@dynamic-labs/waas 4.89.0 → 4.91.0

package/CHANGELOG.md

@@ -1,4 +1,40 @@
 
+## [4.91.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.90.0...v4.91.0) (2026-06-23)
+
+
+### Features
+
+* **midnight:** add WaaS layer to @dynamic-labs/midnight ([#11006](https://github.com/dynamic-labs/dynamic-auth/issues/11006)) ([01b9d16](https://github.com/dynamic-labs/dynamic-auth/commit/01b9d16d0ba92a141a9be546ca00cca4029894d5))
+* **sdk-react-core:** widget support for Midnight multi-address display + export hiding ([#11008](https://github.com/dynamic-labs/dynamic-auth/issues/11008)) ([87320b4](https://github.com/dynamic-labs/dynamic-auth/commit/87320b4d6e286b88e17f144641346e16a27e9e71))
+* **waas:** wire session public key through host backup ops for keyshare diagnostics [DYNT-1280] ([#11675](https://github.com/dynamic-labs/dynamic-auth/issues/11675)) ([4f7981c](https://github.com/dynamic-labs/dynamic-auth/commit/4f7981c009930469dec7b3dec93f20f99bbe5498))
+
+
+### Bug Fixes
+
+* **ethereum-aa:** make ZeroDevConnector inert instead of throwing when ZeroDev config is absent ([#11610](https://github.com/dynamic-labs/dynamic-auth/issues/11610)) ([a3aab6a](https://github.com/dynamic-labs/dynamic-auth/commit/a3aab6a97e2e996f96b725f9336704b844f79603))
+* **react-native-extension:** fall back to react-native-webview when embedded native module is unavailable ([#11683](https://github.com/dynamic-labs/dynamic-auth/issues/11683)) ([3f8d92c](https://github.com/dynamic-labs/dynamic-auth/commit/3f8d92ca0c327128b16e3355ab2f4e63d2c8e731))
+* **sdk-react-core:** warn instead of throwing when ZeroDev connector is absent ([#11611](https://github.com/dynamic-labs/dynamic-auth/issues/11611)) ([5836252](https://github.com/dynamic-labs/dynamic-auth/commit/58362524e45205399c0fdc5b92414190d1929e0b))
+* **waas-evm:** sign EOA transactions with the resolved chainId, not the connector default ([#11653](https://github.com/dynamic-labs/dynamic-auth/issues/11653)) ([e634098](https://github.com/dynamic-labs/dynamic-auth/commit/e634098f0f23f4c53f92a580db6f4aacbd6b1f92))
+
+## [4.90.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.89.0...v4.90.0) (2026-06-19)
+
+
+### Features
+
+* add microsoft to social providers list ([#11631](https://github.com/dynamic-labs/dynamic-auth/issues/11631)) ([761b82d](https://github.com/dynamic-labs/dynamic-auth/commit/761b82dea2e2e86ec1c8b3fc8bab32ed72492132))
+* **sdk-react-core:** preconnect to waas iframe origin at auth-flow start ([#11549](https://github.com/dynamic-labs/dynamic-auth/issues/11549)) ([1bb810c](https://github.com/dynamic-labs/dynamic-auth/commit/1bb810c4eb3d592b43f62c1eaf5450a0e42981c9)), closes [dynamic-labs/dynamic-wallet-sdk#1314](https://github.com/dynamic-labs/dynamic-wallet-sdk/issues/1314)
+* **waas:** opt into SDK eager key-share recovery, drop host RECOVER loop (DYNT-1125) ([#11620](https://github.com/dynamic-labs/dynamic-auth/issues/11620)) ([4bef955](https://github.com/dynamic-labs/dynamic-auth/commit/4bef955b902a7e484ba8bd6323582843bb692a17))
+* **wallet-connector-core:** add isMidnightConnector util + Midnight interface hooks ([#11005](https://github.com/dynamic-labs/dynamic-auth/issues/11005)) ([55117a8](https://github.com/dynamic-labs/dynamic-auth/commit/55117a8cf59640d00b358f68be8df6b29231fab5))
+
+
+### Bug Fixes
+
+* **sdk-react-core:** gate smart-wallet init on user:basic scope ([#11624](https://github.com/dynamic-labs/dynamic-auth/issues/11624)) ([9f891a4](https://github.com/dynamic-labs/dynamic-auth/commit/9f891a46a191532acdd4a91b74c4586089ef0e1a)), closes [#11623](https://github.com/dynamic-labs/dynamic-auth/issues/11623) [#11623](https://github.com/dynamic-labs/dynamic-auth/issues/11623) [#11626](https://github.com/dynamic-labs/dynamic-auth/issues/11626)
+* **sdk-react-core:** search wallet list by metadata name in addition to connector name ([#11638](https://github.com/dynamic-labs/dynamic-auth/issues/11638)) ([a647614](https://github.com/dynamic-labs/dynamic-auth/commit/a647614bcba769e09ef59bf1ddb925ce9835842e))
+* **waas:** rebuild WaaS client on session change after step-up reauth ([#11581](https://github.com/dynamic-labs/dynamic-auth/issues/11581)) ([2b7093e](https://github.com/dynamic-labs/dynamic-auth/commit/2b7093e27f57f1dfcdd303361d436d9bf33e28a9))
+* **waas:** refuse to build WaaS client while auth scope is pending (createRooms 401 chokepoint) ([#11623](https://github.com/dynamic-labs/dynamic-auth/issues/11623)) ([08755f0](https://github.com/dynamic-labs/dynamic-auth/commit/08755f0bda2b74c7bcdff3d0ac9c228a5205ad6e)), closes [#11624](https://github.com/dynamic-labs/dynamic-auth/issues/11624)
+* **wallet-connect:** skip address comparison on reconnect when expectedAddress is empty ([#11639](https://github.com/dynamic-labs/dynamic-auth/issues/11639)) ([8d665cf](https://github.com/dynamic-labs/dynamic-auth/commit/8d665cf3bf1fb0e498d71f14cc8a53d91593c23d))
+
 ## [4.89.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.88.6...v4.89.0) (2026-06-16)
 
