@dynamic-labs/bitcoin 4.94.0 → 4.95.0

package/CHANGELOG.md

@@ -1,4 +1,20 @@
 
+## [4.95.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.94.0...v4.95.0) (2026-07-28)
+
+
+### Features
+
+* **waas:** expose rawSign sha256/blake2b in SignMessageContext [v4] ([#12076](https://github.com/dynamic-labs/dynamic-auth/issues/12076)) ([5133a71](https://github.com/dynamic-labs/dynamic-auth/commit/5133a713ba5aea0cb19935d99f0795ebbe303d2e))
+
+
+### Bug Fixes
+
+* **bitcoin:** resolve the public key of the active wallet, not the first [v4] ([#12090](https://github.com/dynamic-labs/dynamic-auth/issues/12090)) ([a93b55b](https://github.com/dynamic-labs/dynamic-auth/commit/a93b55b882ec3a7ac2adb37e4f653cb935d16193)), closes [#11970](https://github.com/dynamic-labs/dynamic-auth/issues/11970) [#11970](https://github.com/dynamic-labs/dynamic-auth/issues/11970) [#11970](https://github.com/dynamic-labs/dynamic-auth/issues/11970)
+* **client:** ack sdk__loadedChanged in the webview load controller ([#12084](https://github.com/dynamic-labs/dynamic-auth/issues/12084)) ([8688c7d](https://github.com/dynamic-labs/dynamic-auth/commit/8688c7d1cfc320c3ca20913c730326c6f36266e0)), closes [#12071](https://github.com/dynamic-labs/dynamic-auth/issues/12071)
+* fallback to local wallet balance when token balances API returns no tokens ([9ff87c3](https://github.com/dynamic-labs/dynamic-auth/commit/9ff87c3d1836e72a5a1e635ef7bd53464501fc1a))
+* remediate high-severity dependency vulnerabilities ([#12077](https://github.com/dynamic-labs/dynamic-auth/issues/12077)) ([81e2d91](https://github.com/dynamic-labs/dynamic-auth/commit/81e2d91e16edaba1b6251bfa9b9f9c91d09aab80))
+* remediate high-severity dependency vulnerabilities ([#12087](https://github.com/dynamic-labs/dynamic-auth/issues/12087)) ([9250ede](https://github.com/dynamic-labs/dynamic-auth/commit/9250edede5eaa0d0de8faa7d7aad1d164e1c78f7))
+
 ## [4.94.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.93.1...v4.94.0) (2026-07-24)
 
 

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.94.0";
+var version = "4.95.0";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "4.94.0";
+var version = "4.95.0";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/bitcoin",
-  "version": "4.94.0",
+  "version": "4.95.0",
   "description": "A React SDK for implementing wallet web3 authentication and authorization to your website.",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -22,20 +22,20 @@
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
     "@bitcoinerlab/secp256k1": "1.1.1",
     "@btckit/types": "0.0.19",
-    "@dynamic-labs/sdk-api-core": "0.0.1082",
+    "@dynamic-labs/sdk-api-core": "0.0.1093",
     "@wallet-standard/app": "1.0.1",
     "@wallet-standard/base": "1.0.1",
     "bitcoinjs-lib": "6.1.5",
     "ecpair": "2.1.0",
     "sats-connect": "4.2.1",
     "jsontokens": "4.0.1",
-    "@dynamic-labs/assert-package-version": "4.94.0",
-    "@dynamic-labs/logger": "4.94.0",
-    "@dynamic-labs/types": "4.94.0",
-    "@dynamic-labs/utils": "4.94.0",
-    "@dynamic-labs/waas": "4.94.0",
-    "@dynamic-labs/wallet-book": "4.94.0",
-    "@dynamic-labs/wallet-connector-core": "4.94.0",
+    "@dynamic-labs/assert-package-version": "4.95.0",
+    "@dynamic-labs/logger": "4.95.0",
+    "@dynamic-labs/types": "4.95.0",
+    "@dynamic-labs/utils": "4.95.0",
+    "@dynamic-labs/waas": "4.95.0",
+    "@dynamic-labs/wallet-book": "4.95.0",
+    "@dynamic-labs/wallet-connector-core": "4.95.0",
     "eventemitter3": "5.0.1"
   },
   "peerDependencies": {}

