@tesouro/embedded-components-react 0.2.249 → 0.2.253

package/README.md

@@ -183,17 +183,26 @@ listed here.
 
 ### AcceptDisclosuresWidget
 
-A self-contained widget for reviewing and accepting required banking disclosures. Renders an inline bordered card with disclosure links, an agreement checkbox, and an Accept action. You supply the four bank-issued document URLs via `disclosureLinks`; the provider attribution and agreement copy come from the widget init tenant identity. Accepting records the acceptance for the signed-in user and then hides the card.
+A self-contained widget for reviewing and accepting required banking disclosures during the **pre-auth invite flow**. Renders an inline bordered card with disclosure links, an agreement checkbox, and an Accept action. You supply the four bank-issued document URLs via `disclosureLinks`; the provider attribution and agreement copy come from the widget init tenant identity.
+
+Accept posts `POST /api/widget-gateway/disclosure-acceptance` after reading the disclosure version in force from `GET /identity/v1/disclosures` (hosts rewrite that onto `/api/widget-gateway/proxy/identity/v1/disclosures` the same way as other identity calls — do not call the generated catch-all proxy helper, which percent-encodes path slashes and surfaces as a browser CORS error). `version` may be `null` when the org's requirement is `NOT_REQUIRED`; that value is posted through and ignored by the gateway so invitees in those orgs can still activate. Pass `invitationToken` and `userId` so the disclosures lookup can reject a revoked/expired invite before activation. The accept is one transaction: it activates the invitee and records disclosure acceptance together, so a failed second hop cannot leave an `ACTIVE` user with no acceptance on record. After accept succeeds, the widget awaits any async `onAccepted` continuation, then kicks a widget-init refresh so host gates keyed on `INVITED` can clear. Accept and `onAccepted` failures are handled separately — a rejected host continuation does not look like (or re-run) a failed gateway accept. The refresh is fire-and-forget and runs only after `onAccepted` settles — hosts that unmount this widget when status leaves `INVITED` would otherwise hide a rejected continuation. Auth uses the normal `widgetToken` provider contract — **never** pass an application (APP) / M2M bearer as `widgetToken`. The host must pass `invitationToken` and `userId` from the invite link — this widget does not read URL search params.
 
 The widget carries no document URLs of its own — disclosures are bank-issued legal instruments whose hosting is yours to control, and an embeddable library must not depend on infrastructure your content-security policy cannot see. It renders nothing until `disclosureLinks` is supplied and init resolves a `bankName`; it never substitutes another tenant's legal copy. If init omits `vspName`, provider attribution falls back to the bank name so the sentence remains complete.
 
+Once the atomic accept _and_ any async `onAccepted` continuation succeed, the checkbox and Accept control stay disabled, so a legal acceptance is never posted twice even if the host does not navigate away. A failed accept or rejected `onAccepted` shows an inline error and leaves the control usable for a retry; a successful accept is skipped on retry after a later failure. Init refresh is kicked only after `onAccepted` succeeds.
+
 #### Props
 
-| Prop              | Type                                     | Default          | Description                                                                                   |
-| ----------------- | ---------------------------------------- | ---------------- | --------------------------------------------------------------------------------------------- |
-| `disclosureLinks` | `AcceptDisclosuresLinks`                 | —                | URLs of the four disclosure documents. Required to render — the widget ships none of its own. |
-| `labels`          | `Partial<AcceptDisclosuresWidgetLabels>` | —                | Override shell copy (title, Accept, link labels, attribution/agreement templates).            |
-| `onAccept`        | `() => Promise<void> \| void`            | Built-in request | Records the acceptance instead of the built-in request. Reject to keep the card up for retry. |
+| Prop              | Type     | Default | Description                                                                                                                    |
+| ----------------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| `invitationToken` | `string` | —       | **Required.** Invitation token from the invite link (`code` query param). Bound into the disclosures lookup before activation. |
+| `userId`          | `string` | —       | **Required.** Invited user id from the invite link (`userId` query param). Paired with `invitationToken`.                      |
+
+| Prop              | Type                                     | Default | Description                                                                                                                                             |
+| ----------------- | ---------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `disclosureLinks` | `AcceptDisclosuresLinks`                 | —       | URLs of the four disclosure documents. Required to render — the widget ships none of its own.                                                           |
+| `labels`          | `Partial<AcceptDisclosuresWidgetLabels>` | —       | Override shell copy (title, Accept, link labels, attribution/agreement templates).                                                                      |
+| `onAccepted`      | `() => void \| Promise<void>`            | —       | Called after the atomic accept succeeds and before init refresh; awaited before the widget locks. Reject to surface an error and keep Accept retryable. |
 
 ### BankAccountsWidget