@dynamic-labs/waas 5.9.6 → 5.11.0

package/CHANGELOG.md

@@ -1,4 +1,26 @@
 
+## [5.11.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.10.0...v5.11.0) (2026-10-14)
+
+
+### Bug Fixes
+
+* **react-native:** fall back to a TEE-backed key when StrongBox key generation fails on Android ([#12484](https://github.com/dynamic-labs/dynamic-auth/issues/12484)) ([6884ef1](https://github.com/dynamic-labs/dynamic-auth/commit/6884ef1665e4b18d1b8fdb54ee7cd06861b47fc9))
+* support WaaS password overrides in WebView ([#12509](https://github.com/dynamic-labs/dynamic-auth/issues/12509)) ([fc67fcc](https://github.com/dynamic-labs/dynamic-auth/commit/fc67fccb99be7c0cc8df81a2513ccd3a04db9a61))
+
+## [5.10.0](https://github.com/dynamic-labs/dynamic-auth/compare/v5.9.6...v5.10.0) (2026-10-09)
+
+
+### Features
+
+* add lockWallets/lockWallet to re-lock password-encrypted WaaS wallets ([#12461](https://github.com/dynamic-labs/dynamic-auth/issues/12461)) ([090f544](https://github.com/dynamic-labs/dynamic-auth/commit/090f544150f4359bbfd9c0ffb4c450868adb6759))
+
+
+### Bug Fixes
+
+* **logger:** scope server error forwarding per instance ([#12477](https://github.com/dynamic-labs/dynamic-auth/issues/12477)) ([baa8c78](https://github.com/dynamic-labs/dynamic-auth/commit/baa8c780f4ef3cc35d62c363e03e74412ece91b9))
+* **waas:** fall back when crypto.randomUUID is unavailable ([#12435](https://github.com/dynamic-labs/dynamic-auth/issues/12435)) ([5756f53](https://github.com/dynamic-labs/dynamic-auth/commit/5756f53423bd8316bce97e46ce38fc923fd5d574))
+* **waas:** include every wallet in password update batches ([#12462](https://github.com/dynamic-labs/dynamic-auth/issues/12462)) ([80218f7](https://github.com/dynamic-labs/dynamic-auth/commit/80218f702dadfee9673cec4037889449bcd5ceb6))
+
 ### [5.9.6](https://github.com/dynamic-labs/dynamic-auth/compare/v5.9.5...v5.9.6) (2026-10-06)
 
 ### [5.9.5](https://github.com/dynamic-labs/dynamic-auth/compare/v5.9.4...v5.9.5) (2026-10-06)

package/package.cjs

@@ -3,6 +3,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "5.9.6";
+var version = "5.11.0";
 
 exports.version = version;

package/package.js

@@ -1,4 +1,4 @@
 'use client'
-var version = "5.9.6";
+var version = "5.11.0";
 
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/waas",
-  "version": "5.9.6",
+  "version": "5.11.0",
   "type": "module",
   "author": "Dynamic Labs, Inc.",
   "license": "MIT",
@@ -16,20 +16,20 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@dynamic-labs-sdk/client": "1.37.0",
-    "@dynamic-labs/assert-package-version": "5.9.6",
-    "@dynamic-labs/sdk-api-core": "0.70.0",
-    "@dynamic-labs-wallet/browser-wallet-client": "1.1.27",
-    "@dynamic-labs-wallet/core": "1.1.27",
+    "@dynamic-labs-sdk/client": "1.39.1",
+    "@dynamic-labs/assert-package-version": "5.11.0",
+    "@dynamic-labs/sdk-api-core": "0.92.0",
+    "@dynamic-labs-wallet/browser-wallet-client": "1.1.33",
+    "@dynamic-labs-wallet/core": "1.1.33",
     "@dynamic-labs-wallet/forward-mpc-client": "1.0.2",
     "zod": "4.0.5",
-    "@dynamic-labs/ethereum-core": "5.9.6",
-    "@dynamic-labs/logger": "5.9.6",
-    "@dynamic-labs/solana-core": "5.9.6",
-    "@dynamic-labs/sui-core": "5.9.6",
-    "@dynamic-labs/utils": "5.9.6",
-    "@dynamic-labs/wallet-book": "5.9.6",
-    "@dynamic-labs/wallet-connector-core": "5.9.6"
+    "@dynamic-labs/ethereum-core": "5.11.0",
+    "@dynamic-labs/logger": "5.11.0",
+    "@dynamic-labs/solana-core": "5.11.0",
+    "@dynamic-labs/sui-core": "5.11.0",
+    "@dynamic-labs/utils": "5.11.0",
+    "@dynamic-labs/wallet-book": "5.11.0",
+    "@dynamic-labs/wallet-connector-core": "5.11.0"
   },
   "peerDependencies": {}
 }

