@dynamic-labs/bitcoin 5.3.2 → 5.4.0

package/CHANGELOG.md

@@ -1,4 +1,26 @@
 
+## [5.4.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.3.2...v5.4.0) (2026-08-25)
+
+
+### Features
+
+* **aleo:** wire up signMessage on the WaaS Aleo connector ([#12235](https://github.com/dynamic-labs/dynamic-auth/issues/12235)) ([e56cbf5](https://github.com/dynamic-labs/dynamic-auth/commit/e56cbf5546bdcc21ce916dece43ae36dcea9b808))
+* **waas:** thread isRawScalarImport through importPrivateKey for ed25519 chains ([#12220](https://github.com/dynamic-labs/dynamic-auth/issues/12220)) ([ced9efa](https://github.com/dynamic-labs/dynamic-auth/commit/ced9efac5fa5a4a1280383419f56fe22733722cd))
+* **webview:** add policies message contract and controller ([#12248](https://github.com/dynamic-labs/dynamic-auth/issues/12248)) ([8557c1e](https://github.com/dynamic-labs/dynamic-auth/commit/8557c1ed3861e12f1f06b2bb610184813b577daa))
+
+
+### Bug Fixes
+
+* **bitcoin:** pass the wallet's address type when signing ([#12265](https://github.com/dynamic-labs/dynamic-auth/issues/12265)) ([b8a8eab](https://github.com/dynamic-labs/dynamic-auth/commit/b8a8eab7e4cc294cc307fb10ea6814e76111a274))
+* remediate high-severity tar vulnerability and prune a dead override ([#12268](https://github.com/dynamic-labs/dynamic-auth/issues/12268)) ([6b1b343](https://github.com/dynamic-labs/dynamic-auth/commit/6b1b343e7947e8da30012446677e342ae9bfe14a))
+* **waas-svm:** fix retry-classification and environmentId gaps in [#12240](https://github.com/dynamic-labs/dynamic-auth/issues/12240) ([#12247](https://github.com/dynamic-labs/dynamic-auth/issues/12247)) ([e79cecc](https://github.com/dynamic-labs/dynamic-auth/commit/e79ceccd424c48c3a7f45fdd6ea288c269ac0171))
+* **wallet-connect:** reopen WalletConnect IndexedDB when the browser closes the connection ([#12262](https://github.com/dynamic-labs/dynamic-auth/issues/12262)) ([1a20dde](https://github.com/dynamic-labs/dynamic-auth/commit/1a20ddeaeec590ae3390c9e47ef3c14738379b83))
+
+
+### Performance Improvements
+
+* **ethereum-gasless-core:** parallel 7702 auth signing and long-poll sponsored-tx status ([#12225](https://github.com/dynamic-labs/dynamic-auth/issues/12225)) ([53ca916](https://github.com/dynamic-labs/dynamic-auth/commit/53ca91668f8dd839c52d55a0e5d7bb5257f7f415))
+
 ### [5.3.2](https://github.com/dynamic-labs/dynamic-auth/compare/v5.3.1...v5.3.2) (2026-08-19)
 
 

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "5.3.2";
+var version = "5.4.0";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "5.3.2";
+var version = "5.4.0";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/bitcoin",
-  "version": "5.3.2",
+  "version": "5.4.0",
   "description": "A React SDK for implementing wallet web3 authentication and authorization to your website.",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -29,13 +29,13 @@
     "ecpair": "2.1.0",
     "sats-connect": "4.2.1",
     "jsontokens": "4.0.1",
-    "@dynamic-labs/assert-package-version": "5.3.2",
-    "@dynamic-labs/logger": "5.3.2",
-    "@dynamic-labs/types": "5.3.2",
-    "@dynamic-labs/utils": "5.3.2",
-    "@dynamic-labs/waas": "5.3.2",
-    "@dynamic-labs/wallet-book": "5.3.2",
-    "@dynamic-labs/wallet-connector-core": "5.3.2",
+    "@dynamic-labs/assert-package-version": "5.4.0",
+    "@dynamic-labs/logger": "5.4.0",
+    "@dynamic-labs/types": "5.4.0",
+    "@dynamic-labs/utils": "5.4.0",
+    "@dynamic-labs/waas": "5.4.0",
+    "@dynamic-labs/wallet-book": "5.4.0",
+    "@dynamic-labs/wallet-connector-core": "5.4.0",
     "eventemitter3": "5.0.1"
   },
   "peerDependencies": {}

