manu-xmint · Nov 6, 2026 · Nov 6, 2026 · Nov 6, 2026
diff --git a/.changeset/agent-staging-defaults.md b/.changeset/agent-staging-defaults.md
diff --git a/.changeset/olive-buttons-hide.md b/.changeset/olive-buttons-hide.md
diff --git a/.changeset/server-auth-scoped-cookies.md b/.changeset/server-auth-scoped-cookies.md
diff --git a/apps/auth/nextjs-ssr/CHANGELOG.md b/apps/auth/nextjs-ssr/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @crossmint/server-sdk-next-starter
 
+## 0.4.213
+
+### Patch Changes
+
+- Updated dependencies [45514f6]
+- Updated dependencies [a55b5e4]
+- Updated dependencies [0c053ed]
+  - @crossmint/client-sdk-react-ui@5.0.0
+  - @crossmint/server-sdk@1.2.98
+
 ## 0.4.212
 
 ### Patch Changes

diff --git a/apps/auth/nextjs-ssr/package.json b/apps/auth/nextjs-ssr/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/auth-ssr-nextjs-demo",
-    "version": "0.4.212",
+    "version": "0.4.213",
     "private": true,
     "scripts": {
         "dev": "next dev",

diff --git a/apps/auth/node-and-express-server/CHANGELOG.md b/apps/auth/node-and-express-server/CHANGELOG.md
@@ -1,5 +1,12 @@
 # crossmint-auth-node
 
+## 1.1.109
+
+### Patch Changes
+
+- Updated dependencies [0c053ed]
+  - @crossmint/server-sdk@1.2.98
+
 ## 1.1.108
 
 ### Patch Changes

diff --git a/apps/auth/node-and-express-server/package.json b/apps/auth/node-and-express-server/package.json
@@ -1,6 +1,6 @@
 {
     "name": "crossmint-auth-node",
-    "version": "1.1.108",
+    "version": "1.1.109",
     "description": "",
     "main": "index.js",
     "type": "module",

diff --git a/apps/payments/nextjs/CHANGELOG.md b/apps/payments/nextjs/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @crossmint/client-sdk-nextjs-starter
 
+## 2.0.63
+
+### Patch Changes
+
+- Updated dependencies [45514f6]
+- Updated dependencies [a55b5e4]
+  - @crossmint/client-sdk-react-ui@5.0.0
+  - @crossmint/client-sdk-base@5.0.0
+
 ## 2.0.62
 
 ### Patch Changes

diff --git a/apps/payments/nextjs/package.json b/apps/payments/nextjs/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/client-sdk-nextjs-starter",
-    "version": "2.0.62",
+    "version": "2.0.63",
     "private": true,
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",

diff --git a/apps/wallets/expo/CHANGELOG.md b/apps/wallets/expo/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @crossmint/wallets-playground-expo
 
+## 0.0.49
+
+### Patch Changes
+
+- Updated dependencies [45514f6]
+  - @crossmint/client-sdk-react-native-ui@2.1.5
+
 ## 0.0.48
 
 ### Patch Changes

diff --git a/apps/wallets/expo/package.json b/apps/wallets/expo/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@crossmint/wallets-playground-expo",
     "private": true,
-    "version": "0.0.48",
+    "version": "0.0.49",
     "main": "index.ts",
     "scripts": {
         "ios": "npx expo run:ios",

diff --git a/apps/wallets/quickstart-devkit/CHANGELOG.md b/apps/wallets/quickstart-devkit/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @crossmint/wallets-quickstart-devkit
 
+## 0.2.83
+
+### Patch Changes
+
+- Updated dependencies [45514f6]
+- Updated dependencies [a55b5e4]
+  - @crossmint/client-sdk-react-ui@5.0.0
+
 ## 0.2.82
 
 ### Patch Changes

diff --git a/apps/wallets/quickstart-devkit/package.json b/apps/wallets/quickstart-devkit/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/wallets-quickstart-devkit",
-    "version": "0.2.82",
+    "version": "0.2.83",
     "private": true,
     "scripts": {
         "dev": "next dev --turbopack",

diff --git a/apps/wallets/react/CHANGELOG.md b/apps/wallets/react/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @crossmint/wallets-playground-react
 
