@tesouro/embedded-components-react 0.2.324 → 0.2.326

package/README.md

@@ -119,7 +119,7 @@ App-level provider. Resolves `baseUrl` / `widgetToken` / `organizationId` (falli
 | `implementation`                | `'native' \| 'monite' \| null`               | Which implementation the widgets render with for this tree. Falls back to `global.implementation`, then to `'native'`. See Implementation selection.                                                                                                                                                                                 |
 | `analytics`                     | `boolean`                                    | Enables anonymous analytics for this provider tree (default `true`). `RootWidgetProvider` is the analytics owner; set `false` to disable capture and skip loading PostHog.                                                                                                                                                                                                       |
 | `unstable_initResponseOverride` | `WidgetInitResponse`                         | First-party hosts only. Skips the `GET /api/widget-gateway/init` fetch and exposes this host-authored object as `initResponse` to the subtree. Use when the host authenticates users directly against the Tesouro issuer and passes the user's bearer access token as `widgetToken`. Embed integrations minting widget JWEs must leave this unset.                               |
-| `disclosuresAcceptance`         | `ReactNode`                                  | Accept surface shown when an ACTIVE user owes a new disclosure version. Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` with no invite credentials. Cascades to nested providers. Omit for INVITED — that path still uses invite-link `invitationToken` / `userId` on the host landing page.                                                                              |
+| `disclosuresAcceptance`         | `ReactNode`                                  | Accept surface shown when the caller owes disclosures (`INVITED`, or `REQUIRED` with `disclosuresAccepted: false`). Pass `<AcceptDisclosuresWidget />`. Cascades to nested providers.                                                                                                                                                                                            |
 | `children`                      | `ReactNode`                                  | The React subtree that consumes the widget context.                                                                                                                                                                                                                                                                                                                              |
 
 ### `WidgetProvider`
@@ -141,7 +141,7 @@ Mid-tree or standalone provider. With no props it is a transparent pass-through
 | `errorFallback`         | `ReactNode \| (props: FallbackProps) => ReactNode` | Custom fallback for the built-in error boundary in this subtree. A `ReactNode` is rendered as-is; a function receives `{ error, resetErrorBoundary }`. Defaults to a generic `role="alert"` message.                                                                                                                        |
 | `onError`               | `(error: unknown, info: ErrorInfo) => void`        | Optional telemetry hook. Runs once per caught error before the fallback renders.                                                                                                                                                                                                                                            |
 | `analytics`             | `boolean`                                          | Enables anonymous analytics (default `true`). Honored only when this is a standalone analytics owner (no `RootWidgetProvider` ancestor); on a nested provider it is a no-op.                                                                                                                                                |
-| `disclosuresAcceptance` | `ReactNode`                                        | Accept surface shown when an ACTIVE user owes a new disclosure version. Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` with no invite credentials. When omitted, inherits from the nearest ancestor.                                                                                                                |
+| `disclosuresAcceptance` | `ReactNode`                                        | Accept surface shown when the caller owes disclosures (`INVITED`, or `REQUIRED` with `disclosuresAccepted: false`). Pass `<AcceptDisclosuresWidget />`. When omitted, inherits from the nearest ancestor.                                                                                                                   |
 | `children`              | `ReactNode`                                        | The React subtree that consumes the overridden context.                                                                                                                                                                                                                                                                     |
 
 ### `WidgetTokenRefreshProvider`
@@ -163,22 +163,22 @@ Bundles `WidgetTokenRefreshProvider` + `RootWidgetProvider` and wires the live t
 
