@dynamic-labs/waas 4.97.0 → 4.99.0

package/CHANGELOG.md

@@ -1,4 +1,31 @@
 
+## [4.99.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.98.0...v4.99.0) (2026-09-10)
+
+
+### Features
+
+* **solana-core:** standalone sponsored ATA creation [v4 backport] ([#12366](https://github.com/dynamic-labs/dynamic-auth/issues/12366)) ([46d86c9](https://github.com/dynamic-labs/dynamic-auth/commit/46d86c9a1a04c45bf045acc5c6df792dcd4b3590))
+
+
+### Bug Fixes
+
+* do not report wallets installed from a provider selection router (v4) ([#12341](https://github.com/dynamic-labs/dynamic-auth/issues/12341)) ([6b02087](https://github.com/dynamic-labs/dynamic-auth/commit/6b02087685545bb6f672eb9040316d01489c82f4))
+* **screening:** soften the blocked-wallet copy to be provider-neutral (v4) ([#12359](https://github.com/dynamic-labs/dynamic-auth/issues/12359)) ([d6772df](https://github.com/dynamic-labs/dynamic-auth/commit/d6772dfc1419811bfbc1d9cb1db58fe12274d397))
+* **waas:** detach the superseded WaaS client from the iframe reverse channel (v4) ([#12349](https://github.com/dynamic-labs/dynamic-auth/issues/12349)) ([393253d](https://github.com/dynamic-labs/dynamic-auth/commit/393253d9e5934e039e21b85ed6ceded760e0f225)), closes [#11766](https://github.com/dynamic-labs/dynamic-auth/issues/11766) [#12348](https://github.com/dynamic-labs/dynamic-auth/issues/12348)
+
+## [4.98.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.97.0...v4.98.0) (2026-09-02)
+
+
+### Features
+
+* **waas-evm:** route embedded EVM sends through gas sponsorship when enabled (V4) ([#12307](https://github.com/dynamic-labs/dynamic-auth/issues/12307)) ([d8e6b94](https://github.com/dynamic-labs/dynamic-auth/commit/d8e6b94dc86e1d48b66a246bf8bf0b857e7e69c4))
+
+
+### Bug Fixes
+
+* **sdk-react-core:** send a css overrides summary in sdkSettings telemetry (v4) ([#12330](https://github.com/dynamic-labs/dynamic-auth/issues/12330)) ([8547ee7](https://github.com/dynamic-labs/dynamic-auth/commit/8547ee7a7c3fef8de0ff384778f86542b809e7aa))
+* **waas-svm:** apply overrideBlockhash before sponsorship [v4 backport] ([#12320](https://github.com/dynamic-labs/dynamic-auth/issues/12320)) ([0551f01](https://github.com/dynamic-labs/dynamic-auth/commit/0551f01953f5e623ac113b03e1b010d3dc58a81e)), closes [#10599](https://github.com/dynamic-labs/dynamic-auth/issues/10599) [#10599](https://github.com/dynamic-labs/dynamic-auth/issues/10599) [#10599](https://github.com/dynamic-labs/dynamic-auth/issues/10599) [#10599](https://github.com/dynamic-labs/dynamic-auth/issues/10599)
+
 ## [4.97.0](https://github.com/dynamic-labs/dynamic-auth/compare/v4.96.4...v4.97.0) (2026-08-27)
 
 

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "4.97.0";
+var version = "4.99.0";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "4.97.0";
+var version = "4.99.0";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/waas",
-  "version": "4.97.0",
+  "version": "4.99.0",
   "type": "module",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -17,17 +17,17 @@
   },
   "dependencies": {
     "@dynamic-labs-sdk/client": "1.27.1",
-    "@dynamic-labs/assert-package-version": "4.97.0",
+    "@dynamic-labs/assert-package-version": "4.99.0",
     "@dynamic-labs/sdk-api-core": "0.12.0",
-    "@dynamic-labs-wallet/browser-wallet-client": "1.0.92",
-    "@dynamic-labs-wallet/forward-mpc-client": "1.0.1",
-    "@dynamic-labs/ethereum-core": "4.97.0",
-    "@dynamic-labs/logger": "4.97.0",
-    "@dynamic-labs/solana-core": "4.97.0",
-    "@dynamic-labs/sui-core": "4.97.0",
-    "@dynamic-labs/utils": "4.97.0",
-    "@dynamic-labs/wallet-book": "4.97.0",
-    "@dynamic-labs/wallet-connector-core": "4.97.0"
+    "@dynamic-labs-wallet/browser-wallet-client": "1.1.8",
+    "@dynamic-labs-wallet/forward-mpc-client": "2.0.2",
+    "@dynamic-labs/ethereum-core": "4.99.0",
+    "@dynamic-labs/logger": "4.99.0",
+    "@dynamic-labs/solana-core": "4.99.0",
+    "@dynamic-labs/sui-core": "4.99.0",
+    "@dynamic-labs/utils": "4.99.0",
+    "@dynamic-labs/wallet-book": "4.99.0",
+    "@dynamic-labs/wallet-connector-core": "4.99.0"
   },
   "peerDependencies": {}
 }

