@dynamic-labs/waas 4.88.5 → 4.89.0

package/CHANGELOG.md

@@ -1,4 +1,27 @@
 
+## [4.89.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.88.6...v4.89.0) (2026-06-16)
+
+
+### Features
+
+* **moonpay:** add useMoonPayOnramp hook ([#11405](https://github.com/dynamic-labs/dynamic-auth/issues/11405)) ([48cb62f](https://github.com/dynamic-labs/dynamic-auth/commit/48cb62fefecb511fcba9359ee6f6096dfef0b125))
+
+
+### Bug Fixes
+
+* get wallet metadata from wallet-book when its present ([#11566](https://github.com/dynamic-labs/dynamic-auth/issues/11566)) ([a1a8ad5](https://github.com/dynamic-labs/dynamic-auth/commit/a1a8ad53c063157b189aea138fa338fcc67dc4dd))
+* **waas:** instant logout — clear key share host-side, background iframe cleanup ([#11583](https://github.com/dynamic-labs/dynamic-auth/issues/11583)) ([0ab3378](https://github.com/dynamic-labs/dynamic-auth/commit/0ab3378efdbbe233069b17fad62b0c126397bc3a))
+* **wagmi-connector:** await disconnect before connect to defuse SyncDynamicWagmi race DYNT-549 ([#11579](https://github.com/dynamic-labs/dynamic-auth/issues/11579)) ([6ac7c0e](https://github.com/dynamic-labs/dynamic-auth/commit/6ac7c0e02ed863342047bc5a1e60be3a66b8a425)), closes [#11131](https://github.com/dynamic-labs/dynamic-auth/issues/11131) [#11513](https://github.com/dynamic-labs/dynamic-auth/issues/11513) [#11516](https://github.com/dynamic-labs/dynamic-auth/issues/11516) [#11496](https://github.com/dynamic-labs/dynamic-auth/issues/11496) [#11513](https://github.com/dynamic-labs/dynamic-auth/issues/11513) [/github.com/dynamic-labs/dynamic-auth/blob/main/packages/wagmi-connector/src/lib/hooks/useConnectorId/useConnectorId.ts#L19-L26](https://github.com/dynamic-labs//github.com/dynamic-labs/dynamic-auth/blob/main/packages/wagmi-connector/src/lib/hooks/useConnectorId/useConnectorId.ts/issues/L19-L26) [#11131](https://github.com/dynamic-labs/dynamic-auth/issues/11131) [#11516](https://github.com/dynamic-labs/dynamic-auth/issues/11516) [#11513](https://github.com/dynamic-labs/dynamic-auth/issues/11513)
+* **react-native:** resolve intermittent "Wallet with id <uuid> not found" after login ([#11575](https://github.com/dynamic-labs/dynamic-auth/issues/11575)) ([9d7a246](https://github.com/dynamic-labs/dynamic-auth/commit/9d7a246167927b9339dc33c10977c6d12783ab88))
+
+### [4.88.6](https://github.com/dynamic-labs/dynamic-auth/compare/v4.88.5...v4.88.6) (2026-06-13)
+
+
+### Bug Fixes
+
+* **DynamicBridgeWidget:** prevent bridge chain sync from reverting manual wallet switches  ([#11560](https://github.com/dynamic-labs/dynamic-auth/issues/11560)) ([40c4973](https://github.com/dynamic-labs/dynamic-auth/commit/40c4973761b3e887577664f72f89d1d6ba285ea3))
+* resolve EOA wallet client on the correct chain for EIP-7702 smart wallets ([#11564](https://github.com/dynamic-labs/dynamic-auth/issues/11564)) ([893b083](https://github.com/dynamic-labs/dynamic-auth/commit/893b0837a450ec683ccd09f2bb54204b77b6bd50))
+
 ### [4.88.5](https://github.com/dynamic-labs/dynamic-auth/compare/v4.88.4...v4.88.5) (2026-06-11)
 
 
@@ -6502,4 +6525,4 @@ Enjoy!
 ### Bug Fixes
 
 * **view-context:** refactor view context to have initial view ([#2268](https://github.com/dynamic-labs/DynamicAuth/issues/2268)) ([0afe6ae](https://github.com/dynamic-labs/DynamicAuth/commit/0afe6ae469f62fd16fd8471322f9295957f607f6))
-* **wcv2:** upgrade universal p
+* **wcv2:** upgrade universal p

