@strivacity/sdk-angular 4.0.0-beta.1 → 4.0.0-beta.2

package/dist/fesm2022/strivacity-sdk-angular.mjs

@@ -1,12 +1,11 @@
 export * from '@strivacity/sdk-core/flows';
 export * from '@strivacity/sdk-core/handlers';
-import { unflattenObject, isSessionExpired } from '@strivacity/sdk-core/utils';
+import { flushSetCookies, toClientSession, createNativeLoginController } from '@strivacity/sdk-core/utils';
 export * from '@strivacity/sdk-core/utils';
 import * as i0 from '@angular/core';
-import { InjectionToken, CUSTOM_ELEMENTS_SCHEMA, NgModule, makeStateKey, provideAppInitializer, inject, REQUEST, TransferState, signal, PLATFORM_ID, DestroyRef, Injectable } from '@angular/core';
+import { InjectionToken, CUSTOM_ELEMENTS_SCHEMA, NgModule, makeStateKey, provideAppInitializer, inject, REQUEST, TransferState, RESPONSE_INIT, signal, PLATFORM_ID, DestroyRef, Injectable, computed } from '@angular/core';
 import { isPlatformBrowser } from '@angular/common';
 import { initFlow } from '@strivacity/sdk-core';
-import { FallbackError } from '@strivacity/sdk-core/utils/errors';
 export { COOKIE_CHUNK_SIZE, COOKIE_CONTEXT, createCacheAPIStorage, createIndexedDBStorage, createLocalStorage, createMemoryStorage, createServerMemoryStorage, createSessionStorage, createWorkerStorage, handleWorkerStorageRequests } from '@strivacity/sdk-core/storages';
 
 const STRIVACITY_SDK = new InjectionToken('strivacity-sdk');
@@ -51,7 +50,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.4", ngImpor
 const SESSION_TRANSFER_KEY = makeStateKey('sty.session');
 /**
  * Loads the current session from the encrypted cookie storage (using Angular's `REQUEST` token) before the app
- * renders, and hands it over to the client through `TransferState`, so `StrivacityAuthService` can hydrate without
+ * renders, and hands it over to the client through `TransferState` (without the refresh and ID tokens, which stay server-side), so `StrivacityAuthService` can hydrate without
  * an extra round-trip or a loading flash.
  *
  * Add this to the server-only `ApplicationConfig` (e.g. `app.config.server.ts`), alongside `provideServerRendering()`.
@@ -66,8 +65,17 @@ function provideStrivacityServerSession(serverSdk) {
             return;
         }
         const transferState = inject(TransferState);
+        const responseInit = inject(RESPONSE_INIT, { optional: true });
         const session = await serverSdk.getSession(request);
-        transferState.set(SESSION_TRANSFER_KEY, session);
+        const cookies = flushSetCookies(request, new Response(null)).headers.getSetCookie();
+        if (responseInit && cookies.length) {
+            const headers = new Headers(responseInit.headers);
+            for (const cookie of cookies) {
+                headers.append('set-cookie', cookie);
+            }
+            responseInit.headers = headers;
+        }
+        transferState.set(SESSION_TRANSFER_KEY, toClientSession(session));
     });
 }
 
