@tesouro/embedded-components-react 0.2.269 → 0.2.272

package/README.md

@@ -186,13 +186,13 @@ listed here.
 
 ### AcceptDisclosuresWidget
 
-A self-contained widget for reviewing and accepting required banking disclosures. Renders an inline bordered card with disclosure links, an agreement checkbox, and an Accept action. You supply the four bank-issued document URLs via `disclosureLinks`; the provider attribution and agreement copy come from the widget init tenant identity.
+A self-contained widget for reviewing and accepting required banking disclosures. Fetches the caller's disclosure document set (title/url pairs, in presentation order) from `GET /identity/v1/disclosures` and renders an inline bordered card with those links, an agreement checkbox, and an Accept action. The host supplies no document URLs — the document set, its titles, and its order are entirely backend configuration for the bank partner's program. The provider attribution and agreement copy come from the widget init tenant identity.
 
 **Two flows, one surface.** In the **pre-auth invite flow**, pass `invitationToken` and `userId` from the invite link. For an **already-active user who owes a re-acceptance** — a new disclosure version was published, so widget init reports `disclosuresRequired: 'REQUIRED'` with `disclosuresAccepted: false` — pass neither: they hold no invite, and the widget token identifies them on both calls. Read those two init fields rather than `status` to decide whether to mount this widget, because an active user can owe an acceptance while never being invited again.
 
-Accept posts `POST /api/widget-gateway/disclosure-acceptance` after reading the disclosure version in force from `GET /identity/v1/disclosures` (hosts rewrite that onto `/api/widget-gateway/proxy/identity/v1/disclosures` the same way as other identity calls — do not call the generated catch-all proxy helper, which percent-encodes path slashes and surfaces as a browser CORS error). `version` may be `null` when the org's requirement is `NOT_REQUIRED`; that value is posted through and ignored by the gateway so invitees in those orgs can still activate. When you pass the invite credential, the disclosures lookup can reject a revoked/expired invite before activation. The accept is one transaction: it activates the invitee and records disclosure acceptance together, so a failed second hop cannot leave an `ACTIVE` user with no acceptance on record. After accept succeeds, the widget awaits any async `onAccepted` continuation, then kicks a widget-init refresh so host gates keyed on `INVITED` — or on the disclosure flags — can clear. Accept and `onAccepted` failures are handled separately — a rejected host continuation does not look like (or re-run) a failed gateway accept. The refresh is fire-and-forget and runs only after `onAccepted` settles — hosts that unmount this widget when status leaves `INVITED` would otherwise hide a rejected continuation. Auth uses the normal `widgetToken` provider contract — **never** pass an application (APP) / M2M bearer as `widgetToken`. In the invite flow, the host passes `invitationToken` and `userId` from the invite link; this widget does not read URL search params.
+Accept posts `POST /api/widget-gateway/disclosure-acceptance` with the version that was on screen, after a second `GET /identity/v1/disclosures` confirms that version is still in force (hosts rewrite that onto `/api/widget-gateway/proxy/identity/v1/disclosures` the same way as other identity calls — do not call the generated catch-all proxy helper, which percent-encodes path slashes and surfaces as a browser CORS error). If a newer version was published while the caller was reading, accept is refused (no POST) and the widget refetches so they can review the documents that are now in force. `version` may be `null` when the org's requirement is `NOT_REQUIRED`; that value is posted through and ignored by the gateway so invitees in those orgs can still activate. When you pass the invite credential, the disclosures lookup can reject a revoked/expired invite before activation. The accept is one transaction: it activates the invitee and records disclosure acceptance together, so a failed second hop cannot leave an `ACTIVE` user with no acceptance on record. After accept succeeds, the widget awaits any async `onAccepted` continuation, then kicks a widget-init refresh so host gates keyed on `INVITED` — or on the disclosure flags — can clear. Accept and `onAccepted` failures are handled separately — a rejected host continuation does not look like (or re-run) a failed gateway accept. The refresh is fire-and-forget and runs only after `onAccepted` settles — hosts that unmount this widget when status leaves `INVITED` would otherwise hide a rejected continuation. Auth uses the normal `widgetToken` provider contract — **never** pass an application (APP) / M2M bearer as `widgetToken`. In the invite flow, the host passes `invitationToken` and `userId` from the invite link; this widget does not read URL search params.
 
-The widget carries no document URLs of its own — disclosures are bank-issued legal instruments whose hosting is yours to control, and an embeddable library must not depend on infrastructure your content-security policy cannot see. It renders nothing until `disclosureLinks` is supplied and init resolves a `bankName`; it never substitutes another tenant's legal copy. If init omits `vspName`, provider attribution falls back to the bank name so the sentence remains complete.
+A failed disclosures fetch renders an error surface with retry instead of a blank INVITED screen. The widget otherwise renders nothing until the disclosures fetch resolves **and** init resolves a `bankName` — it never substitutes another tenant's legal copy, and never falls back to a Tesouro-hosted document (a published embeddable library must not depend on infrastructure a consumer's content-security policy cannot see). An empty document list (`requirement: NOT_REQUIRED`, `version: null`) is a resolved payload, not missing data: the widget still renders Accept so those invitees can activate. Agreement copy names the returned document titles, in backend order, so the sentence cannot list instruments the links do not show. If init omits `vspName`, provider attribution falls back to the bank name so the sentence remains complete.
 
 Once the atomic accept _and_ any async `onAccepted` continuation succeed, the checkbox and Accept control stay disabled, so a legal acceptance is never posted twice even if the host does not navigate away. A failed accept or rejected `onAccepted` shows an inline error and leaves the control usable for a retry; a successful accept is skipped on retry after a later failure. Init refresh is kicked only after `onAccepted` succeeds.
 
@@ -203,11 +203,11 @@ Once the atomic accept _and_ any async `onAccepted` continuation succeed, the ch
 | `invitationToken` | `string` | `undefined` | Invitation token from the invite link (`code` query param). Bound into the disclosures lookup before activation. |
 | `userId`          | `string` | `undefined` | Invited user id from the invite link (`userId` query param). Paired with `invitationToken`.                      |
 
-| Prop              | Type                                     | Default | Description                                                                                                                                             |
-| ----------------- | ---------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `disclosureLinks` | `AcceptDisclosuresLinks`                 | —       | URLs of the four disclosure documents. Required to render — the widget ships none of its own.                                                           |
-| `labels`          | `Partial<AcceptDisclosuresWidgetLabels>` | —       | Override shell copy (title, Accept, link labels, attribution/agreement templates).                                                                      |
-| `onAccepted`      | `() => void \| Promise<void>`            | —       | Called after the atomic accept succeeds and before init refresh; awaited before the widget locks. Reject to surface an error and keep Accept retryable. |
+| Prop              | Type                                     | Default | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ----------------- | ---------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `labels`          | `Partial<AcceptDisclosuresWidgetLabels>` | —       | Override shell copy (title, Accept, agreement/attribution templates). `{documents}` in `agreementTextTemplate` is replaced with the backend-returned titles; a template that omits `{documents}` still has those titles appended. When the backend returns no documents, `noDocumentsTitle` / `noDocumentsAgreementTextTemplate` / `noDocumentsAgreementCheckboxAriaLabel` replace the disclosures copy (including the checkbox `aria-label`). Document titles themselves are not overridable. |
+| `onAccepted`      | `() => void \| Promise<void>`            | —       | Called after the atomic accept succeeds and before init refresh; awaited before the widget locks. Reject to surface an error and keep Accept retryable.                                                                                                                                                                                                                                                                                                                                        |
+| `disclosureLinks` | `AcceptDisclosuresLinks`                 | —       | **Deprecated.** Ignored. Documents come from `GET /identity/v1/disclosures`. Kept so existing hosts continue to typecheck until a breaking release.                                                                                                                                                                                                                                                                                                                                            |
 
 ### BankAccountsWidget
 

package/dist/experimental/WidgetSuite.d.ts

@@ -619,23 +619,6 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
     onError?: (error: unknown, info: ErrorInfo) => void;
 }
 