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.88.5";
+var version = "4.89.0";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "4.88.5";
+var version = "4.89.0";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/waas",
-  "version": "4.88.5",
+  "version": "4.89.0",
   "type": "module",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -17,17 +17,17 @@
   },
   "dependencies": {
     "@dynamic-labs-sdk/client": "1.8.2",
-    "@dynamic-labs/assert-package-version": "4.88.5",
+    "@dynamic-labs/assert-package-version": "4.89.0",
     "@dynamic-labs/sdk-api-core": "0.0.1015",
     "@dynamic-labs-wallet/browser-wallet-client": "1.0.16",
     "@dynamic-labs-wallet/forward-mpc-client": "0.10.1",
-    "@dynamic-labs/ethereum-core": "4.88.5",
-    "@dynamic-labs/logger": "4.88.5",
-    "@dynamic-labs/solana-core": "4.88.5",
-    "@dynamic-labs/sui-core": "4.88.5",
-    "@dynamic-labs/utils": "4.88.5",
-    "@dynamic-labs/wallet-book": "4.88.5",
-    "@dynamic-labs/wallet-connector-core": "4.88.5"
+    "@dynamic-labs/ethereum-core": "4.89.0",
+    "@dynamic-labs/logger": "4.89.0",
+    "@dynamic-labs/solana-core": "4.89.0",
+    "@dynamic-labs/sui-core": "4.89.0",
+    "@dynamic-labs/utils": "4.89.0",
+    "@dynamic-labs/wallet-book": "4.89.0",
+    "@dynamic-labs/wallet-connector-core": "4.89.0"
   },
   "peerDependencies": {}
 }

package/src/DynamicWaasMixin.cjs

@@ -12,6 +12,9 @@ var constants = require('../utils/constants.cjs');
 var createWaasClientSecureStorage = require('../utils/createWaasClientSecureStorage.cjs');
 var instrumentation = require('../utils/instrumentation.cjs');
 
+// Fallback error code used when a thrown value carries no code, or when
+// formatting the error itself fails.
+const UNKNOWN_ERROR_CODE = 'unknown';
 // This class is common across all waas connectors
 class WaasExportHandler {
     constructor() {
@@ -624,7 +627,28 @@ const withDynamicWaas = (BaseClass) => {
                 // in. On explicit user-initiated logout, shares are always cleared for
                 // security.
                 if (reason !== 'token-expired') {
-                    yield waasClient.cleanup();
+                    // Clear the MPC key share directly on the host's local secure storage.
+                    // This is fast and guaranteed, independent of the iframe round-trip
+                    // cleanup below — whose request-channel timeout (plus a recovery retry)
+                    // can block logout for ~10s on slow devices where secureStorage is slow
+                    // to ACK. Awaited because it is a local operation (milliseconds).
+                    const accountAddress = yield this.getActiveAccountAddress();
+                    if (accountAddress) {
+                        try {
+                            yield createWaasClientSecureStorage.createWaasClientSecureStorage().removeClientKeyShare(accountAddress);
+                        }
+                        catch (error) {
+                            this.instrument('[endSession] direct key share removal failed', Object.assign({ key: 'endSession-removeClientKeyShare-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
+                        }
+                    }
+                    // Tear down the iframe and run its best-effort storage cleanup in the
+                    // background so logout returns immediately instead of blocking on the
+                    // iframe cleanup's request-channel timeout. The iframe handler already
+                    // swallows its own errors, and the DOM teardown obsoletes anything it
+                    // misses. Promise.resolve guards against a non-promise return in tests.
+                    void Promise.resolve(waasClient.cleanup()).catch((error) => {
+                        this.instrument('[endSession] background iframe cleanup failed', Object.assign({ key: 'endSession-cleanup-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
+                    });
                 }
                 this.dynamicWaasClient = undefined;
             });
@@ -661,6 +685,33 @@ const withDynamicWaas = (BaseClass) => {
                 .map((byte) => byte.toString(16).padStart(2, '0'))
                 .join('');
         }
+        /**
+         * Normalizes an unknown thrown value into the error fields used across
+         * instrumentation so callers don't re-derive them at each catch site.
+         *
+         * Wrapped in try/catch: this is best-effort logging, and a value that
+         * resists formatting (e.g. an object whose toString throws) must never
+         * turn a log line into an exception that blocks the calling flow such as
+         * logout.
+         *
+         * `public` (not `private`) because the TS `private` keyword can't be used
+         * on this mixin's exported class expression (TS4094), and ECMAScript
+         * `#private` isn't supported by the package's Jest/Babel transform. It is
+         * internal-only despite the modifier — same constraint as `instrument`.
+         */
+        buildErrorInstrumentContext(error) {
+            var _a, _b;
+            try {
+                return {
+                    errorCode: (_a = error === null || error === void 0 ? void 0 : error.code) !== null && _a !== void 0 ? _a : UNKNOWN_ERROR_CODE,
+                    errorMessage: error instanceof Error ? error.message : String(error),
+                    errorType: (_b = error === null || error === void 0 ? void 0 : error.constructor) === null || _b === void 0 ? void 0 : _b.name,
+                };
+            }
+            catch (_c) {
+                return { errorCode: UNKNOWN_ERROR_CODE };
+            }
+        }
         /**
          * Helper method to instrument with automatic properties inclusion
          */
@@ -676,7 +727,6 @@ const withDynamicWaas = (BaseClass) => {
         }
         instrumentAsync(_a) {
             return _tslib.__awaiter(this, arguments, void 0, function* ({ operation, resource, fn, context, }) {
-                var _b, _c;
                 const timing = new instrumentation.InstrumentationTimer(context === null || context === void 0 ? void 0 : context.startTime);
                 if (context === null || context === void 0 ? void 0 : context.stepStartTime) {
                     timing.setStepStartTime(context.stepStartTime);
@@ -693,11 +743,7 @@ const withDynamicWaas = (BaseClass) => {
                 catch (error) {
                     const isUserRejection = error instanceof utils.UserRejectedRequestError ||
                         (error === null || error === void 0 ? void 0 : error.code) === 'user_rejected_request';
-                    const errorContext = {
-                        errorCode: (_b = error === null || error === void 0 ? void 0 : error.code) !== null && _b !== void 0 ? _b : 'unknown',
-                        errorMessage: error instanceof Error ? error.message : String(error),
-                        errorType: (_c = error === null || error === void 0 ? void 0 : error.constructor) === null || _c === void 0 ? void 0 : _c.name,
-                    };
+                    const errorContext = this.buildErrorInstrumentContext(error);
                     if (isUserRejection) {
                         // User-initiated cancellations are expected — debug only, no backend noise
                         this.logger.debug(`[${operation}] ${resource} - cancelled`, Object.assign(Object.assign({ key: `${resource}-cancelled`, operation, stepTime: timing.getStepElapsed(), time: timing.getElapsed() }, context), errorContext));

