@thunderid/browser 1.0.7 → 1.2.0

package/dist/cjs/index.cjs

@@ -40,19 +40,12 @@ const ERROR = "error";
 const ERROR_DESCRIPTION = "error_description";
 const CUSTOM_GRANT_CONFIG = "custom_grant_config";
 const STATE_QUERY = "state";
-const OP_IFRAME = "opIFrame";
-const RP_IFRAME = "rpIFrame";
-const PROMPT_NONE_IFRAME = "promptNoneIFrame";
-const STATE = "Y2hlY2tTZXNzaW9u";
 const SILENT_SIGN_IN_STATE = "sign-in-silently";
-const INITIALIZED_SILENT_SIGN_IN = "initialized-silent-sign-in";
-const PROMPT_NONE_REQUEST_SENT = "promptNoneRequestSent";
 const ACCESS_TOKEN_INVALID = "Access token is invalid";
 const REFRESH_ACCESS_TOKEN_ERR0R = "refresh-access-token-error";
 const TOKEN_REQUEST_CONFIG_KEY = "token_request_config";
-const CHECK_SESSION_SIGNED_IN = "check_session_signed_in";
-const CHECK_SESSION_SIGNED_OUT = "check_session_signed_out";
-const SET_SESSION_STATE_FROM_IFRAME = "set_session_state_from_iframe";
+const SILENT_SIGN_IN_SIGNED_IN = "silent_sign_in_signed_in";
+const SILENT_SIGN_IN_SIGNED_OUT = "silent_sign_in_signed_out";
 
 //#endregion
 //#region src/FetchHttpClient.ts
@@ -290,13 +283,6 @@ var SPAUtils = class SPAUtils {
 		return false;
 	}
 	/**
-	* Returns `true` if a silent sign-in was previously initialized in this session.
-	*/
-	static wasSilentSignInCalled() {
-		const raw = sessionStorage.getItem(INITIALIZED_SILENT_SIGN_IN);
-		return Boolean(raw ? JSON.parse(raw) : null);
-	}
-	/**
 	* Checks whether the current URL indicates a successful sign-out redirect.
 	* Clears the query string and session data if `true`.
 	*
@@ -359,21 +345,6 @@ var SPAUtils = class SPAUtils {
 		return !!urlObject.searchParams.get(ERROR) && urlObject.searchParams.get(STATE_QUERY) !== __thunderid_javascript.OIDCRequestConstants.Params.SIGN_OUT_SUCCESS;
 	}
 	/**
-	* Returns `true` if no prompt-none request has been sent yet this session.
-	*/
-	static canSendPromptNoneRequest() {
-		const raw = sessionStorage.getItem(PROMPT_NONE_REQUEST_SENT);
-		return !(raw ? JSON.parse(raw) : null);
-	}
-	/**
-	* Records whether a prompt-none request has been sent.
-	*
-	* @param canSend - `true` marks the request as sent.
-	*/
-	static setPromptNoneRequestSent(canSend) {
-		sessionStorage.setItem(PROMPT_NONE_REQUEST_SENT, JSON.stringify(canSend));
-	}
-	/**
 	* Waits until the browser has redirected (non-blocking delay).
 	*
 	* @param time - Time to wait in seconds (default: 3).
@@ -402,7 +373,7 @@ var SPAUtils_default = SPAUtils;
 //#region src/utils/AuthenticationHelper.ts
 /**
 * Browser-level authentication helper that orchestrates HTTP requests with token attachment,
-* automatic token refresh, session management, and the silent sign-in flow.
+* automatic token refresh, and the silent sign-in flow.
 *
 * @typeParam T - The browser client config extension type.
 */
@@ -462,18 +433,6 @@ var AuthenticationHelper = class {
 		httpClient?.disableHandler && httpClient.disableHandler();
 	}
 	/**
-	* Initializes OIDC Session Management via an RP iframe.
-	*
-	* @param config - The current auth config.
-	* @param oidcEndpoints - Resolved OIDC provider endpoints.
-	* @param getSessionState - Returns the current session state from storage.
-	* @param getAuthzURL - Builds an authorization URL with optional params.
-	* @param sessionManagementHelper - The session management helper instance.
