@thunderid/react 1.15.0 → 1.15.1

package/dist/ThunderIDReactClient.js

@@ -93,7 +93,7 @@ var ThunderIDReactClient = class extends ThunderIDBrowserClient {
 			if (typeof arg1 === "object" && arg1 !== null && !isEmpty(arg1) && ("executionId" in arg1 || "applicationId" in arg1)) {
 				this.rejectEmbeddedFlowInBackendMode();
 				const authIdFromUrl = new URL(window.location.href).searchParams.get("authId") ?? "";
-				const authIdFromStorage = await this.getStorageManager().getHybridDataParameter("authId") ?? "";
+				const authIdFromStorage = (arg1.executionId ? await this.getStorageManager().getFlowAuthId(arg1.executionId) : void 0) ?? "";
 				const authId = authIdFromUrl || authIdFromStorage;
 				const response = await executeEmbeddedSignInFlow({
 					authId,

package/dist/ThunderIDReactClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDReactClient.js","names":["config: ThunderIDReactConfig | undefined","isInitialized: boolean","claims: User","arg1: any","arg2: any","authIdFromUrl: string","authIdFromStorage: string","authId: string","response: EmbeddedSignInFlowResponse","decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }","createdAt: number","expiresIn: number","config: ThunderIDReactConfig","firstArg: any","baseUrl: string","response: any","decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }"],"sources":["../src/ThunderIDReactClient.ts"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDBrowserClient,\n  UserProfile,\n  SignInOptions,\n  User,\n  SignUpOptions,\n  ThunderIDRuntimeError,\n  executeEmbeddedSignInFlow,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  TokenResponse,\n  HttpRequestConfig,\n  HttpResponse,\n  TokenExchangeRequestConfig,\n  isEmpty,\n  EmbeddedSignInFlowResponse,\n  executeEmbeddedSignUpFlow,\n  executeEmbeddedRecoveryFlow,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignUpFlowResponse,\n  EmbeddedSignUpFlowStatus,\n  resolveResourceEndpoint,\n} from '@thunderid/browser';\nimport {ThunderIDReactConfig} from './models/config';\n\nclass ThunderIDReactClient<T extends ThunderIDReactConfig = ThunderIDReactConfig> extends ThunderIDBrowserClient<T> {\n  private loadingState = false;\n\n  private _initializeConfig: ThunderIDReactConfig | undefined;\n\n  constructor(instanceId = 0) {\n    super(instanceId);\n  }\n\n  private setLoading(loading: boolean): void {\n    this.loadingState = loading;\n  }\n\n  private async withLoading<TResult>(operation: () => Promise<TResult>): Promise<TResult> {\n    this.setLoading(true);\n    try {\n      const result: TResult = await operation();\n      return result;\n    } finally {\n      this.setLoading(false);\n    }\n  }\n\n  /**\n   * Returns the stored config, re-running initialization first when it has gone missing.\n   *\n   * NOTE: With React 19 strict mode, the initialization logic runs twice, and there's an intermittent\n   * issue where the config object is not getting stored in the storage layer with Vite scaffolding.\n   * An operation that resolves endpoints from a lost config fails (for example \"required endpoints\n   * are missing\"), so recover it from the config this client was initialized with.\n   */\n  private async ensureConfigData(): Promise<ThunderIDReactConfig | undefined> {\n    const config: ThunderIDReactConfig | undefined = (await this.getStorageManager().getConfigData()) as\n      | ThunderIDReactConfig\n      | undefined;\n    const isConfigLost: boolean =\n      !config || Object.keys(config).length === 0 || (Boolean(this._initializeConfig?.baseUrl) && !config.baseUrl);\n\n    if (!isConfigLost || !this._initializeConfig) {\n      return config;\n    }\n\n    await this.initialize(this._initializeConfig);\n\n    // Reload the config persisted by initialization so downstream endpoint resolution\n    // (baseUrl and the flowExecute override) uses the recovered values, not the stale empty config.\n    return (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig | undefined;\n  }\n\n  override initialize(config: ThunderIDReactConfig): Promise<boolean> {\n    return this.withLoading(async () => {\n      this._initializeConfig = {\n        ...config,\n        periodicTokenRefresh:\n          config?.tokenLifecycle?.refreshToken?.autoRefresh ?? (config as any)?.periodicTokenRefresh,\n      } as any;\n\n      return super.initialize(this._initializeConfig as unknown as T);\n    });\n  }\n\n  override reInitialize(config: Partial<ThunderIDReactConfig>): Promise<boolean> {\n    return this.withLoading(async () => {\n      let isInitialized: boolean;\n\n      try {\n        await super.reInitialize(config as Partial<T>);\n        isInitialized = true;\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Failed to check if the client is initialized: ${error instanceof Error ? error.message : String(error)}`,\n          'ThunderIDReactClient-reInitialize-RuntimeError-001',\n          'react',\n          'An error occurred while checking the initialization status of the client.',\n        );\n      }\n\n      return isInitialized;\n    });\n  }\n\n  override async updateUserProfile(): Promise<User> {\n    throw new Error('Not implemented');\n  }\n\n  override async getUser(): Promise<User> {\n    return extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n  }\n\n  override async getDecodedIdToken(sessionId?: string): Promise<IdToken> {\n    return super.getDecodedIdToken(sessionId);\n  }\n\n  override async getIdToken(): Promise<string> {\n    return this.withLoading(async () => super.getIdToken());\n  }\n\n  override async getUserProfile(): Promise<UserProfile> {\n    return this.withLoading(async () => {\n      const claims: User = extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n      return {\n        flattenedProfile: claims,\n        profile: claims,\n        schemas: [],\n      };\n    });\n  }\n\n  override isLoading(): boolean {\n    return this.loadingState || super.isLoading();\n  }\n\n  override async isSignedIn(): Promise<boolean> {\n    return super.isSignedIn();\n  }\n\n  override async exchangeToken(config: TokenExchangeRequestConfig): Promise<TokenResponse | Response> {\n    return this.withLoading(async () => super.exchangeToken(config) as unknown as TokenResponse | Response);\n  }\n\n  override async signIn(...args: any[]): Promise<User | EmbeddedSignInFlowResponse> {\n    return this.withLoading(async () => {\n      const arg1: any = args[0];\n      const arg2: any = args[1];\n\n      const config: ThunderIDReactConfig | undefined = await this.ensureConfigData();\n\n      if (typeof arg1 === 'object' && arg1 !== null && arg1.callOnlyOnRedirect === true) {\n        return undefined as any;\n      }\n\n      if (\n        typeof arg1 === 'object' &&\n        arg1 !