@@ -136,8 +144,8 @@ class StrivacityAuthService {
     handleCallback(...args) {
         return this.sdk.handleCallback(...args);
     }
-    refresh() {
-        return this.sdk.refresh();
+    refresh(...args) {
+        return this.sdk.refresh(...args);
     }
     revoke() {
         return this.sdk.revoke();
@@ -191,22 +199,19 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.4", ngImpor
 class StrivacityNativeLoginService {
     constructor() {
         this.authService = inject(StrivacityAuthService);
-        this.sdk = this.authService.sdk;
-        this.abortController = new AbortController();
-        this.options = {};
-        this.loadingSignal = signal(true, /* @ts-ignore */
-        ...(ngDevMode ? [{ debugName: "loadingSignal" }] : /* istanbul ignore next */ []));
-        this.formsSignal = signal({}, /* @ts-ignore */
-        ...(ngDevMode ? [{ debugName: "formsSignal" }] : /* istanbul ignore next */ []));
-        this.messagesSignal = signal({}, /* @ts-ignore */
-        ...(ngDevMode ? [{ debugName: "messagesSignal" }] : /* istanbul ignore next */ []));
-        this.stateSignal = signal({}, /* @ts-ignore */
-        ...(ngDevMode ? [{ debugName: "stateSignal" }] : /* istanbul ignore next */ []));
-        this.loading = this.loadingSignal.asReadonly();
-        this.forms = this.formsSignal.asReadonly();
-        this.messages = this.messagesSignal.asReadonly();
-        this.state = this.stateSignal.asReadonly();
-        inject(DestroyRef).onDestroy(() => this.abortController.abort());
+        this.controller = createNativeLoginController(() => this.authService.sdk);
+        this.snapshot = signal(this.controller.getSnapshot(), /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "snapshot" }] : /* istanbul ignore next */ []));
+        this.loading = computed(() => this.snapshot().loading, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "loading" }] : /* istanbul ignore next */ []));
+        this.forms = computed(() => this.snapshot().forms, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "forms" }] : /* istanbul ignore next */ []));
+        this.messages = computed(() => this.snapshot().messages, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "messages" }] : /* istanbul ignore next */ []));
+        this.state = computed(() => this.snapshot().state, /* @ts-ignore */
+        ...(ngDevMode ? [{ debugName: "state" }] : /* istanbul ignore next */ []));
+        const unsubscribe = this.controller.subscribe((snapshot) => this.snapshot.set(snapshot));
+        inject(DestroyRef).onDestroy(unsubscribe);
     }
     /**
      * Starts a native login flow session. Should be called once, from the page component that owns this service.
@@ -214,123 +219,23 @@ class StrivacityNativeLoginService {
      * @param {NativeLoginOptions} [options] - Optional options for the login session.
      */
     async start(options = {}) {
-        this.options = options;
-        await this.sdk.init();
-        try {
-            await this.startSession(options.params);
-        }
-        catch (error) {
-            if (error instanceof DOMException && error.name === 'AbortError') {
-                return;
-            }
-            this.sdk.logging?.error('Error fetching authorization URI', error);
-            await this.options.onError?.(error);
-            this.loadingSignal.set(false);
-        }
+        this.controller.setOptions(options);
+        await this.controller.start();
     }
-    async submitForm(formId, customBody) {
-        try {
-            this.loadingSignal.set(true);
-            const nextState = await this.sdk.submitForm(formId, customBody ?? unflattenObject(this.formsSignal()[formId] ?? {}));
-            if (nextState) {
-                await this.handleResponse(nextState);
-            }
-        }
-        catch (error) {
-            if (error instanceof FallbackError) {
-                this.sdk.logging?.error('Fallback error occurred', error);
-                await this.options.onFallback?.(error);
-            }
-            else {
-                this.sdk.logging?.error('Error submitting form', error);
-                await this.options.onError?.(error);
-            }
-        }
+    submitForm(formId, customBody) {
+        return this.controller.submitForm(formId, customBody);
     }
     setFormValue(formId, widgetId, value) {
-        const forms = { ...this.formsSignal() };
-        forms[formId] = { ...(forms[formId] ?? {}), [widgetId]: value === '' ? null : value };
-        this.formsSignal.set(forms);
+        this.controller.setFormValue(formId, widgetId, value);
     }
     setMessage(formId, widgetId, value) {
-        const messages = { ...this.messagesSignal() };
-        messages[formId] = { ...(messages[formId] ?? {}), [widgetId]: value };
-        this.messagesSignal.set(messages);
+        this.controller.setMessage(formId, widgetId, value);
     }
     triggerFallback(message) {
-        this.sdk.logging?.warn(message ? `Triggering fallback due to: ${message}` : 'Triggering fallback');
-        const hostedUrl = this.stateSignal().hostedUrl;
-        if (!hostedUrl) {
-            const error = new Error('No hosted URL provided');
-            this.sdk.logging?.error('Fallback error', error);
-            throw error;
-        }
-        void this.options.onFallback?.(new FallbackError(new URL(hostedUrl)));
+        this.controller.triggerFallback(message);
     }
     triggerClose() {
-        this.sdk.logging?.debug('Triggering close');
-        void this.options.onClose?.();
-    }
-    async startSession(loginParams = {}) {
-        try {
-            this.loadingSignal.set(true);
-            const nextState = await this.sdk.startSession(loginParams);
-            if (nextState) {
-                await this.handleResponse(nextState);
-            }
-        }
-        catch (error) {
-            if (error instanceof FallbackError) {
-                this.sdk.logging?.error('Fallback error occurred', error);
-                await this.options.onFallback?.(error);
-            }
-            else {
-                this.sdk.logging?.error('Error starting session', error);
-                await this.options.onError?.(error);
-            }
-        }
-    }
-    async handleResponse(nextState) {
-        if (this.sdk.session && !isSessionExpired(this.sdk.session)) {
-            return await this.options.onLogin?.(this.sdk.session);
-        }
-        const currentState = this.stateSignal();
-        const newState = {
-            hostedUrl: nextState.hostedUrl ?? currentState.hostedUrl,
-            finalizeUrl: nextState.finalizeUrl ?? currentState.finalizeUrl,
-            screen: nextState.screen ?? currentState.screen,
-            forms: nextState.forms ?? currentState.forms,
-            layout: nextState.layout ?? currentState.layout,
-            messages: nextState.messages ?? {},
-            branding: nextState.branding ?? currentState.branding,
-        };
-        if (newState.screen !== currentState.screen) {
-            const nextForms = {};
-            const nextMessages = {};
-            for (const form of newState.forms ?? []) {
-                nextForms[form.id] = {};
-                nextMessages[form.id] = {};
-            }
-            this.formsSignal.set(nextForms);
-            this.messagesSignal.set(nextMessages);
-        }
-        else {
-            this.sdk.logging?.info(`Updating screen: ${newState.screen}`);
-        }
-        const nextMessageMap = { ...this.messagesSignal() };
-        for (const formId of Object.keys(newState.messages ?? {})) {
-            if (formId === 'global') {
-                await this.options.onGlobalMessage?.(newState.messages.global);
-            }
-            else {
-                nextMessageMap[formId] = newState.messages[formId] ?? {};
-            }
-        }
-        this.messagesSignal.set(nextMessageMap);
-        this.stateSignal.set(newState);
-        if (!newState.finalizeUrl) {
-            this.loadingSignal.set(false);
-        }
+        this.controller.triggerClose();
     }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: StrivacityNativeLoginService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.4", ngImport: i0, type: StrivacityNativeLoginService }); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strivacity/sdk-angular",
-  "version": "4.0.0-beta.1",
+  "version": "4.0.0-beta.2",
   "description": "Strivacity Angular SDK client",
   "license": "MIT",
   "author": "strivacity <opensource@strivacity.com>",
@@ -32,7 +32,7 @@
     }
   },
   "dependencies": {
-    "@strivacity/sdk-core": "4.0.0-beta.1"
+    "@strivacity/sdk-core": "4.0.0-beta.2"
   },
   "peerDependencies": {
     "@angular/core": ">=20",