-	*/
-	initializeSessionManger(config, oidcEndpoints, getSessionState, getAuthzURL, sessionManagementHelper) {
-		sessionManagementHelper.initialize(config.clientId, oidcEndpoints.checkSessionIframe ?? "", getSessionState, config.checkSessionInterval ?? 3, config.sessionRefreshInterval ?? 300, config.afterSignInUrl, getAuthzURL);
-	}
-	/**
 	* Executes a custom token exchange grant, enforcing `allowedExternalUrls` rules when applicable.
 	*
 	* @param config - The token exchange configuration.
@@ -643,76 +602,96 @@ var AuthenticationHelper = class {
 		});
 	}
 	/**
-	* Executes the silent sign-in flow using a prompt-none request via an iFrame.
+	* Executes the silent sign-in flow by loading a `prompt=none` authorize request in a hidden iframe.
 	*
 	* @param constructSilentSignInUrl - Builds the prompt-none authorize URL.
 	* @param requestAccessToken - Exchanges the returned code for tokens.
-	* @param sessionManagementHelper - Handles the iFrame prompt-none response.
 	* @param additionalParams - Extra authorize request params.
 	* @param tokenRequestConfig - Additional params for the token request.
 	* @returns The user session, or `false` if the user is not signed in.
 	*/
-	async signInSilently(constructSilentSignInUrl, requestAccessToken, sessionManagementHelper, additionalParams, tokenRequestConfig) {
+	async signInSilently(constructSilentSignInUrl, requestAccessToken, additionalParams, tokenRequestConfig) {
 		if (SPAUtils_default.isInitializedSilentSignIn()) {
-			await sessionManagementHelper.receivePromptNoneResponse();
+			await this.handleSilentSignInResponse();
 			return Promise.resolve({
 				allowedScopes: "",
 				displayName: "",
 				email: "",
-				sessionState: "",
 				sub: "",
 				tenantDomain: "",
 				username: ""
 			});
 		}
-		const promptNoneIFrame = document.getElementById(RP_IFRAME)?.contentDocument?.getElementById(PROMPT_NONE_IFRAME);
+		let url;
 		try {
-			promptNoneIFrame.src = await constructSilentSignInUrl(additionalParams);
+			url = await constructSilentSignInUrl(additionalParams);
 		} catch (error) {
 			return Promise.reject(error);
 		}
+		const silentSignInIFrame = document.createElement("iframe");
+		silentSignInIFrame.style.display = "none";
 		return new Promise((resolve, reject) => {
+			const cleanUp = () => {
+				window.removeEventListener("message", listenToSilentSignInIFrame);
+				clearTimeout(timer);
+				silentSignInIFrame.remove();
+			};
 			const timer = setTimeout(() => {
+				cleanUp();
 				resolve(false);
 			}, 1e4);
-			const listenToPromptNoneIFrame = async (e) => {
+			const listenToSilentSignInIFrame = async (e) => {
+				if (e.origin !== window.location.origin || e.source !== silentSignInIFrame.contentWindow) return;
 				const data = e.data;
-				if (data?.type == CHECK_SESSION_SIGNED_OUT) {
-					window.removeEventListener("message", listenToPromptNoneIFrame);
-					clearTimeout(timer);
+				if (data?.type === SILENT_SIGN_IN_SIGNED_OUT) {
+					cleanUp();
 					resolve(false);
 				}
-				if (data?.type == CHECK_SESSION_SIGNED_IN && data?.data?.code) {
+				if (data?.type === SILENT_SIGN_IN_SIGNED_IN && data?.data?.code) {
 					const authInfo = data.data;
-					requestAccessToken(authInfo.code, authInfo.sessionState, authInfo.state, tokenRequestConfig).then((response) => {
-						window.removeEventListener("message", listenToPromptNoneIFrame);
-						resolve(response);
-					}).catch((error) => {
-						window.removeEventListener("message", listenToPromptNoneIFrame);
-						reject(error);
-					}).finally(() => {
-						clearTimeout(timer);
-					});
+					cleanUp();
+					requestAccessToken(authInfo.code, authInfo.state, tokenRequestConfig).then(resolve).catch(reject);
 				}
 			};
-			window.addEventListener("message", listenToPromptNoneIFrame);
+			window.addEventListener("message", listenToSilentSignInIFrame);
+			silentSignInIFrame.src = url;
+			document.body.appendChild(silentSignInIFrame);
 		});
 	}
 	/**
+	* Handles the page load inside the silent sign-in iframe: relays the authorization response to the
+	* parent window and blanks the iframe.