== null &&\n        !isEmpty(arg1) &&\n        ('executionId' in arg1 || 'applicationId' in arg1)\n      ) {\n        this.rejectEmbeddedFlowInBackendMode();\n\n        const authIdFromUrl: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n        const authIdFromStorage: string =\n          ((await this.getStorageManager().getHybridDataParameter('authId')) as string) ?? '';\n        const authId: string = authIdFromUrl || authIdFromStorage;\n        const baseUrl: string = config?.baseUrl ?? '';\n\n        const response: EmbeddedSignInFlowResponse = await executeEmbeddedSignInFlow({\n          authId,\n          baseUrl,\n          payload: arg1,\n          url: resolveResourceEndpoint('flowExecute', config, arg2?.url),\n        });\n\n        // A flow for an authorization request posts its SSO sessions to the callback instead.\n        if (!authId && response) {\n          await this.storeFlowSessions(response);\n        }\n\n        if (\n          response &&\n          typeof response === 'object' &&\n          response.flowStatus === EmbeddedSignInFlowStatus.Complete &&\n          response.assertion\n        ) {\n          const decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          } = await this.decodeJwtToken<{\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }>(response.assertion);\n\n          const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n          const expiresIn: number =\n            decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n          await this.setSession({\n            access_token: response.assertion,\n            created_at: createdAt,\n            expires_in: expiresIn,\n            id_token: response.assertion,\n            scope: decodedAssertion.scope,\n            token_type: 'Bearer',\n          });\n\n          this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n        }\n\n        return response;\n      }\n\n      return (await super.signIn(...args)) as unknown as User;\n    });\n  }\n\n  override async signInSilently(options?: SignInOptions): Promise<User | boolean> {\n    await this.ensureConfigData();\n\n    return super.signInSilently(options as Record<string, string | boolean>) as Promise<User | boolean>;\n  }\n\n  override async signUp(options?: SignUpOptions): Promise<void>;\n  override async signUp(payload: any): Promise<any>;\n  override async signUp(...args: any[]): Promise<void | any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n    const firstArg: any = args[0];\n    const baseUrl: string = config?.baseUrl ?? '';\n\n    const authId: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n\n    const response: any = await executeEmbeddedSignUpFlow({\n      authId,\n      baseUrl,\n      payload: typeof firstArg === 'object' && 'flowType' in firstArg ? {...firstArg, verbose: true} : firstArg,\n      url: resolveResourceEndpoint('flowExecute', config),\n    });\n\n    // A flow for an authorization request posts its SSO sessions to the callback instead.\n    if (!authId && response) {\n      await this.storeFlowSessions(response as EmbeddedSignUpFlowResponse);\n    }\n\n    if (\n      response &&\n      typeof response === 'object' &&\n      response.flowStatus === EmbeddedSignUpFlowStatus.Complete &&\n      response.assertion\n    ) {\n      const decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      } = await this.decodeJwtToken<{\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }>(response.assertion);\n\n      const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n      const expiresIn: number =\n        decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n      await this.setSession({\n        access_token: response.assertion,\n        created_at: createdAt,\n        expires_in: expiresIn,\n        id_token: response.assertion,\n        scope: decodedAssertion.scope,\n        token_type: 'Bearer',\n      });\n\n      this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n    }\n\n    return response;\n  }\n\n  override async recover(payload?: any): Promise<any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n\n    return executeEmbeddedRecoveryFlow({\n      baseUrl: config?.baseUrl,\n      payload: {...payload, verbose: true},\n      url: resolveResourceEndpoint('flowExecute', config),\n    }) as any;\n  }\n\n  /**\n   * The embedded flows keep their result in the browser, which running sign-in on the backend rules\n   * out. Running them through the backend is not supported yet.\n   */\n  private rejectEmbeddedFlowInBackendMode(): void {\n    if (this.isBackendMode()) {\n      throw new ThunderIDRuntimeError(\n        'Embedded sign-in, sign-up, and recovery flows are not supported when sign-in runs on the backend.',\n        'ThunderIDReactClient-embeddedFlow-RuntimeError-001',\n        'react',\n        'Use redirect sign-in with the backend.',\n      );\n    }\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  async request(requestConfig?: HttpRequestConfig): Promise<HttpResponse<any>> {\n    return super.httpRequest(requestConfig!) as Promise<HttpResponse<any>>;\n  }\n\n  async requestAll(requestConfigs?: HttpRequestConfig[]): Promise<HttpResponse<any>[]> {\n    return super.httpRequestAll(requestConfigs!) as Promise<HttpResponse<any>[]>;\n  }\n}\n\nexport default ThunderIDReactClient;\n"],"mappings":";;;AA4BA,IAAM,uBAAN,cAA0F,uBAA0B;CAClH,AAAQ,eAAe;CAEvB,AAAQ;CAER,YAAY,aAAa,GAAG;AAC1B,QAAM,WAAW;;CAGnB,AAAQ,WAAW,SAAwB;AACzC,OAAK,eAAe;;CAGtB,MAAc,YAAqB,WAAqD;AACtF,OAAK,WAAW,KAAK;AACrB,MAAI;AAEF,UADwB,MAAM,WAAW;YAEjC;AACR,QAAK,WAAW,MAAM;;;;;;;;;;;CAY1B,MAAc,mBAA8D;EAC1E,MAAMA,SAA4C,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAMhG,MAAI,EAFF,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,KAAM,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,CAAC,OAAO,YAEjF,CAAC,KAAK,kBACzB,QAAO;AAGT,QAAM,KAAK,WAAW,KAAK,kBAAkB;AAI7C,SAAQ,MAAM,KAAK,mBAAmB,CAAC,eAAe;;CAGxD,AAAS,WAAW,QAAgD;AAClE,SAAO,KAAK,YAAY,YAAY;AAClC,QAAK,oBAAoB;IACvB,GAAG;IACH,sBACE,QAAQ,gBAAgB,cAAc,eAAgB,QAAgB;IACzE;AAED,UAAO,MAAM,WAAW,KAAK,kBAAkC;IAC/D;;CAGJ,AAAS,aAAa,QAAyD;AAC7E,SAAO,KAAK,YAAY,YAAY;GAClC,IAAIC;AAEJ,OAAI;AACF,UAAM,MAAM,aAAa,OAAqB;AAC9C,oBAAgB;YACT,OAAO;AACd,UAAM,IAAI,sBACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACvG,sDACA,SACA,4EACD;;AAGH,UAAO;IACP;;CAGJ,MAAe,oBAAmC;AAChD,QAAM,IAAI,MAAM,kBAAkB;;CAGpC,MAAe,UAAyB;AACtC,SAAO,6BAA6B,MAAM,KAAK,mBAAmB,CAAC;;CAGrE,MAAe,kBAAkB,WAAsC;AACrE,SAAO,MAAM,kBAAkB,UAAU;;CAG3C,MAAe,aAA8B;AAC3C,SAAO,KAAK,YAAY,YAAY,MAAM,YAAY,CAAC;;CAGzD,MAAe,iBAAuC;AACpD,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,SAAe,6BAA6B,MAAM,KAAK,mBAAmB,CAAC;AACjF,UAAO;IACL,kBAAkB;IAClB,SAAS;IACT,SAAS,EAAE;IACZ;IACD;;CAGJ,AAAS,YAAqB;AAC5B,SAAO,KAAK,gBAAgB,MAAM,WAAW;;CAG/C,MAAe,aAA+B;AAC5C,SAAO,MAAM,YAAY;;CAG3B,MAAe,cAAc,QAAuE;AAClG,SAAO,KAAK,YAAY,YAAY,MAAM,cAAc,OAAO,CAAwC;;CAGzG,MAAe,OAAO,GAAG,MAAyD;AAChF,