@dynamic-labs/sdk-react-core 4.92.0 → 4.92.1

package/CHANGELOG.md

@@ -1,4 +1,15 @@
 
+### [4.92.1](https://github.com/dynamic-labs/dynamic-auth/compare/v4.92.0...v4.92.1) (2026-07-09)
+
+
+### Bug Fixes
+
+* **ethereum:** fire in-app-browser redirect on sign for injected EVM wallets that use in-app-browser experience ([#11888](https://github.com/dynamic-labs/dynamic-auth/issues/11888)) ([5116d91](https://github.com/dynamic-labs/dynamic-auth/commit/5116d91ab2c71000a490d72c5d278549d4d8ae9a))
+* **sdk-react-core:** show clear message for Phantom redirect signing failures (v4 backport) ([#11886](https://github.com/dynamic-labs/dynamic-auth/issues/11886)) ([60ac897](https://github.com/dynamic-labs/dynamic-auth/commit/60ac897ba81f7758ccd7a05f97b619785e1f50a7))
+* **social:** use redirect strategy for step-up OAuth on mobile [V4 backport] ([#11881](https://github.com/dynamic-labs/dynamic-auth/issues/11881)) ([42a202e](https://github.com/dynamic-labs/dynamic-auth/commit/42a202e6255de8db73df02eff37c0b10b24fef1a))
+* **solana:** fire in-app-browser redirect on sign and wallet switch ([#11871](https://github.com/dynamic-labs/dynamic-auth/issues/11871)) ([4e2d6b7](https://github.com/dynamic-labs/dynamic-auth/commit/4e2d6b7ac8fdef5bf7c62b8a726ecaef1c6210ec))
+* **solana:** resolve Phantom/Backpack provider collision and Backpack >=0.10.x connect hangs ([#11856](https://github.com/dynamic-labs/dynamic-auth/issues/11856)) ([#11882](https://github.com/dynamic-labs/dynamic-auth/issues/11882)) ([5784aff](https://github.com/dynamic-labs/dynamic-auth/commit/5784aff9641bbc85445fb466f3ab1d6a14331e73))
+
 ## [4.92.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.6...v4.92.0) (2026-07-08)
 
 

package/package.cjs

@@ -3,7 +3,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.92.0";
+var version = "4.92.1";
 var dependencies = {
 	"@dynamic-labs/sdk-api-core": "0.0.1067",
 	"@dynamic-labs-sdk/client": "1.18.0",

package/package.js

@@ -1,5 +1,5 @@
 'use client'
-var version = "4.92.0";
+var version = "4.92.1";
 var dependencies = {
 	"@dynamic-labs/sdk-api-core": "0.0.1067",
 	"@dynamic-labs-sdk/client": "1.18.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/sdk-react-core",
-  "version": "4.92.0",
+  "version": "4.92.1",
   "dependencies": {
     "@dynamic-labs/sdk-api-core": "0.0.1067",
     "@dynamic-labs-sdk/client": "1.18.0",
@@ -18,17 +18,17 @@
     "react-i18next": "13.5.0",
     "react-international-phone": "4.5.0",
     "yup": "0.32.11",
-    "@dynamic-labs/assert-package-version": "4.92.0",
-    "@dynamic-labs/iconic": "4.92.0",
-    "@dynamic-labs/locale": "4.92.0",
-    "@dynamic-labs/logger": "4.92.0",
-    "@dynamic-labs/multi-wallet": "4.92.0",
-    "@dynamic-labs/rpc-providers": "4.92.0",
-    "@dynamic-labs/store": "4.92.0",
-    "@dynamic-labs/types": "4.92.0",
-    "@dynamic-labs/utils": "4.92.0",
-    "@dynamic-labs/wallet-book": "4.92.0",
-    "@dynamic-labs/wallet-connector-core": "4.92.0",
+    "@dynamic-labs/assert-package-version": "4.92.1",
+    "@dynamic-labs/iconic": "4.92.1",
+    "@dynamic-labs/locale": "4.92.1",
+    "@dynamic-labs/logger": "4.92.1",
+    "@dynamic-labs/multi-wallet": "4.92.1",
+    "@dynamic-labs/rpc-providers": "4.92.1",
+    "@dynamic-labs/store": "4.92.1",
+    "@dynamic-labs/types": "4.92.1",
+    "@dynamic-labs/utils": "4.92.1",
+    "@dynamic-labs/wallet-book": "4.92.1",
+    "@dynamic-labs/wallet-connector-core": "4.92.1",
     "eventemitter3": "5.0.1"
   },
   "devDependencies": {