-/**
- * The four disclosure documents a host supplies. Keyed rather than a free-form
- * array because `agreementTextTemplate` names exactly these four instruments —
- * an arbitrary-length list would let the rendered links and the text the user
- * agrees to disagree with each other.
- *
- * URLs are host-supplied on purpose: they are bank-issued legal documents whose
- * hosting is the integrator's concern, and a published package must not carry a
- * Tesouro infrastructure URL a consumer's CSP can block (PLAT-1179).
- */
-interface AcceptDisclosuresLinks {
-    termsOfUseUrl: string;
-    privacyPolicyUrl: string;
-    electronicCommunicationsAgreementUrl: string;
-    usaPatriotActUrl: string;
-}
-
 /**
  * The sections the suite can offer, declared in the default menu order
  * (EMBD-4875). Order here is documentation only — the suite renders whatever
@@ -741,14 +724,6 @@ interface WidgetSuiteDisclosureLabels {
         body: string;
         retryButton: string;
     };
-    /**
-     * Acceptance is owed and the host supplied no documents to accept. A host
-     * misconfiguration, so it names no cause the user could act on.
-     */
-    unavailableState: {
-        title: string;
-        body: string;
-    };
 }
 /** Named as the shipped white-label header names them. */
 declare const WIDGET_SUITE_SECTION_LABELS_EN: WidgetSuiteSectionLabels;
@@ -770,21 +745,6 @@ interface WidgetSuiteProps extends WidgetProviderProps {
      * this is the host's ceiling rather than a promise of what renders.
      */
     sections: readonly WidgetSuiteSectionId[];
-    /**
-     * URLs of the bank-issued disclosure documents, for the acceptance state.
-     *
-     * Required only to *render* that state, and only reached when the session owes
-     * an acceptance — an organization whose requirement is `NOT_REQUIRED` never
-     * needs this. Host-supplied for the same reason `AcceptDisclosuresWidget` takes
-     * them: they are bank-issued legal instruments whose hosting is the
-     * integrator's to control, and a published package must not carry a URL a
-     * consumer's content-security policy can block (PLAT-1179).
-     *
-     * A session that owes an acceptance with none of these supplied gets the
-     * unavailable notice, not the suite — the gate is never dropped because the
-     * host under-configured it.
-     */
-    disclosureLinks?: AcceptDisclosuresLinks;
     /** Overrides for the shell's own copy — the nav landmark name, empty state. */
     labels?: PartialDeep<WidgetSuiteShellLabels>;
     /** Overrides for the section names in the menu. */
@@ -800,8 +760,8 @@ interface WidgetSuiteProps extends WidgetProviderProps {
      */
     contentLabels?: PartialDeep<WidgetSuiteContentLabels>;
     /**
-     * Overrides for the copy the disclosure gate owns: its refresh-failure recovery
-     * and its unavailable notice. The acceptance surface carries its own labels.
+     * Overrides for the copy the disclosure gate owns: its init-failure and
+     * refresh-failure recovery. The acceptance surface carries its own labels.
      */
     disclosureLabels?: PartialDeep<WidgetSuiteDisclosureLabels>;
     /**
@@ -844,4 +804,4 @@ interface WidgetSuiteProps extends WidgetProviderProps {
 declare function WidgetSuite({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: WidgetSuiteProps): React.JSX.Element;
 
 export { WIDGET_SUITE_CONTENT_LABELS_EN, WIDGET_SUITE_DEFAULT_SECTIONS, WIDGET_SUITE_DISCLOSURE_LABELS_EN, WIDGET_SUITE_SECTION_LABELS_EN, WIDGET_SUITE_SECTION_TITLE_LABELS_EN, WIDGET_SUITE_SHELL_LABELS_EN, WidgetSuite, WidgetSuiteSectionId };
-export type { AcceptDisclosuresLinks, PartialDeep, WidgetSuiteContentLabels, WidgetSuiteDisclosureLabels, WidgetSuiteProps, WidgetSuiteSectionLabels, WidgetSuiteSectionTitleLabels, WidgetSuiteShellLabels };
+export type { PartialDeep, WidgetSuiteContentLabels, WidgetSuiteDisclosureLabels, WidgetSuiteProps, WidgetSuiteSectionLabels, WidgetSuiteSectionTitleLabels, WidgetSuiteShellLabels };

package/dist/experimental/index.d.ts

@@ -619,23 +619,6 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
     onError?: (error: unknown, info: ErrorInfo) => void;
 }
 
-/**
- * The four disclosure documents a host supplies. Keyed rather than a free-form
- * array because `agreementTextTemplate` names exactly these four instruments —
- * an arbitrary-length list would let the rendered links and the text the user
- * agrees to disagree with each other.
- *
- * URLs are host-supplied on purpose: they are bank-issued legal documents whose
- * hosting is the integrator's concern, and a published package must not carry a
- * Tesouro infrastructure URL a consumer's CSP can block (PLAT-1179).
- */
-interface AcceptDisclosuresLinks {
-    termsOfUseUrl: string;
-    privacyPolicyUrl: string;
-    electronicCommunicationsAgreementUrl: string;
-    usaPatriotActUrl: string;
-}
-
 /**
  * The sections the suite can offer, declared in the default menu order
  * (EMBD-4875). Order here is documentation only — the suite renders whatever
@@ -741,14 +724,6 @@ interface WidgetSuiteDisclosureLabels {
         body: string;
         retryButton: string;
     };
-    /**
-     * Acceptance is owed and the host supplied no documents to accept. A host
-     * misconfiguration, so it names no cause the user could act on.
-     */
-    unavailableState: {
-        title: string;
-        body: string;
-    };
 }
 /** Named as the shipped white-label header names them. */
 declare const WIDGET_SUITE_SECTION_LABELS_EN: WidgetSuiteSectionLabels;
@@ -770,21 +745,6 @@ interface WidgetSuiteProps extends WidgetProviderProps {
      * this is the host's ceiling rather than a promise of what renders.
      */
     sections: readonly WidgetSuiteSectionId[];
-    /**
-     * URLs of the bank-issued disclosure documents, for the acceptance state.
-     *
-     * Required only to *render* that state, and only reached when the session owes
-     * an acceptance — an organization whose requirement is `NOT_REQUIRED` never
-     * needs this. Host-supplied for the same reason `AcceptDisclosuresWidget` takes
-     * them: they are bank-issued legal instruments whose hosting is the
-     * integrator's to control, and a published package must not carry a URL a
-     * consumer's content-security policy can block (PLAT-1179).
-     *
-     * A session that owes an acceptance with none of these supplied gets the
-     * unavailable notice, not the suite — the gate is never dropped because the
-     * host under-configured it.
-     */
-    disclosureLinks?: AcceptDisclosuresLinks;
     /** Overrides for the shell's own copy — the nav landmark name, empty state. */
     labels?: PartialDeep<WidgetSuiteShellLabels>;
     /** Overrides for the section names in the menu. */
@@ -800,8 +760,8 @@ interface WidgetSuiteProps extends WidgetProviderProps {
      */
     contentLabels?: PartialDeep<WidgetSuiteContentLabels>;
     /**
-     * Overrides for the copy the disclosure gate owns: its refresh-failure recovery
-     * and its unavailable notice. The acceptance surface carries its own labels.
+     * Overrides for the copy the disclosure gate owns: its init-failure and
+     * refresh-failure recovery. The acceptance surface carries its own labels.
      */
     disclosureLabels?: PartialDeep<WidgetSuiteDisclosureLabels>;
     /**
@@ -844,4 +804,4 @@ interface WidgetSuiteProps extends WidgetProviderProps {
 declare function WidgetSuite({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: WidgetSuiteProps): React.JSX.Element;
 
 export { WIDGET_SUITE_CONTENT_LABELS_EN, WIDGET_SUITE_DEFAULT_SECTIONS, WIDGET_SUITE_DISCLOSURE_LABELS_EN, WIDGET_SUITE_SECTION_LABELS_EN, WIDGET_SUITE_SECTION_TITLE_LABELS_EN, WIDGET_SUITE_SHELL_LABELS_EN, WidgetSuite, WidgetSuiteSectionId };
-export type { AcceptDisclosuresLinks, PartialDeep, WidgetSuiteContentLabels, WidgetSuiteDisclosureLabels, WidgetSuiteProps, WidgetSuiteSectionLabels, WidgetSuiteSectionTitleLabels, WidgetSuiteShellLabels };
+export type { PartialDeep, WidgetSuiteContentLabels, WidgetSuiteDisclosureLabels, WidgetSuiteProps, WidgetSuiteSectionLabels, WidgetSuiteSectionTitleLabels, WidgetSuiteShellLabels };

package/dist/index.css

@@ -1715,6 +1715,9 @@
   .ttw\:justify-items-start {
     justify-items: start;
   }
+  .ttw\:\!gap-0 {
+    gap: 0px !important;
+  }
   .ttw\:gap-0 {
     gap: 0px;
   }