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,OAAY,KAAK;GACvB,MAAMC,OAAY,KAAK;GAEvB,MAAMJ,SAA2C,MAAM,KAAK,kBAAkB;AAE9E,OAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,KAAK,uBAAuB,KAC3E;AAGF,OACE,OAAO,SAAS,YAChB,SAAS,QACT,CAAC,QAAQ,KAAK,KACb,iBAAiB,QAAQ,mBAAmB,OAC7C;AACA,SAAK,iCAAiC;IAEtC,MAAMK,gBAAwB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;IAC1F,MAAMC,oBACF,MAAM,KAAK,mBAAmB,CAAC,uBAAuB,SAAS,IAAgB;IACnF,MAAMC,SAAiB,iBAAiB;IAGxC,MAAMC,WAAuC,MAAM,0BAA0B;KAC3E;KACA,SAJsB,QAAQ,WAAW;KAKzC,SAAS;KACT,KAAK,wBAAwB,eAAe,QAAQ,MAAM,IAAI;KAC/D,CAAC;AAGF,QAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAS;AAGxC,QACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAe,yBAAyB,YACjD,SAAS,WACT;KACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;KAEtB,MAAMC,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;KACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,WAAM,KAAK,WAAW;MACpB,cAAc,SAAS;MACvB,YAAY;MACZ,YAAY;MACZ,UAAU,SAAS;MACnB,OAAO,iBAAiB;MACxB,YAAY;MACb,CAAC;AAEF,UAAK,aAAa,6BAA6B,iBAA4B,CAAS;;AAGtF,WAAO;;AAGT,UAAQ,MAAM,MAAM,OAAO,GAAG,KAAK;IACnC;;CAGJ,MAAe,eAAe,SAAkD;AAC9E,QAAM,KAAK,kBAAkB;AAE7B,SAAO,MAAM,eAAe,QAA4C;;CAK1E,MAAe,OAAO,GAAG,MAAkC;AACzD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACpF,MAAMC,WAAgB,KAAK;EAC3B,MAAMC,UAAkB,QAAQ,WAAW;EAE3C,MAAMP,SAAiB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;EAEnF,MAAMQ,WAAgB,MAAM,0BAA0B;GACpD;GACA;GACA,SAAS,OAAO,aAAa,YAAY,cAAc,WAAW;IAAC,GAAG;IAAU,SAAS;IAAK,GAAG;GACjG,KAAK,wBAAwB,eAAe,OAAO;GACpD,CAAC;AAGF,MAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAuC;AAGtE,MACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAe,yBAAyB,YACjD,SAAS,WACT;GACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;GAEtB,MAAMN,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;GACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,SAAM,KAAK,WAAW;IACpB,cAAc,SAAS;IACvB,YAAY;IACZ,YAAY;IACZ,UAAU,SAAS;IACnB,OAAO,iBAAiB;IACxB,YAAY;IACb,CAAC;AAEF,QAAK,aAAa,6BAA6B,iBAA4B,CAAS;;AAGtF,SAAO;;CAGT,MAAe,QAAQ,SAA6B;AAClD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEpF,SAAO,4BAA4B;GACjC,SAAS,QAAQ;GACjB,SAAS;IAAC,GAAG;IAAS,SAAS;IAAK;GACpC,KAAK,wBAAwB,eAAe,OAAO;GACpD,CAAC;;;;;;CAOJ,AAAQ,kCAAwC;AAC9C,MAAI,KAAK,eAAe,CACtB,OAAM,IAAI,sBACR,qGACA,sDACA,SACA,yCACD;;CAIL,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAM,QAAQ,eAA+D;AAC3E,SAAO,MAAM,YAAY,cAAe;;CAG1C,MAAM,WAAW,gBAAoE;AACnF,SAAO,MAAM,eAAe,eAAgB;;;AAIhD,mCAAe"}
+{"version":3,"file":"ThunderIDReactClient.js","names":["config: ThunderIDReactConfig | undefined","isInitialized: boolean","claims: User","arg1: any","arg2: any","authIdFromUrl: string","authIdFromStorage: string","authId: string","response: EmbeddedSignInFlowResponse","decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }","createdAt: number","expiresIn: number","config: ThunderIDReactConfig","firstArg: any","baseUrl: string","response: any","decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }"],"sources":["../src/ThunderIDReactClient.ts"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDBrowserClient,\n  UserProfile,\n  SignInOptions,\n  User,\n  SignUpOptions,\n  ThunderIDRuntimeError,\n  executeEmbeddedSignInFlow,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  TokenResponse,\n  HttpRequestConfig,\n  HttpResponse,\n  TokenExchangeRequestConfig,\n  isEmpty,\n  EmbeddedSignInFlowResponse,\n  executeEmbeddedSignUpFlow,\n  executeEmbeddedRecoveryFlow,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignUpFlowResponse,\n  EmbeddedSignUpFlowStatus,\n  resolveResourceEndpoint,\n} from '@thunderid/browser';\nimport {ThunderIDReactConfig} from './models/config';\n\nclass ThunderIDReactClient<T extends ThunderIDReactConfig = ThunderIDReactConfig> extends ThunderIDBrowserClient<T> {\n  private loadingState = false;\n\n  private _initializeConfig: ThunderIDReactConfig | undefined;\n\n  constructor(instanceId = 0) {\n    super(instanceId);\n  }\n\n  private setLoading(loading: boolean): void {\n    this.loadingState = loading;\n  }\n\n  private async withLoading<TResult>(operation: () => Promise<TResult>): Promise<TResult> {\n    this.setLoading(true);\n    try {\n      const result: TResult = await operation();\n      return result;\n    } finally {\n      this.setLoading(false);\n    }\n  }\n\n  /**\n   * Returns the stored config, re-running initialization first when it has gone missing.\n   *\n   * NOTE: With React 19 strict mode, the initialization logic runs twice, and there's an intermittent\n   * issue where the config object is not getting stored in the storage layer with Vite scaffolding.\n   * An operation that resolves endpoints from a lost config fails (for example \"required endpoints\n   * are missing\"), so recover it from the config this client was initialized with.\n   */\n  private async ensureConfigData(): Promise<ThunderIDReactConfig | undefined> {\n    const config: ThunderIDReactConfig | undefined = (await this.getStorageManager().getConfigData()) as\n      | ThunderIDReactConfig\n      | undefined;\n    const isConfigLost: boolean =\n      !config || Object.keys(config).length === 0 || (Boolean(this._initializeConfig?.baseUrl) && !config.baseUrl);\n\n    if (!isConfigLost || !this._initializeConfig) {\n      return config;\n    }\n\n    await this.initialize(this._initializeConfig);\n\n    // Reload the config persisted by initialization so downstream endpoint resolution\n    // (baseUrl and the flowExecute override) uses the recovered values, not the stale empty config.\n    return (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig | undefined;\n  }\n\n  override initialize(config: ThunderIDReactConfig): Promise<boolean> {\n    return this.withLoading(async () => {\n      this._initializeConfig = {\n        ...config,\n        periodicTokenRefresh:\n          config?.tokenLifecycle?.refreshToken?.autoRefresh ?? (config as any)?.periodicTokenRefresh,\n      } as any;\n\n      return super.initialize(this._initializeConfig as unknown as T);\n    });\n  }\n\n  override reInitialize(config: Partial<ThunderIDReactConfig>): Promise<boolean> {\n    return this.withLoading(async () => {\n      let isInitialized: boolean;\n\n      try {\n        await super.reInitialize(config as Partial<T>);\n        isInitialized = true;\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Failed to check if the client is initialized: ${error instanceof Error ? error.message : String(error)}`,\n          'ThunderIDReactClient-reInitialize-RuntimeError-001',\n          'react',\n          'An error occurred while checking the initialization status of the client.',\n        );\n      }\n\n      return isInitialized;\n    });\n  }\n\n  override async updateUserProfile(): Promise<User> {\n    throw new Error('Not implemented');\n  }\n\n  override async getUser(): Promise<User> {\n    return extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n  }\n\n  override async getDecodedIdToken(sessionId?: string): Promise<IdToken> {\n    return super.getDecodedIdToken(sessionId);\n  }\n\n  override async getIdToken(): Promise<string> {\n    return this.withLoading(async () => super.getIdToken());\n  }\n\n  override async getUserProfile(): Promise<UserProfile> {\n    return this.withLoading(async () => {\n      const claims: User = extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n      return {\n        flattenedProfile: claims,\n        profile: claims,\n        schemas: [],\n      };\n    });\n  }\n\n  override isLoading(): boolean {\n    return this.loadingState || super.isLoading();\n  }\n\n  override async isSignedIn(): Promise<boolean> {\n    return super.isSignedIn();\n  }\n\n  override async exchangeToken(config: TokenExchangeRequestConfig): Promise<TokenResponse | Response> {\n    return this.withLoading(async () => super.exchangeToken(config) as unknown as TokenResponse | Response);\n  }\n\n  override async signIn(...args: any[]): Promise<User | EmbeddedSignInFlowResponse> {\n    return this.withLoading(async () => {\n      const arg1: any = args[0];\n      const arg2: any = args[1];\n\n      const config: ThunderIDReactConfig | undefined = await this.ensureConfigData();\n\n      if (typeof arg1 === 'object' && arg1 !== null && arg1.callOnlyOnRedirect === true) {\n        return undefined as any;\n      }\n\n      if (\n        typeof arg1 === 'object' &&\n        arg1 !== null &&\n        !isEmpty(arg1) &&\n        ('executionId' in arg1 || 'applicationId' in arg1)\n      ) {\n        this.rejectEmbeddedFlowInBackendMode();\n\n        const authIdFromUrl: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n        const authIdFromStorage: string =\n          (arg1.executionId ? await this.getStorageManager().getFlowAuthId(arg1.executionId) : undefined) ?? '';\n        const authId: string = authIdFromUrl || authIdFromStorage;\n        const baseUrl: string = config?.baseUrl ?? '';\n\n        const response: EmbeddedSignInFlowResponse = await executeEmbeddedSignInFlow({\n          authId,\n          baseUrl,\n          payload: arg1,\n          url: resolveResourceEndpoint('flowExecute', config, arg2?.url),\n        });\n\n        // A flow for an authorization request posts its SSO sessions to the callback instead.\n        if (!authId && response) {\n          await this.storeFlowSessions(response);\n        }\n\n        if (\n          response &&\n          typeof response === 'object' &&\n          response.flowStatus === EmbeddedSignInFlowStatus.Complete &&\n          response.assertion\n        ) {\n          const decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          } = await this.decodeJwtToken<{\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }>(response.assertion);\n\n          const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n          const expiresIn: number =\n            decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n          await this.setSession({\n            access_token: response.assertion,\n            created_at: createdAt,\n            expires_in: expiresIn,\n            id_token: response.assertion,\n            scope: decodedAssertion.scope,\n            token_type: 'Bearer',\n          });\n\n          this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n        }\n\n        return response;\n      }\n\n      return (await super.signIn(...args)) as unknown as User;\n    });\n  }\n\n  override async signInSilently(options?: SignInOptions): Promise<User | boolean> {\n    await this.ensureConfigData();\n\n    return super.signInSilently(options as Record<string, string | boolean>) as Promise<User | boolean>;\n  }\n\n  override async signUp(options?: SignUpOptions): Promise<void>;\n  override async signUp(payload: any): Promise<any>;\n  override async signUp(...args: any[]): Promise<void | any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n    const firstArg: any = args[0];\n    const baseUrl: string = config?.baseUrl ?? '';\n\n    const authId: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n\n    const response: any = await executeEmbeddedSignUpFlow({\n      authId,\n      baseUrl,\n      payload: typeof firstArg === 'object' && 'flowType' in firstArg ? {...firstArg, verbose: true} : firstArg,\n      url: resolveResourceEndpoint('flowExecute', config),\n    });\n\n    // A flow for an authorization request posts its SSO sessions to the callback instead.\n    if (!authId && response) {\n      await this.storeFlowSessions(response as EmbeddedSignUpFlowResponse);\n    }\n\n    if (\n      response &&\n      typeof response === 'object' &&\n      response.flowStatus === EmbeddedSignUpFlowStatus.Complete &&\n      response.assertion\n    ) {\n      const decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      } = await this.decodeJwtToken<{\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }>(response.assertion);\n\n      const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n      const expiresIn: number =\n        decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n      await this.setSession({\n        access_token: response.assertion,\n        created_at: createdAt,\n        expires_in: expiresIn,\n        id_token: response.assertion,\n        scope: decodedAssertion.scope,\n        token_type: 'Bearer',\n      });\n\n      this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n    }\n\n    return response;\n  }\n\n  override async recover(payload?: any): Promise<any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n\n    return executeEmbeddedRecoveryFlow({\n      baseUrl: config?.baseUrl,\n      payload: {...payload, verbose: true},\n      url: resolveResourceEndpoint('flowExecute', config),\n    }) as any;\n  }\n\n  /**\n   * The embedded flows keep their result in the browser, which running sign-in on the backend rules\n   * out. Running them through the backend is not supported yet.