package/src/DynamicWaasMixin.cjs

@@ -11,11 +11,23 @@ var _package = require('../package.cjs');
 var constants = require('../utils/constants.cjs');
 var createWaasClientSecureStorage = require('../utils/createWaasClientSecureStorage.cjs');
 var instrumentation = require('../utils/instrumentation.cjs');
+var generateUUID = require('../utils/generateUUID.cjs');
 var tokenHasPendingAuthScope = require('../utils/tokenHasPendingAuthScope.cjs');
 
 // Fallback error code used when a thrown value carries no code, or when
 // formatting the error itself fails.
 const UNKNOWN_ERROR_CODE = 'unknown';
+const PASSWORD_UPDATE_ACTIVATED_STATUS = 'activated';
+const PASSWORD_UPDATE_NOT_ACTIVATED_CODE = 'password_update_not_activated';
+// The server activates a password-update batch on the last wallet's check-in. Unless a
+// wallet reports 'activated', the new password never took effect. A missing status is
+// not proof of activation, so it fails closed too.
+const assertPasswordUpdateActivated = (results) => {
+    const isActivated = results.some((result) => (result === null || result === void 0 ? void 0 : result.passwordUpdateStatus) === PASSWORD_UPDATE_ACTIVATED_STATUS);
+    if (!isActivated) {
+        throw new utils.DynamicError('Password update was not applied to all wallets. Please try again.', PASSWORD_UPDATE_NOT_ACTIVATED_CODE);
+    }
+};
 // This class is common across all waas connectors
 class WaasExportHandler {
     constructor() {
@@ -717,7 +729,7 @@ const withDynamicWaas = (BaseClass) => {
             });
         }
         updatePassword(_a) {
-            return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress, existingPassword, newPassword, }) {
+            return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress, existingPassword, newPassword, passwordOverrides, }) {
                 if (!accountAddress) {
                     throw new utils.DynamicError('Account address is required', 'account_address_is_required');
                 }
@@ -729,22 +741,16 @@ const withDynamicWaas = (BaseClass) => {
                 if (!this.getSignedSessionId) {
                     throw new utils.DynamicError('Signed session ID is required', 'signed_session_id_is_required');
                 }
+                // The server only activates the batch once every wallet of the user has
+                // checked in, so wallets that are not password-encrypted yet are included too.
                 const wallets = yield walletClient.getAllWallets();
-                const encryptedWallets = wallets.filter((w) => { var _a; return (_a = w.clientKeySharesBackupInfo) === null || _a === void 0 ? void 0 : _a.passwordEncrypted; });
-                const passwordUpdateBatchId = crypto.randomUUID();
-                yield Promise.all(encryptedWallets.map((wallet) => _tslib.__awaiter(this, void 0, void 0, function* () {
+                const passwordUpdateBatchId = generateUUID.generateUUID();
+                const results = yield Promise.all(wallets.map((wallet) => _tslib.__awaiter(this, void 0, void 0, function* () {
                     var _b, _c;
                     const signedSessionId = yield this.getSignedSessionId();
-                    yield walletClient.updatePassword({
-                        accountAddress: wallet.accountAddress,
-                        authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this),
-                        existingPassword: resolvedExistingPassword,
-                        newPassword,
-                        passwordUpdateBatchId,
-                        sessionPublicKey: yield ((_c = this.getSessionPublicKey) === null || _c === void 0 ? void 0 : _c.call(this)),
-                        signedSessionId,
-                    });
+                    return walletClient.updatePassword(Object.assign(Object.assign({ accountAddress: wallet.accountAddress, authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this), existingPassword: resolvedExistingPassword, newPassword }, (passwordOverrides ? { passwordOverrides } : {})), { passwordUpdateBatchId, sessionPublicKey: yield ((_c = this.getSessionPublicKey) === null || _c === void 0 ? void 0 : _c.call(this)), signedSessionId }));
                 })));
+                assertPasswordUpdateActivated(results);
             });
         }
         setPassword(_a) {
@@ -757,11 +763,11 @@ const withDynamicWaas = (BaseClass) => {
                     throw new utils.DynamicError('Signed session ID is required', 'signed_session_id_is_required');
                 }
                 const wallets = yield walletClient.getAllWallets();
-                const passwordUpdateBatchId = crypto.randomUUID();
-                yield Promise.all(wallets.map((wallet) => _tslib.__awaiter(this, void 0, void 0, function* () {
+                const passwordUpdateBatchId = generateUUID.generateUUID();
+                const results = yield Promise.all(wallets.map((wallet) => _tslib.__awaiter(this, void 0, void 0, function* () {
                     var _b, _c;
                     const signedSessionId = yield this.getSignedSessionId();
-                    yield walletClient.setPassword({
+                    return walletClient.setPassword({
                         accountAddress: wallet.accountAddress,
                         authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this),
                         newPassword,
@@ -770,6 +776,7 @@ const withDynamicWaas = (BaseClass) => {
                         signedSessionId,
                     });
                 })));
+                assertPasswordUpdateActivated(results);
             });
         }
         signRawMessage(_a) {
@@ -825,6 +832,31 @@ const withDynamicWaas = (BaseClass) => {
                 });
             });
         }
+        /**
+         * Re-locks every password-encrypted wallet: the iframe clears its stored
+         * decrypted client key shares, so the next wallet operation prompts for
+         * the wallet password again.
+         */
+        lockWallets() {
+            return _tslib.__awaiter(this, void 0, void 0, function* () {
+                var _a;
+                const walletClient = yield this.getWaasWalletClient();
+                return walletClient.lockWallets({ authToken: (_a = this.getAuthToken) === null || _a === void 0 ? void 0 : _a.call(this) });
+            });
+        }
+        /**
+         * Same re-lock semantics as `lockWallets`, scoped to a single wallet.
+         */
+        lockWallet(_a) {
+            return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress }) {
+                var _b;
+                const walletClient = yield this.getWaasWalletClient();
+                return walletClient.lockWallets({
+                    accountAddress,
+                    authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this),
+                });
+            });
+        }
         getWalletRecoveryState(_a) {
             return _tslib.__awaiter(this, arguments, void 0, function* ({ accountAddress, }) {
                 var _b, _c;