 

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.89.0";
+var version = "4.91.0";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "4.89.0";
+var version = "4.91.0";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/waas",
-  "version": "4.89.0",
+  "version": "4.91.0",
   "type": "module",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -16,18 +16,18 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@dynamic-labs-sdk/client": "1.8.2",
-    "@dynamic-labs/assert-package-version": "4.89.0",
-    "@dynamic-labs/sdk-api-core": "0.0.1015",
-    "@dynamic-labs-wallet/browser-wallet-client": "1.0.16",
-    "@dynamic-labs-wallet/forward-mpc-client": "0.10.1",
-    "@dynamic-labs/ethereum-core": "4.89.0",
-    "@dynamic-labs/logger": "4.89.0",
-    "@dynamic-labs/solana-core": "4.89.0",
-    "@dynamic-labs/sui-core": "4.89.0",
-    "@dynamic-labs/utils": "4.89.0",
-    "@dynamic-labs/wallet-book": "4.89.0",
-    "@dynamic-labs/wallet-connector-core": "4.89.0"
+    "@dynamic-labs-sdk/client": "1.12.1",
+    "@dynamic-labs/assert-package-version": "4.91.0",
+    "@dynamic-labs/sdk-api-core": "0.0.1046",
+    "@dynamic-labs-wallet/browser-wallet-client": "1.0.44",
+    "@dynamic-labs-wallet/forward-mpc-client": "0.12.0",
+    "@dynamic-labs/ethereum-core": "4.91.0",
+    "@dynamic-labs/logger": "4.91.0",
+    "@dynamic-labs/solana-core": "4.91.0",
+    "@dynamic-labs/sui-core": "4.91.0",
+    "@dynamic-labs/utils": "4.91.0",
+    "@dynamic-labs/wallet-book": "4.91.0",
+    "@dynamic-labs/wallet-connector-core": "4.91.0"
   },
   "peerDependencies": {}
 }

package/src/DynamicWaasMixin.cjs

@@ -11,6 +11,7 @@ var _package = require('../package.cjs');
 var constants = require('../utils/constants.cjs');
 var createWaasClientSecureStorage = require('../utils/createWaasClientSecureStorage.cjs');
 var instrumentation = require('../utils/instrumentation.cjs');
+var tokenHasPendingAuthScope = require('../utils/tokenHasPendingAuthScope.cjs');
 
