@dynamic-labs/sdk-react-core 4.88.5 → 4.89.0

package/CHANGELOG.md

@@ -1,4 +1,27 @@
 
+## [4.89.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.88.6...v4.89.0) (2026-06-16)
+
+
+### Features
+
+* **moonpay:** add useMoonPayOnramp hook ([#11405](https://github.com/dynamic-labs/dynamic-auth/issues/11405)) ([48cb62f](https://github.com/dynamic-labs/dynamic-auth/commit/48cb62fefecb511fcba9359ee6f6096dfef0b125))
+
+
+### Bug Fixes
+
+* get wallet metadata from wallet-book when its present ([#11566](https://github.com/dynamic-labs/dynamic-auth/issues/11566)) ([a1a8ad5](https://github.com/dynamic-labs/dynamic-auth/commit/a1a8ad53c063157b189aea138fa338fcc67dc4dd))
+* **waas:** instant logout — clear key share host-side, background iframe cleanup ([#11583](https://github.com/dynamic-labs/dynamic-auth/issues/11583)) ([0ab3378](https://github.com/dynamic-labs/dynamic-auth/commit/0ab3378efdbbe233069b17fad62b0c126397bc3a))
+* **wagmi-connector:** await disconnect before connect to defuse SyncDynamicWagmi race DYNT-549 ([#11579](https://github.com/dynamic-labs/dynamic-auth/issues/11579)) ([6ac7c0e](https://github.com/dynamic-labs/dynamic-auth/commit/6ac7c0e02ed863342047bc5a1e60be3a66b8a425)), closes [#11131](https://github.com/dynamic-labs/dynamic-auth/issues/11131) [#11513](https://github.com/dynamic-labs/dynamic-auth/issues/11513) [#11516](https://github.com/dynamic-labs/dynamic-auth/issues/11516) [#11496](https://github.com/dynamic-labs/dynamic-auth/issues/11496) [#11513](https://github.com/dynamic-labs/dynamic-auth/issues/11513) [/github.com/dynamic-labs/dynamic-auth/blob/main/packages/wagmi-connector/src/lib/hooks/useConnectorId/useConnectorId.ts#L19-L26](https://github.com/dynamic-labs//github.com/dynamic-labs/dynamic-auth/blob/main/packages/wagmi-connector/src/lib/hooks/useConnectorId/useConnectorId.ts/issues/L19-L26) [#11131](https://github.com/dynamic-labs/dynamic-auth/issues/11131) [#11516](https://github.com/dynamic-labs/dynamic-auth/issues/11516) [#11513](https://github.com/dynamic-labs/dynamic-auth/issues/11513)
+* **react-native:** resolve intermittent "Wallet with id <uuid> not found" after login ([#11575](https://github.com/dynamic-labs/dynamic-auth/issues/11575)) ([9d7a246](https://github.com/dynamic-labs/dynamic-auth/commit/9d7a246167927b9339dc33c10977c6d12783ab88))
+
+### [4.88.6](https://github.com/dynamic-labs/dynamic-auth/compare/v4.88.5...v4.88.6) (2026-06-13)
+
+
+### Bug Fixes
+
+* **DynamicBridgeWidget:** prevent bridge chain sync from reverting manual wallet switches  ([#11560](https://github.com/dynamic-labs/dynamic-auth/issues/11560)) ([40c4973](https://github.com/dynamic-labs/dynamic-auth/commit/40c4973761b3e887577664f72f89d1d6ba285ea3))
+* resolve EOA wallet client on the correct chain for EIP-7702 smart wallets ([#11564](https://github.com/dynamic-labs/dynamic-auth/issues/11564)) ([893b083](https://github.com/dynamic-labs/dynamic-auth/commit/893b0837a450ec683ccd09f2bb54204b77b6bd50))
+
 ### [4.88.5](https://github.com/dynamic-labs/dynamic-auth/compare/v4.88.4...v4.88.5) (2026-06-11)
 