package/src/DynamicWaasMixin.d.ts

@@ -191,7 +191,7 @@ export declare const withDynamicWaas: <T extends abstract new (...args: any[]) =
         accountAddress: string;
         password?: string;
     }): Promise<void>;
-    updatePassword({ accountAddress, existingPassword, newPassword, }: UpdatePasswordParams): Promise<void>;
+    updatePassword({ accountAddress, existingPassword, newPassword, passwordOverrides, }: UpdatePasswordParams): Promise<void>;
     setPassword({ accountAddress, newPassword, }: {
         accountAddress: string;
         newPassword: string;
@@ -206,6 +206,18 @@ export declare const withDynamicWaas: <T extends abstract new (...args: any[]) =
         accountAddress: string;
         password?: string;
     }): Promise<import("@dynamic-labs-wallet/browser-wallet-client").GetWalletResponse>;
+    /**
+     * Re-locks every password-encrypted wallet: the iframe clears its stored
+     * decrypted client key shares, so the next wallet operation prompts for
+     * the wallet password again.
+     */
+    lockWallets(): Promise<void>;
+    /**
+     * Same re-lock semantics as `lockWallets`, scoped to a single wallet.
+     */
+    lockWallet({ accountAddress }: {
+        accountAddress: string;
+    }): Promise<void>;
     getWalletRecoveryState({ accountAddress, }: {
         accountAddress: string;
     }): Promise<import("@dynamic-labs-wallet/browser-wallet-client").WalletRecoveryState>;

package/src/DynamicWaasMixin.js

@@ -7,11 +7,23 @@ import { version } from '../package.js';
 import { DEFAULT_BASE_API_URL, DEFAULT_BASE_MPC_RELAY_API_URL } from '../utils/constants.js';
 import { createWaasClientSecureStorage } from '../utils/createWaasClientSecureStorage.js';
 import { InstrumentationTimer } from '../utils/instrumentation.js';
+import { generateUUID } from '../utils/generateUUID.js';
 import { tokenHasPendingAuthScope } from '../utils/tokenHasPendingAuthScope.js';
 