\n   */\n  private rejectEmbeddedFlowInBackendMode(): void {\n    if (this.isBackendMode()) {\n      throw new ThunderIDRuntimeError(\n        'Embedded sign-in, sign-up, and recovery flows are not supported when sign-in runs on the backend.',\n        'ThunderIDReactClient-embeddedFlow-RuntimeError-001',\n        'react',\n        'Use redirect sign-in with the backend.',\n      );\n    }\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  async request(requestConfig?: HttpRequestConfig): Promise<HttpResponse<any>> {\n    return super.httpRequest(requestConfig!) as Promise<HttpResponse<any>>;\n  }\n\n  async requestAll(requestConfigs?: HttpRequestConfig[]): Promise<HttpResponse<any>[]> {\n    return super.httpRequestAll(requestConfigs!) as Promise<HttpResponse<any>[]>;\n  }\n}\n\nexport default ThunderIDReactClient;\n"],"mappings":";;;AA4BA,IAAM,uBAAN,cAA0F,uBAA0B;CAClH,AAAQ,eAAe;CAEvB,AAAQ;CAER,YAAY,aAAa,GAAG;AAC1B,QAAM,WAAW;;CAGnB,AAAQ,WAAW,SAAwB;AACzC,OAAK,eAAe;;CAGtB,MAAc,YAAqB,WAAqD;AACtF,OAAK,WAAW,KAAK;AACrB,MAAI;AAEF,UADwB,MAAM,WAAW;YAEjC;AACR,QAAK,WAAW,MAAM;;;;;;;;;;;CAY1B,MAAc,mBAA8D;EAC1E,MAAMA,SAA4C,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAMhG,MAAI,EAFF,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,KAAM,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,CAAC,OAAO,YAEjF,CAAC,KAAK,kBACzB,QAAO;AAGT,QAAM,KAAK,WAAW,KAAK,kBAAkB;AAI7C,SAAQ,MAAM,KAAK,mBAAmB,CAAC,eAAe;;CAGxD,AAAS,WAAW,QAAgD;AAClE,SAAO,KAAK,YAAY,YAAY;AAClC,QAAK,oBAAoB;IACvB,GAAG;IACH,sBACE,QAAQ,gBAAgB,cAAc,eAAgB,QAAgB;IACzE;AAED,UAAO,MAAM,WAAW,KAAK,kBAAkC;IAC/D;;CAGJ,AAAS,aAAa,QAAyD;AAC7E,SAAO,KAAK,YAAY,YAAY;GAClC,IAAIC;AAEJ,OAAI;AACF,UAAM,MAAM,aAAa,OAAqB;AAC9C,oBAAgB;YACT,OAAO;AACd,UAAM,IAAI,sBACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACvG,sDACA,SACA,4EACD;;AAGH,UAAO;IACP;;CAGJ,MAAe,oBAAmC;AAChD,QAAM,IAAI,MAAM,kBAAkB;;CAGpC,MAAe,UAAyB;AACtC,SAAO,6BAA6B,MAAM,KAAK,mBAAmB,CAAC;;CAGrE,MAAe,kBAAkB,WAAsC;AACrE,SAAO,MAAM,kBAAkB,UAAU;;CAG3C,MAAe,aAA8B;AAC3C,SAAO,KAAK,YAAY,YAAY,MAAM,YAAY,CAAC;;CAGzD,MAAe,iBAAuC;AACpD,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,SAAe,6BAA6B,MAAM,KAAK,mBAAmB,CAAC;AACjF,UAAO;IACL,kBAAkB;IAClB,SAAS;IACT,SAAS,EAAE;IACZ;IACD;;CAGJ,AAAS,YAAqB;AAC5B,SAAO,KAAK,gBAAgB,MAAM,WAAW;;CAG/C,MAAe,aAA+B;AAC5C,SAAO,MAAM,YAAY;;CAG3B,MAAe,cAAc,QAAuE;AAClG,SAAO,KAAK,YAAY,YAAY,MAAM,cAAc,OAAO,CAAwC;;CAGzG,MAAe,OAAO,GAAG,MAAyD;AAChF,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,OAAY,KAAK;GACvB,MAAMC,OAAY,KAAK;GAEvB,MAAMJ,SAA2C,MAAM,KAAK,kBAAkB;AAE9E,OAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,KAAK,uBAAuB,KAC3E;AAGF,OACE,OAAO,SAAS,YAChB,SAAS,QACT,CAAC,QAAQ,KAAK,KACb,iBAAiB,QAAQ,mBAAmB,OAC7C;AACA,SAAK,iCAAiC;IAEtC,MAAMK,gBAAwB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;IAC1F,MAAMC,qBACH,KAAK,cAAc,MAAM,KAAK,mBAAmB,CAAC,cAAc,KAAK,YAAY,GAAG,WAAc;IACrG,MAAMC,SAAiB,iBAAiB;IAGxC,MAAMC,WAAuC,MAAM,0BAA0B;KAC3E;KACA,SAJsB,QAAQ,WAAW;KAKzC,SAAS;KACT,KAAK,wBAAwB,eAAe,QAAQ,MAAM,IAAI;KAC/D,CAAC;AAGF,QAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAS;AAGxC,QACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAe,yBAAyB,YACjD,SAAS,WACT;KACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;KAEtB,MAAMC,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;KACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,WAAM,KAAK,WAAW;MACpB,cAAc,SAAS;MACvB,YAAY;MACZ,YAAY;MACZ,UAAU,SAAS;MACnB,OAAO,iBAAiB;MACxB,YAAY;MACb,CAAC;AAEF,UAAK,aAAa,6BAA6B,iBAA4B,CAAS;;AAGtF,WAAO;;AAGT,UAAQ,MAAM,MAAM,OAAO,GAAG,KAAK;IACnC;;CAGJ,MAAe,eAAe,SAAkD;AAC9E,QAAM,KAAK,kBAAkB;AAE7B,SAAO,MAAM,eAAe,QAA4C;;CAK1E,MAAe,OAAO,GAAG,MAAkC;AACzD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACpF,MAAMC,WAAgB,KAAK;EAC3B,MAAMC,UAAkB,QAAQ,WAAW;EAE3C,MAAMP,SAAiB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;EAEnF,MAAMQ,WAAgB,MAAM,0BAA0B;GACpD;GACA;GACA,SAAS,OAAO,aAAa,YAAY,cAAc,WAAW;IAAC,GAAG;IAAU,SAAS;IAAK,GAAG;GACjG,KAAK,wBAAwB,eAAe,OAAO;GACpD,CAAC;AAGF,MAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAuC;AAGtE,MACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAe,yBAAyB,YACjD,SAAS,WACT;GACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;GAEtB,MAAMN,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;GACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,SAAM,KAAK,WAAW;IACpB,cAAc,SAAS;IACvB,YAAY;IACZ,YAAY;IACZ,UAAU,SAAS;IACnB,OAAO,iBAAiB;IACxB,YAAY;IACb,CAAC;AAEF,QAAK,aAAa,6BAA6B,iBAA4B,CAAS;;AAGtF,SAAO;;CAGT,MAAe,QAAQ,SAA6B;AAClD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEpF,SAAO,4BAA4B;GACjC,SAAS,QAAQ;GACjB,SAAS;IAAC,GAAG;IAAS,SAAS;IAAK;GACpC,KAAK,wBAAwB,eAAe,OAAO;GACpD,CAAC;;;;;;CAOJ,AAAQ,kCAAwC;AAC9C,MAAI,KAAK,eAAe,CACtB,OAAM,IAAI,sBACR,qGACA,sDACA,SACA,yCACD;;CAIL,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAM,QAAQ,eAA+D;AAC3E,SAAO,MAAM,YAAY,cAAe;;CAG1C,MAAM,WAAW,gBAAoE;AACnF,SAAO,MAAM,eAAe,eAAgB;;;AAIhD,mCAAe"}

package/dist/cjs/ThunderIDReactClient.cjs

@@ -95,7 +95,7 @@ var ThunderIDReactClient = class extends __thunderid_browser.ThunderIDBrowserCli
 			if (typeof arg1 === "object" && arg1 !== null && !(0, __thunderid_browser.isEmpty)(arg1) && ("executionId" in arg1 || "applicationId" in arg1)) {
 				this.rejectEmbeddedFlowInBackendMode();
 				const authIdFromUrl = new URL(window.location.href).searchParams.get("authId") ?? "";
-				const authIdFromStorage = await this.getStorageManager().getHybridDataParameter("authId") ?? "";
+				const authIdFromStorage = (arg1.executionId ? await this.getStorageManager().getFlowAuthId(arg1.executionId) : void 0) ?? "";
 				const authId = authIdFromUrl || authIdFromStorage;
 				const response = await (0, __thunderid_browser.executeEmbeddedSignInFlow)({
 					authId,

package/dist/cjs/ThunderIDReactClient.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDReactClient.cjs","names":["ThunderIDBrowserClient","config: ThunderIDReactConfig | undefined","isInitialized: boolean","ThunderIDRuntimeError","claims: User","arg1: any","arg2: any","authIdFromUrl: string","authIdFromStorage: string","authId: string","response: EmbeddedSignInFlowResponse","EmbeddedSignInFlowStatus","decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }","createdAt: number","expiresIn: number","config: ThunderIDReactConfig","firstArg: any","baseUrl: string","response: any","EmbeddedSignUpFlowStatus","decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }"],"sources":["../../src/ThunderIDReactClient.ts"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDBrowserClient,\n  UserProfile,\n  SignInOptions,\n  User,\n  SignUpOptions,\n  ThunderIDRuntimeError,\n  executeEmbeddedSignInFlow,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  TokenResponse,\n  HttpRequestConfig,\n  HttpResponse,\n  TokenExchangeRequestConfig,\n  isEmpty,\n  EmbeddedSignInFlowResponse,\n  executeEmbeddedSignUpFlow,\n  executeEmbeddedRecoveryFlow,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignUpFlowResponse,\n  EmbeddedSignUpFlowStatus,\n  resolveResourceEndpoint,\n} from '@thunderid/browser';\nimport {ThunderIDReactConfig} from './models/config';\n\nclass ThunderIDReactClient<T extends ThunderIDReactConfig = ThunderIDReactConfig> extends ThunderIDBrowserClient<T> {\n  private loadingState = false;\n\n  private _initializeConfig: ThunderIDReactConfig | undefined;\n\n  constructor(instanceId = 0) {\n    super(instanceId);\n  }\n\n  private setLoading(loading: boolean): void {\n    this.loadingState = loading;\n  }\n\n  private async withLoading<TResult>(operation: () => Promise<TResult>): Promise<TResult> {\n    this.setLoading(true);\n    try {\n      const result: TResult = await operation();\n      return result;\n    } finally {\n      this.setLoading(false);\n    }\n  }\n\n  /**\n   * Returns the stored config, re-running initialization first when it has gone missing.