@dynamic-labs/waas 5.6.1 → 5.8.0

package/CHANGELOG.md

@@ -1,4 +1,32 @@
 
+## [5.8.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.7.0...v5.8.0) (2026-09-09)
+
+
+### Features
+
+* **solana-core:** standalone sponsored ATA creation ([#12365](https://github.com/dynamic-labs/dynamic-auth/issues/12365)) ([ac2e776](https://github.com/dynamic-labs/dynamic-auth/commit/ac2e7769fcf91c868e961a227b8acb6347bf3f13))
+
+
+### Bug Fixes
+
+* do not report wallets installed from a provider selection router ([#12340](https://github.com/dynamic-labs/dynamic-auth/issues/12340)) ([dac5546](https://github.com/dynamic-labs/dynamic-auth/commit/dac5546edf6004c37bd84dd2089d94952949230b))
+* **screening:** soften the blocked-wallet copy to be provider-neutral ([#12358](https://github.com/dynamic-labs/dynamic-auth/issues/12358)) ([b4854d8](https://github.com/dynamic-labs/dynamic-auth/commit/b4854d88fa67f684be0e133edd5fd4a4bf5c7f37))
+* show transaction amount when simulation returns no transfers ([#12355](https://github.com/dynamic-labs/dynamic-auth/issues/12355)) ([bfaf337](https://github.com/dynamic-labs/dynamic-auth/commit/bfaf337e5350970f71255baff065e0cdbccdc7ca))
+
+## [5.7.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.6.1...v5.7.0) (2026-09-08)
+
+
+### Features
+
+* **social:** add gemini social provider ([#12292](https://github.com/dynamic-labs/dynamic-auth/issues/12292)) ([fa72cb0](https://github.com/dynamic-labs/dynamic-auth/commit/fa72cb09f678506a5f34188eb7d62415bcb7073b))
+
+
+### Bug Fixes
+
+* **locale:** add missing dyn_upgrade_wallet.no_legacy_wallets and .close keys ([#12350](https://github.com/dynamic-labs/dynamic-auth/issues/12350)) ([50da3fa](https://github.com/dynamic-labs/dynamic-auth/commit/50da3fa3078de4ecbd88031a3e533a4ff6ced89b))
+* **sdk-react-core:** expose SDK i18next instance for extension packages ([#12351](https://github.com/dynamic-labs/dynamic-auth/issues/12351)) ([f3d95b1](https://github.com/dynamic-labs/dynamic-auth/commit/f3d95b1bb1c30114d32d93dec4e9c2455ab4fdbb))
+* **sdk-react-core:** publish ./icons and ./components subpath exports ([#12334](https://github.com/dynamic-labs/dynamic-auth/issues/12334)) ([519487c](https://github.com/dynamic-labs/dynamic-auth/commit/519487cf5f4f7abe895a125c5bf38800cae04bb5))
+
 ### [5.6.1](https://github.com/dynamic-labs/dynamic-auth/compare/v5.6.0...v5.6.1) (2026-09-01)
 
 

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "5.6.1";
+var version = "5.8.0";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "5.6.1";
+var version = "5.8.0";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/waas",
-  "version": "5.6.1",
+  "version": "5.8.0",
   "type": "module",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -17,18 +17,18 @@
   },
   "dependencies": {
     "@dynamic-labs-sdk/client": "1.31.0",
-    "@dynamic-labs/assert-package-version": "5.6.1",
-    "@dynamic-labs/sdk-api-core": "0.12.0",
+    "@dynamic-labs/assert-package-version": "5.8.0",
+    "@dynamic-labs/sdk-api-core": "0.32.0",
     "@dynamic-labs-wallet/browser-wallet-client": "1.0.118",
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.2",
     "zod": "4.0.5",
-    "@dynamic-labs/ethereum-core": "5.6.1",
-    "@dynamic-labs/logger": "5.6.1",
-    "@dynamic-labs/solana-core": "5.6.1",
-    "@dynamic-labs/sui-core": "5.6.1",
-    "@dynamic-labs/utils": "5.6.1",
-    "@dynamic-labs/wallet-book": "5.6.1",
-    "@dynamic-labs/wallet-connector-core": "5.6.1"
+    "@dynamic-labs/ethereum-core": "5.8.0",
+    "@dynamic-labs/logger": "5.8.0",
+    "@dynamic-labs/solana-core": "5.8.0",
+    "@dynamic-labs/sui-core": "5.8.0",
+    "@dynamic-labs/utils": "5.8.0",
+    "@dynamic-labs/wallet-book": "5.8.0",
+    "@dynamic-labs/wallet-connector-core": "5.8.0"
   },
   "peerDependencies": {}
 }