package/src/DynamicWaasMixin.cjs

@@ -241,6 +241,31 @@ const withDynamicWaas = (BaseClass) => {
                 return client;
             });
         }
+        /**
+         * Stops the client answering the iframe's session-scoped reverse-channel
+         * requests — the signed session and the 401 notification. Its key-share
+         * handlers stay attached until the client's own cleanup() has its ACK, so
+         * the iframe can still clear shares on logout.
+         *
+         * Returns false only if the attempt threw: the client may still be
+         * registered, so the caller must not revoke it. Never rethrows — this runs
+         * on the rotation and logout paths, where throwing would leave the caller
+         * with no client at all.
+         */
+        detachWaasClient(client, reason) {
+            var _a;
+            // The pinned browser-wallet-client predates detach(); this goes away with
+            // the version bump.
+            const detachable = client;
+            try {
+                (_a = detachable === null || detachable === void 0 ? void 0 : detachable.detach) === null || _a === void 0 ? void 0 : _a.call(detachable);
+                return true;
+            }
+            catch (error) {
+                this.instrument('[DynamicWaasMixin] WaaS client detach failed', Object.assign({ key: 'waas-client-detach-failed', operation: 'detachWaasClient', reason, time: 0 }, this.buildErrorInstrumentContext(error)));
+                return false;
+            }
+        }
         getWaasWalletClient(traceContext_1) {
             return _tslib.__awaiter(this, arguments, void 0, function* (traceContext, { forceRebuild = false } = {}) {
                 var _a, _b;
@@ -250,11 +275,19 @@ const withDynamicWaas = (BaseClass) => {
                 // available (see getWaasWalletConnector's live-token guard); otherwise
                 // createDynamicWaasClient would throw "Auth token is required".
                 if (forceRebuild) {
-                    // Revoke the previous client's nonce callback before dropping it.
-                    // The old DynamicWalletClient is not destroyed — it has no cancellation
-                    // API — but revoking its reverse-channel callback prevents it from
-                    // fetching fresh nonces and competing with the new client's recovery.
-                    (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this);
+                    // Detach the superseded client, then revoke it — and never revoke one we
+                    // did not detach. The reverse channel is page-wide and
+                    // first-response-wins, so a revoked-but-still-attached client rejects
+                    // instantly, beats the live client to every getSignedSessionId and
+                    // poisons wallet creation for the life of the iframe. Two cases land
+                    // there: a failed detach, and a concurrent rebuild, where
+                    // createDynamicWaasClient has installed the new revoker but not yet
+                    // returned the client it belongs to. The revoke stays as a guard for a
+                    // caller still holding a direct reference.
+                    const superseded = this.dynamicWaasClient;
+                    if (superseded && this.detachWaasClient(superseded, 'force-rebuild')) {
+                        (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this);
+                    }
                     this.revokeSignedSession = undefined;
                     this.dynamicWaasClient = undefined;
                 }
@@ -774,7 +807,28 @@ const withDynamicWaas = (BaseClass) => {
                         });
                     }
                 }
-                (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this);
+                // Detach synchronously: the cleanup() above removes the handlers too, but
+                // it is un-awaited and can sit on the channel's 5s timeout first, leaving
+                // this client in the race with its callback already revoked.
+                //
+                // Same guard as the rebuild path: never revoke a client we did not detach.
+                // waasClient is undefined whenever getWaasWalletClient threw (pending-auth
+                // scope, or a failed build), and a client installed concurrently would own
+                // the revoke we still hold — revoking that one while it is attached is the
+                // original bug.
+                const superseded = waasClient !== null && waasClient !== void 0 ? waasClient : this.dynamicWaasClient;
+                const detached = superseded
+                    ? this.detachWaasClient(superseded, 'end-session')
+                    : false;
+                // Revoke only while the revoker still belongs to the client we detached.
+                // endSession awaits the client, the active address and the key-share
+                // removal, and a rotation completing in any of those windows swaps both
+                // fields — revoking the live replacement while it is attached is the
+                // original bug. Detaching the captured client is unconditional: it is
+                // always safe, and it is the half that actually leaves the race.
+                if (detached && superseded === this.dynamicWaasClient) {
+                    (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this);
+                }
                 this.revokeSignedSession = undefined;
                 this.dynamicWaasClient = undefined;
             });