package/dist/index.d.ts

@@ -12,19 +12,82 @@ interface AcceptDisclosuresWidgetLabels {
     agreementCheckboxAriaLabel: string;
     /** Fallback when the accept API fails without a usable message. */
     acceptErrorFallback: string;
-    /** Use `{bankName}` as the bank display-name placeholder. */
+    /**
+     * Use `{bankName}` for the bank display name and `{documents}` for the
+     * conjunction list of titles the backend returned (same order as the links).
+     * A legacy override that omits `{documents}` still has those titles appended
+     * so consent copy cannot disagree with the linked documents.
+     */
     agreementTextTemplate: string;
     providerAttributionPrefix: string;
     providerAttributionMiddle: string;
     providerAttributionSuffix: string;
+    /**
+     * @deprecated Ignored. Document titles come from
+     * `GET /identity/v1/disclosures`. Kept so hosts that implement the full
+     * published `AcceptDisclosuresWidgetLabels` interface continue to typecheck.
+     */
     linkLabels: {
         termsOfUse: string;
         privacyPolicy: string;
         electronicCommunications: string;
         patriotAct: string;
     };
+    /** Title when the backend returned no documents (`NOT_REQUIRED`). */
+    noDocumentsTitle?: string;
+    /** Use `{bankName}` when the backend returned no documents. */
+    noDocumentsAgreementTextTemplate?: string;
+    /**
+     * Checkbox `aria-label` when the backend returned no documents. Use
+     * `{bankName}`. Must not say the user is agreeing to disclosures.
+     */
+    noDocumentsAgreementCheckboxAriaLabel?: string;
+    /**
+     * Two-item document list. Use `{first}` and `{second}` for the titles.
+     */
+    documentListPairTemplate?: string;
+    /** Separator between titles in a list of three or more (before the last). */
+    documentListSeparator?: string;
+    /** Conjunction before the last title in a list of three or more. */
+    documentListLastConjunction?: string;
+    /** Heading when the disclosures query fails. */
+    loadErrorTitle?: string;
+    /** Fallback when the disclosures query fails without a usable message. */
+    loadErrorFallback?: string;
+    /** Retry control on the disclosures-query error surface. */
+    loadErrorRetryLabel?: string;
+    /**
+     * Shown when accept is refused because a newer disclosure version is in
+     * force than the documents the invitee agreed to.
+     */
+    disclosuresUpdatedFallback?: string;
 }
-declare const ACCEPT_DISCLOSURES_WIDGET_LABELS_EN: AcceptDisclosuresWidgetLabels;
+declare const ACCEPT_DISCLOSURES_WIDGET_LABELS_EN: {
+    title: string;
+    acceptButton: string;
+    agreementCheckboxAriaLabel: string;
+    acceptErrorFallback: string;
+    agreementTextTemplate: string;
+    providerAttributionPrefix: string;
+    providerAttributionMiddle: string;
+    providerAttributionSuffix: string;
+    linkLabels: {
+        termsOfUse: string;
+        privacyPolicy: string;
+        electronicCommunications: string;
+        patriotAct: string;
+    };
+    noDocumentsTitle: string;
+    noDocumentsAgreementTextTemplate: string;
+    noDocumentsAgreementCheckboxAriaLabel: string;
+    documentListPairTemplate: string;
+    documentListSeparator: string;
+    documentListLastConjunction: string;
+    loadErrorTitle: string;
+    loadErrorFallback: string;
+    loadErrorRetryLabel: string;
+    disclosuresUpdatedFallback: string;
+};
 
 interface DisclosureLink {
     label: string;
@@ -1365,14 +1428,11 @@ type CardStatus = CreditCardStatus;
 type CardType = CreditCardType;
 
 /**
- * The four disclosure documents a host supplies. Keyed rather than a free-form
- * array because `agreementTextTemplate` names exactly these four instruments —
- * an arbitrary-length list would let the rendered links and the text the user
- * agrees to disagree with each other.
+ * Host-supplied URLs for the four disclosure documents.
  *
- * URLs are host-supplied on purpose: they are bank-issued legal documents whose
- * hosting is the integrator's concern, and a published package must not carry a
- * Tesouro infrastructure URL a consumer's CSP can block (PLAT-1179).
+ * @deprecated The widget fetches title/url pairs from
+ * `GET /identity/v1/disclosures`. This type remains exported so existing
+ * consumers continue to typecheck until a coordinated breaking release.
  */
 interface AcceptDisclosuresLinks {
     termsOfUseUrl: string;
@@ -1400,13 +1460,6 @@ type InnerProps = Omit<AcceptDisclosuresWidgetProps$1, UiOwnedProps> & {
      * invite flow.
      */
     userId?: string;
-    /**
-     * URLs of the four bank-issued disclosure documents. Required to render along
-     * with a bank name from widget init: the widget carries no document URLs of its
-     * own and never invents a tenant's legal copy, so it renders nothing until the
-     * host supplies the document set.
-     */
-    disclosureLinks?: AcceptDisclosuresLinks;
     /**
      * Called after the atomic accept succeeds and before init refresh is kicked.
      * May return a promise — the widget awaits it before locking controls and
@@ -1414,22 +1467,35 @@ type InnerProps = Omit<AcceptDisclosuresWidgetProps$1, UiOwnedProps> & {
      * Accept retryable (and the host gate stays mounted).
      */
     onAccepted?: () => void | Promise<void>;
+    /**
+     * @deprecated Ignored. Documents come from `GET /identity/v1/disclosures`.
+     * Kept so existing hosts that still pass this continue to typecheck until a
+     * coordinated breaking release.
+     */
+    disclosureLinks?: AcceptDisclosuresLinks;
 };
 type AcceptDisclosuresWidgetProps = WidgetProviderProps & InnerProps;
 /**
- * Self-contained AcceptDisclosures widget.
- * Posts `POST /api/widget-gateway/disclosure-acceptance` (after reading the
- * disclosure version in force via the widget-gateway proxy), which activates
- * the invitee and records acceptance in one transaction, then awaits any
- * `onAccepted` continuation and kicks a widget-init refresh so host gates
- * keyed on `INVITED` can clear. Auth uses the normal WidgetToken provider
- * contract — never an APP/M2M bearer.
+ * Self-contained AcceptDisclosures widget. Fetches the caller's disclosure
+ * document set (title/url pairs, in presentation order) from
+ * `GET /identity/v1/disclosures` and renders it directly — the host supplies
+ * no document URLs. An empty document list (`NOT_REQUIRED`) still renders
+ * Accept so those invitees can activate. Posts
+ * `POST /api/widget-gateway/disclosure-acceptance` with the version that was
+ * on screen after confirming that version is still in force (and the invite
+ * still valid, when one was supplied) via the widget-gateway proxy. A newer
+ * published version is refused rather than accepted unseen. The POST
+ * activates the invitee and records acceptance in one transaction, then
+ * awaits any `onAccepted` continuation and kicks a widget-init refresh so
+ * host gates keyed on `INVITED` — or on the disclosure flags — can clear.
+ * Auth uses the normal WidgetToken provider contract — never an APP/M2M
+ * bearer.
  *
  * Two flows, one surface: the pre-auth invite flow passes `invitationToken` +
- * `userId`; an already-active user who owes a re-acceptance (widget init reports
- * `disclosuresRequired: 'REQUIRED'` with `disclosuresAccepted: false`) passes
- * neither, and the same init refresh clears the gate that mounted this. See
- * `WidgetSuite`, which mounts it as its acceptance state.
+ * `userId`; an already-active user who owes a re-acceptance (widget init
+ * reports `disclosuresRequired: 'REQUIRED'` with `disclosuresAccepted: false`)
+ * passes neither, and the same init refresh clears the gate that mounted this.
+ * See `WidgetSuite`, which mounts it as its acceptance state.
  */
 declare function AcceptDisclosuresWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: AcceptDisclosuresWidgetProps): React.JSX.Element;
 