package/src/lib/context/ErrorContext/ErrorContext.cjs

@@ -16,6 +16,14 @@ const UNLOCK_WALLET_MESSAGE = 'Please unlock your wallet extension and try again
 const INTERNAL_ERROR_MESSAGE = 'There was an internal error. Please try again.';
 const AUTHENTICATION_FAILED_MESSAGE = 'Authentication failed. Please try again.';
 const SESSION_TIMEOUT_MESSAGE = 'Session time out. Please try again.';
+const PHANTOM_SIGNING_FAILED_MESSAGE = "Phantom couldn't sign with the selected account. Switch accounts in Phantom or update the app, then try again.";
+/**
+ * Error code used when Phantom relays an internal signing failure via its
+ * deep-link redirect (e.g. the active account has no usable key to sign).
+ * Phantom's own code for these is generic (e.g. `500`), so we normalize to
+ * this key to surface an actionable message instead of the default fallback.
+ */
+const PHANTOM_SIGNING_FAILED_ERROR_CODE = 'phantom_signing_failed';
 let _errorMessageMap;
 const getErrorMessageMap = () => {
     if (!_errorMessageMap) {
@@ -32,13 +40,14 @@ const getErrorMessageMap = () => {
             4900: INTERNAL_ERROR_MESSAGE,
             5001: MESSAGE_SIGNATURE_DENIED,
             5002: MESSAGE_SIGNATURE_DENIED,
-            account_already_linked_to_different_profile: 'This social account is already linked to a different profile.',
+            [PHANTOM_SIGNING_FAILED_ERROR_CODE]: PHANTOM_SIGNING_FAILED_MESSAGE,
             [utils.SdkErrorCode.CONNECTION_REJECTED]: 'Connection rejected. Please try again.',
-            general_error: DEFAULT_ERROR_MESSAGE,
+            account_already_linked_to_different_profile: 'This social account is already linked to a different profile.',
             [utils.SdkErrorCode.INVALID_EMAIL_VERIFICATION]: 'The verification link is no longer valid. Please start again.',
+            general_error: DEFAULT_ERROR_MESSAGE,
             invalid_provider: 'This sign-in provider is not supported.',
-            metamask_timeout: 'Whoops. Looks like something went wrong. Please try again.',
             [utils.SdkErrorCode.MISSING_NONCE]: DEFAULT_ERROR_MESSAGE,
+            metamask_timeout: 'Whoops. Looks like something went wrong. Please try again.',
             'missing-public-address': 'Connection cancelled. Please try again',
             no_account_linked: 'No linked account was found for this provider.',
             no_auth_code: AUTHENTICATION_FAILED_MESSAGE,
@@ -64,6 +73,12 @@ const getErrorMessageMap = () => {
     }
     return _errorMessageMap;
 };
+/**
+ * Returns the mapped, user-facing message for a given error code, or
+ * `undefined` when the code is not recognized. Exported so callers can decide
+ * whether to normalize an unmapped code before displaying it.
+ */
+const getMappedErrorMessage = (status) => getErrorMessageMap()[status];
 const ErrorContext = React.createContext(undefined);
 const ErrorContextProvider = ({ children }) => {
     /** The error message as a string, used as a fallback if translation is not available */
@@ -117,4 +132,6 @@ const useErrorContext = createProviderHook.createProviderHook(ErrorContext, 'Err
 
 exports.ErrorContext = ErrorContext;
 exports.ErrorContextProvider = ErrorContextProvider;
+exports.PHANTOM_SIGNING_FAILED_ERROR_CODE = PHANTOM_SIGNING_FAILED_ERROR_CODE;
+exports.getMappedErrorMessage = getMappedErrorMessage;
 exports.useErrorContext = useErrorContext;

package/src/lib/context/ErrorContext/ErrorContext.d.ts

@@ -1,5 +1,12 @@
 import { ReactNode } from 'react';
 import { ErrorCode } from '@dynamic-labs/utils';
+/**
+ * Error code used when Phantom relays an internal signing failure via its
+ * deep-link redirect (e.g. the active account has no usable key to sign).
+ * Phantom's own code for these is generic (e.g. `500`), so we normalize to
+ * this key to surface an actionable message instead of the default fallback.
+ */
+export declare const PHANTOM_SIGNING_FAILED_ERROR_CODE = "phantom_signing_failed";
 interface ErrorContextProps {
     error: string | undefined;
     errorCode: ErrorCode | string | undefined;
@@ -8,6 +15,12 @@ interface ErrorContextProps {
     setDefaultError: (error?: unknown) => void;
     clearError(): void;
 }
+/**
+ * Returns the mapped, user-facing message for a given error code, or
+ * `undefined` when the code is not recognized. Exported so callers can decide
+ * whether to normalize an unmapped code before displaying it.
+ */
+export declare const getMappedErrorMessage: (status: string) => string | undefined;
 export declare const ErrorContext: import("react").Context<ErrorContextProps | undefined>;
 export declare const ErrorContextProvider: ({ children }: {
     children: ReactNode;