\n   *\n   * NOTE: With React 19 strict mode, the initialization logic runs twice, and there's an intermittent\n   * issue where the config object is not getting stored in the storage layer with Vite scaffolding.\n   * An operation that resolves endpoints from a lost config fails (for example \"required endpoints\n   * are missing\"), so recover it from the config this client was initialized with.\n   */\n  private async ensureConfigData(): Promise<ThunderIDReactConfig | undefined> {\n    const config: ThunderIDReactConfig | undefined = (await this.getStorageManager().getConfigData()) as\n      | ThunderIDReactConfig\n      | undefined;\n    const isConfigLost: boolean =\n      !config || Object.keys(config).length === 0 || (Boolean(this._initializeConfig?.baseUrl) && !config.baseUrl);\n\n    if (!isConfigLost || !this._initializeConfig) {\n      return config;\n    }\n\n    await this.initialize(this._initializeConfig);\n\n    // Reload the config persisted by initialization so downstream endpoint resolution\n    // (baseUrl and the flowExecute override) uses the recovered values, not the stale empty config.\n    return (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig | undefined;\n  }\n\n  override initialize(config: ThunderIDReactConfig): Promise<boolean> {\n    return this.withLoading(async () => {\n      this._initializeConfig = {\n        ...config,\n        periodicTokenRefresh:\n          config?.tokenLifecycle?.refreshToken?.autoRefresh ?? (config as any)?.periodicTokenRefresh,\n      } as any;\n\n      return super.initialize(this._initializeConfig as unknown as T);\n    });\n  }\n\n  override reInitialize(config: Partial<ThunderIDReactConfig>): Promise<boolean> {\n    return this.withLoading(async () => {\n      let isInitialized: boolean;\n\n      try {\n        await super.reInitialize(config as Partial<T>);\n        isInitialized = true;\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Failed to check if the client is initialized: ${error instanceof Error ? error.message : String(error)}`,\n          'ThunderIDReactClient-reInitialize-RuntimeError-001',\n          'react',\n          'An error occurred while checking the initialization status of the client.',\n        );\n      }\n\n      return isInitialized;\n    });\n  }\n\n  override async updateUserProfile(): Promise<User> {\n    throw new Error('Not implemented');\n  }\n\n  override async getUser(): Promise<User> {\n    return extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n  }\n\n  override async getDecodedIdToken(sessionId?: string): Promise<IdToken> {\n    return super.getDecodedIdToken(sessionId);\n  }\n\n  override async getIdToken(): Promise<string> {\n    return this.withLoading(async () => super.getIdToken());\n  }\n\n  override async getUserProfile(): Promise<UserProfile> {\n    return this.withLoading(async () => {\n      const claims: User = extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n      return {\n        flattenedProfile: claims,\n        profile: claims,\n        schemas: [],\n      };\n    });\n  }\n\n  override isLoading(): boolean {\n    return this.loadingState || super.isLoading();\n  }\n\n  override async isSignedIn(): Promise<boolean> {\n    return super.isSignedIn();\n  }\n\n  override async exchangeToken(config: TokenExchangeRequestConfig): Promise<TokenResponse | Response> {\n    return this.withLoading(async () => super.exchangeToken(config) as unknown as TokenResponse | Response);\n  }\n\n  override async signIn(...args: any[]): Promise<User | EmbeddedSignInFlowResponse> {\n    return this.withLoading(async () => {\n      const arg1: any = args[0];\n      const arg2: any = args[1];\n\n      const config: ThunderIDReactConfig | undefined = await this.ensureConfigData();\n\n      if (typeof arg1 === 'object' && arg1 !== null && arg1.callOnlyOnRedirect === true) {\n        return undefined as any;\n      }\n\n      if (\n        typeof arg1 === 'object' &&\n        arg1 !== null &&\n        !isEmpty(arg1) &&\n        ('executionId' in arg1 || 'applicationId' in arg1)\n      ) {\n        this.rejectEmbeddedFlowInBackendMode();\n\n        const authIdFromUrl: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n        const authIdFromStorage: string =\n          ((await this.getStorageManager().getHybridDataParameter('authId')) as string) ?? '';\n        const authId: string = authIdFromUrl || authIdFromStorage;\n        const baseUrl: string = config?.baseUrl ?? '';\n\n        const response: EmbeddedSignInFlowResponse = await executeEmbeddedSignInFlow({\n          authId,\n          baseUrl,\n          payload: arg1,\n          url: resolveResourceEndpoint('flowExecute', config, arg2?.url),\n        });\n\n        // A flow for an authorization request posts its SSO sessions to the callback instead.\n        if (!authId && response) {\n          await this.storeFlowSessions(response);\n        }\n\n        if (\n          response &&\n          typeof response === 'object' &&\n          response.flowStatus === EmbeddedSignInFlowStatus.Complete &&\n          response.assertion\n        ) {\n          const decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          } = await this.decodeJwtToken<{\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }>(response.assertion);\n\n          const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n          const expiresIn: number =\n            decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n          await this.setSession({\n            access_token: response.assertion,\n            created_at: createdAt,\n            expires_in: expiresIn,\n            id_token: response.assertion,\n            scope: decodedAssertion.scope,\n            token_type: 'Bearer',\n          });\n\n          this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n        }\n\n        return response;\n      }\n\n      return (await super.signIn(...args)) as unknown as User;\n    });\n  }\n\n  override async signInSilently(options?: SignInOptions): Promise<User | boolean> {\n    await this.ensureConfigData();\n\n    return super.signInSilently(options as Record<string, string | boolean>) as Promise<User | boolean>;\n  }\n\n  override async signUp(options?: SignUpOptions): Promise<void>;\n  override async signUp(payload: any): Promise<any>;\n  override async signUp(...args: any[]): Promise<void | any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n    const firstArg: any = args[0];\n    const baseUrl: string = config?.baseUrl ?? '';\n\n    const authId: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n\n    const response: any = await executeEmbeddedSignUpFlow({\n      authId,\n      baseUrl,\n      payload: typeof firstArg === 'object' && 'flowType' in firstArg ? {...firstArg, verbose: true} : firstArg,\n      url: resolveResourceEndpoint('flowExecute', config),\n    });\n\n    // A flow for an authorization request posts its SSO sessions to the callback instead.