+	*
+	* @returns `true` if the current page load was a silent sign-in response.
+	*/
+	async handleSilentSignInResponse() {
+		const url = new URL(window.location.href);
+		const state = url.searchParams.get(STATE_QUERY);
+		if (state === null || !state.includes(SILENT_SIGN_IN_STATE)) return false;
+		const code$1 = url.searchParams.get("code");
+		const message = code$1 !== null && code$1.length !== 0 ? {
+			data: {
+				code: code$1,
+				state
+			},
+			type: SILENT_SIGN_IN_SIGNED_IN
+		} : { type: SILENT_SIGN_IN_SIGNED_OUT };
+		window.parent.postMessage(message, window.location.origin);
+		window.location.href = "about:blank";
+		await SPAUtils_default.waitTillPageRedirect();
+		return true;
+	}
+	/**
 	* Handles the early-return path of `signIn()` when a session already exists
-	* or the page is handling a prompt-none response.
+	* or the page is handling a silent sign-in response.
 	*
-	* @param shouldStopAuthn - Returns `true` if we should short-circuit and return early.
-	* @param checkSession - Callback to initialize OIDC session management.
 	* @returns The current user if already signed in, or `undefined` to continue normal sign-in.
 	*/
-	async handleSignIn(shouldStopAuthn, checkSession) {
-		const configAny = await this._storageManager.getConfigData();
-		if (await shouldStopAuthn()) return Promise.resolve({
+	async handleSignIn() {
+		if (await this.handleSilentSignInResponse()) return Promise.resolve({
 			allowedScopes: "",
 			displayName: "",
 			email: "",
-			sessionState: "",
 			sub: "",
 			tenantDomain: "",
 			username: ""
@@ -720,7 +699,6 @@ var AuthenticationHelper = class {
 		if (await this._isSignedIn()) {
 			await this._spaHelper.clearRefreshTokenTimeout();
 			await this._spaHelper.refreshAccessTokenAutomatically(() => this.refreshAccessToken());
-			if (configAny.syncSession) checkSession();
 			return Promise.resolve(await this._getUser());
 		}
 		const error = new URL(window.location.href).searchParams.get(ERROR);
@@ -838,164 +816,6 @@ const navigate = (url) => {
 };
 var navigate_default = navigate;
 
-//#endregion
-//#region src/utils/SessionManagementHelper.ts
-/**
-* Factory that creates an OIDC Session Management helper using an RP iframe and polling.
-* Appends a hidden RP iframe to the document and returns the helper interface.
-*
-* @param signOut - Returns the sign-out URL for the current session.
-* @param setSessionState - Stores a new session state from a prompt-none response.
-* @returns A `SessionManagementHelperInterface` instance.
-*/
-const createSessionManagementHelper = async (signOut, setSessionState) => {
-	let _clientID;
-	let _checkSessionEndpoint;
-	let _sessionState;
-	let _interval;
-	let _redirectURL;
-	let _sessionRefreshInterval;
-	let _sessionRefreshIntervalTimeout;
-	let _checkSessionIntervalTimeout;
-	let _getSignInUrl;
-	const initialize = (clientId, checkSessionEndpoint, getSessionState, interval, sessionRefreshInterval, redirectURL, getSignInUrl) => {
-		_clientID = clientId;
-		_checkSessionEndpoint = checkSessionEndpoint;
-		_sessionState = getSessionState;
-		_interval = interval;
-		_redirectURL = redirectURL;
-		_sessionRefreshInterval = sessionRefreshInterval;
-		_getSignInUrl = getSignInUrl;
-		if (_interval > -1) initiateCheckSession();
-		if (_sessionRefreshInterval > -1) _sessionRefreshIntervalTimeout = setInterval(() => {
-			sendPromptNoneRequest();
-		}, _sessionRefreshInterval * 1e3);
-	};
-	const initiateCheckSession = async () => {
-		if (!_checkSessionEndpoint || !_clientID || !_redirectURL) return;
-		async function checkSession() {
-			const sessionState = await _sessionState();
-			if (Boolean(_clientID) && Boolean(sessionState)) {
-				const message = `${_clientID} ${sessionState}`;
-				(document.getElementById(RP_IFRAME)?.contentDocument?.getElementById(OP_IFRAME)).contentWindow?.postMessage(message, _checkSessionEndpoint);