package/src/DynamicWaasMixin.cjs

@@ -262,6 +262,31 @@ const withDynamicWaas = (BaseClass) => {
                 return client;
             });
         }
+        /**
+         * Stops the client answering the iframe's session-scoped reverse-channel
+         * requests — the signed session and the 401 notification. Its key-share
+         * handlers stay attached until the client's own cleanup() has its ACK, so
+         * the iframe can still clear shares on logout.
+         *
+         * Returns false only if the attempt threw: the client may still be
+         * registered, so the caller must not revoke it. Never rethrows — this runs
+         * on the rotation and logout paths, where throwing would leave the caller
+         * with no client at all.
+         */
+        detachWaasClient(client, reason) {
+            var _a;
+            // The pinned browser-wallet-client predates detach(); this goes away with
+            // the version bump.
+            const detachable = client;
+            try {
+                (_a = detachable === null || detachable === void 0 ? void 0 : detachable.detach) === null || _a === void 0 ? void 0 : _a.call(detachable);
+                return true;
+            }
+            catch (error) {
+                this.instrument('[DynamicWaasMixin] WaaS client detach failed', Object.assign({ key: 'waas-client-detach-failed', operation: 'detachWaasClient', reason, time: 0 }, this.buildErrorInstrumentContext(error)));
+                return false;
+            }
+        }
         getWaasWalletClient(traceContext_1) {
             return _tslib.__awaiter(this, arguments, void 0, function* (traceContext, { forceRebuild = false } = {}) {
                 var _a, _b;
@@ -271,11 +296,19 @@ const withDynamicWaas = (BaseClass) => {
                 // available (see getWaasWalletConnector's live-token guard); otherwise
                 // createDynamicWaasClient would throw "Auth token is required".
                 if (forceRebuild) {
-                    // Revoke the previous client's nonce callback before dropping it.
-                    // The old DynamicWalletClient is not destroyed — it has no cancellation
-                    // API — but revoking its reverse-channel callback prevents it from
-                    // fetching fresh nonces and competing with the new client's recovery.
-                    (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this, 'force-rebuild');
+                    // Detach the superseded client, then revoke it — and never revoke one we
+                    // did not detach. The reverse channel is page-wide and
+                    // first-response-wins, so a revoked-but-still-attached client rejects
+                    // instantly, beats the live client to every getSignedSessionId and
+                    // poisons wallet creation for the life of the iframe. Two cases land
+                    // there: a failed detach, and a concurrent rebuild, where
+                    // createDynamicWaasClient has installed the new revoker but not yet
+                    // returned the client it belongs to. The revoke stays as a guard for a
+                    // caller still holding a direct reference.
+                    const superseded = this.dynamicWaasClient;
+                    if (superseded && this.detachWaasClient(superseded, 'force-rebuild')) {
+                        (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this, 'force-rebuild');
+                    }
                     this.revokeSignedSession = undefined;
                     this.dynamicWaasClient = undefined;
                 }
@@ -877,7 +910,28 @@ const withDynamicWaas = (BaseClass) => {
                         });
                     }
                 }
-                (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this, 'end-session');
+                // Detach synchronously: the cleanup() above removes the handlers too, but
+                // it is un-awaited and can sit on the channel's 5s timeout first, leaving
+                // this client in the race with its callback already revoked.
+                //
+                // Same guard as the rebuild path: never revoke a client we did not detach.
+                // waasClient is undefined whenever getWaasWalletClient threw (pending-auth
+                // scope, or a failed build), and a client installed concurrently would own
+                // the revoke we still hold — revoking that one while it is attached is the
+                // original bug.
+                const superseded = waasClient !== null && waasClient !== void 0 ? waasClient : this.dynamicWaasClient;
+                const detached = superseded
+                    ? this.detachWaasClient(superseded, 'end-session')
+                    : false;
+                // Revoke only while the revoker still belongs to the client we detached.
+                // endSession awaits the client, the active address and the key-share
+                // removal, and a rotation completing in any of those windows swaps both
+                // fields — revoking the live replacement while it is attached is the
+                // original bug. Detaching the captured client is unconditional: it is
+                // always safe, and it is the half that actually leaves the race.
+                if (detached && superseded === this.dynamicWaasClient) {
+                    (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this, 'end-session');
+                }
                 this.revokeSignedSession = undefined;
                 this.dynamicWaasClient = undefined;
             });

package/src/DynamicWaasMixin.d.ts

@@ -83,6 +83,18 @@ export declare const withDynamicWaas: <T extends abstract new (...args: any[]) =
         getSignedSessionId: () => Promise<string>;
     };
     createDynamicWaasClient(traceContext?: TraceContext): Promise<DynamicWalletClient>;
+    /**
+     * Stops the client answering the iframe's session-scoped reverse-channel
+     * requests — the signed session and the 401 notification. Its key-share
+     * handlers stay attached until the client's own cleanup() has its ACK, so
+     * the iframe can still clear shares on logout.
+     *
+     * Returns false only if the attempt threw: the client may still be
+     * registered, so the caller must not revoke it. Never rethrows — this runs
+     * on the rotation and logout paths, where throwing would leave the caller
+     * with no client at all.
+     */
+    detachWaasClient(client: DynamicWalletClient | undefined, reason: string): boolean;
     getWaasWalletClient(traceContext?: TraceContext, { forceRebuild }?: {
         forceRebuild?: boolean;
     }): Promise<DynamicWalletClient>;