\n    if (!authId && response) {\n      await this.storeFlowSessions(response as EmbeddedSignUpFlowResponse);\n    }\n\n    if (\n      response &&\n      typeof response === 'object' &&\n      response.flowStatus === EmbeddedSignUpFlowStatus.Complete &&\n      response.assertion\n    ) {\n      const decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      } = await this.decodeJwtToken<{\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }>(response.assertion);\n\n      const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n      const expiresIn: number =\n        decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n      await this.setSession({\n        access_token: response.assertion,\n        created_at: createdAt,\n        expires_in: expiresIn,\n        id_token: response.assertion,\n        scope: decodedAssertion.scope,\n        token_type: 'Bearer',\n      });\n\n      this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n    }\n\n    return response;\n  }\n\n  override async recover(payload?: any): Promise<any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n\n    return executeEmbeddedRecoveryFlow({\n      baseUrl: config?.baseUrl,\n      payload: {...payload, verbose: true},\n      url: resolveResourceEndpoint('flowExecute', config),\n    }) as any;\n  }\n\n  /**\n   * The embedded flows keep their result in the browser, which running sign-in on the backend rules\n   * out. Running them through the backend is not supported yet.\n   */\n  private rejectEmbeddedFlowInBackendMode(): void {\n    if (this.isBackendMode()) {\n      throw new ThunderIDRuntimeError(\n        'Embedded sign-in, sign-up, and recovery flows are not supported when sign-in runs on the backend.',\n        'ThunderIDReactClient-embeddedFlow-RuntimeError-001',\n        'react',\n        'Use redirect sign-in with the backend.',\n      );\n    }\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  async request(requestConfig?: HttpRequestConfig): Promise<HttpResponse<any>> {\n    return super.httpRequest(requestConfig!) as Promise<HttpResponse<any>>;\n  }\n\n  async requestAll(requestConfigs?: HttpRequestConfig[]): Promise<HttpResponse<any>[]> {\n    return super.httpRequestAll(requestConfigs!) as Promise<HttpResponse<any>[]>;\n  }\n}\n\nexport default ThunderIDReactClient;\n"],"mappings":";;;;;AA4BA,IAAM,uBAAN,cAA0FA,2CAA0B;CAClH,AAAQ,eAAe;CAEvB,AAAQ;CAER,YAAY,aAAa,GAAG;AAC1B,QAAM,WAAW;;CAGnB,AAAQ,WAAW,SAAwB;AACzC,OAAK,eAAe;;CAGtB,MAAc,YAAqB,WAAqD;AACtF,OAAK,WAAW,KAAK;AACrB,MAAI;AAEF,UADwB,MAAM,WAAW;YAEjC;AACR,QAAK,WAAW,MAAM;;;;;;;;;;;CAY1B,MAAc,mBAA8D;EAC1E,MAAMC,SAA4C,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAMhG,MAAI,EAFF,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,KAAM,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,CAAC,OAAO,YAEjF,CAAC,KAAK,kBACzB,QAAO;AAGT,QAAM,KAAK,WAAW,KAAK,kBAAkB;AAI7C,SAAQ,MAAM,KAAK,mBAAmB,CAAC,eAAe;;CAGxD,AAAS,WAAW,QAAgD;AAClE,SAAO,KAAK,YAAY,YAAY;AAClC,QAAK,oBAAoB;IACvB,GAAG;IACH,sBACE,QAAQ,gBAAgB,cAAc,eAAgB,QAAgB;IACzE;AAED,UAAO,MAAM,WAAW,KAAK,kBAAkC;IAC/D;;CAGJ,AAAS,aAAa,QAAyD;AAC7E,SAAO,KAAK,YAAY,YAAY;GAClC,IAAIC;AAEJ,OAAI;AACF,UAAM,MAAM,aAAa,OAAqB;AAC9C,oBAAgB;YACT,OAAO;AACd,UAAM,IAAIC,0CACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACvG,sDACA,SACA,4EACD;;AAGH,UAAO;IACP;;CAGJ,MAAe,oBAAmC;AAChD,QAAM,IAAI,MAAM,kBAAkB;;CAGpC,MAAe,UAAyB;AACtC,+DAAoC,MAAM,KAAK,mBAAmB,CAAC;;CAGrE,MAAe,kBAAkB,WAAsC;AACrE,SAAO,MAAM,kBAAkB,UAAU;;CAG3C,MAAe,aAA8B;AAC3C,SAAO,KAAK,YAAY,YAAY,MAAM,YAAY,CAAC;;CAGzD,MAAe,iBAAuC;AACpD,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,+DAA4C,MAAM,KAAK,mBAAmB,CAAC;AACjF,UAAO;IACL,kBAAkB;IAClB,SAAS;IACT,SAAS,EAAE;IACZ;IACD;;CAGJ,AAAS,YAAqB;AAC5B,SAAO,KAAK,gBAAgB,MAAM,WAAW;;CAG/C,MAAe,aAA+B;AAC5C,SAAO,MAAM,YAAY;;CAG3B,MAAe,cAAc,QAAuE;AAClG,SAAO,KAAK,YAAY,YAAY,MAAM,cAAc,OAAO,CAAwC;;CAGzG,MAAe,OAAO,GAAG,MAAyD;AAChF,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,OAAY,KAAK;GACvB,MAAMC,OAAY,KAAK;GAEvB,MAAML,SAA2C,MAAM,KAAK,kBAAkB;AAE9E,OAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,KAAK,uBAAuB,KAC3E;AAGF,OACE,OAAO,SAAS,YAChB,SAAS,QACT,kCAAS,KAAK,KACb,iBAAiB,QAAQ,mBAAmB,OAC7C;AACA,SAAK,iCAAiC;IAEtC,MAAMM,gBAAwB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;IAC1F,MAAMC,oBACF,MAAM,KAAK,mBAAmB,CAAC,uBAAuB,SAAS,IAAgB;IACnF,MAAMC,SAAiB,iBAAiB;IAGxC,MAAMC,WAAuC,yDAAgC;KAC3E;KACA,SAJsB,QAAQ,WAAW;KAKzC,SAAS;KACT,sDAA6B,eAAe,QAAQ,MAAM,IAAI;KAC/D,CAAC;AAGF,QAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAS;AAGxC,QACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAeC,6CAAyB,YACjD,SAAS,WACT;KACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;KAEtB,MAAMC,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;KACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,WAAM,KAAK,WAAW;MACpB,cAAc,SAAS;MACvB,YAAY;MACZ,YAAY;MACZ,UAAU,SAAS;MACnB,OAAO,iBAAiB;MACxB,YAAY;MACb,CAAC;AAEF,UAAK,mEAA0C,iBAA4B,CAAS;;AAGtF,WAAO;;AAGT,UAAQ,MAAM,MAAM,OAAO,GAAG,KAAK;IACnC;;CAGJ,MAAe,eAAe,SAAkD;AAC9E,QAAM,KAAK,kBAAkB;AAE7B,SAAO,MAAM,eAAe,QAA4C;;CAK1E,MAAe,OAAO,GAAG,MAAkC;AACzD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACpF,MAAMC,WAAgB,KAAK;EAC3B,MAAMC,UAAkB,QAAQ,WAAW;EAE3C,MAAMR,SAAiB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;EAEnF,MAAMS,WAAgB,yDAAgC;GACpD;GACA;GACA,SAAS,OAAO,aAAa,YAAY,cAAc,WAAW;IAAC,GAAG;IAAU,SAAS;IAAK,GAAG;GACjG,sDAA6B,eAAe,OAAO;GACpD,CAAC;AAGF,MAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAuC;AAGtE,MACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAeC,6CAAyB,YACjD,SAAS,WACT;GACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;GAEtB,MAAMP,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;GACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,SAAM,KAAK,WAAW;IACpB,cAAc,SAAS;IACvB,YAAY;IACZ,YAAY;IACZ,UAAU,SAAS;IACnB,OAAO,iBAAiB;IACxB,YAAY;IACb,CAAC;AAEF,QAAK,mEAA0C,iBAA4B,CAAS;;AAGtF,SAAO;;CAGT,MAAe,QAAQ,SAA6B;AAClD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEpF,8DAAmC;GACjC,SAAS,QAAQ;GACjB,SAAS;IAAC,GAAG;IAAS,SAAS;IAAK;GACpC,sDAA6B,eAAe,OAAO;GACpD,CAAC;;;;;;CAOJ,AAAQ,kCAAwC;AAC9C,MAAI,KAAK,eAAe,CACtB,OAAM,IAAIZ,0CACR,qGACA,sDACA,SACA,yCACD;;CAIL,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAM,QAAQ,eAA+D;AAC3E,SAAO,MAAM,YAAY,cAAe;;CAG1C,MAAM,WAAW,gBAAoE;AACnF,SAAO,MAAM,eAAe,eAAgB;;;AAIhD,mCAAe"}