-			}
-		}
-		const opIframe = document.getElementById(RP_IFRAME)?.contentDocument?.getElementById(OP_IFRAME);
-		opIframe.src = _checkSessionEndpoint + "?client_id=" + _clientID + "&redirect_uri=" + _redirectURL;
-		_checkSessionIntervalTimeout = setInterval(checkSession, _interval * 1e3);
-		listenToResponseFromOPIFrame();
-	};
-	const reset = () => {
-		clearInterval(_checkSessionIntervalTimeout);
-		clearInterval(_sessionRefreshIntervalTimeout);
-	};
-	const listenToResponseFromOPIFrame = () => {
-		async function receiveMessage(e) {
-			const targetOrigin = _checkSessionEndpoint;
-			if (!targetOrigin || targetOrigin?.indexOf(e.origin) < 0 || e?.data?.type === SET_SESSION_STATE_FROM_IFRAME) return;
-			if (e.data === "unchanged") {} else if (e.data === "error") window.location.href = await signOut();
-			else if (e.data === "changed") sendPromptNoneRequest();
-		}
-		window?.addEventListener("message", receiveMessage, false);
-	};
-	const sendPromptNoneRequest = async () => {
-		const promptNoneIFrame = document.getElementById(RP_IFRAME)?.contentDocument?.getElementById(PROMPT_NONE_IFRAME);
-		if (SPAUtils_default.canSendPromptNoneRequest()) {
-			SPAUtils_default.setPromptNoneRequestSent(true);
-			const receiveMessageListener = (e) => {
-				if (e?.data?.type === SET_SESSION_STATE_FROM_IFRAME) {
-					setSessionState(e?.data?.data ?? "");
-					window?.removeEventListener("message", receiveMessageListener);
-				}
-			};
-			window?.addEventListener("message", receiveMessageListener);
-			promptNoneIFrame.src = await _getSignInUrl({
-				prompt: "none",
-				response_mode: "query",
-				state: STATE
-			});
-		}
-	};
-	const receivePromptNoneResponse = async (setSessionStateFn) => {
-		const state = new URL(window.location.href).searchParams.get(STATE_QUERY);
-		const sessionState = new URL(window.location.href).searchParams.get(__thunderid_javascript.OIDCRequestConstants.Params.SESSION_STATE);
-		const parent = window.parent.parent;
-		if (state !== null && (state.includes(STATE) || state.includes(SILENT_SIGN_IN_STATE))) {
-			const code$1 = new URL(window.location.href).searchParams.get("code");
-			if (code$1 !== null && code$1.length !== 0) {
-				if (state.includes(SILENT_SIGN_IN_STATE)) {
-					const message = {
-						data: {
-							code: code$1,
-							sessionState: sessionState ?? "",
-							state
-						},
-						type: CHECK_SESSION_SIGNED_IN
-					};
-					sessionStorage.setItem(INITIALIZED_SILENT_SIGN_IN, "false");
-					parent.postMessage(message, parent.origin);
-					SPAUtils_default.setPromptNoneRequestSent(false);
-					window.location.href = "about:blank";
-					await SPAUtils_default.waitTillPageRedirect();
-					return true;
-				}
-				const newSessionState = new URL(window.location.href).searchParams.get("session_state");
-				setSessionStateFn && await setSessionStateFn(newSessionState);
-				SPAUtils_default.setPromptNoneRequestSent(false);
-				window.location.href = "about:blank";
-				await SPAUtils_default.waitTillPageRedirect();
-				return true;
-			} else {
-				if (state.includes(SILENT_SIGN_IN_STATE)) {
-					const message = { type: CHECK_SESSION_SIGNED_OUT };
-					window.parent.parent.postMessage(message, parent.origin);
-					SPAUtils_default.setPromptNoneRequestSent(false);
-					window.location.href = "about:blank";
-					await SPAUtils_default.waitTillPageRedirect();
-					return true;
-				}
-				SPAUtils_default.setPromptNoneRequestSent(false);
-				const signOutURL = await signOut();
-				parent.location.href = signOutURL;
-				window.location.href = "about:blank";
-				await SPAUtils_default.waitTillPageRedirect();
-				return true;
-			}
-		}
-		return false;
-	};
-	let rpIFrame = document.createElement("iframe");
-	rpIFrame.setAttribute("id", RP_IFRAME);
-	rpIFrame.style.display = "none";
-	let rpIframeLoaded = false;
-	rpIFrame.onload = () => {