package/src/lib/services/auth.service.ts

@@ -76,8 +76,8 @@ export class StrivacityAuthService {
 		return this.sdk.handleCallback(...args);
 	}
 
-	refresh(): ReturnType<typeof this.sdk.refresh> {
-		return this.sdk.refresh();
+	refresh(...args: Parameters<typeof this.sdk.refresh>): ReturnType<typeof this.sdk.refresh> {
+		return this.sdk.refresh(...args);
 	}
 
 	revoke(): ReturnType<typeof this.sdk.revoke> {

package/src/lib/services/native-login.service.ts

@@ -1,28 +1,23 @@
-import type { NativeFlowMessage, NativeFlowState, NativeParams, NativeLoginOptions } from '../../types';
-import { DestroyRef, Injectable, inject, signal } from '@angular/core';
-import { FallbackError } from '@strivacity/sdk-core/utils/errors';
-import { isSessionExpired, unflattenObject } from '@strivacity/sdk-core/utils';
+import type { NativeFlowMessage, NativeLoginOptions } from '../../types';
+import { DestroyRef, Injectable, computed, inject, signal } from '@angular/core';
+import { createNativeLoginController } from '@strivacity/sdk-core/utils';
 import { StrivacityAuthService } from './auth.service';
 
 @Injectable()
 export class StrivacityNativeLoginService {
 	private readonly authService = inject(StrivacityAuthService);
-	private readonly sdk = this.authService.sdk;
-	private readonly abortController = new AbortController();
-	private options: NativeLoginOptions = {};
+	private readonly controller = createNativeLoginController(() => this.authService.sdk);
+	private readonly snapshot = signal(this.controller.getSnapshot());
 