 // Fallback error code used when a thrown value carries no code, or when
 // formatting the error itself fails.
@@ -126,9 +127,12 @@ const withDynamicWaas = (BaseClass) => {
         setGetSignedSessionIdFunction(getSignedSessionId) {
             this.getSignedSessionId = getSignedSessionId;
         }
+        setGetSessionPublicKeyFunction(getSessionPublicKey) {
+            this.getSessionPublicKey = getSessionPublicKey;
+        }
         delegateKeyShares(_a) {
             return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress, password, }) {
-                var _b, _c;
+                var _b, _c, _d;
                 if (!accountAddress) {
                     throw new Error('Account address is required');
                 }
@@ -146,6 +150,7 @@ const withDynamicWaas = (BaseClass) => {
                     accountAddress,
                     authToken,
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_d = this.getSessionPublicKey) === null || _d === void 0 ? void 0 : _d.call(this)),
                     signedSessionId,
                 });
             });
@@ -165,6 +170,7 @@ const withDynamicWaas = (BaseClass) => {
                 ALEO: 'ALEO',
                 BTC: 'BTC',
                 EVM: 'EVM',
+                MIDNIGHT: 'MIDNIGHT',
                 SOL: 'SVM',
                 STELLAR: 'STELLAR',
                 SUI: 'SUI',
@@ -194,12 +200,17 @@ const withDynamicWaas = (BaseClass) => {
                     baseClientKeysharesRelayApiUrl: this.baseClientKeysharesRelayApiUrl,
                     baseMPCRelayApiUrl: this.relayUrl || constants.DEFAULT_BASE_MPC_RELAY_API_URL,
                     chainName: this.chainName,
+                    // Opt into the SDK self-driving eager key-share recovery on auth-token
+                    // arrival, so the host no longer runs its own per-wallet RECOVER loop.
+                    eagerlyRecoverKeyShares: true,
                     environmentId: this.environmentId,
                     sdkVersion: _package.version,
-                }, Object.assign(Object.assign(Object.assign({}, (utils.PlatformService.isWaasSecureStorageSupported
+                }, Object.assign(Object.assign(Object.assign(Object.assign({}, (utils.PlatformService.isWaasSecureStorageSupported
                     ? { secureStorage: createWaasClientSecureStorage.createWaasClientSecureStorage() }
                     : {})), (this.getSignedSessionId
                     ? { getSignedSessionId: this.getSignedSessionId }
+                    : {})), (this.getSessionPublicKey
+                    ? { getSessionPublicKey: this.getSessionPublicKey }
                     : {})), (this.onUnauthorized
                     ? { onUnauthorized: this.onUnauthorized }
                     : {})));
@@ -212,9 +223,29 @@ const withDynamicWaas = (BaseClass) => {
                 return client;
             });
         }
-        getWaasWalletClient(traceContext) {
-            return _tslib.__awaiter(this, void 0, void 0, function* () {
+        getWaasWalletClient(traceContext_1) {
+            return _tslib.__awaiter(this, arguments, void 0, function* (traceContext, { forceRebuild = false } = {}) {
+                var _a;
+                // forceRebuild drops the cached client so the iframe re-auths with the
+                // fresh session (e.g. after a step-up reauth) instead of 401-ing on the
+                // stale cached token. Callers must only force a rebuild when a token is
+                // available (see getWaasWalletConnector's live-token guard); otherwise
+                // createDynamicWaasClient would throw "Auth token is required".
+                if (forceRebuild) {
+                    this.dynamicWaasClient = undefined;
+                }
                 if (!this.dynamicWaasClient) {
+                    // Chokepoint: never build + initialize the iframe client while the auth
+                    // token is still pending MFA/KYC/device registration. The iframe's
+                    // init-time room-cache pre-warm fires `createRooms` using the token
+                    // captured at construction — before any per-operation token resync
+                    // exists to correct it. Built during the pending window, that pre-warm
+                    // 401s and trips the iframe's unauthorized → forced-logout path. Every
+                    // WaaS caller funnels through here, so this single guard covers auto
+                    // wallet creation, ZeroDev smart-wallet init, getWallet, etc.
+                    if (tokenHasPendingAuthScope.tokenHasPendingAuthScope((_a = this.getAuthToken) === null || _a === void 0 ? void 0 : _a.call(this))) {
+                        throw new utils.WaasAuthScopePendingError();
+                    }
                     this.dynamicWaasClient = yield this.createDynamicWaasClient(traceContext);
                 }
                 return this.dynamicWaasClient;
@@ -320,7 +351,7 @@ const withDynamicWaas = (BaseClass) => {
         }
         backupKeySharesToGoogleDrive(_a) {
             return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress, password, googleDriveAccessToken, }) {
-                var _b, _c;
+                var _b, _c, _d;
                 if (!accountAddress) {
                     throw new utils.DynamicError('Account address is required');
                 }
@@ -335,6 +366,7 @@ const withDynamicWaas = (BaseClass) => {
                     authToken: (_c = this.getAuthToken) === null || _c === void 0 ? void 0 : _c.call(this),
                     googleDriveAccessToken,
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_d = this.getSessionPublicKey) === null || _d === void 0 ? void 0 : _d.call(this)),
                     signedSessionId,
                 });
             });
@@ -361,7 +393,7 @@ const withDynamicWaas = (BaseClass) => {
         }
         backupKeySharesToICloud(_a) {
             return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress, password, }) {
-                var _b, _c;
+                var _b, _c, _d;
                 if (!accountAddress) {
                     throw new utils.DynamicError('Account address is required');
                 }
@@ -375,6 +407,7 @@ const withDynamicWaas = (BaseClass) => {
                     accountAddress,
                     authToken: (_c = this.getAuthToken) === null || _c === void 0 ? void 0 : _c.call(this),
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_d = this.getSessionPublicKey) === null || _d === void 0 ? void 0 : _d.call(this)),
                     signedSessionId,
                 });
             });
@@ -401,7 +434,7 @@ const withDynamicWaas = (BaseClass) => {
         }
         refreshWalletAccountShares(_a) {
             return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress, password, }) {
-                var _b, _c, _d, _e, _f, _g;
+                var _b, _c, _d, _e, _f, _g, _h;
                 if (!accountAddress) {
                     throw new utils.DynamicError('Account address is required');
                 }