 
@@ -6502,4 +6525,4 @@ Enjoy!
 ### Bug Fixes
 
 * **view-context:** refactor view context to have initial view ([#2268](https://github.com/dynamic-labs/DynamicAuth/issues/2268)) ([0afe6ae](https://github.com/dynamic-labs/DynamicAuth/commit/0afe6ae469f62fd16fd8471322f9295957f607f6))
-* **wcv2:** upgrade universal p
+* **wcv2:** upgrade universal p

package/package.cjs

@@ -3,7 +3,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.88.5";
+var version = "4.89.0";
 var dependencies = {
 	"@dynamic-labs/sdk-api-core": "0.0.1015",
 	"@dynamic-labs-sdk/client": "1.8.2",

package/package.js

@@ -1,5 +1,5 @@
 'use client'
-var version = "4.88.5";
+var version = "4.89.0";
 var dependencies = {
 	"@dynamic-labs/sdk-api-core": "0.0.1015",
 	"@dynamic-labs-sdk/client": "1.8.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/sdk-react-core",
-  "version": "4.88.5",
+  "version": "4.89.0",
   "dependencies": {
     "@dynamic-labs/sdk-api-core": "0.0.1015",
     "@dynamic-labs-sdk/client": "1.8.2",
@@ -17,17 +17,17 @@
     "yup": "0.32.11",
     "react-international-phone": "4.5.0",
     "bs58": "5.0.0",
-    "@dynamic-labs/assert-package-version": "4.88.5",
-    "@dynamic-labs/iconic": "4.88.5",
-    "@dynamic-labs/locale": "4.88.5",
-    "@dynamic-labs/logger": "4.88.5",
-    "@dynamic-labs/multi-wallet": "4.88.5",
-    "@dynamic-labs/rpc-providers": "4.88.5",
-    "@dynamic-labs/store": "4.88.5",
-    "@dynamic-labs/types": "4.88.5",
-    "@dynamic-labs/utils": "4.88.5",
-    "@dynamic-labs/wallet-book": "4.88.5",
-    "@dynamic-labs/wallet-connector-core": "4.88.5",
+    "@dynamic-labs/assert-package-version": "4.89.0",
+    "@dynamic-labs/iconic": "4.89.0",
+    "@dynamic-labs/locale": "4.89.0",
+    "@dynamic-labs/logger": "4.89.0",
+    "@dynamic-labs/multi-wallet": "4.89.0",
+    "@dynamic-labs/rpc-providers": "4.89.0",
+    "@dynamic-labs/store": "4.89.0",
+    "@dynamic-labs/types": "4.89.0",
+    "@dynamic-labs/utils": "4.89.0",
+    "@dynamic-labs/wallet-book": "4.89.0",
+    "@dynamic-labs/wallet-connector-core": "4.89.0",
     "eventemitter3": "5.0.1"
   },
   "devDependencies": {

package/src/lib/context/DynamicContext/types/DynamicContextProps.d.ts

@@ -119,7 +119,7 @@ export interface DynamicContextProps {
         /**
          * If true, the Metamask SDK will be used to connect to the wallet.
          * If false, the injected eip6963 provider will be used and WalletConnect for mobile.
-         * @default true
+         * @default false
          */
         useMetamaskSdk?: boolean;
     };

package/src/lib/context/WalletGroupContext/WalletGroupContext.cjs

@@ -5,6 +5,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
 
 var jsxRuntime = require('react/jsx-runtime');
 var React = require('react');
+var utils = require('@dynamic-labs/utils');
 var createProviderHook = require('../../shared/utils/functions/createProviderHook/createProviderHook.cjs');
 var getWalletGroupType = require('../../utils/functions/getWalletGroupType/getWalletGroupType.cjs');
 var useWalletItemActions = require('../../utils/hooks/useWalletItemActions/useWalletItemActions.cjs');
@@ -22,6 +23,12 @@ const WalletGroupContextProvider = ({ children, }) => {
     const { handleWalletItemClick } = useWalletItemActions.useWalletItemActions();
     const navigateToWalletGroup = React__default["default"].useCallback((walletGroup, { onSelectWallet } = {}) => {
         setSelectedWalletGroup(walletGroup);
+        // On mobile the walletconnect group (EVM + SOL root connectors) should
+        // go straight to the WC wallet picker, not a chain-selection step.
+        if (utils.isMobile() && walletGroup.key === 'walletconnect') {
+            pushView('wallet-connect-mobile-wallets-list');
+            return;
+        }
         const walletGroupType = getWalletGroupType.getWalletGroupType(walletGroup);
         const mapGroupTypeToView = {
             'multi-chain': 'wallet-group',