-		rpIFrame = document.getElementById(RP_IFRAME);
-		const rpDoc = rpIFrame?.contentDocument;
-		const opIFrame = rpDoc?.createElement("iframe");
-		if (opIFrame) {
-			opIFrame.setAttribute("id", OP_IFRAME);
-			opIFrame.style.display = "none";
-		}
-		const promptNoneIFrame = rpDoc?.createElement("iframe");
-		if (promptNoneIFrame) {
-			promptNoneIFrame.setAttribute("id", PROMPT_NONE_IFRAME);
-			promptNoneIFrame.style.display = "none";
-		}
-		opIFrame && rpIFrame?.contentDocument?.body?.appendChild(opIFrame);
-		promptNoneIFrame && rpIFrame?.contentDocument?.body?.appendChild(promptNoneIFrame);
-		rpIframeLoaded = true;
-	};
-	document?.body?.appendChild(rpIFrame);
-	const sleep = () => new Promise((resolve) => setTimeout(resolve, 1));
-	while (!rpIframeLoaded) await sleep();
-	return {
-		initialize,
-		receivePromptNoneResponse,
-		reset
-	};
-};
-var SessionManagementHelper_default = createSessionManagementHelper;
-
 //#endregion
 //#region ../../node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js
 var require_base64_js = /* @__PURE__ */ __commonJS({ "../../node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js": ((exports) => {
@@ -2598,10 +2418,7 @@ var SPAHelper_default = SPAHelper;
 const logger$2 = (0, __thunderid_javascript.createPackageComponentLogger)("@thunderid/browser", "ThunderIDBrowserClient");
 const BROWSER_DEFAULT_CONFIG = {
 	autoLogoutOnTokenRefreshError: false,
-	checkSessionInterval: 3,
-	periodicTokenRefresh: false,
-	sessionRefreshInterval: 300,
-	syncSession: false
+	periodicTokenRefresh: false
 };
 const initiateStore = (storage) => {
 	switch (storage) {
@@ -2616,7 +2433,6 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 	_browserInstanceId = 0;
 	_httpClient;
 	_spaHelper;
-	_sessionManagementHelper;
 	_authHelper;
 	_storage = BrowserStorage_default.SessionStorage;
 	_getSignOutURLFromSessionStorage = false;
@@ -2655,7 +2471,6 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 			await this._authHelper?.attachTokenToRequestConfig(request);
 		};
 		this._httpClient = FetchHttpClient_default.getInstance(this._browserInstanceId, true, attachToken);
-		this._sessionManagementHelper = await SessionManagementHelper_default(async () => this.getSignOutUrl(), (sessionState) => sm.setSessionDataParameter(__thunderid_javascript.OIDCRequestConstants.Params.SESSION_STATE, sessionState));
 		this._authHelper = new AuthenticationHelper_default(sm, this._spaHelper, this._browserInstanceId, {
 			exchangeToken: (cfg) => super.exchangeToken(cfg),
 			getAccessToken: (sessionId) => this.getAccessToken(sessionId),
@@ -2696,30 +2511,27 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 	isLoading() {
 		return false;
 	}
-	async signIn(config, authorizationCode, sessionState, state, tokenRequestConfig) {
+	async signIn(config, authorizationCode, state, tokenRequestConfig) {
 		await this.isInitialized();
 		if (!SPAUtils_default.canContinueSignIn(Boolean(config?.callOnlyOnRedirect), authorizationCode)) return;
 		delete config?.callOnlyOnRedirect;
-		const user = await this._signInInternal(config, authorizationCode, sessionState, state, tokenRequestConfig);
+		const user = await this._signInInternal(config, authorizationCode, state, tokenRequestConfig);
 		if (user && this._onSignInCallback) this._onSignInCallback(user);
 		return user;
 	}
-	async _signInInternal(signInConfig, authorizationCode, sessionState, state, tokenRequestConfig) {
+	async _signInInternal(signInConfig, authorizationCode, state, tokenRequestConfig) {
 		const sm = this.getStorageManager();
 		const config = await sm.getConfigData();
-		const basicUserInfo = await this._authHelper.handleSignIn(() => this._shouldStopAuthn(), () => this._checkSession());
+		const basicUserInfo = await this._authHelper.handleSignIn();
 		if (basicUserInfo) return basicUserInfo;
 		let resolvedAuthorizationCode;