+## 0.0.46
+
+### Patch Changes
+
+- Updated dependencies [45514f6]
+- Updated dependencies [a55b5e4]
+  - @crossmint/wallets-sdk@1.22.1
+  - @crossmint/client-sdk-react-ui@5.0.0
+
 ## 0.0.45
 
 ### Patch Changes

diff --git a/apps/wallets/react/package.json b/apps/wallets/react/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@crossmint/wallets-playground-react",
     "private": true,
-    "version": "0.0.45",
+    "version": "0.0.46",
     "scripts": {
         "build": "next build",
         "dev": "next dev",

diff --git a/packages/client/auth/CHANGELOG.md b/packages/client/auth/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @crossmint/client-sdk-auth
 
+## 1.3.36
+
+### Patch Changes
+
+- 0c053ed: Read and write the project-scoped auth cookies in the server SDK. Since `@crossmint/client-sdk-auth` 1.3.4 the client stores the session as `crossmint-jwt-<projectId>` and `crossmint-refresh-token-<projectId>`, but the server SDK only read and wrote `crossmint-jwt` and `crossmint-refresh-token`, so `getSession(request)` saw no session and a custom refresh route stored cookies the client never read. `getSession(request)`, `handleCustomRefresh` and `logout` now read the scoped names, and the legacy names only when no scoped cookie is present. `storeAuthMaterial` (and so `getSession(request, response)`, `handleCustomRefresh` and `logout`) writes the scoped names; `logout` also expires the legacy ones. New `getAuthCookieNames(projectId)` returns the scoped names, for code with no request object such as a Next.js Server Component; `validateAPIKey` is re-exported so the project ID can be read from the API key. The naming helper `getScopedCookieName` now lives in `@crossmint/common-sdk-auth` and the client uses it.
+- Updated dependencies [a55b5e4]
+- Updated dependencies [0c053ed]
+  - @crossmint/client-sdk-base@5.0.0
+  - @crossmint/common-sdk-auth@1.1.34
+
 ## 1.3.35
 
 ### Patch Changes

diff --git a/packages/client/auth/package.json b/packages/client/auth/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/client-sdk-auth",
-    "version": "1.3.35",
+    "version": "1.3.36",
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",
     "author": "Paella Labs Inc",

diff --git a/packages/client/base/CHANGELOG.md b/packages/client/base/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @crossmint/client-sdk-base
 
+## 5.0.0
+
+### Major Changes
+
+- a55b5e4: BREAKING: `CrossmintPaymentMethodManagement` no longer renders a built-in submit button. The `hideSubmitButton` prop is removed — the component always asks the host to submit via `ref.submit()`, which must be wired to your own button. The iframe no longer draws the message of an `invalid` or `failed` submit: show the `message` that `ref.submit()` returns. Field errors stay in the iframe.
+
+  `CrossmintPaymentMethodManagement` adds `onReady` and `onChange({ mode, empty, complete })`, like Stripe's `ready` and `change` events, so your button can stay disabled until a submit can succeed. `invalid`, `failed` and `unavailable` submit results now carry a `code` (for example `incomplete_card`, `save_failed`, `timeout`); a code the component does not know becomes `unknown`. The code lists are exported as `PAYMENT_METHOD_SUBMIT_INVALID_CODES`, `PAYMENT_METHOD_SUBMIT_FAILED_CODES` and `PAYMENT_METHOD_SUBMIT_UNAVAILABLE_CODES`.
+
 ## 4.8.0
 
 ### Minor Changes

diff --git a/packages/client/base/package.json b/packages/client/base/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/client-sdk-base",
-    "version": "4.8.0",
+    "version": "5.0.0",
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",
     "author": "Paella Labs Inc",

diff --git a/packages/client/react-base/CHANGELOG.md b/packages/client/react-base/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @crossmint/client-sdk-react-base
 
+## 2.5.5
+
+### Patch Changes
+
+- Updated dependencies [45514f6]
+- Updated dependencies [a55b5e4]
+- Updated dependencies [0c053ed]
+  - @crossmint/wallets-sdk@1.22.1
+  - @crossmint/client-sdk-base@5.0.0
+  - @crossmint/common-sdk-auth@1.1.34
+  - @crossmint/client-sdk-auth@1.3.36
+
 ## 2.5.4
 