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.cjs

@@ -136,6 +136,32 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 : 'mainnet');
         });
     }
+    /**
+     * The address type the wallet's key was derived under, read back from the
+     * address itself.
+     *
+     * `bitcoinConfig.addressType` is the only thing that selects a BTC
+     * derivation path downstream (`getMPCChainConfig` throws without it), and a
+     * wallet created by an import carries no server-side derivation metadata to
+     * fall back on — so signing an imported wallet failed while a
+     * Dynamic-created one signed fine. The address already encodes the answer:
+     * witness v0 is P2WPKH (native segwit), v1 is P2TR (taproot), which are
+     * exactly the two types `importPrivateKey` accepts.
+     *
+     * Falls back to native segwit for an address that is not bech32 (a legacy
+     * P2PKH/P2SH encoding cannot come from this connector's own import or
+     * create paths) so a decode failure can never make signing impossible.
+     */
+    getAddressTypeForSigning(walletAddress) {
+        try {
+            const { version } = bitcoinjsLib.address.fromBech32(walletAddress);
+            return (version === 1 ? 'taproot' : 'native_segwit');
+        }
+        catch (error) {
+            this.logger.warn('Could not read the address type from the wallet address; assuming native segwit', { error, walletAddress });
+            return 'native_segwit';
+        }
+    }
     supportsNetworkSwitching() {
         return true;
     }
@@ -603,10 +629,14 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 accountAddress: this.getWalletIdentityAddress(),
             });
             const messageString = typeof message === 'string' ? message : message.raw;
+            const walletIdentityAddress = this.getWalletIdentityAddress();
             return walletClient.signMessage({
-                accountAddress: this.getWalletIdentityAddress(),
+                accountAddress: walletIdentityAddress,
                 authToken: (_e = this.getAuthToken) === null || _e === void 0 ? void 0 : _e.call(this),
-                bitcoinConfig: { network: yield this.getBitcoinNetworkEnum() },
+                bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(walletIdentityAddress),
+                    network: yield this.getBitcoinNetworkEnum(),
+                },
                 context,
                 elevatedAccessToken,
                 message: messageString,
@@ -838,6 +868,7 @@ class DynamicWaasBitcoinConnector extends waas.withDynamicWaas(BitcoinWalletConn
                 accountAddress: this.getWalletIdentityAddress(),
                 authToken: (_d = this.getAuthToken) === null || _d === void 0 ? void 0 : _d.call(this),
                 bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(this.getWalletIdentityAddress()),
                     network: yield this.getBitcoinNetworkEnum(),
                 },
                 elevatedAccessToken,

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.d.ts

@@ -92,21 +92,20 @@ declare const DynamicWaasBitcoinConnector_base: (abstract new (...args: any[]) =
     }): Promise<{
         shareSetId: string;
     }>;
-    importPrivateKey({ privateKey, thresholdSignatureScheme, publicAddressCheck, addressType, legacyWalletId, password, }: {
+    importPrivateKey({ privateKey, thresholdSignatureScheme, publicAddressCheck, addressType, legacyWalletId, password, isRawScalarImport, }: {
         privateKey: string;
         thresholdSignatureScheme?: string | undefined;
         publicAddressCheck?: string | undefined;
         addressType?: string | undefined;
         legacyWalletId?: string | undefined;
         password?: string | undefined;
+        isRawScalarImport?: boolean | undefined;
     }): Promise<void>;
     migrateFromFireblocks({ deviceId, jwt, walletPassword, ncwStorage, expectedAddresses, coinTypes, password, }: {
         deviceId: string;
         jwt: string;
         walletPassword: string;
-        ncwStorage: Record<string, string>; /**
-         * Gets the current Bitcoin network id (1 mainnet, 2 testnet)
-         */
+        ncwStorage: Record<string, string>;
         expectedAddresses: Record<string, string>;
         coinTypes?: Record<string, number> | undefined;
         password?: string | undefined;
@@ -203,7 +202,18 @@ declare const DynamicWaasBitcoinConnector_base: (abstract new (...args: any[]) =
     generateTraceId(): string;
     buildErrorInstrumentContext(error: unknown): {
         errorCode: string | import("@dynamic-labs/utils").ErrorCode;
-        errorMessage: string;
+        errorMessage: string; /**
+         * Wallet identity: keyshares/wallet records are keyed by the wallet's
+         * primary (mainnet) address. On testnet the active address is the same
+         * wallet's per-network encoding — WaaS lookups (password, signing) must use
+         * the primary address (the same key signs both encodings).
+         *
+         * Resolved from the credential that owns the active address, so a user with
+         * several Bitcoin wallets gets the identity of the wallet being spent from.
+         * Never falls back to another wallet's address: a substituted key produces a
+         * signature that looks valid locally and is rejected by the network, so the
+         * failure has to surface here instead.
+         */
         errorType: string | undefined;
     } | {
         errorCode: string;
@@ -289,6 +299,23 @@ export declare class DynamicWaasBitcoinConnector extends DynamicWaasBitcoinConne
      * the active address automatically.
      */
     private getBitcoinNetworkEnum;
+    /**
+     * The address type the wallet's key was derived under, read back from the
+     * address itself.
+     *
+     * `bitcoinConfig.addressType` is the only thing that selects a BTC
+     * derivation path downstream (`getMPCChainConfig` throws without it), and a
+     * wallet created by an import carries no server-side derivation metadata to
+     * fall back on — so signing an imported wallet failed while a
+     * Dynamic-created one signed fine. The address already encodes the answer:
+     * witness v0 is P2WPKH (native segwit), v1 is P2TR (taproot), which are
+     * exactly the two types `importPrivateKey` accepts.
+     *
+     * Falls back to native segwit for an address that is not bech32 (a legacy
+     * P2PKH/P2SH encoding cannot come from this connector's own import or
+     * create paths) so a decode failure can never make signing impossible.
+     */
+    private getAddressTypeForSigning;
     supportsNetworkSwitching(): boolean;
     /**
      * Testnet when the testnet network (id 2) is selected — drives the widget's