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.cjs

@@ -160,22 +160,57 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
             return _super.getBalance.call(this, (_a = this.activeAccountAddress) !== null && _a !== void 0 ? _a : address);
         });
     }
+    /**
+     * Finds the credential that owns the active address, either as its primary
+     * (mainnet) address or as one of its network-tagged additional addresses.
+     *
+     * This connector is shared across every Bitcoin wallet of the user —
+     * `verifiedCredentials` holds them all — so the owning credential must be
+     * looked up by the active address. Reading `verifiedCredential` instead
+     * would always answer with the user's *first* wallet.
+     */
+    findCredentialForActiveAddress() {
+        var _a;
+        const { activeAccountAddress } = this;
+        if (!activeAccountAddress) {
+            return undefined;
+        }
+        return ((_a = this.verifiedCredentials) !== null && _a !== void 0 ? _a : []).find((credential) => {
+            var _a;
+            return (credential === null || credential === void 0 ? void 0 : credential.address) === activeAccountAddress ||
+                ((_a = credential === null || credential === void 0 ? void 0 : credential.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []).some((additionalAddress) => additionalAddress.address === activeAccountAddress);
+        });
+    }
     /**
      * Wallet identity: keyshares/wallet records are keyed by the wallet's
      * primary (mainnet) address. On testnet the active address is the same
      * wallet's per-network encoding — WaaS lookups (password, signing) must use
      * the primary address (the same key signs both encodings).
+     *
+     * Resolved from the credential that owns the active address, so a user with
+     * several Bitcoin wallets gets the identity of the wallet being spent from.
+     * Never falls back to another wallet's address: a substituted key produces a
+     * signature that looks valid locally and is rejected by the network, so the
+     * failure has to surface here instead.
      */
     getWalletIdentityAddress() {
-        var _a, _b;
-        // The active address is a valid fallback only on mainnet, where it is
-        // the primary encoding; a switched-network encoding must never be used
-        // as the wallet identity.
-        const identity = (_b = (_a = this.verifiedCredential) === null || _a === void 0 ? void 0 : _a.address) !== null && _b !== void 0 ? _b : (this.activeNetworkId === BITCOIN_MAINNET_NETWORK_ID
+        var _a, _b, _c, _d;
+        const owningCredential = this.findCredentialForActiveAddress();
+        // The primary address is normally on the credential itself; fall back to
+        // its mainnet-tagged payment address for credentials that only carry
+        // network-tagged entries.
+        const owningCredentialAddress = (_a = owningCredential === null || owningCredential === void 0 ? void 0 : owningCredential.address) !== null && _a !== void 0 ? _a : (_c = ((_b = owningCredential === null || owningCredential === void 0 ? void 0 : owningCredential.walletAdditionalAddresses) !== null && _b !== void 0 ? _b : []).find((addr) => addr.type === 'payment' &&
+            addr.network === 'mainnet')) === null || _c === void 0 ? void 0 : _c.address;
+        // With no credential owning the active address there is nothing to
+        // identify the wallet by except the active address itself, which on
+        // mainnet is the primary encoding. That is still the *requested* wallet,
+        // so it is a safe answer — unlike `verifiedCredential`, which is always
+        // the user's first wallet and would substitute a different key.
+        const identity = owningCredentialAddress !== null && owningCredentialAddress !== void 0 ? owningCredentialAddress : (this.activeNetworkId === BITCOIN_MAINNET_NETWORK_ID
             ? this.activeAccountAddress
             : undefined);
         if (!identity) {
-            throw new utils.DynamicError('Active account address is required', 'active_account_address_is_required');
+            throw new utils.DynamicError(`Could not resolve the wallet identity for active address ${(_d = this.activeAccountAddress) !== null && _d !== void 0 ? _d : '(unset)'}`, 'active_account_address_is_required');
         }
         return identity;
     }
@@ -185,14 +220,18 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
      * address (wallets created before per-network registration).
      */
     getPaymentAddressForNetwork(network) {
-        var _a, _b, _c;
-        const tagged = (_b = (_a = this.verifiedCredential) === null || _a === void 0 ? void 0 : _a.walletAdditionalAddresses) === null || _b === void 0 ? void 0 : _b.find((addr) => addr.type === 'payment' &&
+        var _a, _b;
+        // Resolved against the wallet that is currently active. Reading
+        // `verifiedCredential` alone would switch the network on the user's first
+        // wallet, handing back an address that belongs to a different wallet.
+        const credential = (_a = this.findCredentialForActiveAddress()) !== null && _a !== void 0 ? _a : this.verifiedCredential;
+        const tagged = (_b = credential === null || credential === void 0 ? void 0 : credential.walletAdditionalAddresses) === null || _b === void 0 ? void 0 : _b.find((addr) => addr.type === 'payment' &&
             addr.network === network);
         if (tagged === null || tagged === void 0 ? void 0 : tagged.address) {
             return tagged.address;
         }
         if (network === 'mainnet') {
-            return (_c = this.verifiedCredential) === null || _c === void 0 ? void 0 : _c.address;
+            return credential === null || credential === void 0 ? void 0 : credential.address;
         }
         return undefined;
     }
@@ -667,7 +706,16 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
             // signs both. Look it up by the wallet identity address rather than the
             // active address, which after a network switch is the testnet encoding.
             const walletIdentityAddress = this.getWalletIdentityAddress();
-            for (const credential of allCredentials) {
+            // Scoped to the credential that owns the active address when there is one.
+            // Searching every credential would let another wallet of the same user
+            // answer for this one, and that is the failure this must not produce: the
+            // PSBT then carries a witness script derived from the wrong key and is
+            // rejected by the network only after broadcast.
+            const owningCredential = this.findCredentialForActiveAddress();
+            const credentialsToSearch = owningCredential
+                ? [owningCredential]
+                : allCredentials;
+            for (const credential of credentialsToSearch) {
                 const { walletAdditionalAddresses } = credential !== null && credential !== void 0 ? credential : {};
                 if (!walletAdditionalAddresses) {
                     continue;
@@ -677,8 +725,8 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                     return additionalAddress.publicKey;
                 }
             }
-            const allAvailableAddresses = allCredentials
-                .flatMap((cred) => { var _a; return (_a = cred.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []; })
+            const allAvailableAddresses = credentialsToSearch
+                .flatMap((cred) => { var _a; return (_a = cred === null || cred === void 0 ? void 0 : cred.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []; })
                 .map((addr) => addr.address)
                 .join(', ');
             throw new utils.DynamicError(`No additional address found for ${walletIdentityAddress}. Available addresses: ${allAvailableAddresses || 'none'}`, 'no_additional_address_found_for_available');