package/src/lib/context/WalletGroupContext/WalletGroupContext.js

@@ -1,6 +1,7 @@
 'use client'
 import { jsx } from 'react/jsx-runtime';
 import React__default from 'react';
+import { isMobile } from '@dynamic-labs/utils';
 import { createProviderHook } from '../../shared/utils/functions/createProviderHook/createProviderHook.js';
 import { getWalletGroupType } from '../../utils/functions/getWalletGroupType/getWalletGroupType.js';
 import { useWalletItemActions } from '../../utils/hooks/useWalletItemActions/useWalletItemActions.js';
@@ -14,6 +15,12 @@ const WalletGroupContextProvider = ({ children, }) => {
     const { handleWalletItemClick } = useWalletItemActions();
     const navigateToWalletGroup = React__default.useCallback((walletGroup, { onSelectWallet } = {}) => {
         setSelectedWalletGroup(walletGroup);
+        // On mobile the walletconnect group (EVM + SOL root connectors) should
+        // go straight to the WC wallet picker, not a chain-selection step.
+        if (isMobile() && walletGroup.key === 'walletconnect') {
+            pushView('wallet-connect-mobile-wallets-list');
+            return;
+        }
         const walletGroupType = getWalletGroupType(walletGroup);
         const mapGroupTypeToView = {
             'multi-chain': 'wallet-group',

package/src/lib/store/state/dynamicContextProps/defaultDynamicSettings.cjs

@@ -23,7 +23,7 @@ const defaultDynamicSettings = {
     shadowDOMEnabled: true,
     showLockedWalletView: false,
     tokensFilter: (tokens) => tokens,
-    useMetamaskSdk: true,
+    useMetamaskSdk: false,
 };
 
 exports.PUBLIC_PROJECT_LIVE_ENVIRONMENT_ID = PUBLIC_PROJECT_LIVE_ENVIRONMENT_ID;

package/src/lib/store/state/dynamicContextProps/defaultDynamicSettings.d.ts

@@ -16,5 +16,5 @@ export declare const defaultDynamicSettings: {
     shadowDOMEnabled: true;
     showLockedWalletView: false;
     tokensFilter: (tokens: import("@dynamic-labs/sdk-api-core").TokenBalance[]) => import("@dynamic-labs/sdk-api-core").TokenBalance[];
-    useMetamaskSdk: true;
+    useMetamaskSdk: false;
 };

package/src/lib/store/state/dynamicContextProps/defaultDynamicSettings.js

@@ -19,7 +19,7 @@ const defaultDynamicSettings = {
     shadowDOMEnabled: true,
     showLockedWalletView: false,
     tokensFilter: (tokens) => tokens,
-    useMetamaskSdk: true,
+    useMetamaskSdk: false,
 };
 
 export { PUBLIC_PROJECT_LIVE_ENVIRONMENT_ID, defaultDynamicSettings };

package/src/lib/utils/hooks/useWalletItemActions/useHandleWalletItem/useHandleWalletItem.cjs

