@dynamic-labs/utils 5.0.0-rc.0 → 5.0.0-rc.2

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 
-## [5.0.0-rc.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.6...v5.0.0-rc.0) (2026-07-05)
+## [5.0.0-rc.2](https://github.com/dynamic-labs/dynamic-auth/compare/v5.0.0-rc.1...v5.0.0-rc.2) (2026-07-17)
+
+## [5.0.0-rc.1](https://github.com/dynamic-labs/dynamic-auth/compare/v5.0.0-rc.0...v5.0.0-rc.1) (2026-07-17)
+
+
+### ⚠ BREAKING CHANGES
+
+* move legacy embedded wallet to waas upgrade flow to new legacy-embedded-wallet-migration package (#11841)
+* drop default injection of legacy embedded wallet connectors (#11833)
+* remove legacy embedded wallet support (#11979)
+* throw when legacy embedded wallet is detected without migration provider (#11855)
+* remove deprecated eclipse package (#11831)
+* remove deprecated functions and props (#11832)
+
+
+### [4.92.4](https://github.com/dynamic-labs/dynamic-auth/compare/v4.92.3...v4.92.4) (2026-07-16)
+
+
+### Features
+
+* **bitcoin:** per-network address switching and dust-limit send validation [v4] ([#11970](https://github.com/dynamic-labs/dynamic-auth/issues/11970)) ([76a4a9a](https://github.com/dynamic-labs/dynamic-auth/commit/76a4a9a5025d78798ebd1beffe6c0af59d2d029a)), closes [#11896](https://github.com/dynamic-labs/dynamic-auth/issues/11896) [#11800](https://github.com/dynamic-labs/dynamic-auth/issues/11800)
+* **midnight:** per-network addresses in deposit and wallet info views [v4] ([#11949](https://github.com/dynamic-labs/dynamic-auth/issues/11949)) ([978446a](https://github.com/dynamic-labs/dynamic-auth/commit/978446aca8546eb038ba9ed3be0503d10594ee15))
+* **midnight:** resolve wallet address per selected network [v4] ([#11948](https://github.com/dynamic-labs/dynamic-auth/issues/11948)) ([d6f858c](https://github.com/dynamic-labs/dynamic-auth/commit/d6f858c5e35defda7ed73cf97b3fdbe5ed9d131d))
+* set useMetamaskSdk to true by default ([#11926](https://github.com/dynamic-labs/dynamic-auth/issues/11926)) ([75b5a4a](https://github.com/dynamic-labs/dynamic-auth/commit/75b5a4a0fe8b1a375afce145c0b8bdc3ce761117))
+
+
+### Bug Fixes
+
+* **midnight:** align per-network code with the final main iteration [v4] ([#11971](https://github.com/dynamic-labs/dynamic-auth/issues/11971)) ([3ef3ba8](https://github.com/dynamic-labs/dynamic-auth/commit/3ef3ba8c090dfd9e4286b4e51bf350ea5e6feac7))
+* settle social sign-in when captcha is backed out or oauth popup never responds (v4) ([#11956](https://github.com/dynamic-labs/dynamic-auth/issues/11956)) ([ad49477](https://github.com/dynamic-labs/dynamic-auth/commit/ad49477f2acf61a154bb79cbe26b24f803cdb0e2))
+* validate that private key is not empty before upgrading to WaaS ([#11952](https://github.com/dynamic-labs/dynamic-auth/issues/11952)) ([21dfb83](https://github.com/dynamic-labs/dynamic-auth/commit/21dfb83cb29e42b335bc94a0cdd2062cf14a262a))
+
+### [4.92.3](https://github.com/dynamic-labs/dynamic-auth/compare/v4.92.2...v4.92.3) (2026-07-10)
+
+
+### Bug Fixes
+
+* **sdk-react-core:** fix deterministic 'Wallet not found' crash in embedded wallet export (v4) ([#11906](https://github.com/dynamic-labs/dynamic-auth/issues/11906)) ([913ef23](https://github.com/dynamic-labs/dynamic-auth/commit/913ef236b26245488e1cd5db7e874601b65ff0a2)), closes [#11905](https://github.com/dynamic-labs/dynamic-auth/issues/11905) [#11729](https://github.com/dynamic-labs/dynamic-auth/issues/11729)
+
+### [4.92.2](https://github.com/dynamic-labs/dynamic-auth/compare/v4.92.1...v4.92.2) (2026-07-09)
+
+
+### Bug Fixes
+