 // Fallback error code used when a thrown value carries no code, or when
 // formatting the error itself fails.
 const UNKNOWN_ERROR_CODE = 'unknown';
+const PASSWORD_UPDATE_ACTIVATED_STATUS = 'activated';
+const PASSWORD_UPDATE_NOT_ACTIVATED_CODE = 'password_update_not_activated';
+// The server activates a password-update batch on the last wallet's check-in. Unless a
+// wallet reports 'activated', the new password never took effect. A missing status is
+// not proof of activation, so it fails closed too.
+const assertPasswordUpdateActivated = (results) => {
+    const isActivated = results.some((result) => (result === null || result === void 0 ? void 0 : result.passwordUpdateStatus) === PASSWORD_UPDATE_ACTIVATED_STATUS);
+    if (!isActivated) {
+        throw new DynamicError('Password update was not applied to all wallets. Please try again.', PASSWORD_UPDATE_NOT_ACTIVATED_CODE);
+    }
+};
 // This class is common across all waas connectors
 class WaasExportHandler {
     constructor() {
@@ -713,7 +725,7 @@ const withDynamicWaas = (BaseClass) => {
             });
         }
         updatePassword(_a) {
-            return __awaiter(this, arguments, void 0, function* ({ accountAddress, existingPassword, newPassword, }) {
+            return __awaiter(this, arguments, void 0, function* ({ accountAddress, existingPassword, newPassword, passwordOverrides, }) {
                 if (!accountAddress) {
                     throw new DynamicError('Account address is required', 'account_address_is_required');
                 }
@@ -725,22 +737,16 @@ const withDynamicWaas = (BaseClass) => {
                 if (!this.getSignedSessionId) {
                     throw new DynamicError('Signed session ID is required', 'signed_session_id_is_required');
                 }
+                // The server only activates the batch once every wallet of the user has
+                // checked in, so wallets that are not password-encrypted yet are included too.
                 const wallets = yield walletClient.getAllWallets();
-                const encryptedWallets = wallets.filter((w) => { var _a; return (_a = w.clientKeySharesBackupInfo) === null || _a === void 0 ? void 0 : _a.passwordEncrypted; });
-                const passwordUpdateBatchId = crypto.randomUUID();
-                yield Promise.all(encryptedWallets.map((wallet) => __awaiter(this, void 0, void 0, function* () {
+                const passwordUpdateBatchId = generateUUID();
+                const results = yield Promise.all(wallets.map((wallet) => __awaiter(this, void 0, void 0, function* () {
                     var _b, _c;
                     const signedSessionId = yield this.getSignedSessionId();
-                    yield walletClient.updatePassword({
-                        accountAddress: wallet.accountAddress,
-                        authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this),
-                        existingPassword: resolvedExistingPassword,
-                        newPassword,
-                        passwordUpdateBatchId,
-                        sessionPublicKey: yield ((_c = this.getSessionPublicKey) === null || _c === void 0 ? void 0 : _c.call(this)),
-                        signedSessionId,
-                    });
+                    return walletClient.updatePassword(Object.assign(Object.assign({ accountAddress: wallet.accountAddress, authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this), existingPassword: resolvedExistingPassword, newPassword }, (passwordOverrides ? { passwordOverrides } : {})), { passwordUpdateBatchId, sessionPublicKey: yield ((_c = this.getSessionPublicKey) === null || _c === void 0 ? void 0 : _c.call(this)), signedSessionId }));
                 })));
+                assertPasswordUpdateActivated(results);
             });
         }
         setPassword(_a) {
@@ -753,11 +759,11 @@ const withDynamicWaas = (BaseClass) => {
                     throw new DynamicError('Signed session ID is required', 'signed_session_id_is_required');
                 }
                 const wallets = yield walletClient.getAllWallets();
-                const passwordUpdateBatchId = crypto.randomUUID();
-                yield Promise.all(wallets.map((wallet) => __awaiter(this, void 0, void 0, function* () {
+                const passwordUpdateBatchId = generateUUID();
+                const results = yield Promise.all(wallets.map((wallet) => __awaiter(this, void 0, void 0, function* () {
                     var _b, _c;
                     const signedSessionId = yield this.getSignedSessionId();
-                    yield walletClient.setPassword({
+                    return walletClient.setPassword({
                         accountAddress: wallet.accountAddress,
                         authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this),
                         newPassword,
@@ -766,6 +772,7 @@ const withDynamicWaas = (BaseClass) => {
                         signedSessionId,
                     });
                 })));
+                assertPasswordUpdateActivated(results);
             });
         }
         signRawMessage(_a) {
@@ -821,6 +828,31 @@ const withDynamicWaas = (BaseClass) => {
                 });
             });
         }
+        /**
+         * Re-locks every password-encrypted wallet: the iframe clears its stored
+         * decrypted client key shares, so the next wallet operation prompts for
+         * the wallet password again.
+         */
+        lockWallets() {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                const walletClient = yield this.getWaasWalletClient();
+                return walletClient.lockWallets({ authToken: (_a = this.getAuthToken) === null || _a === void 0 ? void 0 : _a.call(this) });
+            });
+        }
+        /**
+         * Same re-lock semantics as `lockWallets`, scoped to a single wallet.
+         */
+        lockWallet(_a) {
+            return __awaiter(this, arguments, void 0, function* ({ accountAddress }) {
+                var _b;
+                const walletClient = yield this.getWaasWalletClient();
+                return walletClient.lockWallets({
+                    accountAddress,
+                    authToken: (_b = this.getAuthToken) === null || _b === void 0 ? void 0 : _b.call(this),
+                });
+            });
+        }
         getWalletRecoveryState(_a) {
             return __awaiter(this, arguments, void 0, function* ({ accountAddress, }) {
                 var _b, _c;