package/dist/lib/AcceptDisclosuresWidget.d.ts

@@ -11,19 +11,82 @@ interface AcceptDisclosuresWidgetLabels {
     agreementCheckboxAriaLabel: string;
     /** Fallback when the accept API fails without a usable message. */
     acceptErrorFallback: string;
-    /** Use `{bankName}` as the bank display-name placeholder. */
+    /**
+     * Use `{bankName}` for the bank display name and `{documents}` for the
+     * conjunction list of titles the backend returned (same order as the links).
+     * A legacy override that omits `{documents}` still has those titles appended
+     * so consent copy cannot disagree with the linked documents.
+     */
     agreementTextTemplate: string;
     providerAttributionPrefix: string;
     providerAttributionMiddle: string;
     providerAttributionSuffix: string;
+    /**
+     * @deprecated Ignored. Document titles come from
+     * `GET /identity/v1/disclosures`. Kept so hosts that implement the full
+     * published `AcceptDisclosuresWidgetLabels` interface continue to typecheck.
+     */
     linkLabels: {
         termsOfUse: string;
         privacyPolicy: string;
         electronicCommunications: string;
         patriotAct: string;
     };
+    /** Title when the backend returned no documents (`NOT_REQUIRED`). */
+    noDocumentsTitle?: string;
+    /** Use `{bankName}` when the backend returned no documents. */
+    noDocumentsAgreementTextTemplate?: string;
+    /**
+     * Checkbox `aria-label` when the backend returned no documents. Use
+     * `{bankName}`. Must not say the user is agreeing to disclosures.
+     */
+    noDocumentsAgreementCheckboxAriaLabel?: string;
+    /**
+     * Two-item document list. Use `{first}` and `{second}` for the titles.
+     */
+    documentListPairTemplate?: string;
+    /** Separator between titles in a list of three or more (before the last). */
+    documentListSeparator?: string;
+    /** Conjunction before the last title in a list of three or more. */
+    documentListLastConjunction?: string;
+    /** Heading when the disclosures query fails. */
+    loadErrorTitle?: string;
+    /** Fallback when the disclosures query fails without a usable message. */
+    loadErrorFallback?: string;
+    /** Retry control on the disclosures-query error surface. */
+    loadErrorRetryLabel?: string;
+    /**
+     * Shown when accept is refused because a newer disclosure version is in
+     * force than the documents the invitee agreed to.
+     */
+    disclosuresUpdatedFallback?: string;
 }
-declare const ACCEPT_DISCLOSURES_WIDGET_LABELS_EN: AcceptDisclosuresWidgetLabels;
+declare const ACCEPT_DISCLOSURES_WIDGET_LABELS_EN: {
+    title: string;
+    acceptButton: string;
+    agreementCheckboxAriaLabel: string;
+    acceptErrorFallback: string;
+    agreementTextTemplate: string;
+    providerAttributionPrefix: string;
+    providerAttributionMiddle: string;
+    providerAttributionSuffix: string;
+    linkLabels: {
+        termsOfUse: string;
+        privacyPolicy: string;
+        electronicCommunications: string;
+        patriotAct: string;
+    };
+    noDocumentsTitle: string;
+    noDocumentsAgreementTextTemplate: string;
+    noDocumentsAgreementCheckboxAriaLabel: string;
+    documentListPairTemplate: string;
+    documentListSeparator: string;
+    documentListLastConjunction: string;
+    loadErrorTitle: string;
+    loadErrorFallback: string;
+    loadErrorRetryLabel: string;
+    disclosuresUpdatedFallback: string;
+};
 
 interface DisclosureLink {
     label: string;
@@ -643,14 +706,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
 }
 
 /**
- * The four disclosure documents a host supplies. Keyed rather than a free-form
- * array because `agreementTextTemplate` names exactly these four instruments —
- * an arbitrary-length list would let the rendered links and the text the user
- * agrees to disagree with each other.
+ * Host-supplied URLs for the four disclosure documents.
  *
- * URLs are host-supplied on purpose: they are bank-issued legal documents whose
- * hosting is the integrator's concern, and a published package must not carry a
- * Tesouro infrastructure URL a consumer's CSP can block (PLAT-1179).
+ * @deprecated The widget fetches title/url pairs from
+ * `GET /identity/v1/disclosures`. This type remains exported so existing
+ * consumers continue to typecheck until a coordinated breaking release.
  */
 interface AcceptDisclosuresLinks {
     termsOfUseUrl: string;
@@ -678,13 +738,6 @@ type InnerProps = Omit<AcceptDisclosuresWidgetProps$1, UiOwnedProps> & {
      * invite flow.
      */
     userId?: string;
-    /**
-     * URLs of the four bank-issued disclosure documents. Required to render along
-     * with a bank name from widget init: the widget carries no document URLs of its
-     * own and never invents a tenant's legal copy, so it renders nothing until the
-     * host supplies the document set.
-     */
-    disclosureLinks?: AcceptDisclosuresLinks;
     /**
      * Called after the atomic accept succeeds and before init refresh is kicked.
      * May return a promise — the widget awaits it before locking controls and
@@ -692,22 +745,35 @@ type InnerProps = Omit<AcceptDisclosuresWidgetProps$1, UiOwnedProps> & {
      * Accept retryable (and the host gate stays mounted).
      */
     onAccepted?: () => void | Promise<void>;
+    /**
+     * @deprecated Ignored. Documents come from `GET /identity/v1/disclosures`.
+     * Kept so existing hosts that still pass this continue to typecheck until a
+     * coordinated breaking release.
+     */
+    disclosureLinks?: AcceptDisclosuresLinks;
 };
 type AcceptDisclosuresWidgetProps = WidgetProviderProps & InnerProps;
 /**
- * Self-contained AcceptDisclosures widget.
- * Posts `POST /api/widget-gateway/disclosure-acceptance` (after reading the
- * disclosure version in force via the widget-gateway proxy), which activates
- * the invitee and records acceptance in one transaction, then awaits any
- * `onAccepted` continuation and kicks a widget-init refresh so host gates
- * keyed on `INVITED` can clear. Auth uses the normal WidgetToken provider
- * contract — never an APP/M2M bearer.
+ * Self-contained AcceptDisclosures widget. Fetches the caller's disclosure
+ * document set (title/url pairs, in presentation order) from
+ * `GET /identity/v1/disclosures` and renders it directly — the host supplies
+ * no document URLs. An empty document list (`NOT_REQUIRED`) still renders
+ * Accept so those invitees can activate. Posts
+ * `POST /api/widget-gateway/disclosure-acceptance` with the version that was
+ * on screen after confirming that version is still in force (and the invite
+ * still valid, when one was supplied) via the widget-gateway proxy. A newer
+ * published version is refused rather than accepted unseen. The POST
+ * activates the invitee and records acceptance in one transaction, then
+ * awaits any `onAccepted` continuation and kicks a widget-init refresh so
+ * host gates keyed on `INVITED` — or on the disclosure flags — can clear.
+ * Auth uses the normal WidgetToken provider contract — never an APP/M2M
+ * bearer.
  *
  * Two flows, one surface: the pre-auth invite flow passes `invitationToken` +
- * `userId`; an already-active user who owes a re-acceptance (widget init reports
- * `disclosuresRequired: 'REQUIRED'` with `disclosuresAccepted: false`) passes
- * neither, and the same init refresh clears the gate that mounted this. See
- * `WidgetSuite`, which mounts it as its acceptance state.
+ * `userId`; an already-active user who owes a re-acceptance (widget init
+ * reports `disclosuresRequired: 'REQUIRED'` with `disclosuresAccepted: false`)
+ * passes neither, and the same init refresh clears the gate that mounted this.
+ * See `WidgetSuite`, which mounts it as its acceptance state.
  */
 declare function AcceptDisclosuresWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: AcceptDisclosuresWidgetProps): React.JSX.Element;
 

package/dist/libs/tesouro-embedded-components-react/accept-disclosures-widget/data-access/dist/index.js

@@ -1,2 +1,3 @@
 import { useAcceptWidgetDisclosures as e } from "./index2.js";
-export { e as useAcceptWidgetDisclosures };
+import { useDisclosuresQuery as t } from "./index3.js";
+export { e as useAcceptWidgetDisclosures, t as useDisclosuresQuery };

package/dist/libs/tesouro-embedded-components-react/accept-disclosures-widget/data-access/dist/index2.js