package/src/lib/context/ErrorContext/ErrorContext.js

@@ -12,6 +12,14 @@ const UNLOCK_WALLET_MESSAGE = 'Please unlock your wallet extension and try again
 const INTERNAL_ERROR_MESSAGE = 'There was an internal error. Please try again.';
 const AUTHENTICATION_FAILED_MESSAGE = 'Authentication failed. Please try again.';
 const SESSION_TIMEOUT_MESSAGE = 'Session time out. Please try again.';
+const PHANTOM_SIGNING_FAILED_MESSAGE = "Phantom couldn't sign with the selected account. Switch accounts in Phantom or update the app, then try again.";
+/**
+ * Error code used when Phantom relays an internal signing failure via its
+ * deep-link redirect (e.g. the active account has no usable key to sign).
+ * Phantom's own code for these is generic (e.g. `500`), so we normalize to
+ * this key to surface an actionable message instead of the default fallback.
+ */
+const PHANTOM_SIGNING_FAILED_ERROR_CODE = 'phantom_signing_failed';
 let _errorMessageMap;
 const getErrorMessageMap = () => {
     if (!_errorMessageMap) {
@@ -28,13 +36,14 @@ const getErrorMessageMap = () => {
             4900: INTERNAL_ERROR_MESSAGE,
             5001: MESSAGE_SIGNATURE_DENIED,
             5002: MESSAGE_SIGNATURE_DENIED,
-            account_already_linked_to_different_profile: 'This social account is already linked to a different profile.',
+            [PHANTOM_SIGNING_FAILED_ERROR_CODE]: PHANTOM_SIGNING_FAILED_MESSAGE,
             [SdkErrorCode.CONNECTION_REJECTED]: 'Connection rejected. Please try again.',
-            general_error: DEFAULT_ERROR_MESSAGE,
+            account_already_linked_to_different_profile: 'This social account is already linked to a different profile.',
             [SdkErrorCode.INVALID_EMAIL_VERIFICATION]: 'The verification link is no longer valid. Please start again.',
+            general_error: DEFAULT_ERROR_MESSAGE,
             invalid_provider: 'This sign-in provider is not supported.',
-            metamask_timeout: 'Whoops. Looks like something went wrong. Please try again.',
             [SdkErrorCode.MISSING_NONCE]: DEFAULT_ERROR_MESSAGE,
+            metamask_timeout: 'Whoops. Looks like something went wrong. Please try again.',
             'missing-public-address': 'Connection cancelled. Please try again',
             no_account_linked: 'No linked account was found for this provider.',
             no_auth_code: AUTHENTICATION_FAILED_MESSAGE,
@@ -60,6 +69,12 @@ const getErrorMessageMap = () => {
     }
     return _errorMessageMap;
 };
+/**
+ * Returns the mapped, user-facing message for a given error code, or
+ * `undefined` when the code is not recognized. Exported so callers can decide
+ * whether to normalize an unmapped code before displaying it.
+ */
+const getMappedErrorMessage = (status) => getErrorMessageMap()[status];
 const ErrorContext = createContext(undefined);
 const ErrorContextProvider = ({ children }) => {
     /** The error message as a string, used as a fallback if translation is not available */
@@ -111,4 +126,4 @@ const ErrorContextProvider = ({ children }) => {
 };
 const useErrorContext = createProviderHook(ErrorContext, 'ErrorContextProvider');
 