-	private readonly loadingSignal = signal(true);
-	private readonly formsSignal = signal<Record<string, Record<string, unknown>>>({});
-	private readonly messagesSignal = signal<Record<string, Record<string, NativeFlowMessage>>>({});
-	private readonly stateSignal = signal<Partial<NativeFlowState>>({});
-
-	readonly loading = this.loadingSignal.asReadonly();
-	readonly forms = this.formsSignal.asReadonly();
-	readonly messages = this.messagesSignal.asReadonly();
-	readonly state = this.stateSignal.asReadonly();
+	readonly loading = computed(() => this.snapshot().loading);
+	readonly forms = computed(() => this.snapshot().forms);
+	readonly messages = computed(() => this.snapshot().messages);
+	readonly state = computed(() => this.snapshot().state);
 
 	constructor() {
-		inject(DestroyRef).onDestroy(() => this.abortController.abort());
+		const unsubscribe = this.controller.subscribe((snapshot) => this.snapshot.set(snapshot));
+
+		inject(DestroyRef).onDestroy(unsubscribe);
 	}
 
 	/**
@@ -31,142 +26,27 @@ export class StrivacityNativeLoginService {
 	 * @param {NativeLoginOptions} [options] - Optional options for the login session.
 	 */
 	async start(options: NativeLoginOptions = {}): Promise<void> {
-		this.options = options;
-
-		await this.sdk.init();
-
-		try {
-			await this.startSession(options.params);
-		} catch (error) {
-			if (error instanceof DOMException && error.name === 'AbortError') {
-				return;
-			}
-
-			this.sdk.logging?.error('Error fetching authorization URI', error as Error);
-			await this.options.onError?.(error as Error);
-			this.loadingSignal.set(false);
-		}
+		this.controller.setOptions(options);
+		await this.controller.start();
 	}
 
-	async submitForm(formId: string, customBody?: Record<string, unknown>): Promise<void> {
-		try {
-			this.loadingSignal.set(true);
-
-			const nextState = await this.sdk.submitForm(formId, customBody ?? unflattenObject(this.formsSignal()[formId] ?? {}));
-
-			if (nextState) {
-				await this.handleResponse(nextState);
-			}
-		} catch (error) {
-			if (error instanceof FallbackError) {
-				this.sdk.logging?.error('Fallback error occurred', error);
-				await this.options.onFallback?.(error);
-			} else {
-				this.sdk.logging?.error('Error submitting form', error as Error);
-				await this.options.onError?.(error as Error);
-			}
-		}
+	submitForm(formId: string, customBody?: Record<string, unknown>): Promise<void> {
+		return this.controller.submitForm(formId, customBody);
 	}
 
 	setFormValue(formId: string, widgetId: string, value: unknown): void {
-		const forms = { ...this.formsSignal() };
-
-		forms[formId] = { ...(forms[formId] ?? {}), [widgetId]: value === '' ? null : value };
-		this.formsSignal.set(forms);
+		this.controller.setFormValue(formId, widgetId, value);
 	}
 
 	setMessage(formId: string, widgetId: string, value: NativeFlowMessage): void {
-		const messages = { ...this.messagesSignal() };
-
-		messages[formId] = { ...(messages[formId] ?? {}), [widgetId]: value };
-		this.messagesSignal.set(messages);
+		this.controller.setMessage(formId, widgetId, value);
 	}
 
 	triggerFallback(message?: string): void {
-		this.sdk.logging?.warn(message ? `Triggering fallback due to: ${message}` : 'Triggering fallback');
-
-		const hostedUrl = this.stateSignal().hostedUrl;
-
-		if (!hostedUrl) {
-			const error = new Error('No hosted URL provided');
-			this.sdk.logging?.error('Fallback error', error);
-			throw error;
-		}
-
-		void this.options.onFallback?.(new FallbackError(new URL(hostedUrl)));
+		this.controller.triggerFallback(message);
 	}
 