@@ -13,7 +13,6 @@ var MockContext = require('../../../../context/MockContext/MockContext.cjs');
 var ViewContext = require('../../../../context/ViewContext/ViewContext.cjs');
 var dynamicEvents = require('../../../../events/dynamicEvents.cjs');
 var logger = require('../../../../shared/logger.cjs');
-var authMode = require('../../../../store/state/authMode/authMode.cjs');
 var localStorage = require('../../../constants/localStorage.cjs');
 require('@dynamic-labs/sdk-api-core');
 require('../../../constants/values.cjs');
@@ -41,8 +40,8 @@ var isSelectedWalletAlreadyConnected = require('../../../functions/isSelectedWal
 const useHandleWalletItem = ({ allowAlreadyConnectedWallet, onQrCodeConnect, onConnectOnly, onCustodialWallet, onInstalledExtension, }) => {
     const { setMultiWalletWidgetState, setShowAuthFlow, setSelectedWalletConnectorKey, walletConnectorOptions, setQrcodeUri, setDesktopUri, user, linkedWallets, setLegacyIsVerifying, } = useInternalDynamicContext.useInternalDynamicContext();
     const { mockedSDK } = MockContext.useMockContext();
-    const { setError, setErrorMessage } = ErrorContext.useErrorContext();
-    const { pushView, clearStackAndPushInitialView, replaceView } = ViewContext.useViewContext();
+    const { setError } = ErrorContext.useErrorContext();
+    const { pushView, replaceView } = ViewContext.useViewContext();
     const handleCustodialWalletClick = (walletConnector) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
         logger.logger.debug('handleCustodialWalletClick', walletConnector);
         const twoStepAuthentication = requiresTwoStepAuthentication.requiresTwoStepAuthentication(walletConnector);
@@ -189,31 +188,16 @@ const useHandleWalletItem = ({ allowAlreadyConnectedWallet, onQrCodeConnect, onC
             yield walletConnector.endSession();
         }
         setLegacyIsVerifying(false);
-        const isMetamask = walletConnector.metadata.groupKey === 'metamask';
-        const authMode$1 = authMode.getAuthMode();
-        // in connect only we only allow one account to be connected in the same wallet
-        // also this is only a feature in MM
-        // NOTE: WalletConnect doesn't support requestPermissions - it uses enable() to connect
-        // So we skip chooseAccountsToConnect for WalletConnect connectors
-        if (authMode$1 !== 'connect-only' &&
-            isMetamask &&
-            !walletConnector.isWalletConnect) {
-            try {
-                setSelectedWalletConnectorKey({
-                    chain: walletConnector.connectedChain,
-                    key: walletConnector.key,
-                });
-                pushView('pending-connect');
-                yield walletConnector.chooseAccountsToConnect();
-            }
-            catch (error) {
-                if (error instanceof utils.UserRejectedRequestError) {
-                    setErrorMessage('connection_rejected', undefined, 'wallet-account-select');
-                    clearStackAndPushInitialView();
-                    return;
-                }
-            }
-        }
+        // Historical MM-only account-picker hook point. Until #11056 the dedicated
+        // MetaMaskConnector overrode chooseAccountsToConnect() as a no-op
+        // (`return []`), so this block never prompted. #11056 deleted that
+        // connector and both replacement paths (metamask-evm SDK connector and the
+        // generic injected fallback) inherit the base implementation, which calls
+        // wallet_requestPermissions and ALWAYS pops the MetaMask approval UI —
+        // blocking flows that re-connect an already-connected MM (external-wallet
+        // funding's duplicate-wallet detection, account-switch flows) on a popup
+        // that never resolves. Restore the long-standing no-op behavior by not
+        // calling it at all.
         const supportsMultiAccount = walletConnectorCore.connectorRequiresDisconnectionForNewConnection(walletConnector);
         const isNotInstalledWithQrCodeSupport = walletConnector.isWalletConnect ||
             (!walletConnector.isInstalledOnBrowser() &&

package/src/lib/utils/hooks/useWalletItemActions/useHandleWalletItem/useHandleWalletItem.js