-		let resolvedSessionState;
 		let resolvedState;
 		let resolvedTokenRequestConfig = { params: {} };
 		if (config?.responseMode === "form_post" && authorizationCode) {
 			resolvedAuthorizationCode = authorizationCode;
-			resolvedSessionState = sessionState ?? "";
 			resolvedState = state ?? "";
 		} else {
 			resolvedAuthorizationCode = new URL(window.location.href).searchParams.get(__thunderid_javascript.OIDCRequestConstants.Params.AUTHORIZATION_CODE) ?? "";
-			resolvedSessionState = new URL(window.location.href).searchParams.get(__thunderid_javascript.OIDCRequestConstants.Params.SESSION_STATE) ?? "";
 			resolvedState = new URL(window.location.href).searchParams.get(__thunderid_javascript.OIDCRequestConstants.Params.STATE) ?? "";
 			SPAUtils_default.removeAuthorizationCode();
 		}
@@ -2727,7 +2539,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 			sm.setSessionStatus("true");
 			const storedTokenRequestConfig = await sm.getTemporaryDataParameter(TOKEN_REQUEST_CONFIG_KEY);
 			if (storedTokenRequestConfig && typeof storedTokenRequestConfig === "string") resolvedTokenRequestConfig = JSON.parse(storedTokenRequestConfig);
-			return this._exchangeCodeForTokens(resolvedAuthorizationCode, resolvedSessionState, resolvedState, resolvedTokenRequestConfig);
+			return this._exchangeCodeForTokens(resolvedAuthorizationCode, resolvedState, resolvedTokenRequestConfig);
 		}
 		return this.getSignInUrl(signInConfig).then(async (url) => {
 			if (this._storage === BrowserStorage_default.BrowserMemory && config.enablePKCE) {
@@ -2741,34 +2553,32 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 				allowedScopes: "",
 				displayName: "",
 				email: "",
-				sessionState: "",
 				sub: "",
 				tenantDomain: "",
 				username: ""
 			};
 		});
 	}
-	async _exchangeCodeForTokens(authorizationCode, sessionState, state, tokenRequestConfig) {
+	async _exchangeCodeForTokens(authorizationCode, state, tokenRequestConfig) {
 		const config = await this.getStorageManager().getConfigData();
-		if (this._storage === BrowserStorage_default.BrowserMemory && config.enablePKCE && sessionState) {
-			const pkceKey = (0, __thunderid_javascript.extractPkceStorageKeyFromState)(sessionState);
+		if (this._storage === BrowserStorage_default.BrowserMemory && config.enablePKCE && state) {
+			const pkceKey = (0, __thunderid_javascript.extractPkceStorageKeyFromState)(state);
 			const pkce = SPAUtils_default.getPKCE(pkceKey);
 			await this.setPKCECode(pkce, pkceKey);
 		}
-		await this.requestAccessToken(authorizationCode, sessionState ?? "", state ?? "", void 0, tokenRequestConfig);
+		await this.requestAccessToken(authorizationCode, state ?? "", void 0, tokenRequestConfig);
 		try {
 			const signOutUrl = await this.getSignOutUrl();
 			SPAUtils_default.setSignOutURL(signOutUrl, config.clientId, this._browserInstanceId);
 		} catch {}
 		await this._spaHelper.clearRefreshTokenTimeout();
 		await this._spaHelper.refreshAccessTokenAutomatically(() => this.refreshAccessToken());
-		if (config.syncSession) this._checkSession();
 		return this.getUser();
 	}
 	async signInSilently(additionalParams, tokenRequestConfig) {
 		await this.isInitialized();
 		if (SPAUtils_default.wasSignInCalled()) return;
-		const response = await this._authHelper.signInSilently((params) => this._constructSilentSignInUrl(params), (code$1, ss, s, trc) => this._exchangeCodeForTokens(code$1, ss, s, trc), this._sessionManagementHelper, additionalParams, tokenRequestConfig);
+		const response = await this._authHelper.signInSilently((params) => this._constructSilentSignInUrl(params), (code$1, s, trc) => this._exchangeCodeForTokens(code$1, s, trc), additionalParams, tokenRequestConfig);
 		if (this._onSignInCallback && response) this._onSignInCallback(response);
 		return response;
 	}
@@ -2867,7 +2677,6 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 		await this._validateMethod();