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.d.ts

@@ -279,11 +279,27 @@ export declare class DynamicWaasBitcoinConnector extends DynamicWaasBitcoinConne
      * routing is address-driven).
      */
     getBalance(address: string): Promise<string | undefined>;
+    /**
+     * Finds the credential that owns the active address, either as its primary
+     * (mainnet) address or as one of its network-tagged additional addresses.
+     *
+     * This connector is shared across every Bitcoin wallet of the user —
+     * `verifiedCredentials` holds them all — so the owning credential must be
+     * looked up by the active address. Reading `verifiedCredential` instead
+     * would always answer with the user's *first* wallet.
+     */
+    private findCredentialForActiveAddress;
     /**
      * Wallet identity: keyshares/wallet records are keyed by the wallet's
      * primary (mainnet) address. On testnet the active address is the same
      * wallet's per-network encoding — WaaS lookups (password, signing) must use
      * the primary address (the same key signs both encodings).
+     *
+     * Resolved from the credential that owns the active address, so a user with
+     * several Bitcoin wallets gets the identity of the wallet being spent from.
+     * Never falls back to another wallet's address: a substituted key produces a
+     * signature that looks valid locally and is rejected by the network, so the
+     * failure has to surface here instead.
      */
     private getWalletIdentityAddress;
     /**