package/src/connectors/DynamicWaasBitcoinConnector/DynamicWaasBitcoinConnector.js

@@ -1,6 +1,6 @@
 'use client'
 import { __awaiter } from '../../../_virtual/_tslib.js';
-import { networks, Psbt } from 'bitcoinjs-lib';
+import { address, networks, Psbt } from 'bitcoinjs-lib';
 import { Logger } from '@dynamic-labs/logger';
 import { MFAAction, TokenScope } from '@dynamic-labs/sdk-api-core';
 import { DynamicError } from '@dynamic-labs/utils';
@@ -132,6 +132,32 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 : 'mainnet');
         });
     }
+    /**
+     * The address type the wallet's key was derived under, read back from the
+     * address itself.
+     *
+     * `bitcoinConfig.addressType` is the only thing that selects a BTC
+     * derivation path downstream (`getMPCChainConfig` throws without it), and a
+     * wallet created by an import carries no server-side derivation metadata to
+     * fall back on — so signing an imported wallet failed while a
+     * Dynamic-created one signed fine. The address already encodes the answer:
+     * witness v0 is P2WPKH (native segwit), v1 is P2TR (taproot), which are
+     * exactly the two types `importPrivateKey` accepts.
+     *
+     * Falls back to native segwit for an address that is not bech32 (a legacy
+     * P2PKH/P2SH encoding cannot come from this connector's own import or
+     * create paths) so a decode failure can never make signing impossible.
+     */
+    getAddressTypeForSigning(walletAddress) {
+        try {
+            const { version } = address.fromBech32(walletAddress);
+            return (version === 1 ? 'taproot' : 'native_segwit');
+        }
+        catch (error) {
+            this.logger.warn('Could not read the address type from the wallet address; assuming native segwit', { error, walletAddress });
+            return 'native_segwit';
+        }
+    }
     supportsNetworkSwitching() {
         return true;
     }
@@ -599,10 +625,14 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 accountAddress: this.getWalletIdentityAddress(),
             });
             const messageString = typeof message === 'string' ? message : message.raw;
+            const walletIdentityAddress = this.getWalletIdentityAddress();
             return walletClient.signMessage({
-                accountAddress: this.getWalletIdentityAddress(),
+                accountAddress: walletIdentityAddress,
                 authToken: (_e = this.getAuthToken) === null || _e === void 0 ? void 0 : _e.call(this),
-                bitcoinConfig: { network: yield this.getBitcoinNetworkEnum() },
+                bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(walletIdentityAddress),
+                    network: yield this.getBitcoinNetworkEnum(),
+                },
                 context,
                 elevatedAccessToken,
                 message: messageString,
@@ -834,6 +864,7 @@ class DynamicWaasBitcoinConnector extends withDynamicWaas(BitcoinWalletConnector
                 accountAddress: this.getWalletIdentityAddress(),
                 authToken: (_d = this.getAuthToken) === null || _d === void 0 ? void 0 : _d.call(this),
                 bitcoinConfig: {
+                    addressType: this.getAddressTypeForSigning(this.getWalletIdentityAddress()),
                     network: yield this.getBitcoinNetworkEnum(),
                 },
                 elevatedAccessToken,