package/src/DynamicWaasMixin.d.ts

@@ -82,6 +82,18 @@ export declare const withDynamicWaas: <T extends abstract new (...args: any[]) =
         getSignedSessionId: () => Promise<string>;
     };
     createDynamicWaasClient(traceContext?: TraceContext): Promise<DynamicWalletClient>;
+    /**
+     * Stops the client answering the iframe's session-scoped reverse-channel
+     * requests — the signed session and the 401 notification. Its key-share
+     * handlers stay attached until the client's own cleanup() has its ACK, so
+     * the iframe can still clear shares on logout.
+     *
+     * Returns false only if the attempt threw: the client may still be
+     * registered, so the caller must not revoke it. Never rethrows — this runs
+     * on the rotation and logout paths, where throwing would leave the caller
+     * with no client at all.
+     */
+    detachWaasClient(client: DynamicWalletClient | undefined, reason: string): boolean;
     getWaasWalletClient(traceContext?: TraceContext, { forceRebuild }?: {
         forceRebuild?: boolean;
     }): Promise<DynamicWalletClient>;

package/src/DynamicWaasMixin.js

@@ -237,6 +237,31 @@ const withDynamicWaas = (BaseClass) => {
                 return client;
             });
         }
+        /**
+         * Stops the client answering the iframe's session-scoped reverse-channel
+         * requests — the signed session and the 401 notification. Its key-share
+         * handlers stay attached until the client's own cleanup() has its ACK, so
+         * the iframe can still clear shares on logout.
+         *
+         * Returns false only if the attempt threw: the client may still be
+         * registered, so the caller must not revoke it. Never rethrows — this runs
+         * on the rotation and logout paths, where throwing would leave the caller
+         * with no client at all.
+         */
+        detachWaasClient(client, reason) {
+            var _a;
+            // The pinned browser-wallet-client predates detach(); this goes away with
+            // the version bump.
+            const detachable = client;
+            try {
+                (_a = detachable === null || detachable === void 0 ? void 0 : detachable.detach) === null || _a === void 0 ? void 0 : _a.call(detachable);
+                return true;
+            }
+            catch (error) {
+                this.instrument('[DynamicWaasMixin] WaaS client detach failed', Object.assign({ key: 'waas-client-detach-failed', operation: 'detachWaasClient', reason, time: 0 }, this.buildErrorInstrumentContext(error)));
+                return false;
+            }
+        }
         getWaasWalletClient(traceContext_1) {
             return __awaiter(this, arguments, void 0, function* (traceContext, { forceRebuild = false } = {}) {
                 var _a, _b;
@@ -246,11 +271,19 @@ const withDynamicWaas = (BaseClass) => {
                 // available (see getWaasWalletConnector's live-token guard); otherwise
                 // createDynamicWaasClient would throw "Auth token is required".
                 if (forceRebuild) {
-                    // Revoke the previous client's nonce callback before dropping it.
-                    // The old DynamicWalletClient is not destroyed — it has no cancellation
-                    // API — but revoking its reverse-channel callback prevents it from
-                    // fetching fresh nonces and competing with the new client's recovery.
-                    (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this);
+                    // Detach the superseded client, then revoke it — and never revoke one we
+                    // did not detach. The reverse channel is page-wide and
+                    // first-response-wins, so a revoked-but-still-attached client rejects
+                    // instantly, beats the live client to every getSignedSessionId and
+                    // poisons wallet creation for the life of the iframe. Two cases land
+                    // there: a failed detach, and a concurrent rebuild, where
+                    // createDynamicWaasClient has installed the new revoker but not yet
+                    // returned the client it belongs to. The revoke stays as a guard for a
+                    // caller still holding a direct reference.
+                    const superseded = this.dynamicWaasClient;
+                    if (superseded && this.detachWaasClient(superseded, 'force-rebuild')) {
+                        (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this);
+                    }
                     this.revokeSignedSession = undefined;
                     this.dynamicWaasClient = undefined;
                 }
@@ -770,7 +803,28 @@ const withDynamicWaas = (BaseClass) => {
                         });
                     }
                 }
-                (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this);
+                // Detach synchronously: the cleanup() above removes the handlers too, but
+                // it is un-awaited and can sit on the channel's 5s timeout first, leaving
+                // this client in the race with its callback already revoked.
+                //
+                // Same guard as the rebuild path: never revoke a client we did not detach.
+                // waasClient is undefined whenever getWaasWalletClient threw (pending-auth
+                // scope, or a failed build), and a client installed concurrently would own
+                // the revoke we still hold — revoking that one while it is attached is the
+                // original bug.
+                const superseded = waasClient !== null && waasClient !== void 0 ? waasClient : this.dynamicWaasClient;
+                const detached = superseded
+                    ? this.detachWaasClient(superseded, 'end-session')
+                    : false;
+                // Revoke only while the revoker still belongs to the client we detached.
+                // endSession awaits the client, the active address and the key-share
+                // removal, and a rotation completing in any of those windows swaps both
+                // fields — revoking the live replacement while it is attached is the
+                // original bug. Detaching the captured client is unconditional: it is
+                // always safe, and it is the half that actually leaves the race.
+                if (detached && superseded === this.dynamicWaasClient) {
+                    (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this);
+                }
                 this.revokeSignedSession = undefined;
                 this.dynamicWaasClient = undefined;
             });