+* engage captcha during step-up OTP re-auth ([#11879](https://github.com/dynamic-labs/dynamic-auth/issues/11879)) ([585460a](https://github.com/dynamic-labs/dynamic-auth/commit/585460a8976803a8ed0aad16a4a00047bd6c115a))
+* **waas:** gate v1 wallet upgrade on recovery for email-only wallets ([#11897](https://github.com/dynamic-labs/dynamic-auth/issues/11897)) ([5a6f0c6](https://github.com/dynamic-labs/dynamic-auth/commit/5a6f0c6bf3120e59cf502004d09fae56f193e977))
+
+### [4.92.1](https://github.com/dynamic-labs/dynamic-auth/compare/v4.92.0...v4.92.1) (2026-07-09)
+
+
+### Bug Fixes
+
+* **ethereum:** fire in-app-browser redirect on sign for injected EVM wallets that use in-app-browser experience ([#11888](https://github.com/dynamic-labs/dynamic-auth/issues/11888)) ([5116d91](https://github.com/dynamic-labs/dynamic-auth/commit/5116d91ab2c71000a490d72c5d278549d4d8ae9a))
+* **sdk-react-core:** show clear message for Phantom redirect signing failures (v4 backport) ([#11886](https://github.com/dynamic-labs/dynamic-auth/issues/11886)) ([60ac897](https://github.com/dynamic-labs/dynamic-auth/commit/60ac897ba81f7758ccd7a05f97b619785e1f50a7))
+* **social:** use redirect strategy for step-up OAuth on mobile [V4 backport] ([#11881](https://github.com/dynamic-labs/dynamic-auth/issues/11881)) ([42a202e](https://github.com/dynamic-labs/dynamic-auth/commit/42a202e6255de8db73df02eff37c0b10b24fef1a))
+* **solana:** fire in-app-browser redirect on sign and wallet switch ([#11871](https://github.com/dynamic-labs/dynamic-auth/issues/11871)) ([4e2d6b7](https://github.com/dynamic-labs/dynamic-auth/commit/4e2d6b7ac8fdef5bf7c62b8a726ecaef1c6210ec))
+* **solana:** resolve Phantom/Backpack provider collision and Backpack >=0.10.x connect hangs ([#11856](https://github.com/dynamic-labs/dynamic-auth/issues/11856)) ([#11882](https://github.com/dynamic-labs/dynamic-auth/issues/11882)) ([5784aff](https://github.com/dynamic-labs/dynamic-auth/commit/5784aff9641bbc85445fb466f3ab1d6a14331e73))
+
+## [4.92.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.6...v4.92.0) (2026-07-08)
+
+
+### Features
+
+* **captcha:** add Cloudflare Turnstile provider support alongside hCaptcha (v4) ([#11798](https://github.com/dynamic-labs/dynamic-auth/issues/11798)) ([114c770](https://github.com/dynamic-labs/dynamic-auth/commit/114c7702e900d8dedeebe7be867de35d11a93f31))
+
+
+### Bug Fixes
+
+* **ethereum-aa:** resolve kernel client config per wallet (v4) ([#11870](https://github.com/dynamic-labs/dynamic-auth/issues/11870)) ([1b66d79](https://github.com/dynamic-labs/dynamic-auth/commit/1b66d79b4a32b4b6de433b7536bc46e6719224c6))
+* **iframe-setup:** block dangerous URL schemes and verify sender in OPEN_URL ([#11819](https://github.com/dynamic-labs/dynamic-auth/issues/11819)) ([329b27e](https://github.com/dynamic-labs/dynamic-auth/commit/329b27e9fac825916ab227ec8cf93dc343898923))
+* improve social OAuth error messages ([#11837](https://github.com/dynamic-labs/dynamic-auth/issues/11837)) ([8e57c06](https://github.com/dynamic-labs/dynamic-auth/commit/8e57c067c5a89111a32a12fb82e190cf6c46ad67))
+* **react-native-extension:** reject path traversal in downloadFile fileName ([#11816](https://github.com/dynamic-labs/dynamic-auth/issues/11816)) ([9367a56](https://github.com/dynamic-labs/dynamic-auth/commit/9367a56b6daa853d7f7e7f5534261bc68825b239))
+* **sdk-react-core:** display exactly the bytes signed in personal_sign preview ([#11818](https://github.com/dynamic-labs/dynamic-auth/issues/11818)) ([30b9382](https://github.com/dynamic-labs/dynamic-auth/commit/30b93829122f00060cb484aef09a03294c03f651))
+  
 