 ### Patch Changes

diff --git a/packages/client/react-base/package.json b/packages/client/react-base/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/client-sdk-react-base",
-    "version": "2.5.4",
+    "version": "2.5.5",
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",
     "author": "Paella Labs Inc",

diff --git a/packages/client/ui/react-native/CHANGELOG.md b/packages/client/ui/react-native/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @crossmint/client-sdk-react-native-ui
 
+## 2.1.5
+
+### Patch Changes
+
+- 45514f6: Readmes now default to Crossmint Auth in staging, and their staging examples fund wallets with `stagingFund` and send USDXM. The bring-your-own-auth links point at the current docs page.
+- Updated dependencies [45514f6]
+- Updated dependencies [a55b5e4]
+- Updated dependencies [0c053ed]
+  - @crossmint/wallets-sdk@1.22.1
+  - @crossmint/client-sdk-base@5.0.0
+  - @crossmint/common-sdk-auth@1.1.34
+  - @crossmint/client-sdk-auth@1.3.36
+  - @crossmint/client-sdk-react-base@2.5.5
+
 ## 2.1.4
 
 ### Patch Changes

diff --git a/packages/client/ui/react-native/package.json b/packages/client/ui/react-native/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/client-sdk-react-native-ui",
-    "version": "2.1.4",
+    "version": "2.1.5",
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",
     "author": "Paella Labs Inc",

diff --git a/packages/client/ui/react-ui/CHANGELOG.md b/packages/client/ui/react-ui/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @crossmint/client-sdk-react-ui
 
+## 5.0.0
+
+### Major Changes
+
+- a55b5e4: BREAKING: `CrossmintPaymentMethodManagement` no longer renders a built-in submit button. The `hideSubmitButton` prop is removed — the component always asks the host to submit via `ref.submit()`, which must be wired to your own button. The iframe no longer draws the message of an `invalid` or `failed` submit: show the `message` that `ref.submit()` returns. Field errors stay in the iframe.
+
+  `CrossmintPaymentMethodManagement` adds `onReady` and `onChange({ mode, empty, complete })`, like Stripe's `ready` and `change` events, so your button can stay disabled until a submit can succeed. `invalid`, `failed` and `unavailable` submit results now carry a `code` (for example `incomplete_card`, `save_failed`, `timeout`); a code the component does not know becomes `unknown`. The code lists are exported as `PAYMENT_METHOD_SUBMIT_INVALID_CODES`, `PAYMENT_METHOD_SUBMIT_FAILED_CODES` and `PAYMENT_METHOD_SUBMIT_UNAVAILABLE_CODES`.
+
+### Patch Changes
+
+- 45514f6: Readmes now default to Crossmint Auth in staging, and their staging examples fund wallets with `stagingFund` and send USDXM. The bring-your-own-auth links point at the current docs page.
+- Updated dependencies [45514f6]
+- Updated dependencies [a55b5e4]
+- Updated dependencies [0c053ed]
+  - @crossmint/wallets-sdk@1.22.1
+  - @crossmint/client-sdk-base@5.0.0
+  - @crossmint/common-sdk-auth@1.1.34
+  - @crossmint/client-sdk-react-base@2.5.5
+
 ## 4.13.4
 
 ### Patch Changes

diff --git a/packages/client/ui/react-ui/package.json b/packages/client/ui/react-ui/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/client-sdk-react-ui",
-    "version": "4.13.4",
+    "version": "5.0.0",
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",
     "author": "Paella Labs Inc",

diff --git a/packages/client/verifiable-credentials/CHANGELOG.md b/packages/client/verifiable-credentials/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @crossmint/client-sdk-verifiable-credentials
 
+## 3.4.112
+
+### Patch Changes
+
+- Updated dependencies [a55b5e4]
+  - @crossmint/client-sdk-base@5.0.0
+
 ## 3.4.111
 
 ### Patch Changes

diff --git a/packages/client/verifiable-credentials/package.json b/packages/client/verifiable-credentials/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/client-sdk-verifiable-credentials",
-    "version": "3.4.111",
+    "version": "3.4.112",
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",
     "author": "Paella Labs Inc",

diff --git a/packages/client/wallets/smart-wallet/CHANGELOG.md b/packages/client/wallets/smart-wallet/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @crossmint/client-sdk-smart-wallet
 