@@ -7,28 +7,34 @@ import { getDisclosures as t, postApiWidgetGatewayDisclosureAcceptance as n } fr
 import "../../../shared/data-access/dist/index.js";
 import { useMutation as r } from "@tanstack/react-query";
 //#region ../../libs/tesouro-embedded-components-react/accept-disclosures-widget/data-access/dist/index2.js
-function i() {
-	let { client: i, widgetToken: a } = e();
-	return r({ mutationFn: async ({ invitationToken: e, userId: r } = {}) => {
-		if (!a) throw Error("Widget token is required to accept disclosures");
-		let { data: o } = await t({
-			client: i,
-			headers: { "X-Widget-Token": a },
+var i = class extends Error {
+	constructor() {
+		super("Displayed disclosure version is no longer in force"), this.name = "DisclosuresVersionChangedError";
+	}
+};
+function a() {
+	let { client: a, widgetToken: o } = e();
+	return r({ mutationFn: async ({ invitationToken: e, userId: r, displayedVersion: s }) => {
+		if (!o) throw Error("Widget token is required to accept disclosures");
+		let { data: c } = await t({
+			client: a,
+			headers: { "X-Widget-Token": o },
 			...e && r ? { query: {
 				invitationToken: e,
 				userId: r
 			} } : {},
 			throwOnError: !0
 		});
-		if (!o) throw Error("Unexpected disclosures response from widget gateway");
-		let { data: s } = await n({
-			client: i,
-			headers: { "X-Widget-Token": a },
-			body: { version: o.version },
+		if (!c) throw Error("Unexpected disclosures response from widget gateway");
+		if (c.version !== s) throw new i();
+		let { data: l } = await n({
+			client: a,
+			headers: { "X-Widget-Token": o },
+			body: { version: s },
 			throwOnError: !0
 		});
-		return s;
+		return l;
 	} });
 }
 //#endregion
-export { i as useAcceptWidgetDisclosures };
+export { i as DisclosuresVersionChangedError, a as useAcceptWidgetDisclosures };

package/dist/libs/tesouro-embedded-components-react/accept-disclosures-widget/data-access/dist/index3.js

@@ -0,0 +1,58 @@
+"use client";
+"use client";
+"use client";
+"use client";
+import { useEmbedApi as e } from "../../../shared/data-access/dist/lib/EmbedApiContext.js";
+import { getDisclosures as t } from "../../../shared/data-access/dist/lib/rest/sdk.gen.js";
+import { withAuthEpoch as n } from "../../../shared/data-access/dist/lib/withAuthEpoch.js";
+import "../../../shared/data-access/dist/index.js";
+import { useQuery as r } from "@tanstack/react-query";
+//#region ../../libs/tesouro-embedded-components-react/accept-disclosures-widget/data-access/dist/index3.js
+function i(e) {
+	let t = 2166136261;
+	for (let n = 0; n < e.length; n += 1) t ^= e.charCodeAt(n), t = Math.imul(t, 16777619);
+	return (t >>> 0).toString(16);
+}
+function a(e, t) {
+	return JSON.stringify(e.slice(0, -1)) === JSON.stringify(t);
+}
+var o = [];
+function s(e, t) {
+	if (e !== void 0 && t !== void 0 && a(t.queryKey, o)) return e;
+}
+function c({ invitationToken: a, userId: c, enabled: l } = {}) {
+	let { client: u, widgetToken: d, authEpoch: f } = e(), p = a && c ? {
+		invitationToken: a,
+		userId: c
+	} : void 0, m = async ({ signal: e }) => {
+		let { data: n } = await t({
+			client: u,
+			headers: { "X-Widget-Token": d ?? "" },
+			...p ? { query: p } : {},
+			signal: e,
+			throwOnError: !0
+		});
+		if (!n) throw Error("Unexpected disclosures response from widget gateway");
+		return n;
+	}, h = ["getDisclosures", {
+		baseUrl: u.getConfig().baseUrl,
+		...p ? {
+			userId: p.userId,
+			invitationTokenFingerprint: i(p.invitationToken)
+		} : {}
+	}];
+	o = h;
+	let { queryKey: g } = n({
+		queryKey: h,
+		queryFn: m,
+		placeholderData: void 0
+	}, f);
+	return r({
+		queryKey: g,
+		queryFn: m,
+		placeholderData: s,
+		enabled: !!d && (l === !0 || l === void 0)
+	});
+}
+//#endregion
+export { c as useDisclosuresQuery };

package/dist/libs/tesouro-embedded-components-react/accept-disclosures-widget/feature/dist/index3.js

@@ -1,43 +1,29 @@
-import { ACCEPT_DISCLOSURES_WIDGET_LABELS_EN as e } from "../../ui/dist/lib/AcceptDisclosuresWidget/labels.js";
+import { mergeAcceptDisclosuresWidgetLabels as e } from "../../ui/dist/lib/AcceptDisclosuresWidget/labels.js";
 import "../../ui/dist/index.js";
 //#region ../../libs/tesouro-embedded-components-react/accept-disclosures-widget/feature/dist/index3.js
-function t(t) {
-	return {
-		...e,
-		...t,
-		linkLabels: {
-			...e.linkLabels,
-			...t?.linkLabels
-		}
-	};
+function t(e, t) {
+	return e.length === 0 ? "" : e.length === 1 ? e[0] ?? "" : e.length === 2 ? t.documentListPairTemplate.replaceAll("{first}", e[0] ?? "").replaceAll("{second}", e[1] ?? "") : `${e.slice(0, -1).join(t.documentListSeparator)}${t.documentListLastConjunction}${e[e.length - 1]}`;
+}
+var n = "{documents}";
+function r(e, r, i, a) {
+	let o = t(i, a), s = e.replaceAll("{bankName}", r);
+	return e.includes(n) ? s.replaceAll(n, o) : i.length === 0 ? s : `${s.trimEnd().replace(/\.$/, "")}. ${o}.`;
 }
-function n(e) {
-	let n = e?.disclosureLinks, r = e?.vspName?.trim() ?? "", i = e?.bankName?.trim() ?? "";
-	if (!n || !i) return null;
-	let a = t(e?.labels), o = a.linkLabels;
+function i(t) {
+	let n = t?.documents, i = t?.vspName?.trim() ?? "", a = t?.bankName?.trim() ?? "";
+	if (n === void 0 || !a) return null;
+	let o = e(t?.labels), s = n.map((e) => e.title), c = s.length > 0, l = c ? r(o.agreementTextTemplate, a, s, o) : o.noDocumentsAgreementTextTemplate.replaceAll("{bankName}", a);
 	return {
-		vspName: r || i,
-		bankName: i,
-		disclosureLinks: [
-			{
-				label: o.termsOfUse,
-				href: n.termsOfUseUrl
-			},
-			{
-				label: o.privacyPolicy,
-				href: n.privacyPolicyUrl
-			},
-			{
-				label: o.electronicCommunications,
-				href: n.electronicCommunicationsAgreementUrl
-			},
-			{
-				label: o.patriotAct,
-				href: n.usaPatriotActUrl
-			}
-		],
-		agreementText: a.agreementTextTemplate.replaceAll("{bankName}", i)
+		vspName: i || a,
+		bankName: a,
+		title: c ? o.title : o.noDocumentsTitle,
+		disclosureLinks: n.map((e) => ({
+			label: e.title,
+			href: e.url
+		})),
+		agreementText: l,
+		agreementCheckboxAriaLabel: c ? o.agreementCheckboxAriaLabel : o.noDocumentsAgreementCheckboxAriaLabel.replaceAll("{bankName}", a)
 	};
 }
 //#endregion
-export { n as resolveAcceptDisclosuresContent };
+export { i as resolveAcceptDisclosuresContent };

package/dist/libs/tesouro-embedded-components-react/accept-disclosures-widget/feature/dist/index4.js

