@incodetech/web 2.3.2 → 2.4.0-rc.1

package/dist/types/certificate-issuance.d.ts

@@ -3,6 +3,7 @@ import { CertificateIssuanceManager } from '@incodetech/core/certificate-issuanc
 import { DeepPartial } from '@incodetech/core/flow';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -170,8 +194,6 @@ export { }
 
 declare global {
     interface HTMLElementTagNameMap {
-        'incode-certificate-issuance': HTMLElement & IncodeModuleProps<CertificateIssuanceConfig,
-  void,
-  CertificateIssuanceManager>;
+        'incode-certificate-issuance': HTMLElement & import('preact').ComponentProps<typeof CertificateIssuance>;
     }
 }

package/dist/types/consent.d.ts

@@ -3,6 +3,7 @@ import { ConsentManager } from '@incodetech/core/consent';
 import { DeepPartial } from '@incodetech/core/flow';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -170,6 +194,6 @@ export { }
 
 declare global {
     interface HTMLElementTagNameMap {
-        'incode-consent': HTMLElement & IncodeModuleProps<ConsentConfig, void, ConsentManager>;
+        'incode-consent': HTMLElement & import('preact').ComponentProps<typeof Consent>;
     }
 }

package/dist/types/cross-document-data-match.d.ts

@@ -3,6 +3,7 @@ import { CrossDocumentDataMatchManager } from '@incodetech/core/cross-document-d
 import { DeepPartial } from '@incodetech/core/flow';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -167,3 +191,9 @@ declare type SpinnerSize = 'small' | 'medium' | 'large';
 declare type SvgComponent = FunctionComponent<SVGProps<SVGSVGElement>>;
 
 export { }
+
+declare global {
+    interface HTMLElementTagNameMap {
+        'incode-cross-document-data-match': HTMLElement & import('preact').ComponentProps<typeof CrossDocumentDataMatch>;
+    }
+}

package/dist/types/curp-validation.d.ts

@@ -3,6 +3,7 @@ import { CurpValidationManager } from '@incodetech/core/curp-validation';
 import { DeepPartial } from '@incodetech/core/flow';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -170,8 +194,6 @@ export { }
 
 declare global {
     interface HTMLElementTagNameMap {
-        'incode-curp-validation': HTMLElement & IncodeModuleProps<CurpValidationConfig,
-  void,
-  CurpValidationManager>;
+        'incode-curp-validation': HTMLElement & import('preact').ComponentProps<typeof CurpValidation>;
     }
 }

package/dist/types/document-capture.d.ts

@@ -3,6 +3,7 @@ import { DocumentCaptureConfig } from '@incodetech/core/document-capture';
 import { DocumentCaptureManager } from '@incodetech/core/document-capture';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -167,3 +191,9 @@ declare type SpinnerSize = 'small' | 'medium' | 'large';
 declare type SvgComponent = FunctionComponent<SVGProps<SVGSVGElement>>;
 
 export { }
+
+declare global {
+    interface HTMLElementTagNameMap {
+        'incode-document-capture': HTMLElement & import('preact').ComponentProps<typeof DocumentCapture>;
+    }
+}

package/dist/types/dynamic-forms.d.ts

@@ -3,6 +3,7 @@ import { DynamicFormsConfig } from '@incodetech/core/dynamic-forms';
 import { DynamicFormsManager } from '@incodetech/core/dynamic-forms';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -170,8 +194,6 @@ export { }
 
 declare global {
     interface HTMLElementTagNameMap {
-        'incode-dynamic-forms': HTMLElement & IncodeModuleProps<DynamicFormsConfig,
-  void,
-  DynamicFormsManager>;
+        'incode-dynamic-forms': HTMLElement & import('preact').ComponentProps<typeof DynamicForms>;
     }
 }

package/dist/types/ekyb.d.ts

@@ -3,6 +3,7 @@ import { EkybConfig } from '@incodetech/core/ekyb';
 import { EkybManager } from '@incodetech/core/ekyb';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -167,3 +191,9 @@ declare type SpinnerSize = 'small' | 'medium' | 'large';
 declare type SvgComponent = FunctionComponent<SVGProps<SVGSVGElement>>;
 