@@ -429,13 +462,14 @@ const withDynamicWaas = (BaseClass) => {
                     elevatedAccessToken,
                     mfaToken,
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_h = this.getSessionPublicKey) === null || _h === void 0 ? void 0 : _h.call(this)),
                     signedSessionId: backupSignedSessionId,
                 });
             });
         }
         reshareWalletAccountShares(_a) {
             return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress, thresholdSignatureScheme, password, }) {
-                var _b, _c, _d, _e;
+                var _b, _c, _d, _e, _f;
                 if (!accountAddress) {
                     throw new utils.DynamicError('Account address is required');
                 }
@@ -465,13 +499,14 @@ const withDynamicWaas = (BaseClass) => {
                     newThresholdSignatureScheme: thresholdSignatureScheme,
                     oldThresholdSignatureScheme,
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_f = this.getSessionPublicKey) === null || _f === void 0 ? void 0 : _f.call(this)),
                     signedSessionId,
                 });
             });
         }
         revokeDelegation(_a) {
             return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress, password, }) {
-                var _b, _c;
+                var _b, _c, _d;
                 if (!accountAddress) {
                     throw new utils.DynamicError('Account address is required');
                 }
@@ -485,6 +520,7 @@ const withDynamicWaas = (BaseClass) => {
                     accountAddress,
                     authToken: (_c = this.getAuthToken) === null || _c === void 0 ? void 0 : _c.call(this),
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_d = this.getSessionPublicKey) === null || _d === void 0 ? void 0 : _d.call(this)),
                     signedSessionId,
                 });
             });
@@ -506,7 +542,7 @@ const withDynamicWaas = (BaseClass) => {
                 const encryptedWallets = wallets.filter((w) => { var _a; return (_a = w.clientKeySharesBackupInfo) === null || _a === void 0 ? void 0 : _a.passwordEncrypted; });
                 const passwordUpdateBatchId = crypto.randomUUID();
                 yield Promise.all(encryptedWallets.map((wallet) => _tslib.__awaiter(this, void 0, void 0, function* () {
-                    var _b;
+                    var _b, _c;
                     const signedSessionId = yield this.getSignedSessionId();
                     yield walletClient.updatePassword({
                         accountAddress: wallet.accountAddress,
@@ -514,6 +550,7 @@ const withDynamicWaas = (BaseClass) => {
                         existingPassword: resolvedExistingPassword,
                         newPassword,
                         passwordUpdateBatchId,
+                        sessionPublicKey: yield ((_c = this.getSessionPublicKey) === null || _c === void 0 ? void 0 : _c.call(this)),
                         signedSessionId,
                     });
                 })));
@@ -531,13 +568,14 @@ const withDynamicWaas = (BaseClass) => {
                 const wallets = yield walletClient.getAllWallets();
                 const passwordUpdateBatchId = crypto.randomUUID();
                 yield Promise.all(wallets.map((wallet) => _tslib.__awaiter(this, void 0, void 0, function* () {
-                    var _b;
+                    var _b, _c;
                     const signedSessionId = yield this.getSignedSessionId();
                     yield walletClient.setPassword({
                         accountAddress: wallet.accountAddress,
                         authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this),
                         newPassword,
                         passwordUpdateBatchId,
+                        sessionPublicKey: yield ((_c = this.getSessionPublicKey) === null || _c === void 0 ? void 0 : _c.call(this)),
                         signedSessionId,
                     });
                 })));
@@ -612,9 +650,18 @@ const withDynamicWaas = (BaseClass) => {
         }
         endSession(reason) {
             return _tslib.__awaiter(this, void 0, void 0, function* () {
-                const waasClient = yield this.getWaasWalletClient();
-                if (!waasClient) {
-                    return;
+                // Building the wallet client requires an auth token (createDynamicWaasClient
+                // throws in header auth mode when none is present); the new scope guard in
+                // getWaasWalletClient also throws during pending-auth (MFA/KYC/device). On
+                // logout we must not let either throw abort logout — the security-critical
+                // key share removal below does not need the client. Only the iframe cleanup
+                // does, so we proceed without it if the client can't be obtained.
+                let waasClient;
+                try {
+                    waasClient = yield this.getWaasWalletClient();
+                }
+                catch (error) {
+                    this.instrument('[endSession] getWaasWalletClient failed; proceeding', Object.assign({ key: 'endSession-getClient-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
                 }
                 // When a session token expires, we preserve key shares in storage instead
                 // of clearing them. Customers with short-lived sessions (minutes) were
@@ -646,9 +693,13 @@ const withDynamicWaas = (BaseClass) => {
                     // iframe cleanup's request-channel timeout. The iframe handler already
                     // swallows its own errors, and the DOM teardown obsoletes anything it
                     // misses. Promise.resolve guards against a non-promise return in tests.
-                    void Promise.resolve(waasClient.cleanup()).catch((error) => {
-                        this.instrument('[endSession] background iframe cleanup failed', Object.assign({ key: 'endSession-cleanup-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
-                    });
+                    // Skipped when the client could not be built/obtained (no token, or
+                    // pending-auth scope guard) — there is no iframe to tear down then.
+                    if (waasClient) {
+                        void Promise.resolve(waasClient.cleanup()).catch((error) => {
+                            this.instrument('[endSession] background iframe cleanup failed', Object.assign({ key: 'endSession-cleanup-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
+                        });
+                    }
                 }
                 this.dynamicWaasClient = undefined;
             });
@@ -755,6 +806,11 @@ const withDynamicWaas = (BaseClass) => {
                 }
             });
         }
+        getPrivateBalance() {
+            return _tslib.__awaiter(this, void 0, void 0, function* () {
+                throw new utils.DynamicError(`getPrivateBalance is not supported for ${this.chainName} wallets`);
+            });
+        }
     }
     return DynamicWaasMixin;
 };