 ### [4.91.6](https://github.com/dynamic-labs/dynamic-auth/compare/v4.91.5...v4.91.6) (2026-07-03)
 

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "5.0.0-rc.0";
+var version = "5.0.0-rc.2";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "5.0.0-rc.0";
+var version = "5.0.0-rc.2";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/utils",
-  "version": "5.0.0-rc.0",
+  "version": "5.0.0-rc.2",
   "description": "A React SDK for implementing wallet web3 authentication and authorization to your website.",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -18,11 +18,11 @@
   },
   "homepage": "https://www.dynamic.xyz/",
   "dependencies": {
-    "@dynamic-labs/sdk-api-core": "0.0.1046",
+    "@dynamic-labs/sdk-api-core": "0.0.1082",
     "tldts": "6.0.16",
-    "@dynamic-labs/assert-package-version": "5.0.0-rc.0",
-    "@dynamic-labs/logger": "5.0.0-rc.0",
-    "@dynamic-labs/types": "5.0.0-rc.0",
+    "@dynamic-labs/assert-package-version": "5.0.0-rc.2",
+    "@dynamic-labs/logger": "5.0.0-rc.2",
+    "@dynamic-labs/types": "5.0.0-rc.2",
     "buffer": "6.0.3",
     "eventemitter3": "5.0.1"
   },

package/src/errors/WalletRequiresInAppBrowserError.cjs

@@ -0,0 +1,24 @@
+'use client'
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var CustomError = require('./CustomError.cjs');
+
+/**
+ * Error thrown when a wallet action (e.g. signing) requires the wallet's
+ * in-app browser but there is no injected provider available and no way to
+ * redirect the user into it.
+ *
+ * This typically happens on mobile web when an in-app-browser wallet
+ * (Phantom, Backpack, Solflare, MetaMask, ...) has been made primary but the
+ * user is not inside the wallet's in-app browser, so no provider can be
+ * reached to sign.
+ */
+class WalletRequiresInAppBrowserError extends CustomError.CustomError {
+    constructor(walletName) {
+        super(`${walletName} requires its in-app browser to sign. Open this site inside the ${walletName} app's browser and try again.`, 'wallet_requires_in_app_browser');
+    }
+}
+
+exports.WalletRequiresInAppBrowserError = WalletRequiresInAppBrowserError;

package/src/errors/WalletRequiresInAppBrowserError.d.ts

@@ -0,0 +1,14 @@
+import { CustomError } from './CustomError';
+/**
+ * Error thrown when a wallet action (e.g. signing) requires the wallet's
+ * in-app browser but there is no injected provider available and no way to
+ * redirect the user into it.
+ *
+ * This typically happens on mobile web when an in-app-browser wallet
+ * (Phantom, Backpack, Solflare, MetaMask, ...) has been made primary but the
+ * user is not inside the wallet's in-app browser, so no provider can be
+ * reached to sign.
+ */
+export declare class WalletRequiresInAppBrowserError extends CustomError {
+    constructor(walletName: string);
+}

package/src/errors/WalletRequiresInAppBrowserError.js

@@ -0,0 +1,20 @@
+'use client'
+import { CustomError } from './CustomError.js';
+
+/**
+ * Error thrown when a wallet action (e.g. signing) requires the wallet's
+ * in-app browser but there is no injected provider available and no way to
+ * redirect the user into it.
+ *
+ * This typically happens on mobile web when an in-app-browser wallet
+ * (Phantom, Backpack, Solflare, MetaMask, ...) has been made primary but the
+ * user is not inside the wallet's in-app browser, so no provider can be
+ * reached to sign.
+ */
+class WalletRequiresInAppBrowserError extends CustomError {
+    constructor(walletName) {
+        super(`${walletName} requires its in-app browser to sign. Open this site inside the ${walletName} app's browser and try again.`, 'wallet_requires_in_app_browser');
+    }
+}
+
+export { WalletRequiresInAppBrowserError };