@@ -1,6 +1,6 @@
 'use client'
 import { __awaiter } from '../../../../../../_virtual/_tslib.js';
-import { StorageService, isMobile, UserRejectedRequestError } from '@dynamic-labs/utils';
+import { StorageService, isMobile } from '@dynamic-labs/utils';
 import { isPhantomRedirectConnector, connectorRequiresDisconnectionForNewConnection } from '@dynamic-labs/wallet-connector-core';
 import '../../../../context/DynamicContext/useDynamicContext/useDynamicContext.js';
 import { useInternalDynamicContext } from '../../../../context/DynamicContext/useDynamicContext/useInternalDynamicContext/useInternalDynamicContext.js';
@@ -9,7 +9,6 @@ import { useMockContext } from '../../../../context/MockContext/MockContext.js';
 import { useViewContext } from '../../../../context/ViewContext/ViewContext.js';
 import { dynamicEvents } from '../../../../events/dynamicEvents.js';
 import { logger } from '../../../../shared/logger.js';
-import { getAuthMode } from '../../../../store/state/authMode/authMode.js';
 import { PHANTOM_SIGNATURE_STATE } from '../../../constants/localStorage.js';
 import '@dynamic-labs/sdk-api-core';
 import '../../../constants/values.js';
@@ -37,8 +36,8 @@ import { isSelectedWalletAlreadyConnected } from '../../../functions/isSelectedW
 const useHandleWalletItem = ({ allowAlreadyConnectedWallet, onQrCodeConnect, onConnectOnly, onCustodialWallet, onInstalledExtension, }) => {
     const { setMultiWalletWidgetState, setShowAuthFlow, setSelectedWalletConnectorKey, walletConnectorOptions, setQrcodeUri, setDesktopUri, user, linkedWallets, setLegacyIsVerifying, } = useInternalDynamicContext();
     const { mockedSDK } = useMockContext();
-    const { setError, setErrorMessage } = useErrorContext();
-    const { pushView, clearStackAndPushInitialView, replaceView } = useViewContext();
+    const { setError } = useErrorContext();
+    const { pushView, replaceView } = useViewContext();
     const handleCustodialWalletClick = (walletConnector) => __awaiter(void 0, void 0, void 0, function* () {
         logger.debug('handleCustodialWalletClick', walletConnector);
         const twoStepAuthentication = requiresTwoStepAuthentication(walletConnector);
@@ -185,31 +184,16 @@ const useHandleWalletItem = ({ allowAlreadyConnectedWallet, onQrCodeConnect, onC
             yield walletConnector.endSession();
         }
         setLegacyIsVerifying(false);
-        const isMetamask = walletConnector.metadata.groupKey === 'metamask';
-        const authMode = getAuthMode();
-        // in connect only we only allow one account to be connected in the same wallet
-        // also this is only a feature in MM
-        // NOTE: WalletConnect doesn't support requestPermissions - it uses enable() to connect
-        // So we skip chooseAccountsToConnect for WalletConnect connectors
-        if (authMode !== 'connect-only' &&
-            isMetamask &&
-            !walletConnector.isWalletConnect) {
-            try {
-                setSelectedWalletConnectorKey({
-                    chain: walletConnector.connectedChain,
-                    key: walletConnector.key,
-                });
-                pushView('pending-connect');
-                yield walletConnector.chooseAccountsToConnect();
-            }
-            catch (error) {
-                if (error instanceof UserRejectedRequestError) {
-                    setErrorMessage('connection_rejected', undefined, 'wallet-account-select');
-                    clearStackAndPushInitialView();
-                    return;
-                }
-            }
-        }
+        // Historical MM-only account-picker hook point. Until #11056 the dedicated
+        // MetaMaskConnector overrode chooseAccountsToConnect() as a no-op
+        // (`return []`), so this block never prompted. #11056 deleted that
+        // connector and both replacement paths (metamask-evm SDK connector and the
+        // generic injected fallback) inherit the base implementation, which calls
+        // wallet_requestPermissions and ALWAYS pops the MetaMask approval UI —
+        // blocking flows that re-connect an already-connected MM (external-wallet
+        // funding's duplicate-wallet detection, account-switch flows) on a popup
+        // that never resolves. Restore the long-standing no-op behavior by not
+        // calling it at all.
         const supportsMultiAccount = connectorRequiresDisconnectionForNewConnection(walletConnector);
         const isNotInstalledWithQrCodeSupport = walletConnector.isWalletConnect ||
             (!walletConnector.isInstalledOnBrowser() &&