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.js

@@ -156,22 +156,57 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
             return _super.getBalance.call(this, (_a = this.activeAccountAddress) !== null && _a !== void 0 ? _a : address);
         });
     }
+    /**
+     * Finds the credential that owns the active address, either as its primary
+     * (mainnet) address or as one of its network-tagged additional addresses.
+     *
+     * This connector is shared across every Bitcoin wallet of the user —
+     * `verifiedCredentials` holds them all — so the owning credential must be
+     * looked up by the active address. Reading `verifiedCredential` instead
+     * would always answer with the user's *first* wallet.
+     */
+    findCredentialForActiveAddress() {
+        var _a;
+        const { activeAccountAddress } = this;
+        if (!activeAccountAddress) {
+            return undefined;
+        }
+        return ((_a = this.verifiedCredentials) !== null && _a !== void 0 ? _a : []).find((credential) => {
+            var _a;
+            return (credential === null || credential === void 0 ? void 0 : credential.address) === activeAccountAddress ||
+                ((_a = credential === null || credential === void 0 ? void 0 : credential.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []).some((additionalAddress) => additionalAddress.address === activeAccountAddress);
+        });
+    }
     /**
      * Wallet identity: keyshares/wallet records are keyed by the wallet's
      * primary (mainnet) address. On testnet the active address is the same
      * wallet's per-network encoding — WaaS lookups (password, signing) must use
      * the primary address (the same key signs both encodings).
+     *
+     * Resolved from the credential that owns the active address, so a user with
+     * several Bitcoin wallets gets the identity of the wallet being spent from.
+     * Never falls back to another wallet's address: a substituted key produces a
+     * signature that looks valid locally and is rejected by the network, so the
+     * failure has to surface here instead.
      */
     getWalletIdentityAddress() {
-        var _a, _b;
-        // The active address is a valid fallback only on mainnet, where it is
-        // the primary encoding; a switched-network encoding must never be used
-        // as the wallet identity.
-        const identity = (_b = (_a = this.verifiedCredential) === null || _a === void 0 ? void 0 : _a.address) !== null && _b !== void 0 ? _b : (this.activeNetworkId === BITCOIN_MAINNET_NETWORK_ID
+        var _a, _b, _c, _d;
+        const owningCredential = this.findCredentialForActiveAddress();
+        // The primary address is normally on the credential itself; fall back to
+        // its mainnet-tagged payment address for credentials that only carry
+        // network-tagged entries.
+        const owningCredentialAddress = (_a = owningCredential === null || owningCredential === void 0 ? void 0 : owningCredential.address) !== null && _a !== void 0 ? _a : (_c = ((_b = owningCredential === null || owningCredential === void 0 ? void 0 : owningCredential.walletAdditionalAddresses) !== null && _b !== void 0 ? _b : []).find((addr) => addr.type === 'payment' &&
+            addr.network === 'mainnet')) === null || _c === void 0 ? void 0 : _c.address;
+        // With no credential owning the active address there is nothing to
+        // identify the wallet by except the active address itself, which on
+        // mainnet is the primary encoding. That is still the *requested* wallet,
+        // so it is a safe answer — unlike `verifiedCredential`, which is always
+        // the user's first wallet and would substitute a different key.
+        const identity = owningCredentialAddress !== null && owningCredentialAddress !== void 0 ? owningCredentialAddress : (this.activeNetworkId === BITCOIN_MAINNET_NETWORK_ID
             ? this.activeAccountAddress
             : undefined);
         if (!identity) {
-            throw new DynamicError('Active account address is required', 'active_account_address_is_required');
+            throw new DynamicError(`Could not resolve the wallet identity for active address ${(_d = this.activeAccountAddress) !== null && _d !== void 0 ? _d : '(unset)'}`, 'active_account_address_is_required');
         }
         return identity;
     }
@@ -181,14 +216,18 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
      * address (wallets created before per-network registration).
      */
     getPaymentAddressForNetwork(network) {
-        var _a, _b, _c;
-        const tagged = (_b = (_a = this.verifiedCredential) === null || _a === void 0 ? void 0 : _a.walletAdditionalAddresses) === null || _b === void 0 ? void 0 : _b.find((addr) => addr.type === 'payment' &&
+        var _a, _b;
+        // Resolved against the wallet that is currently active. Reading
+        // `verifiedCredential` alone would switch the network on the user's first
+        // wallet, handing back an address that belongs to a different wallet.
+        const credential = (_a = this.findCredentialForActiveAddress()) !== null && _a !== void 0 ? _a : this.verifiedCredential;
+        const tagged = (_b = credential === null || credential === void 0 ? void 0 : credential.walletAdditionalAddresses) === null || _b === void 0 ? void 0 : _b.find((addr) => addr.type === 'payment' &&
             addr.network === network);
         if (tagged === null || tagged === void 0 ? void 0 : tagged.address) {
             return tagged.address;
         }
         if (network === 'mainnet') {
-            return (_c = this.verifiedCredential) === null || _c === void 0 ? void 0 : _c.address;
+            return credential === null || credential === void 0 ? void 0 : credential.address;
         }
         return undefined;
     }
@@ -663,7 +702,16 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
             // signs both. Look it up by the wallet identity address rather than the
             // active address, which after a network switch is the testnet encoding.
             const walletIdentityAddress = this.getWalletIdentityAddress();
-            for (const credential of allCredentials) {
+            // Scoped to the credential that owns the active address when there is one.
+            // Searching every credential would let another wallet of the same user
+            // answer for this one, and that is the failure this must not produce: the
+            // PSBT then carries a witness script derived from the wrong key and is
+            // rejected by the network only after broadcast.
+            const owningCredential = this.findCredentialForActiveAddress();
+            const credentialsToSearch = owningCredential
+                ? [owningCredential]
+                : allCredentials;
+            for (const credential of credentialsToSearch) {
                 const { walletAdditionalAddresses } = credential !== null && credential !== void 0 ? credential : {};
                 if (!walletAdditionalAddresses) {
                     continue;
@@ -673,8 +721,8 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                     return additionalAddress.publicKey;
                 }
             }
-            const allAvailableAddresses = allCredentials
-                .flatMap((cred) => { var _a; return (_a = cred.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []; })
+            const allAvailableAddresses = credentialsToSearch
+                .flatMap((cred) => { var _a; return (_a = cred === null || cred === void 0 ? void 0 : cred.walletAdditionalAddresses) !== null && _a !== void 0 ? _a : []; })
                 .map((addr) => addr.address)
                 .join(', ');
             throw new DynamicError(`No additional address found for ${walletIdentityAddress}. Available addresses: ${allAvailableAddresses || 'none'}`, 'no_additional_address_found_for_available');