package/src/errors/index.d.ts

@@ -47,4 +47,5 @@ export * from './VerificationDataCollectionError';
 export * from './WaasAuthScopePendingError';
 export * from './WalletAddressMismatchError';
 export * from './WalletNotDeployedError';
+export * from './WalletRequiresInAppBrowserError';
 export * from './WalletUsedError';

package/src/index.cjs

@@ -58,6 +58,7 @@ var VerificationDataCollectionError = require('./errors/VerificationDataCollecti
 var WaasAuthScopePendingError = require('./errors/WaasAuthScopePendingError.cjs');
 var WalletAddressMismatchError = require('./errors/WalletAddressMismatchError.cjs');
 var WalletNotDeployedError = require('./errors/WalletNotDeployedError.cjs');
+var WalletRequiresInAppBrowserError = require('./errors/WalletRequiresInAppBrowserError.cjs');
 var WalletUsedError = require('./errors/WalletUsedError.cjs');
 var eventTimeline = require('./eventTimeline/eventTimeline.cjs');
 var formatNumberText = require('./formatNumberText/formatNumberText.cjs');
@@ -186,6 +187,7 @@ exports.WAAS_AUTH_SCOPE_PENDING_CODE = WaasAuthScopePendingError.WAAS_AUTH_SCOPE
 exports.WaasAuthScopePendingError = WaasAuthScopePendingError.WaasAuthScopePendingError;
 exports.WalletAddressMismatchError = WalletAddressMismatchError.WalletAddressMismatchError;
 exports.WalletNotDeployedError = WalletNotDeployedError.WalletNotDeployedError;
+exports.WalletRequiresInAppBrowserError = WalletRequiresInAppBrowserError.WalletRequiresInAppBrowserError;
 exports.WalletUsedError = WalletUsedError.WalletUsedError;
 exports.createEventTimeline = eventTimeline.createEventTimeline;
 exports.formatNumberText = formatNumberText.formatNumberText;

package/src/index.js

@@ -54,6 +54,7 @@ export { VerificationDataCollectionError } from './errors/VerificationDataCollec
 export { WAAS_AUTH_SCOPE_PENDING_CODE, WaasAuthScopePendingError } from './errors/WaasAuthScopePendingError.js';
 export { WalletAddressMismatchError } from './errors/WalletAddressMismatchError.js';
 export { WalletNotDeployedError } from './errors/WalletNotDeployedError.js';
+export { WalletRequiresInAppBrowserError } from './errors/WalletRequiresInAppBrowserError.js';
 export { WalletUsedError } from './errors/WalletUsedError.js';
 export { createEventTimeline } from './eventTimeline/eventTimeline.js';
 export { formatNumberText } from './formatNumberText/formatNumberText.js';

package/src/services/Oauth2Service/createWindowOauth2Service/createWindowOauth2Service.cjs

@@ -12,6 +12,12 @@ var PlatformService = require('../../PlatformService/PlatformService.cjs');
 require('tldts');
 