package/src/lib/widgets/DynamicBridgeWidget/DynamicBridgeWidget.cjs

@@ -123,6 +123,16 @@ const DynamicBridgeWidget = ({ className, variant = 'modal', iconVariant = 'chai
     const { showAuthFlow, setShowBridgeWidget, bridgeChains, setShowAuthFlow, connectedWallets, sdkHasLoaded, primaryWallet, setPrimaryWallet, } = useInternalDynamicContext.useInternalDynamicContext();
     const { widgetRef, inlineControlsRef } = DynamicBridgeWidgetContext.useDynamicBridgeWidgetContext();
     const { t } = reactI18next.useTranslation();
+    // Use refs so the bridgeChains effect only fires when bridgeChains changes,
+    // not when the user manually switches the primary wallet.
+    // setPrimaryWallet is a useCallback that recreates on every primaryWalletId
+    // change, so it must also be a ref to avoid retriggering the effect.
+    const primaryWalletRef = React.useRef(primaryWallet);
+    primaryWalletRef.current = primaryWallet;
+    const connectedWalletsRef = React.useRef(connectedWallets);
+    connectedWalletsRef.current = connectedWallets;
+    const setPrimaryWalletRef = React.useRef(setPrimaryWallet);
+    setPrimaryWalletRef.current = setPrimaryWallet;
     const closeOnOutsideClick = React.useCallback((e) => {
         var _a;
         const target = e.composedPath().shift();
@@ -134,20 +144,22 @@ const DynamicBridgeWidget = ({ className, variant = 'modal', iconVariant = 'chai
     }, [inlineControlsRef, variant, showAuthFlow, setShowBridgeWidget]);
     index.useOnClickOutside(widgetRef, closeOnOutsideClick);
     React.useEffect(() => {
+        const currentPrimaryWallet = primaryWalletRef.current;
+        const currentConnectedWallets = connectedWalletsRef.current;
         // no need to update primary wallet if it's already set to the correct chain
-        if (!primaryWallet ||
+        if (!currentPrimaryWallet ||
             !bridgeChains ||
-            connectedWallets.length <= 1 ||
-            primaryWallet.chain === bridgeChains[0].chain) {
+            currentConnectedWallets.length <= 1 ||
+            currentPrimaryWallet.chain === bridgeChains[0].chain) {
             return;
         }
         // find a connected wallet that matches the primary bridge chain
-        const newPrimaryWallet = connectedWallets.find((wallet) => wallet.chain === bridgeChains[0].chain);
+        const newPrimaryWallet = currentConnectedWallets.find((wallet) => wallet.chain === bridgeChains[0].chain);
         // if a new primary wallet is found, update the primary wallet
         if (newPrimaryWallet) {
             logger.logger.debug('[DynamicBridgeWidget] bridgeChains changed - updating primary wallet', {
                 bridgeChains,
-                connectedWallets: connectedWallets.map((wallet) => ({
+                connectedWallets: currentConnectedWallets.map((wallet) => ({
                     address: wallet.address,
                     chain: wallet.chain,
                     id: wallet.id,
@@ -158,14 +170,14 @@ const DynamicBridgeWidget = ({ className, variant = 'modal', iconVariant = 'chai
                     id: newPrimaryWallet.id,
                 },
                 oldPrimaryWallet: {
-                    address: primaryWallet.address,
-                    chain: primaryWallet.chain,
-                    id: primaryWallet.id,
+                    address: currentPrimaryWallet.address,
+                    chain: currentPrimaryWallet.chain,
+                    id: currentPrimaryWallet.id,
                 },
             });
-            setPrimaryWallet(newPrimaryWallet.id);
+            setPrimaryWalletRef.current(newPrimaryWallet.id);
         }
-    }, [bridgeChains, primaryWallet, connectedWallets, setPrimaryWallet]);
+    }, [bridgeChains]);
     return (jsxRuntime.jsxs(ShadowDOM.ShadowDOM, { id: 'dynamic-bridge-widget', className: 'dynamic-widget__container', children: [jsxRuntime.jsx(InlineWidget.InlineWidget, { ref: inlineControlsRef, className: className, dataTestId: 'BridgeWidgetNav', children: bridgeChains === null || bridgeChains === void 0 ? void 0 : bridgeChains.map(({ chain }) => {
                     const ChainIcon = getChainIcon.getChainIcon(chain);
                     if (!sdkHasLoaded) {

