -71,13 +71,21 @@ export class SignatureService {
         timeoutMs: this.walletResponseTimeoutMs,
         signal: options?.signal
       },
-      sessionHandoffContext('signMessage', session),
+      sessionHandoffContext(
+        'signMessage',
+        session,
+        this.usingIntegratedBrowser
+      ),
       // tonConnect resolves undefined and keeps its message-only call shape.
       () =>
         provider === undefined
           ? connector.signMessage!(message)
           : connector.signMessage!(message, provider)
     )
+    // Record the namespace just signed — the parking proxy for the next op.
+    this.sessionManager.updateSession({
+      lastSignedNamespace: session.activeNetwork?.namespace ?? null
+    })
     // AFTER the funnel: the wallet settled, so its truthful terminal is already
     // recorded; an abort that raced completion still rejects the caller here.
     options?.signal?.throwIfAborted()
@@ -112,12 +120,16 @@ export class SignatureService {
       provider = resolveSessionProvider(session, this.usingIntegratedBrowser)
     }
 
-    return await instrumentHandoff(
+    const signature = await instrumentHandoff(
       {
         eventManager: this.eventManager,
         timeoutMs: this.walletResponseTimeoutMs
       },
-      sessionHandoffContext('signTypedData', session),
+      sessionHandoffContext(
+        'signTypedData',
+        session,
+        this.usingIntegratedBrowser
+      ),
       () =>
         session.connectionMode === 'injected'
           ? connector.signTypedData!(
@@ -128,5 +140,8 @@ export class SignatureService {
             )
           : connector.signTypedData!(typedData)
     )
+    // signTypedData is EVM-only — records eip155 as the last-signed namespace.
+    this.sessionManager.updateSession({ lastSignedNamespace: 'eip155' })
+    return signature
   }
 }

package/src/services/transaction-service.ts

@@ -90,13 +90,22 @@ export class TransactionService {
         timeoutMs: this.walletResponseTimeoutMs,
         signal: options?.signal
       },
-      sessionHandoffContext('sendTransaction', session),
+      sessionHandoffContext(
+        'sendTransaction',
+        session,
+        this.usingIntegratedBrowser
+      ),
       // tonConnect resolves undefined and keeps its request-only call shape.
       () =>
         provider === undefined
           ? connector.sendTransaction!(request)
           : connector.sendTransaction!(request, provider)
     )
+    // Record the namespace just signed — the parking proxy the NEXT op's handoff
+    // context reads (e.g. a following EVM switch/send after a Solana transfer).
+    this.sessionManager.updateSession({
+      lastSignedNamespace: session.activeNetwork?.namespace ?? null
+    })
     // AFTER the funnel: the tx already broadcast, so its truthful terminal is
     // recorded; an abort that raced completion still rejects the caller here.
     options?.signal?.throwIfAborted()
@@ -122,13 +131,20 @@ export class TransactionService {
       )
     }
 
-    return await instrumentHandoff(
+    const signature = await instrumentHandoff(
       {
         eventManager: this.eventManager,
         timeoutMs: this.walletResponseTimeoutMs
       },
-      sessionHandoffContext('signSolanaTransaction', session),
+      sessionHandoffContext(
+        'signSolanaTransaction',
+        session,
+        this.usingIntegratedBrowser
+      ),
       () => connector.signSolanaTransactionBytes!(serializedTx)
     )
+    // Sign-only on Solana still parks the wallet's active namespace on Solana.
+    this.sessionManager.updateSession({ lastSignedNamespace: 'solana' })
+    return signature
   }
 }

package/src/universal-wallet-connector.ts

@@ -317,6 +317,10 @@ export class UniversalWalletConnector {
       // Legacy-mode hang).
       onSecondarySolanaConnectSkipped: info =>
         this.eventManager.emit('secondarySolanaConnectSkipped', info),
+      // Positive counterpart (ONC-231): a legacy-`injectedId` wallet's secondary
+      // Solana address WAS gathered — confirms the framed gather works.
+      onSecondarySolanaConnectGathered: info =>
+        this.eventManager.emit('secondarySolanaConnectGathered', info),
       // The wallet-switch guard released a different wallet's live state —
       // surface it so the otherwise-silent release is observable in prod.
       onWalletConnectionsReleased: info =>

package/src/version.ts

@@ -1,2 +1,2 @@
 // Generated from package.json by scripts/generate-version.mjs — do not edit.
-export const UWC_CORE_VERSION = '1.9.0'
+export const UWC_CORE_VERSION = '1.10.0'