 	triggerClose(): void {
-		this.sdk.logging?.debug('Triggering close');
-		void this.options.onClose?.();
-	}
-
-	private async startSession(loginParams: NativeParams = {}): Promise<void> {
-		try {
-			this.loadingSignal.set(true);
-
-			const nextState = await this.sdk.startSession(loginParams);
-
-			if (nextState) {
-				await this.handleResponse(nextState);
-			}
-		} catch (error) {
-			if (error instanceof FallbackError) {
-				this.sdk.logging?.error('Fallback error occurred', error);
-				await this.options.onFallback?.(error);
-			} else {
-				this.sdk.logging?.error('Error starting session', error as Error);
-				await this.options.onError?.(error as Error);
-			}
-		}
-	}
-
-	private async handleResponse(nextState: Partial<NativeFlowState>): Promise<void> {
-		if (this.sdk.session && !isSessionExpired(this.sdk.session)) {
-			return await this.options.onLogin?.(this.sdk.session);
-		}
-
-		const currentState = this.stateSignal();
-		const newState: NativeFlowState = {
-			hostedUrl: nextState.hostedUrl ?? currentState.hostedUrl,
-			finalizeUrl: nextState.finalizeUrl ?? currentState.finalizeUrl,
-			screen: nextState.screen ?? currentState.screen,
-			forms: nextState.forms ?? currentState.forms,
-			layout: nextState.layout ?? currentState.layout,
-			messages: nextState.messages ?? {},
-			branding: nextState.branding ?? currentState.branding,
-		};
-
-		if (newState.screen !== currentState.screen) {
-			const nextForms: Record<string, Record<string, unknown>> = {};
-			const nextMessages: Record<string, Record<string, NativeFlowMessage>> = {};
-
-			for (const form of newState.forms ?? []) {
-				nextForms[form.id] = {};
-				nextMessages[form.id] = {};
-			}
-
-			this.formsSignal.set(nextForms);
-			this.messagesSignal.set(nextMessages);
-		} else {
-			this.sdk.logging?.info(`Updating screen: ${newState.screen}`);
-		}
-
-		const nextMessageMap = { ...this.messagesSignal() };
-
-		for (const formId of Object.keys(newState.messages ?? {})) {
-			if (formId === 'global') {
-				await this.options.onGlobalMessage?.(newState.messages!.global!);
-			} else {
-				nextMessageMap[formId] = newState.messages![formId] ?? {};
-			}
-		}
-
-		this.messagesSignal.set(nextMessageMap);
-		this.stateSignal.set(newState);
-
-		if (!newState.finalizeUrl) {
-			this.loadingSignal.set(false);
-		}
+		this.controller.triggerClose();
 	}
 }

package/src/server/sdk.ts

@@ -93,7 +93,7 @@ export function createServerSDK(initConfig: AngularServerSDKInitConfig): Angular
 			return base.options;
 		},
 		handlers: getRouteHandlers(base),
-		getSession: (req) => base.getSession(req),
+		getSession: (req, params) => base.getSession(req, params),
 		updateSession: (session, req) => base.updateSession(session, req),
 		refreshSession: (req) => base.refreshSession(req),
 		revokeSession: (req) => base.revokeSession(req),

package/src/server/session.ts

@@ -1,12 +1,13 @@
 import type { EnvironmentProviders } from '@angular/core';
 import type { AngularServerSDK, SessionData } from './types';
-import { REQUEST, TransferState, inject, makeStateKey, provideAppInitializer } from '@angular/core';
+import { REQUEST, RESPONSE_INIT, TransferState, inject, makeStateKey, provideAppInitializer } from '@angular/core';
+import { flushSetCookies, toClientSession } from '@strivacity/sdk-core/utils';
 
 export const SESSION_TRANSFER_KEY = makeStateKey<SessionData | null>('sty.session');
 
 /**
  * Loads the current session from the encrypted cookie storage (using Angular's `REQUEST` token) before the app
- * renders, and hands it over to the client through `TransferState`, so `StrivacityAuthService` can hydrate without
+ * renders, and hands it over to the client through `TransferState` (without the refresh and ID tokens, which stay server-side), so `StrivacityAuthService` can hydrate without
  * an extra round-trip or a loading flash.
  *
  * Add this to the server-only `ApplicationConfig` (e.g. `app.config.server.ts`), alongside `provideServerRendering()`.
@@ -23,8 +24,21 @@ export function provideStrivacityServerSession(serverSdk: AngularServerSDK | und
 		}
 
 		const transferState = inject(TransferState);
+		const responseInit = inject(RESPONSE_INIT, { optional: true });
+
 		const session = await serverSdk.getSession(request);
+		const cookies = flushSetCookies(request, new Response(null)).headers.getSetCookie();
+
+		if (responseInit && cookies.length) {
+			const headers = new Headers(responseInit.headers);
+
+			for (const cookie of cookies) {
+				headers.append('set-cookie', cookie);
+			}
+
+			responseInit.headers = headers;
+		}
 