package/src/lib/widgets/DynamicBridgeWidget/DynamicBridgeWidget.js

@@ -1,6 +1,6 @@
 'use client'
 import { jsxs, jsx } from 'react/jsx-runtime';
-import { useCallback, useEffect } from 'react';
+import { useRef, useCallback, useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 import { WalletIcon } from '@dynamic-labs/wallet-book';
 import '../../components/Accordion/components/AccordionItem/AccordionItem.js';
@@ -119,6 +119,16 @@ const DynamicBridgeWidget = ({ className, variant = 'modal', iconVariant = 'chai
     const { showAuthFlow, setShowBridgeWidget, bridgeChains, setShowAuthFlow, connectedWallets, sdkHasLoaded, primaryWallet, setPrimaryWallet, } = useInternalDynamicContext();
     const { widgetRef, inlineControlsRef } = useDynamicBridgeWidgetContext();
     const { t } = useTranslation();
+    // Use refs so the bridgeChains effect only fires when bridgeChains changes,
+    // not when the user manually switches the primary wallet.
+    // setPrimaryWallet is a useCallback that recreates on every primaryWalletId
+    // change, so it must also be a ref to avoid retriggering the effect.
+    const primaryWalletRef = useRef(primaryWallet);
+    primaryWalletRef.current = primaryWallet;
+    const connectedWalletsRef = useRef(connectedWallets);
+    connectedWalletsRef.current = connectedWallets;
+    const setPrimaryWalletRef = useRef(setPrimaryWallet);
+    setPrimaryWalletRef.current = setPrimaryWallet;
     const closeOnOutsideClick = useCallback((e) => {
         var _a;
         const target = e.composedPath().shift();
@@ -130,20 +140,22 @@ const DynamicBridgeWidget = ({ className, variant = 'modal', iconVariant = 'chai
     }, [inlineControlsRef, variant, showAuthFlow, setShowBridgeWidget]);
     useOnClickOutside(widgetRef, closeOnOutsideClick);
     useEffect(() => {
+        const currentPrimaryWallet = primaryWalletRef.current;
+        const currentConnectedWallets = connectedWalletsRef.current;
         // no need to update primary wallet if it's already set to the correct chain
-        if (!primaryWallet ||
+        if (!currentPrimaryWallet ||
             !bridgeChains ||
-            connectedWallets.length <= 1 ||
-            primaryWallet.chain === bridgeChains[0].chain) {
+            currentConnectedWallets.length <= 1 ||
+            currentPrimaryWallet.chain === bridgeChains[0].chain) {
             return;
         }
         // find a connected wallet that matches the primary bridge chain
-        const newPrimaryWallet = connectedWallets.find((wallet) => wallet.chain === bridgeChains[0].chain);
+        const newPrimaryWallet = currentConnectedWallets.find((wallet) => wallet.chain === bridgeChains[0].chain);
         // if a new primary wallet is found, update the primary wallet
         if (newPrimaryWallet) {
             logger.debug('[DynamicBridgeWidget] bridgeChains changed - updating primary wallet', {
                 bridgeChains,
-                connectedWallets: connectedWallets.map((wallet) => ({
+                connectedWallets: currentConnectedWallets.map((wallet) => ({
                     address: wallet.address,
                     chain: wallet.chain,
                     id: wallet.id,
@@ -154,14 +166,14 @@ const DynamicBridgeWidget = ({ className, variant = 'modal', iconVariant = 'chai
                     id: newPrimaryWallet.id,
                 },
                 oldPrimaryWallet: {
-                    address: primaryWallet.address,
-                    chain: primaryWallet.chain,
-                    id: primaryWallet.id,
+                    address: currentPrimaryWallet.address,
+                    chain: currentPrimaryWallet.chain,
+                    id: currentPrimaryWallet.id,
                 },
             });
-            setPrimaryWallet(newPrimaryWallet.id);
+            setPrimaryWalletRef.current(newPrimaryWallet.id);
         }
-    }, [bridgeChains, primaryWallet, connectedWallets, setPrimaryWallet]);
+    }, [bridgeChains]);
     return (jsxs(ShadowDOM, { id: 'dynamic-bridge-widget', className: 'dynamic-widget__container', children: [jsx(InlineWidget, { ref: inlineControlsRef, className: className, dataTestId: 'BridgeWidgetNav', children: bridgeChains === null || bridgeChains === void 0 ? void 0 : bridgeChains.map(({ chain }) => {
                     const ChainIcon = getChainIcon(chain);
                     if (!sdkHasLoaded) {