package/src/DynamicWaasMixin.d.ts

@@ -15,6 +15,7 @@ export declare const withDynamicWaas: <T extends abstract new (...args: any[]) =
     overrideKey: string;
     isEmbeddedWallet: boolean;
     getSignedSessionId?: (() => Promise<string>) | undefined;
+    getSessionPublicKey?: (() => Promise<string | undefined>) | undefined;
     getMfaToken?: ((props?: {
         mfaAction?: MFAAction;
     }) => Promise<string | undefined>) | undefined;
@@ -71,12 +72,15 @@ export declare const withDynamicWaas: <T extends abstract new (...args: any[]) =
     setBaseClientKeysharesRelayApiUrl(baseClientKeysharesRelayApiUrl?: string): void;
     setRelayUrl(relayUrl: string): void;
     setGetSignedSessionIdFunction(getSignedSessionId: () => Promise<string>): void;
+    setGetSessionPublicKeyFunction(getSessionPublicKey: () => Promise<string | undefined>): void;
     delegateKeyShares({ accountAddress, password, }: {
         accountAddress: string;
         password?: string;
     }): Promise<void>;
     createDynamicWaasClient(traceContext?: TraceContext): Promise<DynamicWalletClient>;
-    getWaasWalletClient(traceContext?: TraceContext): Promise<DynamicWalletClient>;
+    getWaasWalletClient(traceContext?: TraceContext, { forceRebuild }?: {
+        forceRebuild?: boolean;
+    }): Promise<DynamicWalletClient>;
     createWalletAccount({ thresholdSignatureScheme, password, bitcoinConfig, }?: {
         thresholdSignatureScheme?: string;
         password?: string;
@@ -199,4 +203,14 @@ export declare const withDynamicWaas: <T extends abstract new (...args: any[]) =
         fn: (timing: InstrumentationTimer) => Promise<T_1>;
         context?: Record<string, any> | undefined;
     }): Promise<T_1>;
+    getPrivateBalance(): Promise<{
+        unshielded: Record<string, string>;
+        shielded: Record<string, string>;
+        dust: {
+            balance: string;
+            cap: string;
+        };
+        address: string;
+        dustSynced: boolean;
+    }>;
 }) & T;

package/src/DynamicWaasMixin.js

@@ -2,11 +2,12 @@
 import { __awaiter } from '../_virtual/_tslib.js';
 import { DynamicWalletClient } from '@dynamic-labs-wallet/browser-wallet-client';
 import { MFAAction, TokenScope } from '@dynamic-labs/sdk-api-core';
-import { DynamicError, UserRejectedRequestError, PlatformService } from '@dynamic-labs/utils';
+import { DynamicError, UserRejectedRequestError, PlatformService, WaasAuthScopePendingError } from '@dynamic-labs/utils';
 import { version } from '../package.js';
 import { DEFAULT_BASE_API_URL, DEFAULT_BASE_MPC_RELAY_API_URL } from '../utils/constants.js';
 import { createWaasClientSecureStorage } from '../utils/createWaasClientSecureStorage.js';
 import { InstrumentationTimer } from '../utils/instrumentation.js';
+import { tokenHasPendingAuthScope } from '../utils/tokenHasPendingAuthScope.js';
 