-		transferState.set(SESSION_TRANSFER_KEY, session);
+		transferState.set(SESSION_TRANSFER_KEY, toClientSession(session));
 	});
 }

package/src/server/types.ts

@@ -16,17 +16,17 @@ export type AngularServerStorage = SDKStorage<
 export type AngularServerSDKOptions<
 	Storage extends AngularServerStorage = AngularServerStorage,
 	StateStorage extends SDKStorage = SDKStorage,
-> = ServerSDKOptions<Storage, StateStorage>;
+> = ServerSDKOptions<AngularServerRequest | undefined, Storage, StateStorage>;
 
 export type AngularServerSDKInitConfig<
 	Storage extends AngularServerStorage = AngularServerStorage,
 	StateStorage extends SDKStorage = SDKStorage,
-> = ServerSDKInitConfig & Partial<AngularServerSDKOptions<Storage, StateStorage>>;
+> = ServerSDKInitConfig<AngularServerRequest | undefined> & Partial<AngularServerSDKOptions<Storage, StateStorage>>;
 
 export type AngularServerSDK<TEvent extends AngularServerRequest | undefined = AngularServerRequest | undefined> = BaseServerSDK<TEvent> & {
 	/**
 	 * The Express router exposing the authentication endpoints.
-	 * Mount it under `authUrlPrefix`, e.g. `app.use('/auth', sdk.router)`.
+	 * Mount it under `authUrlPrefix`, e.g. `app.use('/auth', sdk.handlers)`.
 	 */
 	readonly handlers: Router;
 };

package/src/types/index.ts

@@ -1,6 +1,5 @@
-import type { SDKInitConfig, NativeFlowMessage, NativeParams, SessionData } from '@strivacity/sdk-core/types';
+import type { SDKInitConfig, NativeLoginControllerOptions } from '@strivacity/sdk-core/types';
 import type { initFlow } from '@strivacity/sdk-core';
-import type { FallbackError } from '@strivacity/sdk-core/utils';
 
 export * from '@strivacity/sdk-core/types';
 
@@ -14,34 +13,7 @@ export type AngularSDKInitConfig = SDKInitConfig;
  */
 export type SDKInstance = ReturnType<typeof initFlow>;
 
-export type NativeLoginOptions = {
-	/**
-	 * Optional parameters to be passed to the login session request. These parameters will be sent to the `authorizationUri` endpoint.
-	 */
-	params?: NativeParams;
-
-	/**
-	 * Called when the user successfully completes the login flow.
-	 */
-	onLogin?: (session: SessionData) => void | Promise<void>;
-
-	/**
-	 * Called when the fallback flow is triggered, typically due to an error or unsupported environment.
-	 */
-	onFallback?: (error: FallbackError) => void | Promise<void>;
-
-	/**
-	 * Called when the login flow is closed by the user.
-	 */
-	onClose?: () => void | Promise<void>;
-
-	/**
-	 * Called when an error occurs during the login session initialization or flow.
-	 */
-	onError?: (error: Error) => void | Promise<void>;
-
-	/**
-	 * Called when a global message is received during the login flow.
-	 */
-	onGlobalMessage?: (message: NativeFlowMessage) => void | Promise<void>;
-};
+/**
+ * Callbacks and parameters of the native login flow. See `NativeLoginControllerOptions` in `@strivacity/sdk-core`.
+ */
+export type NativeLoginOptions = NativeLoginControllerOptions;

package/testing/tests/auth.service.spec.ts

@@ -202,7 +202,7 @@ describe('StrivacityAuthService', () => {
 		['checkAuthentication', [{ autoRefresh: false }]],
 		['tokenExchange', [{ code: 'abc' }]],
 		['handleCallback', ['https://brandtegrity.io/callback?code=abc']],
-		['refresh', []],
+		['refresh', [{ returnTo: '/orders' }]],
 		['revoke', []],
 		['logout', [{ postLogoutRedirectUri: 'https://brandtegrity.io' }]],
 		['login', [{ scopes: ['openid'] }]],