package/src/index.cjs

@@ -69,6 +69,7 @@ exports.PsbtParser = PsbtParser.PsbtParser;
 exports.BitcoinWallet = BitcoinWallet.BitcoinWallet;
 exports.isBitcoinWallet = isBitcoinWallet.isBitcoinWallet;
 exports.BitcoinProviderHelper = bitcoinProviderHelper.BitcoinProviderHelper;
+exports.DUST_LIMIT = _const.DUST_LIMIT;
 exports.HTTP_STATUS_NOT_FOUND = _const.HTTP_STATUS_NOT_FOUND;
 exports.HTTP_STATUS_TOO_MANY_REQUESTS = _const.HTTP_STATUS_TOO_MANY_REQUESTS;
 exports.BitcoinWalletConnectors = BitcoinWalletConnectors;

package/src/index.d.ts

@@ -6,4 +6,4 @@ export * from './wallet';
 export { UnisatConnector, BitcoinSatsConnectConnector, DynamicWaasBitcoinConnector, } from './connectors';
 export declare const BitcoinWalletConnectors: (props: any) => (import("dist/packages/wallet-connector-core/src").WalletConnectorConstructor | typeof OkxConnector)[];
 export { BitcoinProviderHelper } from './bitcoinProviderHelper';
-export { HTTP_STATUS_NOT_FOUND, HTTP_STATUS_TOO_MANY_REQUESTS } from './const';
+export { DUST_LIMIT, HTTP_STATUS_NOT_FOUND, HTTP_STATUS_TOO_MANY_REQUESTS, } from './const';

package/src/index.js

@@ -34,7 +34,7 @@ export { PsbtParser } from './utils/psbtParser/PsbtParser.js';
 export { BitcoinWallet } from './wallet/BitcoinWallet.js';
 export { isBitcoinWallet } from './wallet/isBitcoinWallet/isBitcoinWallet.js';
 export { BitcoinProviderHelper } from './bitcoinProviderHelper.js';
-export { HTTP_STATUS_NOT_FOUND, HTTP_STATUS_TOO_MANY_REQUESTS } from './const.js';
+export { DUST_LIMIT, HTTP_STATUS_NOT_FOUND, HTTP_STATUS_TOO_MANY_REQUESTS } from './const.js';
 
 assertPackageVersion('@dynamic-labs/bitcoin', version);
 const BitcoinWalletConnectors = (props) => [

package/src/services/MempoolApiService.cjs

@@ -140,7 +140,10 @@ class MempoolApiService {
             if (!response.ok) {
                 const error = yield response.text();
                 logger.debug(`sendRawTransaction - response not ok: ${JSON.stringify(error)}`);
-                throw new utils.DynamicError('sendRawTransaction - failed to send transaction', 'sendrawtransaction_failed_to_send_transaction');
+                // The node's reject reason is the only thing that distinguishes a bad
+                // witness from a fee or mempool problem, so it goes in the thrown
+                // message rather than only into a debug log the integrator cannot read.
+                throw new utils.DynamicError(`sendRawTransaction - failed to send transaction${error ? `: ${error}` : ''}`, 'sendrawtransaction_failed_to_send_transaction');
             }
             return response.text();
         });

package/src/services/MempoolApiService.js

@@ -136,7 +136,10 @@ class MempoolApiService {
             if (!response.ok) {
                 const error = yield response.text();
                 logger.debug(`sendRawTransaction - response not ok: ${JSON.stringify(error)}`);
-                throw new DynamicError('sendRawTransaction - failed to send transaction', 'sendrawtransaction_failed_to_send_transaction');
+                // The node's reject reason is the only thing that distinguishes a bad
+                // witness from a fee or mempool problem, so it goes in the thrown
+                // message rather than only into a debug log the integrator cannot read.
+                throw new DynamicError(`sendRawTransaction - failed to send transaction${error ? `: ${error}` : ''}`, 'sendrawtransaction_failed_to_send_transaction');
             }
             return response.text();
         });