@@ -3,118 +3,136 @@
 "use client";
 "use client";
 import { AcceptDisclosuresWidgetAnalyticsEvent as e, WIDGET_NAME as t } from "./index2.js";
-import { ACCEPT_DISCLOSURES_WIDGET_LABELS_EN as n } from "../../ui/dist/lib/AcceptDisclosuresWidget/labels.js";
+import { mergeAcceptDisclosuresWidgetLabels as n } from "../../ui/dist/lib/AcceptDisclosuresWidget/labels.js";
 import { AcceptDisclosuresWidget as r } from "../../ui/dist/lib/AcceptDisclosuresWidget/AcceptDisclosuresWidget.js";
 import "../../ui/dist/index.js";
 import { resolveAcceptDisclosuresContent as i } from "./index3.js";
 import { useAcceptWidgetDisclosures as a } from "../../data-access/dist/index2.js";
+import { useDisclosuresQuery as o } from "../../data-access/dist/index3.js";
 import "../../data-access/dist/index.js";
-import { useAnalyticsTrack as o } from "../../../shared/feature/dist/lib/analytics/hooks.js";
-import { WidgetProvider as s } from "../../../shared/feature/dist/lib/WidgetProvider/WidgetProvider.js";
-import { extractApiErrorMessage as c } from "../../../shared/util/dist/lib/apiErrors.js";
-import { useRefetchWidget as l, useWidgetConfig as u, useWidgetInitStaleForToken as d } from "../../../shared/feature/dist/lib/WidgetProvider/hooks.js";
+import { ErrorState as s } from "../../../shared/ui/dist/lib/ErrorState/ErrorState.js";
+import "../../../shared/ui/dist/index.js";
+import { useAnalyticsTrack as c } from "../../../shared/feature/dist/lib/analytics/hooks.js";
+import { WidgetProvider as l } from "../../../shared/feature/dist/lib/WidgetProvider/WidgetProvider.js";
+import { extractApiErrorMessage as u } from "../../../shared/util/dist/lib/apiErrors.js";
+import { useRefetchWidget as d, useWidgetConfig as f, useWidgetInitStaleForToken as p } from "../../../shared/feature/dist/lib/WidgetProvider/hooks.js";
 import "../../../shared/feature/dist/index.js";
-import { useCallback as f, useEffect as p, useRef as m, useState as h } from "react";
-import { Fragment as g, jsx as _, jsxs as v } from "react/jsx-runtime";
+import { useCallback as m, useEffect as h, useRef as g, useState as _ } from "react";
+import { Fragment as v, jsx as y, jsxs as b } from "react/jsx-runtime";
 //#region ../../libs/tesouro-embedded-components-react/accept-disclosures-widget/feature/dist/index4.js
-function y(e) {
-	return {
-		...n,
-		...e,
-		linkLabels: {
-			...n.linkLabels,
-			...e?.linkLabels
-		}
-	};
-}
-function b(e, t, n) {
-	return /* @__PURE__ */ v(g, { children: [
+function x(e, t, n) {
+	return /* @__PURE__ */ b(v, { children: [
 		n.providerAttributionPrefix,
-		/* @__PURE__ */ _("strong", { children: e }),
+		/* @__PURE__ */ y("strong", { children: e }),
 		n.providerAttributionMiddle,
 		t,
 		n.providerAttributionSuffix
 	] });
 }
-function x({ invitationToken: t, userId: n, disclosureLinks: r, labels: a, onAccepted: s }) {
-	let c = o(), { initResponse: l } = u(), f = d(), m = y(a);
-	p(() => {
-		c(e.Mounted);
-	}, [c]);
-	let h = i({
-		disclosureLinks: r,
-		vspName: l?.vspName,
-		bankName: l?.bankName,
+function S({ invitationToken: t, userId: r, labels: a, onAccepted: l }) {
+	let d = c(), { initResponse: m } = f(), g = p(), _ = n(a), { data: v, isError: b, error: x, refetch: S } = o({
+		invitationToken: t,
+		userId: r
+	});
+	if (h(() => {
+		d(e.Mounted);
+	}, [d]), b) return /* @__PURE__ */ y(s, {
+		title: _.loadErrorTitle,
+		description: u(x) ?? _.loadErrorFallback,
+		retryLabel: _.loadErrorRetryLabel,
+		onRetry: () => {
+			S();
+		},
+		testId: "accept-disclosures-load-error"
+	});
+	let w = i({
+		documents: v?.documents,
+		vspName: m?.vspName,
+		bankName: m?.bankName,
 		labels: a
 	});
-	if (!h) return null;
-	let g = !!(t && n);
-	if (!g && f) return null;
-	let v = `${g ? `invite:${t}:${n}` : `user:${l?.userId ?? ""}`}:${h.vspName}:${h.bankName}:${h.agreementText}:${h.disclosureLinks.map((e) => e.href).join("|")}`;
-	return /* @__PURE__ */ _(S, {
+	if (!w) return null;
+	let T = v?.version ?? null, E = !!(t && r);
+	if (!E && g) return null;
+	let D = `${E ? `invite:${t}:${r}` : `user:${m?.userId ?? ""}`}:${T}:${w.vspName}:${w.bankName}:${w.agreementText}:${w.disclosureLinks.map((e) => e.href).join("|")}`;
+	return /* @__PURE__ */ y(C, {
 		invitationToken: t,
-		userId: n,
+		userId: r,
+		displayedVersion: T,
 		labelOverrides: a,
-		content: h,
-		labels: m,
-		onAccepted: s
-	}, v);
+		content: w,
+		labels: _,
+		onAccepted: l,
+		onDisclosuresVersionChanged: S
+	}, D);
 }
-function S({ invitationToken: e, userId: t, labelOverrides: n, content: i, labels: o, onAccepted: s }) {
-	let [u, d] = h(!1), [p, g] = h(), [v, y] = h(!1), [x, S] = h(!1), C = m(!1), { mutateAsync: w } = a(), T = l(), E = f((e) => {
-		g(void 0), d(e);
-	}, []), D = f(async () => {
-		if (!(!u || v || x)) {
-			g(void 0), y(!0);
+function C({ invitationToken: e, userId: t, displayedVersion: n, labelOverrides: i, content: o, labels: s, onAccepted: c, onDisclosuresVersionChanged: l }) {
+	let [f, p] = _(!1), [h, v] = _(), [b, S] = _(!1), [C, w] = _(!1), T = g(!1), { mutateAsync: E } = a(), D = d(), O = m((e) => {
+		v(void 0), p(e);
+	}, []), k = m(async () => {
+		if (!(!f || b || C)) {
+			v(void 0), S(!0);
 			try {
-				if (!C.current) try {
-					await w({
+				if (!T.current) try {
+					await E({
 						invitationToken: e,
-						userId: t
-					}), C.current = !0;
+						userId: t,
+						displayedVersion: n
+					}), T.current = !0;
 				} catch (e) {
-					g(c(e) ?? o.acceptErrorFallback);
+					if (e instanceof Error && e.name === "DisclosuresVersionChangedError") {
+						v(s.disclosuresUpdatedFallback), l();
+						return;
+					}
+					v(u(e) ?? s.acceptErrorFallback);
 					return;
 				}
 				try {
-					await s?.();
+					await c?.();
 				} catch (e) {
-					g(c(e) ?? o.acceptErrorFallback);
+					v(u(e) ?? s.acceptErrorFallback);
 					return;
 				}
-				T(), S(!0);
+				D(), w(!0);
 			} finally {
-				y(!1);
+				S(!1);
 			}
 		}
 	}, [
-		w,
-		x,
+		E,
+		n,
+		C,
 		e,
-		u,
-		v,
-		o.acceptErrorFallback,
-		s,
-		T,
+		f,
+		b,
+		s.acceptErrorFallback,
+		s.disclosuresUpdatedFallback,
+		c,
+		l,
+		D,
 		t
 	]);
-	return /* @__PURE__ */ _(r, {
-		labels: n,
-		providerAttribution: b(i.vspName, i.bankName, o),
-		agreementText: i.agreementText,
-		disclosureLinks: i.disclosureLinks,
-		isAgreed: u,
-		onAgreedChange: E,
+	return /* @__PURE__ */ y(r, {
+		labels: {
+			...i,
+			title: o.title,
+			agreementCheckboxAriaLabel: o.agreementCheckboxAriaLabel
+		},
+		providerAttribution: x(o.vspName, o.bankName, s),
+		agreementText: o.agreementText,
+		disclosureLinks: o.disclosureLinks,
+		isAgreed: f,
+		onAgreedChange: O,
 		onAccept: () => {
-			D();
+			k();
 		},
-		isSubmitting: v,
-		isAccepted: x,
-		errorMessage: p
+		isSubmitting: b,
+		isAccepted: C,
+		errorMessage: h
 	});
 }
-function C({ baseUrl: e, widgetToken: n, organizationId: r, configClient: i, gatewayRouting: a, linkComponent: o, implementation: c, uiFramework: l, errorFallback: u, onError: d, analytics: f, ...p }) {
-	return /* @__PURE__ */ _(s, {
+function w({ baseUrl: e, widgetToken: n, organizationId: r, configClient: i, gatewayRouting: a, linkComponent: o, implementation: s, uiFramework: c, errorFallback: u, onError: d, analytics: f, ...p }) {
+	return /* @__PURE__ */ y(l, {
 		widgetName: t,
 		baseUrl: e,
 		widgetToken: n,
@@ -122,13 +140,13 @@ function C({ baseUrl: e, widgetToken: n, organizationId: r, configClient: i, gat
 		configClient: i,
 		gatewayRouting: a,
 		linkComponent: o,
-		implementation: c,
-		uiFramework: l,
+		implementation: s,
+		uiFramework: c,
 		errorFallback: u,
 		onError: d,
 		analytics: f,
-		children: /* @__PURE__ */ _(x, { ...p })
+		children: /* @__PURE__ */ y(S, { ...p })
 	});
 }
 //#endregion
-export { C as AcceptDisclosuresWidget };
+export { w as AcceptDisclosuresWidget };

package/dist/libs/tesouro-embedded-components-react/accept-disclosures-widget/ui/dist/index.js