 #### Props
 
-| Prop                            | Source                       | Notes                                                                                                                                            |
-| ------------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `baseUrl`                       | `RootWidgetProvider`         | Falls back to the global store when omitted.                                                                                                     |
-| `organizationId`                | `RootWidgetProvider`         | Pass `null` to clear the org scope; falls back to the global store when omitted.                                                                 |
-| `configClient`                  | `RootWidgetProvider`         | Optional post-creation hook for the scoped HTTP client.                                                                                          |
-| `gatewayRouting`                | `RootWidgetProvider`         | Overrides widget-gateway routing; unset, it applies per request when the request origin is a known Tesouro API host.                             |
-| `linkComponent`                 | `RootWidgetProvider`         | Component used in place of plain `<a>` tags inside widgets.                                                                                      |
-| `uiFramework`                   | `RootWidgetProvider`         | `'shadcn'` (default) or `'tecton'`; inherits down the provider cascade.                                                                          |
-| `implementation`                | `RootWidgetProvider`         | `'native'` (default) or `'monite'`; inherits down the provider cascade.                                                                          |
-| `analytics`                     | `RootWidgetProvider`         | Enables anonymous analytics (default `true`); set `false` to disable capture.                                                                    |
-| `unstable_initResponseOverride` | `RootWidgetProvider`         | First-party hosts only. Skips the gateway init fetch and supplies host-authored identity for the subtree.                                        |
-| `disclosuresAcceptance`         | `RootWidgetProvider`         | Accept surface for an ACTIVE user who owes a new disclosure version. Cascades to nested providers.                                               |
-| `fetcher`                       | `WidgetTokenRefreshProvider` | Required.                                                                                                                                        |
-| `leadSeconds`                   | `WidgetTokenRefreshProvider` | Default `60`.                                                                                                                                    |
-| `onToken`                       | `WidgetTokenRefreshProvider` | Fires once per distinct token; useful for telemetry, persistence, or — for non-React hosts — mirroring the token via `updateGlobalWidgetConfig`. |
-| `children`                      | —                            | Render inside both providers' contexts (so `useWidgetToken()` and `useWidgetConfig()` both work in descendants).                                 |
+| Prop                            | Source                       | Notes                                                                                                                                             |
+| ------------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `baseUrl`                       | `RootWidgetProvider`         | Falls back to the global store when omitted.                                                                                                      |
+| `organizationId`                | `RootWidgetProvider`         | Pass `null` to clear the org scope; falls back to the global store when omitted.                                                                  |
+| `configClient`                  | `RootWidgetProvider`         | Optional post-creation hook for the scoped HTTP client.                                                                                           |
+| `gatewayRouting`                | `RootWidgetProvider`         | Overrides widget-gateway routing; unset, it applies per request when the request origin is a known Tesouro API host.                              |
+| `linkComponent`                 | `RootWidgetProvider`         | Component used in place of plain `<a>` tags inside widgets.                                                                                       |
+| `uiFramework`                   | `RootWidgetProvider`         | `'shadcn'` (default) or `'tecton'`; inherits down the provider cascade.                                                                           |
+| `implementation`                | `RootWidgetProvider`         | `'native'` (default) or `'monite'`; inherits down the provider cascade.                                                                           |
+| `analytics`                     | `RootWidgetProvider`         | Enables anonymous analytics (default `true`); set `false` to disable capture.                                                                     |
+| `unstable_initResponseOverride` | `RootWidgetProvider`         | First-party hosts only. Skips the gateway init fetch and supplies host-authored identity for the subtree.                                         |
+| `disclosuresAcceptance`         | `RootWidgetProvider`         | Accept surface shown when the caller owes disclosures (`INVITED`, or `REQUIRED` with `disclosuresAccepted: false`). Cascades to nested providers. |
+| `fetcher`                       | `WidgetTokenRefreshProvider` | Required.                                                                                                                                         |
+| `leadSeconds`                   | `WidgetTokenRefreshProvider` | Default `60`.                                                                                                                                     |
+| `onToken`                       | `WidgetTokenRefreshProvider` | Fires once per distinct token; useful for telemetry, persistence, or — for non-React hosts — mirroring the token via `updateGlobalWidgetConfig`.  |
+| `children`                      | —                            | Render inside both providers' contexts (so `useWidgetToken()` and `useWidgetConfig()` both work in descendants).                                  |
 
 ## Components
 
@@ -191,9 +191,9 @@ listed here.
 
 A self-contained widget for reviewing and accepting required banking disclosures. Fetches the caller's disclosure document set (title/url pairs, in presentation order) from `GET /identity/v1/disclosures` and renders an inline bordered card with those links, an agreement checkbox, and an Accept action. The host supplies no document URLs — the document set, its titles, and its order are entirely backend configuration for the bank partner's program. The provider attribution and agreement copy come from the widget init tenant identity.
 