-export { ErrorContext, ErrorContextProvider, useErrorContext };
+export { ErrorContext, ErrorContextProvider, PHANTOM_SIGNING_FAILED_ERROR_CODE, getMappedErrorMessage, useErrorContext };

package/src/lib/context/PhantomRedirectContext/useResponseHandlers.cjs

@@ -379,8 +379,17 @@ const useResponseHandlers = () => {
             return;
         }
         instrumentAuthLoginFailed.instrumentAuthLoginFailed({ code: errorCode, message: errorMessage }, { authOrigin: 'phantom-redirect' });
-        setErrorMessage(errorCode, undefined, 'phantom-redirect');
         const method = phantomRedirectConnector.consumeMethod();
+        // Phantom relays its own signing failures back through the redirect URL
+        // (e.g. the active account has no usable key to sign). These come with a
+        // generic, unmapped code, which would otherwise surface the default
+        // "Something went wrong" message. When the failed operation was a signing
+        // request, normalize unmapped codes to an actionable Phantom message.
+        const isUnmappedSigningError = method !== undefined && ErrorContext.getMappedErrorMessage(errorCode) === undefined;
+        const errorMessageKey = isUnmappedSigningError
+            ? ErrorContext.PHANTOM_SIGNING_FAILED_ERROR_CODE
+            : errorCode;
+        setErrorMessage(errorMessageKey, errorMessage, 'phantom-redirect');
         logger.logger.logVerboseTroubleshootingMessage('[PhantomRedirect handleErrorResponse] consumed method, emitting error', { errorCode, errorMessage, method });
         switch (method) {
             case 'signAndSendTransaction':

package/src/lib/context/PhantomRedirectContext/useResponseHandlers.js

@@ -10,7 +10,7 @@ import '../DynamicContext/useDynamicContext/useDynamicContext.js';
 import { useInternalDynamicContext } from '../DynamicContext/useDynamicContext/useInternalDynamicContext/useInternalDynamicContext.js';
 import { useCaptchaContext } from '../CaptchaContext/CaptchaContext.js';
 import '@dynamic-labs/sdk-api-core';
-import { useErrorContext } from '../ErrorContext/ErrorContext.js';
+import { useErrorContext, getMappedErrorMessage, PHANTOM_SIGNING_FAILED_ERROR_CODE } from '../ErrorContext/ErrorContext.js';
 import { useViewContext } from '../ViewContext/ViewContext.js';
 import '@dynamic-labs/iconic';
 import 'react/jsx-runtime';
@@ -375,8 +375,17 @@ const useResponseHandlers = () => {
             return;
         }
         instrumentAuthLoginFailed({ code: errorCode, message: errorMessage }, { authOrigin: 'phantom-redirect' });
-        setErrorMessage(errorCode, undefined, 'phantom-redirect');
         const method = phantomRedirectConnector.consumeMethod();
+        // Phantom relays its own signing failures back through the redirect URL
+        // (e.g. the active account has no usable key to sign). These come with a
+        // generic, unmapped code, which would otherwise surface the default
+        // "Something went wrong" message. When the failed operation was a signing
+        // request, normalize unmapped codes to an actionable Phantom message.
+        const isUnmappedSigningError = method !== undefined && getMappedErrorMessage(errorCode) === undefined;
+        const errorMessageKey = isUnmappedSigningError
+            ? PHANTOM_SIGNING_FAILED_ERROR_CODE
+            : errorCode;
+        setErrorMessage(errorMessageKey, errorMessage, 'phantom-redirect');
         logger.logVerboseTroubleshootingMessage('[PhantomRedirect handleErrorResponse] consumed method, emitting error', { errorCode, errorMessage, method });
         switch (method) {
             case 'signAndSendTransaction':

package/src/lib/utils/hooks/useSocialAuth/useSocialAuth.cjs

@@ -394,7 +394,13 @@ const useSocialAuth = ({ onSettled, onError, onFarcasterUrl, }) => {
         }
         const isMobile = utils.isMobile();
         try {
-            const effectiveStrategy = authMode === 'stepup' || forcePopup ? 'popup' : strategy;
+            // Step-up normally forces a popup, but on mobile browsers popups
+            // opened after an async gap (e.g. captcha verification) lose user
+            // activation and are blocked (notably iOS Safari). Fall back to the
+            // configured strategy (redirect) on mobile so the flow can resume.
+            const effectiveStrategy = (authMode === 'stepup' && !isMobile) || forcePopup
+                ? 'popup'
+                : strategy;
             const authCode = yield utils.Oauth2Service.getOauthCode({
                 apiProvider: getProviderByType.getProviderByType((_k = projectSettings === null || projectSettings === void 0 ? void 0 : projectSettings.providers) !== null && _k !== void 0 ? _k : [], provider),
                 getOAuthResultFromApi: () => oauth.getOAuthResult(environmentId, provider, {

