@asgardeo/javascript 0.17.0 → 0.18.1

package/dist/models/v2/embedded-signin-flow-v2.d.ts

@@ -155,6 +155,11 @@ export interface ExtendedEmbeddedSignInFlowResponse {
  * @experimental This interface is part of the new Asgardeo platform
  */
 export interface EmbeddedSignInFlowResponse extends ExtendedEmbeddedSignInFlowResponse {
+    /**
+     * Per-step challenge token for replay protection.
+     * Must be included in the next request to continue this flow.
+     */
+    challengeToken?: string;
     /**
      * Core response data containing UI components and flow metadata.
      * Includes both modern meta.components structure and legacy fields for compatibility.
@@ -302,6 +307,11 @@ export interface EmbeddedSignInFlowRequest extends Partial<EmbeddedSignInFlowIni
      * Corresponds to action components in the UI (e.g., submit button, social login).
      */
     action?: string;
+    /**
+     * Per-step challenge token received from the previous flow response.
+     * Required when continuing an existing flow to prevent replay attacks.
+     */
+    challengeToken?: string;
     /**
      * Identifier of the flow instance to continue.
      * Required when submitting data for an existing flow.

package/dist/models/v2/embedded-signup-flow-v2.d.ts

@@ -130,6 +130,11 @@ export interface ExtendedEmbeddedSignUpFlowResponse {
  * @see {@link EmbeddedSignUpFlowStatus} for available flow statuses
  */
 export interface EmbeddedSignUpFlowResponse extends ExtendedEmbeddedSignUpFlowResponse {
+    /**
+     * Per-step challenge token for replay protection.
+     * Must be included in the next request to continue this flow.
+     */
+    challengeToken?: string;
     /**
      * Flow data containing form inputs and available actions.
      * This is transformed to component-driven format by the React transformer.
@@ -191,6 +196,7 @@ export type EmbeddedSignUpFlowInitiateRequest = {
  */
 export interface EmbeddedSignUpFlowRequest extends Partial<EmbeddedSignUpFlowInitiateRequest> {
     action?: string;
+    challengeToken?: string;
     executionId?: string;
     inputs?: Record<string, any>;
 }

package/dist/utils/processOpenIDScopes.d.ts

@@ -21,16 +21,21 @@
  * If the input is an array, it joins the elements into a single string separated by spaces.
  * If the input is neither, it throws an error.
  *
- * @param scopes - The OpenID scopes to process, which can be a string or an array of strings.
+ * Default scopes are only injected when no scopes are configured (undefined, empty string,
+ * or empty array). If the caller explicitly provides scopes, those are used as-is.
+ *
+ * @param scopes - The OpenID scopes to process, which can be a string, an array of strings,
+ *   or undefined/null when not configured.
  * @returns A string of OpenID scopes separated by spaces.
  *
  * @example
  * ```typescript
  * processOpenIDScopes("openid profile email"); // returns "openid profile email"
  * processOpenIDScopes(["openid", "profile", "email"]); // returns "openid profile email"
+ * processOpenIDScopes(undefined); // returns default scopes
  * processOpenIDScopes(123); // throws AsgardeoRuntimeError
  * processOpenIDScopes({}); // throws AsgardeoRuntimeError
  * ```
  */
-declare const processOpenIDScopes: (scopes: string | string[]) => string;
+declare const processOpenIDScopes: (scopes: string | string[] | undefined | null) => string;
 export default processOpenIDScopes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/javascript",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "Framework agnostic JavaScript SDK for Asgardeo.",
   "keywords": [
     "asgardeo",