 let authWindowInterval;
+let authWindowTimeout;
+// The backend caches the oauth init state for 5 minutes; past that the
+// redirect can never complete, so if the popup still hasn't posted a result
+// back by then (eg it landed on an error page and just sits there), settle
+// the promise instead of leaving the pending view up forever.
+const OAUTH_COMPLETION_TIMEOUT_MS = 6 * 60 * 1000;
 const createWindowOauth2Service = () => ({
     getOauthCode: ({ apiProvider, provider, redirectUrl, setIsProcessing, state, oauthLoginUrl, initWebAuth, strategy, }) => new Promise((resolve, _reject) => {
         /**
@@ -46,6 +52,7 @@ const createWindowOauth2Service = () => ({
         const typedReject = (params) => _reject(params);
         // Clear any potential pending timeouts and intervals
         clearInterval(authWindowInterval);
+        clearTimeout(authWindowTimeout);
         const providersWaitingOauthMessage = {};
         const authWindow = window.open('', '_blank', 'width=500,height=600');
         if (authWindow === null || typeof authWindow === 'undefined') {
@@ -58,6 +65,7 @@ const createWindowOauth2Service = () => ({
         }
         const clearListeners = () => {
             window.removeEventListener('message', handleWindowMessage);
+            clearTimeout(authWindowTimeout);
             providersWaitingOauthMessage[provider] = false;
         };
         const handleWindowMessage = (event) => _tslib.__awaiter(void 0, void 0, void 0, function* () {
@@ -170,10 +178,24 @@ const createWindowOauth2Service = () => ({
         // First we store the state in backend
         initWebAuth().then(() => {
             authWindow === null || authWindow === void 0 ? void 0 : authWindow.location.assign(oauthLoginUrl);
+            authWindowTimeout = setTimeout(() => {
+                clearInterval(authWindowInterval);
+                setIsProcessing(false);
+                // already resolved or rejected through another path
+                if (!providersWaitingOauthMessage[provider])
+                    return;
+                clearListeners();
+                authWindow === null || authWindow === void 0 ? void 0 : authWindow.close();
+                typedReject({
+                    code: types.SocialOAuthErrorCode.SESSION_TIMEOUT,
+                    message: `Connecting ${provider} account timed out. Please try again.`,
+                });
+            }, OAUTH_COMPLETION_TIMEOUT_MS);
             authWindowInterval = setInterval(() => {
                 if (!(authWindow === null || authWindow === void 0 ? void 0 : authWindow.closed))
                     return;
                 clearInterval(authWindowInterval);
+                clearTimeout(authWindowTimeout);
                 setIsProcessing(false);
                 // user didn't complete oauth
                 if (providersWaitingOauthMessage[provider])

package/src/services/Oauth2Service/createWindowOauth2Service/createWindowOauth2Service.js

@@ -8,6 +8,12 @@ import { PlatformService } from '../../PlatformService/PlatformService.js';
 import 'tldts';
 
 let authWindowInterval;
+let authWindowTimeout;
+// The backend caches the oauth init state for 5 minutes; past that the
+// redirect can never complete, so if the popup still hasn't posted a result
+// back by then (eg it landed on an error page and just sits there), settle
+// the promise instead of leaving the pending view up forever.
+const OAUTH_COMPLETION_TIMEOUT_MS = 6 * 60 * 1000;
 const createWindowOauth2Service = () => ({
     getOauthCode: ({ apiProvider, provider, redirectUrl, setIsProcessing, state, oauthLoginUrl, initWebAuth, strategy, }) => new Promise((resolve, _reject) => {
         /**
@@ -42,6 +48,7 @@ const createWindowOauth2Service = () => ({
         const typedReject = (params) => _reject(params);
         // Clear any potential pending timeouts and intervals
         clearInterval(authWindowInterval);
+        clearTimeout(authWindowTimeout);
         const providersWaitingOauthMessage = {};
         const authWindow = window.open('', '_blank', 'width=500,height=600');
         if (authWindow === null || typeof authWindow === 'undefined') {
@@ -54,6 +61,7 @@ const createWindowOauth2Service = () => ({
         }
         const clearListeners = () => {
             window.removeEventListener('message', handleWindowMessage);
+            clearTimeout(authWindowTimeout);
             providersWaitingOauthMessage[provider] = false;
         };
         const handleWindowMessage = (event) => __awaiter(void 0, void 0, void 0, function* () {
@@ -166,10 +174,24 @@ const createWindowOauth2Service = () => ({
         // First we store the state in backend
         initWebAuth().then(() => {
             authWindow === null || authWindow === void 0 ? void 0 : authWindow.location.assign(oauthLoginUrl);
+            authWindowTimeout = setTimeout(() => {
+                clearInterval(authWindowInterval);
+                setIsProcessing(false);
+                // already resolved or rejected through another path
+                if (!providersWaitingOauthMessage[provider])
+                    return;
+                clearListeners();
+                authWindow === null || authWindow === void 0 ? void 0 : authWindow.close();
+                typedReject({
+                    code: SocialOAuthErrorCode.SESSION_TIMEOUT,
+                    message: `Connecting ${provider} account timed out. Please try again.`,
+                });
+            }, OAUTH_COMPLETION_TIMEOUT_MS);
             authWindowInterval = setInterval(() => {
                 if (!(authWindow === null || authWindow === void 0 ? void 0 : authWindow.closed))
                     return;
                 clearInterval(authWindowInterval);
+                clearTimeout(authWindowTimeout);
                 setIsProcessing(false);
                 // user didn't complete oauth
                 if (providersWaitingOauthMessage[provider])