@asgardeo/javascript 0.18.0 → 0.19.0

package/dist/models/config.d.ts

@@ -16,6 +16,7 @@
  * under the License.
  */
 import { I18nBundle } from '@asgardeo/i18n';
+import { ComponentsExtensions } from './v2/extensions/components';
 import { Platform } from './platforms';
 import { RecursivePartial } from './utility-types';
 import { ThemeConfig, ThemeMode } from '../theme/types';
@@ -49,7 +50,7 @@ export type SignOutOptions = Record<string, unknown>;
  * signUpOptions: { appId: "your-app-id" }
  */
 export type SignUpOptions = Record<string, unknown>;
-export interface BaseConfig<T = unknown> extends WithPreferences {
+export interface BaseConfig<T = unknown> extends WithPreferences, WithExtensions {
     /**
      * Optional URL where the authorization server should redirect after authentication.
      * This must match one of the allowed redirect URIs configured in your IdP.
@@ -328,6 +329,18 @@ export interface WithPreferences {
      */
     preferences?: Preferences;
 }
+export interface Extensions {
+    /**
+     * Extension configuration for flow component rendering.
+     */
+    components?: ComponentsExtensions;
+}
+export interface WithExtensions {
+    /**
+     * Extensions for customizing SDK behavior at defined integration points.
+     */
+    extensions?: Extensions;
+}
 export type Config<T = unknown> = BaseConfig<T>;
 export interface ThemePreferences {
     /**

package/dist/models/v2/embedded-signin-flow-v2.d.ts

@@ -155,6 +155,11 @@ export interface ExtendedEmbeddedSignInFlowResponse {
  * @experimental This interface is part of the new Asgardeo platform
  */
 export interface EmbeddedSignInFlowResponse extends ExtendedEmbeddedSignInFlowResponse {
+    /**
+     * Per-step challenge token for replay protection.
+     * Must be included in the next request to continue this flow.
+     */
+    challengeToken?: string;
     /**
      * Core response data containing UI components and flow metadata.
      * Includes both modern meta.components structure and legacy fields for compatibility.
@@ -302,6 +307,11 @@ export interface EmbeddedSignInFlowRequest extends Partial<EmbeddedSignInFlowIni
      * Corresponds to action components in the UI (e.g., submit button, social login).
      */
     action?: string;
+    /**
+     * Per-step challenge token received from the previous flow response.
+     * Required when continuing an existing flow to prevent replay attacks.
+     */
+    challengeToken?: string;
     /**
      * Identifier of the flow instance to continue.
      * Required when submitting data for an existing flow.

package/dist/models/v2/embedded-signup-flow-v2.d.ts

@@ -130,6 +130,11 @@ export interface ExtendedEmbeddedSignUpFlowResponse {
  * @see {@link EmbeddedSignUpFlowStatus} for available flow statuses
  */
 export interface EmbeddedSignUpFlowResponse extends ExtendedEmbeddedSignUpFlowResponse {
+    /**
+     * Per-step challenge token for replay protection.
+     * Must be included in the next request to continue this flow.
+     */
+    challengeToken?: string;
     /**
      * Flow data containing form inputs and available actions.
      * This is transformed to component-driven format by the React transformer.
@@ -191,6 +196,7 @@ export type EmbeddedSignUpFlowInitiateRequest = {
  */
 export interface EmbeddedSignUpFlowRequest extends Partial<EmbeddedSignUpFlowInitiateRequest> {
     action?: string;
+    challengeToken?: string;
     executionId?: string;
     inputs?: Record<string, any>;
 }

package/dist/models/v2/extensions/components.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import type { EmbeddedFlowComponent as EmbeddedFlowComponentV2 } from '../embedded-flow-v2';
+import type { FlowMetadataResponse } from '../flow-meta-v2';
+/**
+ * Framework-agnostic context passed to every custom component renderer.
+ * Contains form state and callbacks needed to render and submit flow components.
+ */
+export interface ComponentRenderContext {
+    /**
+     * Extra payload propagated by the flow engine for component rendering.
+     */
+    additionalData?: Record<string, any>;
+    /**
+     * Authentication flow type currently being rendered.
+     */
+    authType: 'signin' | 'signup';
+    /**
+     * Validation messages keyed by field name.
+     */
+    formErrors: Record<string, string>;
+    /**
+     * Current form values keyed by field name.
+     */
+    formValues: Record<string, string>;
+    /**
+     * Whether the current form state passes validation.
+     */
+    isFormValid: boolean;
+    /**
+     * Indicates whether a submit action is currently in progress.
+     */
+    isLoading: boolean;
+    /**
+     * Optional flow metadata associated with the current step.
+     */
+    meta?: FlowMetadataResponse | null;
+    /**
+     * Optional callback fired when an input loses focus.
+     */
+    onInputBlur?: (name: string) => void;
+    /**
+     * Callback to update the value of a named input field.
+     */
+    onInputChange: (name: string, value: string) => void;
+    /**
+     * Optional submit handler for progressing the flow.
+     */
+    onSubmit?: (component: EmbeddedFlowComponentV2, data?: Record<string, any>, skipValidation?: boolean) => void;
+    /**
+     * Tracks whether each field has been interacted with.
+     */
+    touchedFields: Record<string, boolean>;
+}
+/**
+ * A function that renders a flow component of a given type.
+ * `TElement` is `unknown` at the JS SDK level; each framework narrows it
+ * (React: `ReactElement`, Vue: `VNode`, etc.).
+ *
+ * Returning `null` hides the component. If no renderer is registered for a
+ * component type, the SDK falls back to its built-in rendering.
+ */
+export type ComponentRenderer<TElement = unknown> = (component: EmbeddedFlowComponentV2, context: ComponentRenderContext) => TElement | null;
+/**
+ * Extension configuration for flow component rendering.
+ * Keyed by component type string (e.g. `"PASSWORD_INPUT"`, `"ACTION"`).
+ */
+export interface ComponentsExtensions {
+    /**
+     * Custom renderers keyed by flow component type.
+     */
+    renderers?: Record<string, ComponentRenderer<unknown>>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/javascript",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Framework agnostic JavaScript SDK for Asgardeo.",
   "keywords": [
     "asgardeo",
@@ -19,6 +19,7 @@
   "main": "dist/cjs/index.js",
   "module": "dist/index.js",
   "exports": {
+    "edge-light": "./dist/edge/index.js",
     "import": "./dist/index.js",
     "require": "./dist/cjs/index.js"
   },