package/utils/generateUUID.cjs

@@ -0,0 +1,23 @@
+'use client'
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+// crypto.randomUUID is unavailable on older webviews (< Chrome 92) and in
+// non-secure contexts; fall back to a getRandomValues-based v4 UUID there.
+const generateUUID = () => {
+    const cryptoProvider = globalThis.crypto;
+    if (typeof (cryptoProvider === null || cryptoProvider === void 0 ? void 0 : cryptoProvider.randomUUID) === 'function') {
+        return cryptoProvider.randomUUID();
+    }
+    if (typeof (cryptoProvider === null || cryptoProvider === void 0 ? void 0 : cryptoProvider.getRandomValues) !== 'function') {
+        throw new TypeError('Secure UUID generation is unavailable');
+    }
+    const bytes = cryptoProvider.getRandomValues(new Uint8Array(16));
+    bytes[6] = (bytes[6] & 0x0f) | 0x40;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+};
+
+exports.generateUUID = generateUUID;

package/utils/generateUUID.d.ts

@@ -0,0 +1 @@
+export declare const generateUUID: () => string;

package/utils/generateUUID.js

@@ -0,0 +1,19 @@
+'use client'
+// crypto.randomUUID is unavailable on older webviews (< Chrome 92) and in
+// non-secure contexts; fall back to a getRandomValues-based v4 UUID there.
+const generateUUID = () => {
+    const cryptoProvider = globalThis.crypto;
+    if (typeof (cryptoProvider === null || cryptoProvider === void 0 ? void 0 : cryptoProvider.randomUUID) === 'function') {
+        return cryptoProvider.randomUUID();
+    }
+    if (typeof (cryptoProvider === null || cryptoProvider === void 0 ? void 0 : cryptoProvider.getRandomValues) !== 'function') {
+        throw new TypeError('Secure UUID generation is unavailable');
+    }
+    const bytes = cryptoProvider.getRandomValues(new Uint8Array(16));
+    bytes[6] = (bytes[6] & 0x0f) | 0x40;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+};
+
+export { generateUUID };