package/src/DynamicWaasMixin.js

@@ -258,6 +258,31 @@ const withDynamicWaas = (BaseClass) => {
                 return client;
             });
         }
+        /**
+         * Stops the client answering the iframe's session-scoped reverse-channel
+         * requests — the signed session and the 401 notification. Its key-share
+         * handlers stay attached until the client's own cleanup() has its ACK, so
+         * the iframe can still clear shares on logout.
+         *
+         * Returns false only if the attempt threw: the client may still be
+         * registered, so the caller must not revoke it. Never rethrows — this runs
+         * on the rotation and logout paths, where throwing would leave the caller
+         * with no client at all.
+         */
+        detachWaasClient(client, reason) {
+            var _a;
+            // The pinned browser-wallet-client predates detach(); this goes away with
+            // the version bump.
+            const detachable = client;
+            try {
+                (_a = detachable === null || detachable === void 0 ? void 0 : detachable.detach) === null || _a === void 0 ? void 0 : _a.call(detachable);
+                return true;
+            }
+            catch (error) {
+                this.instrument('[DynamicWaasMixin] WaaS client detach failed', Object.assign({ key: 'waas-client-detach-failed', operation: 'detachWaasClient', reason, time: 0 }, this.buildErrorInstrumentContext(error)));
+                return false;
+            }
+        }
         getWaasWalletClient(traceContext_1) {
             return __awaiter(this, arguments, void 0, function* (traceContext, { forceRebuild = false } = {}) {
                 var _a, _b;
@@ -267,11 +292,19 @@ const withDynamicWaas = (BaseClass) => {
                 // available (see getWaasWalletConnector's live-token guard); otherwise
                 // createDynamicWaasClient would throw "Auth token is required".
                 if (forceRebuild) {
-                    // Revoke the previous client's nonce callback before dropping it.
-                    // The old DynamicWalletClient is not destroyed — it has no cancellation
-                    // API — but revoking its reverse-channel callback prevents it from
-                    // fetching fresh nonces and competing with the new client's recovery.
-                    (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this, 'force-rebuild');
+                    // Detach the superseded client, then revoke it — and never revoke one we
+                    // did not detach. The reverse channel is page-wide and
+                    // first-response-wins, so a revoked-but-still-attached client rejects
+                    // instantly, beats the live client to every getSignedSessionId and
+                    // poisons wallet creation for the life of the iframe. Two cases land
+                    // there: a failed detach, and a concurrent rebuild, where
+                    // createDynamicWaasClient has installed the new revoker but not yet
+                    // returned the client it belongs to. The revoke stays as a guard for a
+                    // caller still holding a direct reference.
+                    const superseded = this.dynamicWaasClient;
+                    if (superseded && this.detachWaasClient(superseded, 'force-rebuild')) {
+                        (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this, 'force-rebuild');
+                    }
                     this.revokeSignedSession = undefined;
                     this.dynamicWaasClient = undefined;
                 }
@@ -873,7 +906,28 @@ const withDynamicWaas = (BaseClass) => {
                         });
                     }
                 }
-                (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this, 'end-session');
+                // Detach synchronously: the cleanup() above removes the handlers too, but
+                // it is un-awaited and can sit on the channel's 5s timeout first, leaving
+                // this client in the race with its callback already revoked.
+                //
+                // Same guard as the rebuild path: never revoke a client we did not detach.
+                // waasClient is undefined whenever getWaasWalletClient threw (pending-auth
+                // scope, or a failed build), and a client installed concurrently would own
+                // the revoke we still hold — revoking that one while it is attached is the
+                // original bug.
+                const superseded = waasClient !== null && waasClient !== void 0 ? waasClient : this.dynamicWaasClient;
+                const detached = superseded
+                    ? this.detachWaasClient(superseded, 'end-session')
+                    : false;
+                // Revoke only while the revoker still belongs to the client we detached.
+                // endSession awaits the client, the active address and the key-share
+                // removal, and a rotation completing in any of those windows swaps both
+                // fields — revoking the live replacement while it is attached is the
+                // original bug. Detaching the captured client is unconditional: it is
+                // always safe, and it is the half that actually leaves the race.
+                if (detached && superseded === this.dynamicWaasClient) {
+                    (_a = this.revokeSignedSession) === null || _a === void 0 ? void 0 : _a.call(this, 'end-session');
+                }
                 this.revokeSignedSession = undefined;
                 this.dynamicWaasClient = undefined;
             });