package/src/lib/utils/hooks/useSocialAuth/useSocialAuth.js

@@ -390,7 +390,13 @@ const useSocialAuth = ({ onSettled, onError, onFarcasterUrl, }) => {
         }
         const isMobile$1 = isMobile();
         try {
-            const effectiveStrategy = authMode === 'stepup' || forcePopup ? 'popup' : strategy;
+            // Step-up normally forces a popup, but on mobile browsers popups
+            // opened after an async gap (e.g. captcha verification) lose user
+            // activation and are blocked (notably iOS Safari). Fall back to the
+            // configured strategy (redirect) on mobile so the flow can resume.
+            const effectiveStrategy = (authMode === 'stepup' && !isMobile$1) || forcePopup
+                ? 'popup'
+                : strategy;
             const authCode = yield Oauth2Service.getOauthCode({
                 apiProvider: getProviderByType((_k = projectSettings === null || projectSettings === void 0 ? void 0 : projectSettings.providers) !== null && _k !== void 0 ? _k : [], provider),
                 getOAuthResultFromApi: () => getOAuthResult(environmentId, provider, {

package/src/lib/utils/hooks/useSwitchWallet/useSwitchWallet.cjs

@@ -5,6 +5,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
 
 var _tslib = require('../../../../../_virtual/_tslib.cjs');
 var React = require('react');
+var utils = require('@dynamic-labs/utils');
 var walletConnectorCore = require('@dynamic-labs/wallet-connector-core');
 require('../../../context/DynamicContext/useDynamicContext/useDynamicContext.cjs');
 var useInternalDynamicContext = require('../../../context/DynamicContext/useDynamicContext/useInternalDynamicContext/useInternalDynamicContext.cjs');
@@ -49,6 +50,19 @@ const useSwitchWallet = () => {
         if (!wallet.connector.isAvailable) {
             throw new Error("Cannot make this wallet active, since this wallet doesn't have a compatible connector on this device.");
         }
+        // On mobile, an in-app-browser wallet that isn't injected on the current
+        // browser (e.g. switching to a linked Phantom on mobile web) has no
+        // provider to sign with. Trigger the wallet's in-app-browser redirect up
+        // front so the user lands inside the wallet app, instead of the switch
+        // silently succeeding and every later signature failing. The connector
+        // self-gates: this is a no-op for installed, embedded, or redirect-only
+        // wallets.
+        if (utils.isMobile()) {
+            const didOpenInAppBrowser = wallet.connector.openInAppBrowserIfRequired();
+            if (didOpenInAppBrowser) {
+                return;
+            }
+        }
         const eoaWallet = getEOAWallet(wallet);
         if (eoaWallet && walletConnectorCore.isTurnkeyWalletConnector(eoaWallet.connector)) {
             const sortedVcs = (_b = (_a = eoaWallet.connector) === null || _a === void 0 ? void 0 : _a.verifiedCredentials) === null || _b === void 0 ? void 0 : _b.reduce((acc, vc) => {

package/src/lib/utils/hooks/useSwitchWallet/useSwitchWallet.js

@@ -1,6 +1,7 @@
 'use client'
 import { __awaiter } from '../../../../../_virtual/_tslib.js';
 import { useCallback } from 'react';
+import { isMobile } from '@dynamic-labs/utils';
 import { isTurnkeyWalletConnector, isEmailWalletConnector } from '@dynamic-labs/wallet-connector-core';
 import '../../../context/DynamicContext/useDynamicContext/useDynamicContext.js';
 import { useInternalDynamicContext } from '../../../context/DynamicContext/useDynamicContext/useInternalDynamicContext/useInternalDynamicContext.js';
@@ -45,6 +46,19 @@ const useSwitchWallet = () => {
         if (!wallet.connector.isAvailable) {
             throw new Error("Cannot make this wallet active, since this wallet doesn't have a compatible connector on this device.");
         }
+        // On mobile, an in-app-browser wallet that isn't injected on the current
+        // browser (e.g. switching to a linked Phantom on mobile web) has no
+        // provider to sign with. Trigger the wallet's in-app-browser redirect up
+        // front so the user lands inside the wallet app, instead of the switch
+        // silently succeeding and every later signature failing. The connector
+        // self-gates: this is a no-op for installed, embedded, or redirect-only
+        // wallets.
+        if (isMobile()) {
+            const didOpenInAppBrowser = wallet.connector.openInAppBrowserIfRequired();
+            if (didOpenInAppBrowser) {
+                return;
+            }
+        }
         const eoaWallet = getEOAWallet(wallet);
         if (eoaWallet && isTurnkeyWalletConnector(eoaWallet.connector)) {
             const sortedVcs = (_b = (_a = eoaWallet.connector) === null || _a === void 0 ? void 0 : _a.verifiedCredentials) === null || _b === void 0 ? void 0 : _b.reduce((acc, vc) => {