 // Fallback error code used when a thrown value carries no code, or when
 // formatting the error itself fails.
@@ -122,9 +123,12 @@ const withDynamicWaas = (BaseClass) => {
         setGetSignedSessionIdFunction(getSignedSessionId) {
             this.getSignedSessionId = getSignedSessionId;
         }
+        setGetSessionPublicKeyFunction(getSessionPublicKey) {
+            this.getSessionPublicKey = getSessionPublicKey;
+        }
         delegateKeyShares(_a) {
             return __awaiter(this, arguments, void 0, function* ({ accountAddress, password, }) {
-                var _b, _c;
+                var _b, _c, _d;
                 if (!accountAddress) {
                     throw new Error('Account address is required');
                 }
@@ -142,6 +146,7 @@ const withDynamicWaas = (BaseClass) => {
                     accountAddress,
                     authToken,
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_d = this.getSessionPublicKey) === null || _d === void 0 ? void 0 : _d.call(this)),
                     signedSessionId,
                 });
             });
@@ -161,6 +166,7 @@ const withDynamicWaas = (BaseClass) => {
                 ALEO: 'ALEO',
                 BTC: 'BTC',
                 EVM: 'EVM',
+                MIDNIGHT: 'MIDNIGHT',
                 SOL: 'SVM',
                 STELLAR: 'STELLAR',
                 SUI: 'SUI',
@@ -190,12 +196,17 @@ const withDynamicWaas = (BaseClass) => {
                     baseClientKeysharesRelayApiUrl: this.baseClientKeysharesRelayApiUrl,
                     baseMPCRelayApiUrl: this.relayUrl || DEFAULT_BASE_MPC_RELAY_API_URL,
                     chainName: this.chainName,
+                    // Opt into the SDK self-driving eager key-share recovery on auth-token
+                    // arrival, so the host no longer runs its own per-wallet RECOVER loop.
+                    eagerlyRecoverKeyShares: true,
                     environmentId: this.environmentId,
                     sdkVersion: version,
-                }, Object.assign(Object.assign(Object.assign({}, (PlatformService.isWaasSecureStorageSupported
+                }, Object.assign(Object.assign(Object.assign(Object.assign({}, (PlatformService.isWaasSecureStorageSupported
                     ? { secureStorage: createWaasClientSecureStorage() }
                     : {})), (this.getSignedSessionId
                     ? { getSignedSessionId: this.getSignedSessionId }
+                    : {})), (this.getSessionPublicKey
+                    ? { getSessionPublicKey: this.getSessionPublicKey }
                     : {})), (this.onUnauthorized
                     ? { onUnauthorized: this.onUnauthorized }
                     : {})));
@@ -208,9 +219,29 @@ const withDynamicWaas = (BaseClass) => {
                 return client;
             });
         }
-        getWaasWalletClient(traceContext) {
-            return __awaiter(this, void 0, void 0, function* () {
+        getWaasWalletClient(traceContext_1) {
+            return __awaiter(this, arguments, void 0, function* (traceContext, { forceRebuild = false } = {}) {
+                var _a;
+                // forceRebuild drops the cached client so the iframe re-auths with the
+                // fresh session (e.g. after a step-up reauth) instead of 401-ing on the
+                // stale cached token. Callers must only force a rebuild when a token is
+                // available (see getWaasWalletConnector's live-token guard); otherwise
+                // createDynamicWaasClient would throw "Auth token is required".
+                if (forceRebuild) {
+                    this.dynamicWaasClient = undefined;
+                }
                 if (!this.dynamicWaasClient) {
+                    // Chokepoint: never build + initialize the iframe client while the auth
+                    // token is still pending MFA/KYC/device registration. The iframe's
+                    // init-time room-cache pre-warm fires `createRooms` using the token
+                    // captured at construction — before any per-operation token resync
+                    // exists to correct it. Built during the pending window, that pre-warm
+                    // 401s and trips the iframe's unauthorized → forced-logout path. Every
+                    // WaaS caller funnels through here, so this single guard covers auto
+                    // wallet creation, ZeroDev smart-wallet init, getWallet, etc.
+                    if (tokenHasPendingAuthScope((_a = this.getAuthToken) === null || _a === void 0 ? void 0 : _a.call(this))) {
+                        throw new WaasAuthScopePendingError();
+                    }
                     this.dynamicWaasClient = yield this.createDynamicWaasClient(traceContext);
                 }
                 return this.dynamicWaasClient;
@@ -316,7 +347,7 @@ const withDynamicWaas = (BaseClass) => {
         }
         backupKeySharesToGoogleDrive(_a) {
             return __awaiter(this, arguments, void 0, function* ({ accountAddress, password, googleDriveAccessToken, }) {
-                var _b, _c;
+                var _b, _c, _d;
                 if (!accountAddress) {
                     throw new DynamicError('Account address is required');
                 }
@@ -331,6 +362,7 @@ const withDynamicWaas = (BaseClass) => {
                     authToken: (_c = this.getAuthToken) === null || _c === void 0 ? void 0 : _c.call(this),
                     googleDriveAccessToken,
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_d = this.getSessionPublicKey) === null || _d === void 0 ? void 0 : _d.call(this)),
                     signedSessionId,
                 });
             });
@@ -357,7 +389,7 @@ const withDynamicWaas = (BaseClass) => {
         }
         backupKeySharesToICloud(_a) {
             return __awaiter(this, arguments, void 0, function* ({ accountAddress, password, }) {
-                var _b, _c;
+                var _b, _c, _d;
                 if (!accountAddress) {
                     throw new DynamicError('Account address is required');
                 }
@@ -371,6 +403,7 @@ const withDynamicWaas = (BaseClass) => {
                     accountAddress,
                     authToken: (_c = this.getAuthToken) === null || _c === void 0 ? void 0 : _c.call(this),
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_d = this.getSessionPublicKey) === null || _d === void 0 ? void 0 : _d.call(this)),
                     signedSessionId,
                 });
             });
@@ -397,7 +430,7 @@ const withDynamicWaas = (BaseClass) => {
         }
         refreshWalletAccountShares(_a) {
             return __awaiter(this, arguments, void 0, function* ({ accountAddress, password, }) {
-                var _b, _c, _d, _e, _f, _g;
+                var _b, _c, _d, _e, _f, _g, _h;
                 if (!accountAddress) {
                     throw new DynamicError('Account address is required');
                 }
@@ -425,13 +458,14 @@ const withDynamicWaas = (BaseClass) => {