@@ -1,3 +1,3 @@
-import { ACCEPT_DISCLOSURES_WIDGET_LABELS_EN as e } from "./lib/AcceptDisclosuresWidget/labels.js";
-import { AcceptDisclosuresWidget as t } from "./lib/AcceptDisclosuresWidget/AcceptDisclosuresWidget.js";
-export { e as ACCEPT_DISCLOSURES_WIDGET_LABELS_EN, t as AcceptDisclosuresWidget };
+import { ACCEPT_DISCLOSURES_WIDGET_LABELS_EN as e, mergeAcceptDisclosuresWidgetLabels as t } from "./lib/AcceptDisclosuresWidget/labels.js";
+import { AcceptDisclosuresWidget as n } from "./lib/AcceptDisclosuresWidget/AcceptDisclosuresWidget.js";
+export { e as ACCEPT_DISCLOSURES_WIDGET_LABELS_EN, n as AcceptDisclosuresWidget, t as mergeAcceptDisclosuresWidgetLabels };

package/dist/libs/tesouro-embedded-components-react/accept-disclosures-widget/ui/dist/lib/AcceptDisclosuresWidget/AcceptDisclosuresWidget.js

@@ -1,17 +1,10 @@
-import { ACCEPT_DISCLOSURES_WIDGET_LABELS_EN as e } from "./labels.js";
+import { mergeAcceptDisclosuresWidgetLabels as e } from "./labels.js";
 import { Button as t, Checkbox as n } from "../../../../../../../packages/shared-ui-shadcn/dist/index.js";
 import { useId as r } from "react";
 import { jsx as i, jsxs as a } from "react/jsx-runtime";
 //#region ../../libs/tesouro-embedded-components-react/accept-disclosures-widget/ui/dist/lib/AcceptDisclosuresWidget/AcceptDisclosuresWidget.js
 function o({ providerAttribution: o, agreementText: s, disclosureLinks: c, isAgreed: l, onAgreedChange: u, onAccept: d, isSubmitting: f = !1, isAccepted: p = !1, errorMessage: m, labels: h }) {
-	let g = f || p, _ = {
-		...e,
-		...h,
-		linkLabels: {
-			...e.linkLabels,
-			...h?.linkLabels
-		}
-	}, v = r(), y = `${v}-agree`, b = `${v}-agree-description`, x = `${v}-accept-error`;
+	let g = f || p, _ = e(h), v = r(), y = `${v}-agree`, b = `${v}-agree-description`, x = `${v}-accept-error`;
 	return /* @__PURE__ */ a("div", {
 		"data-testid": "accept-disclosures-widget-root",
 		className: "ttw:block ttw:w-full ttw:rounded-lg ttw:border ttw:border-border ttw:bg-background ttw:p-6",
@@ -25,7 +18,7 @@ function o({ providerAttribution: o, agreementText: s, disclosureLinks: c, isAgr
 				className: "ttw:mb-4 ttw:text-sm ttw:text-foreground",
 				children: o
 			}),
-			/* @__PURE__ */ i("ul", {
+			c.length > 0 ? /* @__PURE__ */ i("ul", {
 				"data-testid": "accept-disclosures-links",
 				className: "ttw:mb-4 ttw:list-disc ttw:space-y-2 ttw:pl-5",
 				children: c.map((e) => /* @__PURE__ */ i("li", {
@@ -38,7 +31,7 @@ function o({ providerAttribution: o, agreementText: s, disclosureLinks: c, isAgr
 						children: e.label
 					})
 				}, e.href))
-			}),
+			}) : null,
 			/* @__PURE__ */ a("div", {
 				className: "ttw:mb-4 ttw:flex ttw:items-start ttw:gap-3",
 				children: [/* @__PURE__ */ i(n, {
@@ -77,4 +70,4 @@ function o({ providerAttribution: o, agreementText: s, disclosureLinks: c, isAgr
 	});
 }
 //#endregion
-export { e as ACCEPT_DISCLOSURES_WIDGET_LABELS_EN, o as AcceptDisclosuresWidget };
+export { o as AcceptDisclosuresWidget, e as mergeAcceptDisclosuresWidgetLabels };

package/dist/libs/tesouro-embedded-components-react/accept-disclosures-widget/ui/dist/lib/AcceptDisclosuresWidget/labels.js

@@ -4,7 +4,7 @@ var e = {
 	acceptButton: "Accept",
 	agreementCheckboxAriaLabel: "Agree to banking disclosures",
 	acceptErrorFallback: "Failed to accept disclosures",
-	agreementTextTemplate: "I agree to {bankName}'s Terms of Use and Privacy Policy, consent to receive electronic communications about my accounts and services, and acknowledge receipt of the USA PATRIOT Act Disclosure.",
+	agreementTextTemplate: "I agree to {bankName}'s {documents}.",
 	providerAttributionPrefix: "Banking services for ",
 	providerAttributionMiddle: " are provided by ",
 	providerAttributionSuffix: ", Member FDIC.",
@@ -13,7 +13,27 @@ var e = {
 		privacyPolicy: "Privacy Policy",
 		electronicCommunications: "Electronic Communications Agreement",
 		patriotAct: "USA PATRIOT Act Disclosure"
-	}
+	},
+	noDocumentsTitle: "Accept to continue",
+	noDocumentsAgreementTextTemplate: "I agree to continue with {bankName}.",
+	noDocumentsAgreementCheckboxAriaLabel: "Agree to continue with {bankName}",
+	documentListPairTemplate: "{first} and {second}",
+	documentListSeparator: ", ",
+	documentListLastConjunction: ", and ",
+	loadErrorTitle: "Unable to load disclosures",
+	loadErrorFallback: "Failed to load disclosures",
+	loadErrorRetryLabel: "Try again",
+	disclosuresUpdatedFallback: "These disclosures have been updated. Review the new documents and accept again."
 };
+function t(t) {
+	return {
+		...e,
+		...t,
+		linkLabels: {
+			...e.linkLabels,
+			...t?.linkLabels
+		}
+	};
+}
 //#endregion
-export { e as ACCEPT_DISCLOSURES_WIDGET_LABELS_EN };
+export { e as ACCEPT_DISCLOSURES_WIDGET_LABELS_EN, t as mergeAcceptDisclosuresWidgetLabels };

package/dist/libs/tesouro-embedded-components-react/cards-widget/feature/dist/index7.js

@@ -58,7 +58,7 @@ function u({ cardProgram: s, pagination: u, defaultPagination: d, onPaginationCh
 		resetKey: O,
 		paginationToken: T.paginationToken,
 		pageSize: T.pageSize
-	})), [De, Oe] = o(!1), [ke, M] = he({
+	})), [De, Oe] = o(!0), [ke, M] = he({
 		prop: ve,
 		defaultProp: ye ?? null,
 		onChange: be,

package/dist/libs/tesouro-embedded-components-react/cards-widget/ui/dist/lib/CardsList/CardsList.js

@@ -24,7 +24,7 @@ function w({ columnCount: e }) {
 		children: Array.from({ length: e }).map((e, n) => /* @__PURE__ */ v(a, { children: /* @__PURE__ */ v(t, { className: "ttw:h-4 ttw:w-24" }) }, n))
 	}, r)) });
 }
-function T({ rows: t, columns: _, isLoading: C = !1, isError: T = !1, canToggleShowMyCards: E = !1, isShowingMyCards: D = !1, onShowMyCardsChange: O, canCreateCard: k = !1, onCreateCardClick: A, onRetry: j, isPaginationVisible: M = !1, pageSize: N = 10, pageSizeOptions: P = S, rangeLabel: F = "", isPreviousPageDisabled: I = !1, isNextPageDisabled: L = !1, onPageSizeChange: R, onPreviousPageClick: z, onNextPageClick: B, labels: V }) {
+function T({ rows: t, columns: _, isLoading: C = !1, isError: T = !1, canToggleShowMyCards: E = !1, isShowingMyCards: D = !0, onShowMyCardsChange: O, canCreateCard: k = !1, onCreateCardClick: A, onRetry: j, isPaginationVisible: M = !1, pageSize: N = 10, pageSizeOptions: P = S, rangeLabel: F = "", isPreviousPageDisabled: I = !1, isNextPageDisabled: L = !1, onPageSizeChange: R, onPreviousPageClick: z, onNextPageClick: B, labels: V }) {
 	let H = h(), U = g(() => p(V), [V]), W = !!(k && A), G = R && z && B ? {
 		onPageSizeChange: R,
 		onPreviousPageClick: z,

package/dist/libs/tesouro-embedded-components-react/cards-widget/ui/dist/lib/CardsList/CardsListDetailsSheet.js