package/src/DynamicWaasMixin.d.ts

@@ -166,6 +166,29 @@ export declare const withDynamicWaas: <T extends abstract new (...args: any[]) =
      */
     getConnectedAccounts(): Promise<string[]>;
     generateTraceId(): string;
+    /**
+     * Normalizes an unknown thrown value into the error fields used across
+     * instrumentation so callers don't re-derive them at each catch site.
+     *
+     * Wrapped in try/catch: this is best-effort logging, and a value that
+     * resists formatting (e.g. an object whose toString throws) must never
+     * turn a log line into an exception that blocks the calling flow such as
+     * logout.
+     *
+     * `public` (not `private`) because the TS `private` keyword can't be used
+     * on this mixin's exported class expression (TS4094), and ECMAScript
+     * `#private` isn't supported by the package's Jest/Babel transform. It is
+     * internal-only despite the modifier — same constraint as `instrument`.
+     */
+    buildErrorInstrumentContext(error: unknown): {
+        errorCode: string | import("@dynamic-labs/utils").ErrorCode;
+        errorMessage: string;
+        errorType: string | undefined;
+    } | {
+        errorCode: string;
+        errorMessage?: undefined;
+        errorType?: undefined;
+    };
     /**
      * Helper method to instrument with automatic properties inclusion
      */

package/src/DynamicWaasMixin.js

@@ -8,6 +8,9 @@ import { DEFAULT_BASE_API_URL, DEFAULT_BASE_MPC_RELAY_API_URL } from '../utils/c
 import { createWaasClientSecureStorage } from '../utils/createWaasClientSecureStorage.js';
 import { InstrumentationTimer } from '../utils/instrumentation.js';
 