                     elevatedAccessToken,
                     mfaToken,
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_h = this.getSessionPublicKey) === null || _h === void 0 ? void 0 : _h.call(this)),
                     signedSessionId: backupSignedSessionId,
                 });
             });
         }
         reshareWalletAccountShares(_a) {
             return __awaiter(this, arguments, void 0, function* ({ accountAddress, thresholdSignatureScheme, password, }) {
-                var _b, _c, _d, _e;
+                var _b, _c, _d, _e, _f;
                 if (!accountAddress) {
                     throw new DynamicError('Account address is required');
                 }
@@ -461,13 +495,14 @@ const withDynamicWaas = (BaseClass) => {
                     newThresholdSignatureScheme: thresholdSignatureScheme,
                     oldThresholdSignatureScheme,
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_f = this.getSessionPublicKey) === null || _f === void 0 ? void 0 : _f.call(this)),
                     signedSessionId,
                 });
             });
         }
         revokeDelegation(_a) {
             return __awaiter(this, arguments, void 0, function* ({ accountAddress, password, }) {
-                var _b, _c;
+                var _b, _c, _d;
                 if (!accountAddress) {
                     throw new DynamicError('Account address is required');
                 }
@@ -481,6 +516,7 @@ const withDynamicWaas = (BaseClass) => {
                     accountAddress,
                     authToken: (_c = this.getAuthToken) === null || _c === void 0 ? void 0 : _c.call(this),
                     password: resolvedPassword,
+                    sessionPublicKey: yield ((_d = this.getSessionPublicKey) === null || _d === void 0 ? void 0 : _d.call(this)),
                     signedSessionId,
                 });
             });
@@ -502,7 +538,7 @@ const withDynamicWaas = (BaseClass) => {
                 const encryptedWallets = wallets.filter((w) => { var _a; return (_a = w.clientKeySharesBackupInfo) === null || _a === void 0 ? void 0 : _a.passwordEncrypted; });
                 const passwordUpdateBatchId = crypto.randomUUID();
                 yield Promise.all(encryptedWallets.map((wallet) => __awaiter(this, void 0, void 0, function* () {
-                    var _b;
+                    var _b, _c;
                     const signedSessionId = yield this.getSignedSessionId();
                     yield walletClient.updatePassword({
                         accountAddress: wallet.accountAddress,
@@ -510,6 +546,7 @@ const withDynamicWaas = (BaseClass) => {
                         existingPassword: resolvedExistingPassword,
                         newPassword,
                         passwordUpdateBatchId,
+                        sessionPublicKey: yield ((_c = this.getSessionPublicKey) === null || _c === void 0 ? void 0 : _c.call(this)),
                         signedSessionId,
                     });
                 })));
@@ -527,13 +564,14 @@ const withDynamicWaas = (BaseClass) => {
                 const wallets = yield walletClient.getAllWallets();
                 const passwordUpdateBatchId = crypto.randomUUID();
                 yield Promise.all(wallets.map((wallet) => __awaiter(this, void 0, void 0, function* () {
-                    var _b;
+                    var _b, _c;
                     const signedSessionId = yield this.getSignedSessionId();
                     yield walletClient.setPassword({
                         accountAddress: wallet.accountAddress,
                         authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this),
                         newPassword,
                         passwordUpdateBatchId,
+                        sessionPublicKey: yield ((_c = this.getSessionPublicKey) === null || _c === void 0 ? void 0 : _c.call(this)),
                         signedSessionId,
                     });
                 })));
@@ -608,9 +646,18 @@ const withDynamicWaas = (BaseClass) => {
         }
         endSession(reason) {
             return __awaiter(this, void 0, void 0, function* () {
-                const waasClient = yield this.getWaasWalletClient();
-                if (!waasClient) {
-                    return;
+                // Building the wallet client requires an auth token (createDynamicWaasClient
+                // throws in header auth mode when none is present); the new scope guard in
+                // getWaasWalletClient also throws during pending-auth (MFA/KYC/device). On
+                // logout we must not let either throw abort logout — the security-critical
+                // key share removal below does not need the client. Only the iframe cleanup
+                // does, so we proceed without it if the client can't be obtained.
+                let waasClient;
+                try {
+                    waasClient = yield this.getWaasWalletClient();
+                }
+                catch (error) {
+                    this.instrument('[endSession] getWaasWalletClient failed; proceeding', Object.assign({ key: 'endSession-getClient-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
                 }
                 // When a session token expires, we preserve key shares in storage instead
                 // of clearing them. Customers with short-lived sessions (minutes) were
@@ -642,9 +689,13 @@ const withDynamicWaas = (BaseClass) => {
                     // iframe cleanup's request-channel timeout. The iframe handler already
                     // swallows its own errors, and the DOM teardown obsoletes anything it
                     // misses. Promise.resolve guards against a non-promise return in tests.
-                    void Promise.resolve(waasClient.cleanup()).catch((error) => {
-                        this.instrument('[endSession] background iframe cleanup failed', Object.assign({ key: 'endSession-cleanup-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
-                    });
+                    // Skipped when the client could not be built/obtained (no token, or
+                    // pending-auth scope guard) — there is no iframe to tear down then.
+                    if (waasClient) {
+                        void Promise.resolve(waasClient.cleanup()).catch((error) => {
+                            this.instrument('[endSession] background iframe cleanup failed', Object.assign({ key: 'endSession-cleanup-failed', time: 0 }, this.buildErrorInstrumentContext(error)));
+                        });
+                    }
                 }
                 this.dynamicWaasClient = undefined;
             });
@@ -751,6 +802,11 @@ const withDynamicWaas = (BaseClass) => {
                 }
             });
         }
+        getPrivateBalance() {
+            return __awaiter(this, void 0, void 0, function* () {
+                throw new DynamicError(`getPrivateBalance is not supported for ${this.chainName} wallets`);
+            });
+        }
     }
     return DynamicWaasMixin;
 };