package/src/lib/widgets/DynamicWidget/views/MoonPayOnramp/CryptoTokenSelectScreen/CryptoTokenSelectScreen.d.ts

@@ -0,0 +1,14 @@
+import { FC } from 'react';
+export type CryptoToken = {
+    code: string;
+    icon?: string;
+    name: string;
+};
+type CryptoTokenSelectScreenProps = {
+    onClose: () => void;
+    onSelectToken: (tokenCode: string) => void;
+    tokens: CryptoToken[];
+    currentToken: string;
+};
+export declare const CryptoTokenSelectScreen: FC<CryptoTokenSelectScreenProps>;
+export {};

package/src/lib/widgets/DynamicWidget/views/MoonPayOnramp/CryptoTokenSelectScreen/index.d.ts

@@ -0,0 +1 @@
+export { CryptoTokenSelectScreen, type CryptoToken, } from './CryptoTokenSelectScreen';

package/src/lib/widgets/DynamicWidget/views/MoonPayOnramp/isTrustedImageUrl.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Validates that an externally-sourced image URL is safe to render as an
+ * `<img src>`. Token icon URLs come from the MoonPay currencies API response,
+ * so they are treated as untrusted input: only absolute HTTPS URLs are allowed,
+ * which rules out `javascript:`, `data:`, and other non-network schemes.
+ */
+export declare const isTrustedImageUrl: (url: string | undefined) => url is string;

package/src/lib/widgets/DynamicWidget/views/MoonPayOnramp/useMoonPayOnramp.d.ts

@@ -0,0 +1,30 @@
+import { useInternalDynamicContext } from '../../../../context/DynamicContext/useDynamicContext';
+import type { CryptoToken } from './CryptoTokenSelectScreen';
+export type UseMoonPayOnrampParams = {
+    /** Pre-select a token; falls back to the first available currency when invalid. */
+    initialToken?: string;
+    merchantName?: string;
+    /** Override the wallet address; defaults to the primary wallet address. */
+    walletAddressOverride?: string;
+    /** Called with the signed MoonPay URL instead of opening a popup. */
+    onPaymentCreated?: (paymentUrl: string) => void;
+};
+export type UseMoonPayOnrampReturn = {
+    primaryWallet: ReturnType<typeof useInternalDynamicContext>['primaryWallet'];
+    availableTokens: CryptoToken[];
+    tokensLoading: boolean;
+    tokensError: boolean;
+    selectedToken: string;
+    setSelectedToken: (tokenCode: string) => void;
+    isOpening: boolean;
+    error: string | null;
+    effectiveWalletAddress: string;
+    openMoonPay: () => void;
+};
+/**
+ * Owns the MoonPay onramp data + actions: fetching supported currencies for the
+ * connected wallet's chain, tracking the selected token, and opening the signed
+ * MoonPay URL (validated against *.moonpay.com over HTTPS). The presentational
+ * MoonPayOnramp view consumes this hook.
+ */
+export declare const useMoonPayOnramp: ({ initialToken, merchantName, walletAddressOverride, onPaymentCreated, }: UseMoonPayOnrampParams) => UseMoonPayOnrampReturn;