+## 0.3.87
+
+### Patch Changes
+
+- Updated dependencies [a55b5e4]
+  - @crossmint/client-sdk-base@5.0.0
+
 ## 0.3.86
 
 ### Patch Changes

diff --git a/packages/client/wallets/smart-wallet/package.json b/packages/client/wallets/smart-wallet/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/client-sdk-smart-wallet",
-    "version": "0.3.86",
+    "version": "0.3.87",
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",
     "author": "Paella Labs Inc",

diff --git a/packages/common/auth/CHANGELOG.md b/packages/common/auth/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @crossmint/common-sdk-auth
 
+## 1.1.34
+
+### Patch Changes
+
+- 0c053ed: Read and write the project-scoped auth cookies in the server SDK. Since `@crossmint/client-sdk-auth` 1.3.4 the client stores the session as `crossmint-jwt-<projectId>` and `crossmint-refresh-token-<projectId>`, but the server SDK only read and wrote `crossmint-jwt` and `crossmint-refresh-token`, so `getSession(request)` saw no session and a custom refresh route stored cookies the client never read. `getSession(request)`, `handleCustomRefresh` and `logout` now read the scoped names, and the legacy names only when no scoped cookie is present. `storeAuthMaterial` (and so `getSession(request, response)`, `handleCustomRefresh` and `logout`) writes the scoped names; `logout` also expires the legacy ones. New `getAuthCookieNames(projectId)` returns the scoped names, for code with no request object such as a Next.js Server Component; `validateAPIKey` is re-exported so the project ID can be read from the API key. The naming helper `getScopedCookieName` now lives in `@crossmint/common-sdk-auth` and the client uses it.
+- Updated dependencies [a55b5e4]
+  - @crossmint/client-sdk-base@5.0.0
+
 ## 1.1.33
 
 ### Patch Changes

diff --git a/packages/common/auth/package.json b/packages/common/auth/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/common-sdk-auth",
-    "version": "1.1.33",
+    "version": "1.1.34",
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",
     "author": "Paella Labs Inc",

diff --git a/packages/server/CHANGELOG.md b/packages/server/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @crossmint/server-sdk
 
+## 1.2.98
+
+### Patch Changes
+
+- 0c053ed: Read and write the project-scoped auth cookies in the server SDK. Since `@crossmint/client-sdk-auth` 1.3.4 the client stores the session as `crossmint-jwt-<projectId>` and `crossmint-refresh-token-<projectId>`, but the server SDK only read and wrote `crossmint-jwt` and `crossmint-refresh-token`, so `getSession(request)` saw no session and a custom refresh route stored cookies the client never read. `getSession(request)`, `handleCustomRefresh` and `logout` now read the scoped names, and the legacy names only when no scoped cookie is present. `storeAuthMaterial` (and so `getSession(request, response)`, `handleCustomRefresh` and `logout`) writes the scoped names; `logout` also expires the legacy ones. New `getAuthCookieNames(projectId)` returns the scoped names, for code with no request object such as a Next.js Server Component; `validateAPIKey` is re-exported so the project ID can be read from the API key. The naming helper `getScopedCookieName` now lives in `@crossmint/common-sdk-auth` and the client uses it.
+- Updated dependencies [0c053ed]
+  - @crossmint/common-sdk-auth@1.1.34
+
 ## 1.2.97
 
 ### Patch Changes

diff --git a/packages/server/package.json b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@crossmint/server-sdk",
-    "version": "1.2.97",
+    "version": "1.2.98",
     "repository": "https://github.com/Crossmint/crossmint-sdk",
     "license": "Apache-2.0",
     "author": "Paella Labs Inc",

diff --git a/packages/wallets/CHANGELOG.md b/packages/wallets/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @crossmint/wallets-sdk
 
+## 1.22.1
+
+### Patch Changes
+
+- 45514f6: Readmes now default to Crossmint Auth in staging, and their staging examples fund wallets with `stagingFund` and send USDXM. The bring-your-own-auth links point at the current docs page.
+- Updated dependencies [0c053ed]
+  - @crossmint/common-sdk-auth@1.1.34
+
 ## 1.22.0
 
 ### Minor Changes