-**Two flows, one surface.** In the **pre-auth invite flow**, pass `invitationToken` and `userId` from the invite link. For an **already-active user who owes a re-acceptance** — a new disclosure version was published, so widget init reports `disclosuresRequired: 'REQUIRED'` with `disclosuresAccepted: false` — pass neither: they hold no invite, and the widget token identifies them on both calls. Read those two init fields rather than `status` to decide whether to mount this widget, because an active user can owe an acceptance while never being invited again.
+The widget token identifies the caller on both the disclosures lookup and the accept. Mount this when widget init reports `status: 'INVITED'`, **or** `disclosuresRequired: 'REQUIRED'` with `disclosuresAccepted: false`. The first covers an invited teammate who is not yet active — including orgs whose requirement is `NOT_REQUIRED`, where Accept still posts a `null` version to activate them. The second covers an already-active user who owes a newly published version. Do not gate on `REQUIRED` alone: that would skip `INVITED` users in `NOT_REQUIRED` orgs and leave them stuck.
 
-Accept posts `POST /api/widget-gateway/disclosure-acceptance` with the version that was on screen, after a second `GET /identity/v1/disclosures` confirms that version is still in force (hosts rewrite that onto `/api/widget-gateway/proxy/identity/v1/disclosures` the same way as other identity calls — do not call the generated catch-all proxy helper, which percent-encodes path slashes and surfaces as a browser CORS error). If a newer version was published while the caller was reading, accept is refused (no POST) and the widget refetches so they can review the documents that are now in force. `version` may be `null` when the org's requirement is `NOT_REQUIRED`; that value is posted through and ignored by the gateway so invitees in those orgs can still activate. When you pass the invite credential, the disclosures lookup can reject a revoked/expired invite before activation. The accept is one transaction: it activates the invitee and records disclosure acceptance together, so a failed second hop cannot leave an `ACTIVE` user with no acceptance on record. After accept succeeds, the widget awaits any async `onAccepted` continuation, then kicks a widget-init refresh so host gates keyed on `INVITED` — or on the disclosure flags — can clear. Accept and `onAccepted` failures are handled separately — a rejected host continuation does not look like (or re-run) a failed gateway accept. The refresh is fire-and-forget and runs only after `onAccepted` settles — hosts that unmount this widget when status leaves `INVITED` would otherwise hide a rejected continuation. Auth uses the normal `widgetToken` provider contract — **never** pass an application (APP) / M2M bearer as `widgetToken`. In the invite flow, the host passes `invitationToken` and `userId` from the invite link; this widget does not read URL search params.
+Accept posts `POST /api/widget-gateway/disclosure-acceptance` with the version that was on screen, after a second `GET /identity/v1/disclosures` confirms that version is still in force (hosts rewrite that onto `/api/widget-gateway/proxy/identity/v1/disclosures` the same way as other identity calls — do not call the generated catch-all proxy helper, which percent-encodes path slashes and surfaces as a browser CORS error). If a newer version was published while the caller was reading, accept is refused (no POST) and the widget refetches so they can review the documents that are now in force. `version` may be `null` when the org's requirement is `NOT_REQUIRED`; that value is posted through and ignored by the gateway so invitees in those orgs can still activate. The accept is one transaction: it activates the invitee (when they are still invited) and records disclosure acceptance together, so a failed second hop cannot leave an `ACTIVE` user with no acceptance on record. After accept succeeds, the widget awaits any async `onAccepted` continuation, then kicks a widget-init refresh so host gates keyed on `INVITED` — or on the disclosure flags — can clear. Accept and `onAccepted` failures are handled separately — a rejected host continuation does not look like (or re-run) a failed gateway accept. The refresh is fire-and-forget and runs only after `onAccepted` settles — hosts that unmount this widget when status leaves `INVITED` would otherwise hide a rejected continuation. Auth uses the normal `widgetToken` provider contract — **never** pass an application (APP) / M2M bearer as `widgetToken`. This widget does not take invite-link credentials and does not read URL search params.
 