@@ -19,7 +19,7 @@ function l({ isOpen: l, onClose: u, labels: d, contentClassName: f, children: p
 		},
 		children: /* @__PURE__ */ c(t, {
 			showCloseButton: !1,
-			className: i("ttw:w-168 ttw:sm:max-w-168", f ?? "ttw:overflow-y-auto"),
+			className: i("ttw:w-168 ttw:sm:max-w-168", "ttw:!gap-0", f ?? "ttw:overflow-y-auto"),
 			children: [
 				/* @__PURE__ */ s(r, {
 					className: "ttw:sr-only",

package/dist/libs/tesouro-embedded-components-react/shared/feature/dist/lib/analytics/build-info.js

@@ -1,5 +1,5 @@
 //#region ../../libs/tesouro-embedded-components-react/shared/feature/dist/lib/analytics/build-info.js
-var e = "@tesouro/embedded-components-react", t = "0.2.269", n = "5e2af314f61dddcebbe315cf33ef886165d193e3", r = Object.freeze({
+var e = "@tesouro/embedded-components-react", t = "0.2.272", n = "1d93289f62e822c5d71a073df8a4f6ed6c3ac630", r = Object.freeze({
 	library_name: e,
 	library_version: t,
 	library_sha: n

package/dist/libs/tesouro-embedded-components-react/widget-suite/feature/dist/index4.js

@@ -22,10 +22,6 @@ var e = {
 		title: "We couldn't finish loading this page",
 		body: "Your disclosure acceptance was saved, so you won't need to accept again.",
 		retryButton: "Try again"
-	},
-	unavailableState: {
-		title: "This account needs to accept disclosures",
-		body: "The documents are not available right now. Please contact support to continue."
 	}
 };
 //#endregion

package/dist/libs/tesouro-embedded-components-react/widget-suite/feature/dist/index6.js

@@ -24,102 +24,90 @@ import { Fragment as C, jsx as w, jsxs as T } from "react/jsx-runtime";
 //#region ../../libs/tesouro-embedded-components-react/widget-suite/feature/dist/index6.js
 var E = {
 	initFailed: "widget-suite-init-failed",
-	disclosuresRefreshFailed: "widget-suite-disclosures-refresh-failed",
-	disclosuresUnavailable: "widget-suite-disclosures-unavailable"
+	disclosuresRefreshFailed: "widget-suite-disclosures-refresh-failed"
 };
-function D({ sections: r, disclosureLinks: m, labels: D, sectionLabels: O, sectionTitleLabels: k, contentLabels: A, disclosureLabels: j, showSectionTitle: M = !0 }) {
-	let N = n();
+function D({ sections: r, labels: m, sectionLabels: D, sectionTitleLabels: O, contentLabels: k, disclosureLabels: A, showSectionTitle: j = !0 }) {
+	let M = n();
 	b(() => {
-		N(h.Mounted);
-	}, [N]);
-	let P = {
+		M(h.Mounted);
+	}, [M]);
+	let N = {
 		...d,
-		...O
-	}, { initResponse: F } = a(), I = o(), L = s(), R = F?.scopes, z = x(() => ({
+		...D
+	}, { initResponse: P } = a(), F = o(), I = s(), L = P?.scopes, R = x(() => ({
 		creditCards: {
 			...l.creditCards,
-			...A?.creditCards
+			...k?.creditCards
 		},
 		debitCards: {
 			...l.debitCards,
-			...A?.debitCards
+			...k?.debitCards
 		},
 		expensePlaceholders: {
 			...l.expensePlaceholders,
-			...A?.expensePlaceholders
+			...k?.expensePlaceholders
 		}
-	}), [A]), [B, V] = S(r[0] ?? ""), H = i(), [U, W] = S(!1), G = y(() => W(!0), []), K = g(F), q = {
+	}), [k]), [z, B] = S(r[0] ?? ""), V = i(), [H, U] = S(!1), W = y(() => U(!0), []), G = g(P), K = {
 		...u,
-		...j,
+		...A,
 		initFailedState: {
 			...u.initFailedState,
-			...j?.initFailedState
+			...A?.initFailedState
 		},
 		refreshFailedState: {
 			...u.refreshFailedState,
-			...j?.refreshFailedState
-		},
-		unavailableState: {
-			...u.unavailableState,
-			...j?.unavailableState
+			...A?.refreshFailedState
 		}
 	};
 	b(() => {
-		!K && U && W(!1);
-	}, [U, K]);
-	let J = !!(F && L);
-	if (!F && !I || J && !I) return /* @__PURE__ */ w(_, {
+		!G && H && U(!1);
+	}, [H, G]);
+	let q = !!(P && I);
+	if (!P && !F || q && !F) return /* @__PURE__ */ w(_, {
 		isLoading: !0,
 		sections: [],
 		selectedSectionId: "",
-		onSectionChange: V,
-		labels: D
+		onSectionChange: B,
+		labels: m
 	});
-	if ((!F || J) && I) return /* @__PURE__ */ w(t, {
-		title: q.initFailedState.title,
-		description: q.initFailedState.body,
-		retryLabel: q.initFailedState.retryButton,
-		onRetry: H,
+	if ((!P || q) && F) return /* @__PURE__ */ w(t, {
+		title: K.initFailedState.title,
+		description: K.initFailedState.body,
+		retryLabel: K.initFailedState.retryButton,
+		onRetry: V,
 		testId: E.initFailed
 	});
-	if (K) return U && I ? /* @__PURE__ */ w(t, {
-		title: q.refreshFailedState.title,
-		description: q.refreshFailedState.body,
-		retryLabel: q.refreshFailedState.retryButton,
-		onRetry: H,
+	if (G) return H && F ? /* @__PURE__ */ w(t, {
+		title: K.refreshFailedState.title,
+		description: K.refreshFailedState.body,
+		retryLabel: K.refreshFailedState.retryButton,
+		onRetry: V,
 		testId: E.disclosuresRefreshFailed
-	}) : m ? /* @__PURE__ */ w(c, {
-		disclosureLinks: m,
-		onAccepted: G
-	}) : /* @__PURE__ */ w(t, {
-		title: q.unavailableState.title,
-		description: q.unavailableState.body,
-		testId: E.disclosuresUnavailable
-	});
-	let Y = F?.bankName?.trim(), X = Y ? {
+	}) : /* @__PURE__ */ w(c, { onAccepted: W });
+	let J = P?.bankName?.trim(), Y = J ? {
 		...f,
-		...k
-	}.bankTagline.replaceAll("{bankName}", Y) : void 0, Z = r.flatMap((t) => {
+		...O
+	}.bankTagline.replaceAll("{bankName}", J) : void 0, X = r.flatMap((t) => {
 		let n = p[t];
-		if (!n || n.anyOfScopes && !e(R, n.anyOfScopes)) return [];
-		let r = P[t], i = n.render({
-			grantedScopes: R,
-			labels: z
+		if (!n || n.anyOfScopes && !e(L, n.anyOfScopes)) return [];
+		let r = N[t], i = n.render({
+			grantedScopes: L,
+			labels: R
 		});
 		return [{
 			id: t,
 			label: r,
-			content: M && !n.rendersOwnTitle ? /* @__PURE__ */ T(C, { children: [/* @__PURE__ */ w(v, {
+			content: j && !n.rendersOwnTitle ? /* @__PURE__ */ T(C, { children: [/* @__PURE__ */ w(v, {
 				title: r,
-				bankTagline: X
+				bankTagline: Y
 			}), i] }) : i
 		}];
-	}), Q = Z.some((e) => e.id === B) ? B : Z[0]?.id ?? "";
+	}), Z = X.some((e) => e.id === z) ? z : X[0]?.id ?? "";
 	return /* @__PURE__ */ w(_, {
-		sections: Z,
-		selectedSectionId: Q,
-		onSectionChange: V,
-		labels: D
+		sections: X,
+		selectedSectionId: Z,
+		onSectionChange: B,
+		labels: m
 	});
 }
 function O({ baseUrl: e, widgetToken: t, organizationId: n, configClient: i, gatewayRouting: a, linkComponent: o, implementation: s, uiFramework: c, errorFallback: l, onError: u, analytics: d, ...f }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tesouro/embedded-components-react",
-  "version": "0.2.269",
+  "version": "0.2.272",
   "license": "Apache-2.0",
   "type": "module",
   "packageDepSync": {