package/testing/tests/index.spec.ts

@@ -35,6 +35,7 @@ describe('client', () => {
 			'buildEndSessionUrl',
 			'createDefaultLogging',
 			'createHttpClient',
+			'createNativeLoginController',
 			'createSession',
 			'createState',
 			'createWebAuthnCredential',
@@ -72,6 +73,7 @@ describe('client', () => {
 			'throwHttpError',
 			'throwTokenEndpointError',
 			'timestamp',
+			'toClientSession',
 			'toSafeRedirect',
 			'unflattenObject',
 			'verifyIdToken',
@@ -128,7 +130,10 @@ describe('server', () => {
 			'createServerStateStorage',
 			'createSessionStorage',
 			'createWorkerStorage',
+			'deleteEncryptedCookie',
 			'handleWorkerStorageRequests',
+			'readEncryptedCookie',
+			'writeEncryptedCookie',
 			'AlgorithmTypeList',
 			'GrantTypeList',
 			'ResponseModeList',
@@ -147,6 +152,7 @@ describe('server', () => {
 			'buildEndSessionUrl',
 			'createDefaultLogging',
 			'createHttpClient',
+			'createNativeLoginController',
 			'createSession',
 			'createState',
 			'createWebAuthnCredential',
@@ -182,6 +188,7 @@ describe('server', () => {
 			'serializeState',
 			'submitLoginForm',
 			'timestamp',
+			'toClientSession',
 			'toSafeRedirect',
 			'unflattenObject',
 			'verifyIdToken',

package/testing/tests/native-login.service.spec.ts

@@ -149,19 +149,17 @@ describe('StrivacityNativeLoginService', () => {
 			expect(login.loading()).toBe(true);
 		});
 
-		test('propagates a rejection from sdk.init() as-is, since only the startSession() call is guarded by the try/catch', async () => {
-			// the AbortError short-circuit in start()'s own catch guards `this.startSession(...)`, not `await this.sdk.init()`
-			// above it - startSession() also swallows every error itself (including AbortError) and reports it through onError,
-			// so that branch is unreachable via a mocked flow; a rejecting init() is the one thing genuinely uncaught here.
+		test('reports a rejection from sdk.init() to onError and stops loading, without starting a session', async () => {
 			const flow = createMockFlow<NativeFlow>();
-			const abortError = new DOMException('The operation was aborted', 'AbortError');
-			vi.mocked(flow.init).mockRejectedValue(abortError);
+			const error = new Error('init failed');
+			vi.mocked(flow.init).mockRejectedValue(error);
 			const onError = vi.fn();
 			const login = configure(flow);
 
-			await expect(login.start({ onError })).rejects.toBe(abortError);
+			await login.start({ onError });
 
-			expect(onError).not.toHaveBeenCalled();
+			expect(onError).toHaveBeenCalledWith(error);
+			expect(login.loading()).toBe(false);
 			expect(flow.startSession).not.toHaveBeenCalled();
 		});
 	});
@@ -293,19 +291,17 @@ describe('StrivacityNativeLoginService', () => {
 		expect(flow.logging!.debug).toHaveBeenCalledWith('Triggering close');
 	});
 
-	test('aborts the in-flight abort controller when the owning injector is destroyed', () => {
+	test('stops tracking the flow state when the owning injector is destroyed', () => {
 		const flow = createMockFlow<NativeFlow>();
 		vi.mocked(initFlow).mockReturnValue(flow);
 		TestBed.configureTestingModule({ providers: [{ provide: STRIVACITY_SDK, useValue: createOptions({ mode: 'native' }) }, StrivacityAuthService] });
 
-		const abortSpy = vi.spyOn(AbortController.prototype, 'abort');
-
 		// both services must live on the component's own injector for fixture.destroy() to fire their DestroyRef callbacks
-		const { destroy } = mountWithProviders([StrivacityAuthService, StrivacityNativeLoginService], () => inject(StrivacityNativeLoginService));
+		const { value: login, destroy } = mountWithProviders([StrivacityAuthService, StrivacityNativeLoginService], () => inject(StrivacityNativeLoginService));
 
 		destroy();
+		login.setFormValue('form1', 'email', 'a@b.c');
 
-		expect(abortSpy).toHaveBeenCalledTimes(1);
-		abortSpy.mockRestore();
+		expect(login.forms()).toEqual({});
 	});
 });