 A failed disclosures fetch renders an error surface with retry instead of a blank INVITED screen. The widget otherwise renders nothing until the disclosures fetch resolves **and** init resolves a `bankName` — it never substitutes another tenant's legal copy, and never falls back to a Tesouro-hosted document (a published embeddable library must not depend on infrastructure a consumer's content-security policy cannot see). An empty document list (`requirement: NOT_REQUIRED`, `version: null`) is a resolved payload, not missing data: the widget still renders Accept so those invitees can activate. Agreement copy names the returned document titles, in backend order, so the sentence cannot list instruments the links do not show. If init omits `vspName`, provider attribution falls back to the bank name so the sentence remains complete.
 
@@ -201,11 +201,6 @@ Once the atomic accept _and_ any async `onAccepted` continuation succeed, the ch
 
 #### Props
 
-| Prop              | Type     | Default     | Description                                                                                                      |
-| ----------------- | -------- | ----------- | ---------------------------------------------------------------------------------------------------------------- |
-| `invitationToken` | `string` | `undefined` | Invitation token from the invite link (`code` query param). Bound into the disclosures lookup before activation. |
-| `userId`          | `string` | `undefined` | Invited user id from the invite link (`userId` query param). Paired with `invitationToken`.                      |
-
 | Prop              | Type                                     | Default | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | ----------------- | ---------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `labels`          | `Partial<AcceptDisclosuresWidgetLabels>` | —       | Override shell copy (title, Accept, agreement/attribution templates). `{documents}` in `agreementTextTemplate` is replaced with the backend-returned titles; a template that omits `{documents}` still has those titles appended. When the backend returns no documents, `noDocumentsTitle` / `noDocumentsAgreementTextTemplate` / `noDocumentsAgreementCheckboxAriaLabel` replace the disclosures copy (including the checkbox `aria-label`). Document titles themselves are not overridable. |

package/dist/experimental/WidgetSuite.d.ts

@@ -618,11 +618,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/experimental/index.d.ts

@@ -618,11 +618,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/index.css

@@ -846,6 +846,9 @@
   .ttw\:h-auto {
     height: auto;
   }
+  .ttw\:h-auto\! {
+    height: auto !important;
+  }
   .ttw\:h-full {
     height: 100%;
   }
@@ -2906,6 +2909,9 @@
   .ttw\:pt-1 {
     padding-top: var(--ttw-spacing);
   }
+  .ttw\:pt-1\.5 {
+    padding-top: calc(var(--ttw-spacing) * 1.5);
+  }
   .ttw\:pt-2 {
     padding-top: calc(var(--ttw-spacing) * 2);
   }
@@ -5226,6 +5232,12 @@
     -webkit-box-orient: vertical;
     -webkit-line-clamp: 1;
   }
+  :is(.ttw\:\*\:data-\[slot\=select-value\]\:line-clamp-none > *)[data-slot="select-value"] {
+    overflow: visible;
+    display: block;
+    -webkit-box-orient: horizontal;
+    -webkit-line-clamp: unset;
+  }
   :is(.ttw\:\*\:data-\[slot\=select-value\]\:flex > *)[data-slot="select-value"] {
     display: flex;
   }

package/dist/index.d.ts

@@ -1012,10 +1012,10 @@ interface RootWidgetProviderProps extends WidgetProviderBaseProps {
      */
     unstable_initResponseOverride?: WidgetInitResponse;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials) so gated widgets have somewhere to accept. Cascades to
-     * nested WidgetProviders.
+     * Accept surface shown when the caller owes disclosures — INVITED or
+     * an ACTIVE user who owes a new version. Pass `<AcceptDisclosuresWidget />`
+     * so gated widgets have somewhere to accept. Cascades to nested
+     * WidgetProviders.
      */
     disclosuresAcceptance?: ReactNode;
 }
@@ -1096,11 +1096,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }
@@ -1282,9 +1282,9 @@ declare function useWidgetConfig(): WidgetConfig;
  */
 declare function useOwnWidgetConfig(): WidgetConfigInput | null;
 /**
- * Host-supplied AcceptDisclosuresWidget (or equivalent) for ACTIVE users who
- * owe a new disclosure version. `undefined` outside a provider or when the
- * host has not passed `disclosuresAcceptance`.
+ * Host-supplied AcceptDisclosuresWidget (or equivalent) for callers who
+ * owe disclosures. `undefined` outside a provider or when the host has
+ * not passed `disclosuresAcceptance`.
  */
 declare function useDisclosuresAcceptanceSurface(): ReactNode | undefined;
 /**
@@ -1466,23 +1466,6 @@ interface AcceptDisclosuresLinks {
 