package/utils/tokenHasPendingAuthScope.cjs

@@ -0,0 +1,55 @@
+'use client'
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var sdkApiCore = require('@dynamic-labs/sdk-api-core');
+
+// Scopes that mean the user has not finished authenticating (MFA / KYC /
+// device registration still pending). A JWT carrying any of these has not
+// upgraded to `user:basic`, and the WaaS backend rejects calls made with it
+// (e.g. createRooms) with a 401.
+//
+// Note `user:basic` and `waasBackupToken` are intentionally NOT in this list:
+// backup / recovery flows legitimately run with a `waasBackupToken` scope, so
+// only the pending-auth scopes below should block WaaS client creation.
+const PENDING_AUTH_SCOPES = [
+    sdkApiCore.JwtScope.RequiresAdditionalAuth,
+    sdkApiCore.JwtScope.UserDataForm,
+    sdkApiCore.JwtScope.Deviceregister,
+];
+const decodeScope = (authToken) => {
+    const payload = authToken === null || authToken === void 0 ? void 0 : authToken.split('.')[1];
+    if (!payload) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(atob(payload)).scope;
+    }
+    catch (_a) {
+        return undefined;
+    }
+};
+/**
+ * Returns true when the auth token still carries a pending-authentication
+ * scope (`requiresAdditionalAuth` / `userDataForm` / `device:register`).
+ *
+ * The WaaS iframe's API client is a shared, mutable axios instance. The token
+ * captured at client construction is what the init-time room-cache pre-warm
+ * `createRooms` uses — it runs before any per-operation token resync. So if the
+ * client is built during this pending window, that pre-warm fires with the
+ * stale pre-`user:basic` token and 401s; the iframe reports the 401 back to the
+ * host, which force-logs-out the user. Callers must therefore refuse to build
+ * the client until the token clears (the vulnerable window is construction +
+ * init, not the whole client lifetime).
+ *
+ * A token with no decodable scope is treated as not-pending (returns false):
+ * the backend remains the source of truth and will reject anything invalid.
+ */
+const tokenHasPendingAuthScope = (authToken) => {
+    var _a, _b;
+    const scopes = (_b = (_a = decodeScope(authToken)) === null || _a === void 0 ? void 0 : _a.split(' ')) !== null && _b !== void 0 ? _b : [];
+    return scopes.some((scope) => PENDING_AUTH_SCOPES.includes(scope));
+};
+
+exports.tokenHasPendingAuthScope = tokenHasPendingAuthScope;

package/utils/tokenHasPendingAuthScope.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Returns true when the auth token still carries a pending-authentication
+ * scope (`requiresAdditionalAuth` / `userDataForm` / `device:register`).
+ *
+ * The WaaS iframe's API client is a shared, mutable axios instance. The token
+ * captured at client construction is what the init-time room-cache pre-warm
+ * `createRooms` uses — it runs before any per-operation token resync. So if the
+ * client is built during this pending window, that pre-warm fires with the
+ * stale pre-`user:basic` token and 401s; the iframe reports the 401 back to the
+ * host, which force-logs-out the user. Callers must therefore refuse to build
+ * the client until the token clears (the vulnerable window is construction +
+ * init, not the whole client lifetime).
+ *
+ * A token with no decodable scope is treated as not-pending (returns false):
+ * the backend remains the source of truth and will reject anything invalid.
+ */
+export declare const tokenHasPendingAuthScope: (authToken?: string) => boolean;

package/utils/tokenHasPendingAuthScope.js

@@ -0,0 +1,51 @@
+'use client'
+import { JwtScope } from '@dynamic-labs/sdk-api-core';
+
+// Scopes that mean the user has not finished authenticating (MFA / KYC /
+// device registration still pending). A JWT carrying any of these has not
+// upgraded to `user:basic`, and the WaaS backend rejects calls made with it
+// (e.g. createRooms) with a 401.
+//
+// Note `user:basic` and `waasBackupToken` are intentionally NOT in this list:
+// backup / recovery flows legitimately run with a `waasBackupToken` scope, so
+// only the pending-auth scopes below should block WaaS client creation.
+const PENDING_AUTH_SCOPES = [
+    JwtScope.RequiresAdditionalAuth,
+    JwtScope.UserDataForm,
+    JwtScope.Deviceregister,
+];
+const decodeScope = (authToken) => {
+    const payload = authToken === null || authToken === void 0 ? void 0 : authToken.split('.')[1];
+    if (!payload) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(atob(payload)).scope;
+    }
+    catch (_a) {
+        return undefined;
+    }
+};
+/**
+ * Returns true when the auth token still carries a pending-authentication
+ * scope (`requiresAdditionalAuth` / `userDataForm` / `device:register`).
+ *
+ * The WaaS iframe's API client is a shared, mutable axios instance. The token
+ * captured at client construction is what the init-time room-cache pre-warm
+ * `createRooms` uses — it runs before any per-operation token resync. So if the
+ * client is built during this pending window, that pre-warm fires with the
+ * stale pre-`user:basic` token and 401s; the iframe reports the 401 back to the
+ * host, which force-logs-out the user. Callers must therefore refuse to build
+ * the client until the token clears (the vulnerable window is construction +
+ * init, not the whole client lifetime).
+ *
+ * A token with no decodable scope is treated as not-pending (returns false):
+ * the backend remains the source of truth and will reject anything invalid.
+ */
+const tokenHasPendingAuthScope = (authToken) => {
+    var _a, _b;
+    const scopes = (_b = (_a = decodeScope(authToken)) === null || _a === void 0 ? void 0 : _a.split(' ')) !== null && _b !== void 0 ? _b : [];
+    return scopes.some((scope) => PENDING_AUTH_SCOPES.includes(scope));
+};
+
+export { tokenHasPendingAuthScope };