 		const timer = await this._spaHelper.getRefreshTimeoutTimer();
 		await super.revokeAccessToken(userId);
-		this._sessionManagementHelper?.reset();
 		await this._spaHelper.clearRefreshTokenTimeout(timer);
 		this._onEndUserSession && await this._onEndUserSession(true);
 		return true;
@@ -2881,17 +2690,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 	}
 	async reInitialize(config) {
 		await this.isInitialized();
-		const existingConfig = await this.getStorageManager().getConfigData();
-		const isCheckSessionIframeDifferent = !(existingConfig?.endpoints?.checkSessionIframe && config?.endpoints?.checkSessionIframe && existingConfig.endpoints.checkSessionIframe === config.endpoints.checkSessionIframe);
-		const result = await super.reInitialize(config);
-		if ({
-			...existingConfig,
-			...config
-		}.syncSession && isCheckSessionIframeDifferent) {
-			this._sessionManagementHelper?.reset();
-			this._checkSession();
-		}
-		return result;
+		return super.reInitialize(config);
 	}
 	async startAutoRefreshToken() {
 		await this.isInitialized();
@@ -2954,18 +2753,6 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 			default: throw new __thunderid_javascript.ThunderIDAuthException("SPA-AUTH_CLIENT-ON-IV01", "Invalid hook.", `Unknown hook: "${hook}"`);
 		}
 	}
-	async _checkSession() {
-		const oidcEndpoints = await this.getOpenIDProviderEndpoints();
-		const sm = this.getStorageManager();
-		const config = await sm.getConfigData();
-		this._authHelper.initializeSessionManger(config, oidcEndpoints, async () => (await sm.getSessionData())?.session_state ?? "", async (params) => this.getSignInUrl(params), this._sessionManagementHelper);
-	}
-	async _shouldStopAuthn() {
-		const sm = this.getStorageManager();
-		return this._sessionManagementHelper.receivePromptNoneResponse(async (sessionState) => {
-			await sm.setSessionDataParameter(__thunderid_javascript.OIDCRequestConstants.Params.SESSION_STATE, sessionState ?? "");
-		});
-	}
 	_enableRetrievingSignOutURLFromSession(config) {
 		if (config.preventSignOutURLUpdate) this._getSignOutURLFromSessionStorage = true;
 	}
@@ -3014,10 +2801,10 @@ var Hooks_default = Hooks;
 //#endregion
 //#region src/utils/hasAuthParamsInUrl.ts
 /**
-* Utility to check if `code` and `session_state` are available in the URL as search params.
+* Utility to check if `code` is available in the URL as a search param.
 *
 * @param params - The URL search params to check. Defaults to `window.location.search`.
-* @return `true` if the URL contains `code` and `session_state` search params, otherwise `false`.
+* @return `true` if the URL contains a `code` search param, otherwise `false`.
 */
 const hasAuthParamsInUrl = (params = window.location.search) => {
 	return /[?&]code=[^&]+/.test(params);
@@ -3062,6 +2849,56 @@ const http = (client) => {
 };
 var http_default = http;
 
+//#endregion
+//#region src/utils/createHttpClientFetcher.ts
+/**
+* Builds a `fetch`-shaped function backed by the shared `FetchHttpClient` singleton, for
+* framework wrappers (`@thunderid/react`, `@thunderid/vue`) that need to hand a core
+* `@thunderid/javascript` API function a `fetcher` carrying the access token automatically.
+*
+* Unlike a plain `fetch` call, `FetchHttpClient.request` throws on a non-2xx response instead
+* of resolving it. This adapter catches that and reconstructs a `Response`-shaped object from
+* the thrown error's `response`, so the core API function sees the real status and body instead
+* of treating every non-2xx result as a network failure. A genuine network error (no response
+* attached) still propagates.
+*
+* @param instanceId - Which `FetchHttpClient` instance to use, for multi-instance apps. Defaults to `0`.
+* @returns A function matching the `(url, config) => Promise<Response>` shape core API functions expect.