 type UiOwnedProps = 'providerAttribution' | 'agreementText' | 'disclosureLinks' | 'isAgreed' | 'onAgreedChange' | 'onAccept' | 'isSubmitting' | 'isAccepted' | 'errorMessage';
 type InnerProps = Omit<AcceptDisclosuresWidgetProps$1, UiOwnedProps> & {
-    /**
-     * Invitation token from the invite link. Bound into the disclosures lookup
-     * before activation, and used to remount consent state when the invite
-     * changes. This widget does not read URL search params.
-     *
-     * Supply it (with {@link userId}) for the invite flow. Omit both for an
-     * already-active user re-accepting a newly published version — they hold no
-     * invite, and the widget token identifies them on both calls. See
-     * `useAcceptWidgetDisclosures`.
-     */
-    invitationToken?: string;
-    /**
-     * Invited user id from the invite link. Paired with {@link invitationToken}
-     * for the disclosures lookup and remount identity; omitted with it outside the
-     * invite flow.
-     */
-    userId?: string;
     /**
      * Called after the atomic accept succeeds and before init refresh is kicked.
      * May return a promise — the widget awaits it before locking controls and
@@ -1505,19 +1488,16 @@ type AcceptDisclosuresWidgetProps = WidgetProviderProps & InnerProps;
  * no document URLs. An empty document list (`NOT_REQUIRED`) still renders
  * Accept so those invitees can activate. Posts
  * `POST /api/widget-gateway/disclosure-acceptance` with the version that was
- * on screen after confirming that version is still in force (and the invite
- * still valid, when one was supplied) via the widget-gateway proxy. A newer
- * published version is refused rather than accepted unseen. The POST
- * activates the invitee and records acceptance in one transaction, then
- * awaits any `onAccepted` continuation and kicks a widget-init refresh so
- * host gates keyed on `INVITED` — or on the disclosure flags — can clear.
- * Auth uses the normal WidgetToken provider contract — never an APP/M2M
- * bearer.
+ * on screen after confirming that version is still in force via the
+ * widget-gateway proxy. A newer published version is refused rather than
+ * accepted unseen. The POST activates the invitee (when they are still
+ * invited) and records acceptance in one transaction, then awaits any
+ * `onAccepted` continuation and kicks a widget-init refresh so host gates
+ * keyed on `INVITED` — or on the disclosure flags — can clear. Auth uses
+ * the normal WidgetToken provider contract — never an APP/M2M bearer. The
+ * widget token identifies the caller on both the disclosures lookup and
+ * the accept; this widget does not take invite-link credentials.
  *
- * Two flows, one surface: the pre-auth invite flow passes `invitationToken` +
- * `userId`; an already-active user who owes a re-acceptance (widget init
- * reports `disclosuresRequired: 'REQUIRED'` with `disclosuresAccepted: false`)
- * passes neither, and the same init refresh clears the gate that mounted this.
  * See `WidgetSuite`, which mounts it as its acceptance state.
  */
 declare function AcceptDisclosuresWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, disclosuresAcceptance, ...innerProps }: AcceptDisclosuresWidgetProps): React.JSX.Element;

package/dist/lib/AcceptDisclosuresWidget.d.ts

@@ -704,11 +704,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }
@@ -729,23 +729,6 @@ interface AcceptDisclosuresLinks {
 