 export { }
+
+declare global {
+    interface HTMLElementTagNameMap {
+        'incode-ekyb': HTMLElement & import('preact').ComponentProps<typeof EkybModule>;
+    }
+}

package/dist/types/ekyc.d.ts

@@ -3,6 +3,7 @@ import { EkycConfig } from '@incodetech/core/ekyc';
 import { EkycManager } from '@incodetech/core/ekyc';
 import { FC } from 'preact/compat';
 import { FunctionComponent } from 'preact';
+import { SessionExpiredError } from '@incodetech/core/session';
 import { SVGProps } from 'preact/compat';
 
 /**
@@ -79,6 +80,15 @@ declare type IncodeFinishMeta = {
      * replace the SDK screen. Not a guarantee.
      */
     sdkOwnsTerminalScreen?: boolean;
+    /**
+     * True when the workflow is OAuth2-secured. The OAuth authorization server
+     * owns the redirect back to the client's `redirect_uri`, so the host must not
+     * navigate to `redirectionUrl` itself. A host redirect drops the `error` and
+     * `state` parameters, and the client reads a failed authentication as a
+     * success. The workflow always sets it on finish; treat a missing value as
+     * unknown.
+     */
+    oauth2Secured?: boolean;
 };
 
 declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TConfigInput = ConfigWithOverrides<TConfig>> = {
@@ -92,7 +102,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      */
     config?: TConfigInput;
     /**
-     * Optional pre-built manager. When provided, the module does not create or manage the manager lifecycle.
+     * Optional pre-built manager. The host owns its ordinary lifecycle.
+     * Session expiry always stops it to release capture resources, even when
+     * supplied by the host. Create a new manager for a replacement session;
+     * do not reuse the stopped instance in another mounted module.
      */
     manager?: TManager;
     /**
@@ -112,8 +125,10 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown, TCon
      * @param moduleErrorCode - Optional machine-readable error code (e.g. a
      *   `FaceErrorCode` such as `NONEXISTENT_CUSTOMER`). Lets an orchestrator
      *   branch on the specific terminal error without parsing the message string.
+     * @param details - Structured session-expiry error with statusCode 401 and
+     *   code/type SESSION_EXPIRED. The first three arguments stay compatible.
      */
-    onError?: (error: string | undefined, errorCode?: number, moduleErrorCode?: string) => void;
+    onError?: ModuleErrorHandler;
 };
 
 /**
@@ -128,6 +143,13 @@ declare type InstanceOverrides = {
     assets?: AssetOverrides;
     animations?: AnimationOverrides;
     spinner?: SpinnerPresentation;
+    /**
+     * `true` hides the unsupported-browser screen for this element; `false`
+     * forces it on. Wins over `setup({ uiConfig })`. When both are omitted, the
+     * session Flow's setting applies. `<incode-flow>` and `<incode-workflow>`
+     * ignore it and always use their server setting.
+     */
+    disableUnsupportedBrowserScreen?: boolean;
 };
 
 declare type LottieAnimationData = {
@@ -139,6 +161,8 @@ declare type LottieAnimationData = {
     h: number;
 };
 
+declare type ModuleErrorHandler = (message: string | undefined, errorCode?: number, moduleErrorCode?: string, details?: SessionExpiredError) => void;
+
 /**
  * Host-facing loader presentation, settable globally via
  * `setup({ uiConfig: { spinner } })` or per element via `config.spinner`.
@@ -167,3 +191,9 @@ declare type SpinnerSize = 'small' | 'medium' | 'large';
 declare type SvgComponent = FunctionComponent<SVGProps<SVGSVGElement>>;
 
 export { }
+
+declare global {
+    interface HTMLElementTagNameMap {
+        'incode-ekyc': HTMLElement & import('preact').ComponentProps<typeof EkycModule>;
+    }
+}