+// Fallback error code used when a thrown value carries no code, or when
+// formatting the error itself fails.
+const UNKNOWN_ERROR_CODE = 'unknown';
 // This class is common across all waas connectors
 class WaasExportHandler {
     constructor() {
@@ -620,7 +623,28 @@ const withDynamicWaas = (BaseClass) => {
                 // in. On explicit user-initiated logout, shares are always cleared for
                 // security.
                 if (reason !== 'token-expired') {
-                    yield waasClient.cleanup();
+                    // Clear the MPC key share directly on the host's local secure storage.
+                    // This is fast and guaranteed, independent of the iframe round-trip
+                    // cleanup below — whose request-channel timeout (plus a recovery retry)
+                    // can block logout for ~10s on slow devices where secureStorage is slow
+                    // to ACK. Awaited because it is a local operation (milliseconds).
+                    const accountAddress = yield this.getActiveAccountAddress();
+                    if (accountAddress) {
+                        try {
+                            yield createWaasClientSecureStorage().removeClientKeyShare(accountAddress);
+                        }
+                        catch (error) {
+                            this.instrument('[endSession] direct key share removal failed', Object.assign({ key: 'endSession-removeClientKeyShare-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
+                        }
+                    }
+                    // Tear down the iframe and run its best-effort storage cleanup in the
+                    // background so logout returns immediately instead of blocking on the
+                    // iframe cleanup's request-channel timeout. The iframe handler already
+                    // swallows its own errors, and the DOM teardown obsoletes anything it
+                    // misses. Promise.resolve guards against a non-promise return in tests.
+                    void Promise.resolve(waasClient.cleanup()).catch((error) => {
+                        this.instrument('[endSession] background iframe cleanup failed', Object.assign({ key: 'endSession-cleanup-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
+                    });
                 }
                 this.dynamicWaasClient = undefined;
             });
@@ -657,6 +681,33 @@ const withDynamicWaas = (BaseClass) => {
                 .map((byte) => byte.toString(16).padStart(2, '0'))
                 .join('');
         }
+        /**
+         * Normalizes an unknown thrown value into the error fields used across
+         * instrumentation so callers don't re-derive them at each catch site.
+         *
+         * Wrapped in try/catch: this is best-effort logging, and a value that
+         * resists formatting (e.g. an object whose toString throws) must never
+         * turn a log line into an exception that blocks the calling flow such as
+         * logout.
+         *
+         * `public` (not `private`) because the TS `private` keyword can't be used
+         * on this mixin's exported class expression (TS4094), and ECMAScript
+         * `#private` isn't supported by the package's Jest/Babel transform. It is
+         * internal-only despite the modifier — same constraint as `instrument`.
+         */
+        buildErrorInstrumentContext(error) {
+            var _a, _b;
+            try {
+                return {
+                    errorCode: (_a = error === null || error === void 0 ? void 0 : error.code) !== null && _a !== void 0 ? _a : UNKNOWN_ERROR_CODE,
+                    errorMessage: error instanceof Error ? error.message : String(error),
+                    errorType: (_b = error === null || error === void 0 ? void 0 : error.constructor) === null || _b === void 0 ? void 0 : _b.name,
+                };
+            }
+            catch (_c) {
+                return { errorCode: UNKNOWN_ERROR_CODE };
+            }
+        }
         /**
          * Helper method to instrument with automatic properties inclusion
          */
@@ -672,7 +723,6 @@ const withDynamicWaas = (BaseClass) => {
         }
         instrumentAsync(_a) {
             return __awaiter(this, arguments, void 0, function* ({ operation, resource, fn, context, }) {
-                var _b, _c;
                 const timing = new InstrumentationTimer(context === null || context === void 0 ? void 0 : context.startTime);
                 if (context === null || context === void 0 ? void 0 : context.stepStartTime) {
                     timing.setStepStartTime(context.stepStartTime);
@@ -689,11 +739,7 @@ const withDynamicWaas = (BaseClass) => {
                 catch (error) {
                     const isUserRejection = error instanceof UserRejectedRequestError ||
                         (error === null || error === void 0 ? void 0 : error.code) === 'user_rejected_request';
-                    const errorContext = {
-                        errorCode: (_b = error === null || error === void 0 ? void 0 : error.code) !== null && _b !== void 0 ? _b : 'unknown',
-                        errorMessage: error instanceof Error ? error.message : String(error),
-                        errorType: (_c = error === null || error === void 0 ? void 0 : error.constructor) === null || _c === void 0 ? void 0 : _c.name,
-                    };
+                    const errorContext = this.buildErrorInstrumentContext(error);
                     if (isUserRejection) {
                         // User-initiated cancellations are expected — debug only, no backend noise
                         this.logger.debug(`[${operation}] ${resource} - cancelled`, Object.assign(Object.assign({ key: `${resource}-cancelled`, operation, stepTime: timing.getStepElapsed(), time: timing.getElapsed() }, context), errorContext));