+* @example
+* ```typescript
+* await updateMeCredentials({
+*   ...config,
+*   fetcher: fetcher ?? createHttpClientFetcher(instanceId),
+* });
+* ```
+*/
+const createHttpClientFetcher = (instanceId = 0) => {
+	return async (url, config) => {
+		const httpClient = FetchHttpClient_default.getInstance(instanceId);
+		const toResponse = (data, status, statusText) => ({
+			json: () => Promise.resolve(data),
+			ok: status >= 200 && status < 300,
+			status,
+			statusText,
+			text: () => Promise.resolve(typeof data === "string" ? data : JSON.stringify(data))
+		});
+		try {
+			const response = await httpClient.request({
+				data: config.body ? JSON.parse(config.body) : void 0,
+				headers: config.headers,
+				method: config.method || "POST",
+				url
+			});
+			return toResponse(response.data, response.status, response.statusText || "");
+		} catch (error) {
+			const httpError = error;
+			if (httpError?.response) return toResponse(httpError.response.data, httpError.response.status, httpError.response.statusText ?? "");
+			throw error;
+		}
+	};
+};
+var createHttpClientFetcher_default = createHttpClientFetcher;
+
 //#endregion
 //#region src/utils/handleWebAuthnAuthentication.ts
 const logger$1 = (0, __thunderid_javascript.createPackageComponentLogger)("@thunderid/browser", "WebAuthn");
@@ -3903,35 +3740,28 @@ exports.AVATAR_URI_SCHEME = AVATAR_URI_SCHEME;
 exports.AuthenticationHelper = AuthenticationHelper_default;
 exports.BrowserHooks = Hooks;
 exports.BrowserStorage = BrowserStorage_default;
-exports.CHECK_SESSION_SIGNED_IN = CHECK_SESSION_SIGNED_IN;
-exports.CHECK_SESSION_SIGNED_OUT = CHECK_SESSION_SIGNED_OUT;
 exports.CUSTOM_GRANT_CONFIG = CUSTOM_GRANT_CONFIG;
 exports.ERROR = ERROR;
 exports.ERROR_DESCRIPTION = ERROR_DESCRIPTION;
 exports.FetchHttpClient = FetchHttpClient_default;
 exports.Hooks = Hooks_default;
-exports.INITIALIZED_SILENT_SIGN_IN = INITIALIZED_SILENT_SIGN_IN;
 exports.LocalStore = LocalStore_default;
 exports.MemoryStore = MemoryStore_default;
-exports.OP_IFRAME = OP_IFRAME;
-exports.PROMPT_NONE_IFRAME = PROMPT_NONE_IFRAME;
-exports.PROMPT_NONE_REQUEST_SENT = PROMPT_NONE_REQUEST_SENT;
 exports.REFRESH_ACCESS_TOKEN_ERR0R = REFRESH_ACCESS_TOKEN_ERR0R;
-exports.RP_IFRAME = RP_IFRAME;
-exports.SET_SESSION_STATE_FROM_IFRAME = SET_SESSION_STATE_FROM_IFRAME;
+exports.SILENT_SIGN_IN_SIGNED_IN = SILENT_SIGN_IN_SIGNED_IN;
+exports.SILENT_SIGN_IN_SIGNED_OUT = SILENT_SIGN_IN_SIGNED_OUT;
 exports.SILENT_SIGN_IN_STATE = SILENT_SIGN_IN_STATE;
 exports.SPACryptoUtils = SPACryptoUtils_default;
 exports.SPAHelper = SPAHelper_default;
 exports.SPAUtils = SPAUtils_default;
-exports.STATE = STATE;
 exports.STATE_QUERY = STATE_QUERY;
 exports.SessionStore = SessionStore_default;
 exports.TOKEN_REQUEST_CONFIG_KEY = TOKEN_REQUEST_CONFIG_KEY;
 exports.ThunderIDBrowserClient = ThunderIDBrowserClient_default;
 exports.buildAvatarSpec = buildAvatarSpec_default;
 exports.createClassObserver = createClassObserver;
+exports.createHttpClientFetcher = createHttpClientFetcher_default;
 exports.createMediaQueryListener = createMediaQueryListener;
-exports.createSessionManagementHelper = SessionManagementHelper_default;
 exports.deriveAvatarContent = deriveAvatarContent;
 exports.detectThemeMode = detectThemeMode;
 exports.extractAvatarParamsFromUri = extractAvatarParamsFromUri_default;