 type UiOwnedProps = 'providerAttribution' | 'agreementText' | 'disclosureLinks' | 'isAgreed' | 'onAgreedChange' | 'onAccept' | 'isSubmitting' | 'isAccepted' | 'errorMessage';
 type InnerProps = Omit<AcceptDisclosuresWidgetProps$1, UiOwnedProps> & {
-    /**
-     * Invitation token from the invite link. Bound into the disclosures lookup
-     * before activation, and used to remount consent state when the invite
-     * changes. This widget does not read URL search params.
-     *
-     * Supply it (with {@link userId}) for the invite flow. Omit both for an
-     * already-active user re-accepting a newly published version — they hold no
-     * invite, and the widget token identifies them on both calls. See
-     * `useAcceptWidgetDisclosures`.
-     */
-    invitationToken?: string;
-    /**
-     * Invited user id from the invite link. Paired with {@link invitationToken}
-     * for the disclosures lookup and remount identity; omitted with it outside the
-     * invite flow.
-     */
-    userId?: string;
     /**
      * Called after the atomic accept succeeds and before init refresh is kicked.
      * May return a promise — the widget awaits it before locking controls and
@@ -768,19 +751,16 @@ type AcceptDisclosuresWidgetProps = WidgetProviderProps & InnerProps;
  * no document URLs. An empty document list (`NOT_REQUIRED`) still renders
  * Accept so those invitees can activate. Posts
  * `POST /api/widget-gateway/disclosure-acceptance` with the version that was
- * on screen after confirming that version is still in force (and the invite
- * still valid, when one was supplied) via the widget-gateway proxy. A newer
- * published version is refused rather than accepted unseen. The POST
- * activates the invitee and records acceptance in one transaction, then
- * awaits any `onAccepted` continuation and kicks a widget-init refresh so
- * host gates keyed on `INVITED` — or on the disclosure flags — can clear.
- * Auth uses the normal WidgetToken provider contract — never an APP/M2M
- * bearer.
+ * on screen after confirming that version is still in force via the
+ * widget-gateway proxy. A newer published version is refused rather than
+ * accepted unseen. The POST activates the invitee (when they are still
+ * invited) and records acceptance in one transaction, then awaits any
+ * `onAccepted` continuation and kicks a widget-init refresh so host gates
+ * keyed on `INVITED` — or on the disclosure flags — can clear. Auth uses
+ * the normal WidgetToken provider contract — never an APP/M2M bearer. The
+ * widget token identifies the caller on both the disclosures lookup and
+ * the accept; this widget does not take invite-link credentials.
  *
- * Two flows, one surface: the pre-auth invite flow passes `invitationToken` +
- * `userId`; an already-active user who owes a re-acceptance (widget init
- * reports `disclosuresRequired: 'REQUIRED'` with `disclosuresAccepted: false`)
- * passes neither, and the same init refresh clears the gate that mounted this.
  * See `WidgetSuite`, which mounts it as its acceptance state.
  */
 declare function AcceptDisclosuresWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, disclosuresAcceptance, ...innerProps }: AcceptDisclosuresWidgetProps): React.JSX.Element;

package/dist/lib/BalancesWidget.d.ts

@@ -610,11 +610,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/BankAccountOnboardingWidget.d.ts

@@ -856,11 +856,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/BankAccountsWidget.d.ts

@@ -628,11 +628,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/BillPayWidget.d.ts

@@ -740,11 +740,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/CardDetailsWidget.d.ts

@@ -659,11 +659,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/CardsWidget.d.ts

@@ -678,11 +678,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/ChartOfAccountsWidget.d.ts

@@ -836,11 +836,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/CounterpartsWidget.d.ts

@@ -589,11 +589,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/CreateCardWidget.d.ts

@@ -650,11 +650,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/ExpenseApprovalPoliciesWidget.d.ts

@@ -589,11 +589,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/ExpenseManagementWidget.d.ts

@@ -598,11 +598,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/ExpenseRequirementsWidget.d.ts

@@ -589,11 +589,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }

package/dist/lib/HelpWidget.d.ts

@@ -673,11 +673,11 @@ interface WidgetProviderProps extends WidgetProviderBaseProps {
      */
     onError?: (error: unknown, info: ErrorInfo) => void;
     /**
-     * Accept surface shown when an ACTIVE user owes a new disclosure version.
-     * Pass `<AcceptDisclosuresWidget disclosureLinks={…} />` (no invite
-     * credentials). Cascades like `linkComponent`. Omit on INVITED — that
-     * path still uses invite-link `invitationToken`/`userId` on the host
-     * landing page. WidgetProvider cannot import the widget itself (cycle).
+     * Accept surface shown when the caller owes disclosures — an INVITED
+     * teammate (including `NOT_REQUIRED` orgs, who still need Accept to
+     * activate) or an ACTIVE user who owes a new version. Pass
+     * `<AcceptDisclosuresWidget />`. Cascades like `linkComponent`.
+     * WidgetProvider cannot import the widget itself (cycle).
      */
     disclosuresAcceptance?: ReactNode;
 }