+{"version":3,"file":"ThunderIDReactClient.cjs","names":["ThunderIDBrowserClient","config: ThunderIDReactConfig | undefined","isInitialized: boolean","ThunderIDRuntimeError","claims: User","arg1: any","arg2: any","authIdFromUrl: string","authIdFromStorage: string","authId: string","response: EmbeddedSignInFlowResponse","EmbeddedSignInFlowStatus","decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }","createdAt: number","expiresIn: number","config: ThunderIDReactConfig","firstArg: any","baseUrl: string","response: any","EmbeddedSignUpFlowStatus","decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }"],"sources":["../../src/ThunderIDReactClient.ts"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDBrowserClient,\n  UserProfile,\n  SignInOptions,\n  User,\n  SignUpOptions,\n  ThunderIDRuntimeError,\n  executeEmbeddedSignInFlow,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  TokenResponse,\n  HttpRequestConfig,\n  HttpResponse,\n  TokenExchangeRequestConfig,\n  isEmpty,\n  EmbeddedSignInFlowResponse,\n  executeEmbeddedSignUpFlow,\n  executeEmbeddedRecoveryFlow,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignUpFlowResponse,\n  EmbeddedSignUpFlowStatus,\n  resolveResourceEndpoint,\n} from '@thunderid/browser';\nimport {ThunderIDReactConfig} from './models/config';\n\nclass ThunderIDReactClient<T extends ThunderIDReactConfig = ThunderIDReactConfig> extends ThunderIDBrowserClient<T> {\n  private loadingState = false;\n\n  private _initializeConfig: ThunderIDReactConfig | undefined;\n\n  constructor(instanceId = 0) {\n    super(instanceId);\n  }\n\n  private setLoading(loading: boolean): void {\n    this.loadingState = loading;\n  }\n\n  private async withLoading<TResult>(operation: () => Promise<TResult>): Promise<TResult> {\n    this.setLoading(true);\n    try {\n      const result: TResult = await operation();\n      return result;\n    } finally {\n      this.setLoading(false);\n    }\n  }\n\n  /**\n   * Returns the stored config, re-running initialization first when it has gone missing.\n   *\n   * NOTE: With React 19 strict mode, the initialization logic runs twice, and there's an intermittent\n   * issue where the config object is not getting stored in the storage layer with Vite scaffolding.\n   * An operation that resolves endpoints from a lost config fails (for example \"required endpoints\n   * are missing\"), so recover it from the config this client was initialized with.\n   */\n  private async ensureConfigData(): Promise<ThunderIDReactConfig | undefined> {\n    const config: ThunderIDReactConfig | undefined = (await this.getStorageManager().getConfigData()) as\n      | ThunderIDReactConfig\n      | undefined;\n    const isConfigLost: boolean =\n      !config || Object.keys(config).length === 0 || (Boolean(this._initializeConfig?.baseUrl) && !config.baseUrl);\n\n    if (!isConfigLost || !this._initializeConfig) {\n      return config;\n    }\n\n    await this.initialize(this._initializeConfig);\n\n    // Reload the config persisted by initialization so downstream endpoint resolution\n    // (baseUrl and the flowExecute override) uses the recovered values, not the stale empty config.\n    return (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig | undefined;\n  }\n\n  override initialize(config: ThunderIDReactConfig): Promise<boolean> {\n    return this.withLoading(async () => {\n      this._initializeConfig = {\n        ...config,\n        periodicTokenRefresh:\n          config?.tokenLifecycle?.refreshToken?.autoRefresh ?? (config as any)?.periodicTokenRefresh,\n      } as any;\n\n      return super.initialize(this._initializeConfig as unknown as T);\n    });\n  }\n\n  override reInitialize(config: Partial<ThunderIDReactConfig>): Promise<boolean> {\n    return this.withLoading(async () => {\n      let isInitialized: boolean;\n\n      try {\n        await super.reInitialize(config as Partial<T>);\n        isInitialized = true;\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Failed to check if the client is initialized: ${error instanceof Error ? error.message : String(error)}`,\n          'ThunderIDReactClient-reInitialize-RuntimeError-001',\n          'react',\n          'An error occurred while checking the initialization status of the client.',\n        );\n      }\n\n      return isInitialized;\n    });\n  }\n\n  override async updateUserProfile(): Promise<User> {\n    throw new Error('Not implemented');\n  }\n\n  override async getUser(): Promise<User> {\n    return extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n  }\n\n  override async getDecodedIdToken(sessionId?: string): Promise<IdToken> {\n    return super.getDecodedIdToken(sessionId);\n  }\n\n  override async getIdToken(): Promise<string> {\n    return this.withLoading(async () => super.getIdToken());\n  }\n\n  override async getUserProfile(): Promise<UserProfile> {\n    return this.withLoading(async () => {\n      const claims: User = extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n      return {\n        flattenedProfile: claims,\n        profile: claims,\n        schemas: [],\n      };\n    });\n  }\n\n  override isLoading(): boolean {\n    return this.loadingState || super.isLoading();\n  }\n\n  override async isSignedIn(): Promise<boolean> {\n    return super.isSignedIn();\n  }\n\n  override async exchangeToken(config: TokenExchangeRequestConfig): Promise<TokenResponse | Response> {\n    return this.withLoading(async () => super.exchangeToken(config) as unknown as TokenResponse | Response);\n  }\n\n  override async signIn(...args: any[]): Promise<User | EmbeddedSignInFlowResponse> {\n    return this.withLoading(async () => {\n      const arg1: any = args[0];\n      const arg2: any = args[1];\n\n      const config: ThunderIDReactConfig | undefined = await this.ensureConfigData();\n\n      if (typeof arg1 === 'object' && arg1 !== null && arg1.callOnlyOnRedirect === true) {\n        return undefined as any;\n      }\n\n      if (\n        typeof arg1 === 'object' &&\n        arg1 !== null &&\n        !isEmpty(arg1) &&\n        ('executionId' in arg1 || 'applicationId' in arg1)\n      ) {\n        this.rejectEmbeddedFlowInBackendMode();\n\n        const authIdFromUrl: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n        const authIdFromStorage: string =\n          (arg1.executionId ? await this.getStorageManager().getFlowAuthId(arg1.executionId) : undefined) ?? '';\n        const authId: string = authIdFromUrl || authIdFromStorage;\n        const baseUrl: string = config?.baseUrl ?? '';\n\n        const response: EmbeddedSignInFlowResponse = await executeEmbeddedSignInFlow({\n          authId,\n          baseUrl,\n          payload: arg1,\n          url: resolveResourceEndpoint('flowExecute', config, arg2?.url),\n        });\n\n        // A flow for an authorization request posts its SSO sessions to the callback instead.\n        if (!authId && response) {\n          await this.storeFlowSessions(response);\n        }\n\n        if (\n          response &&\n          typeof response === 'object' &&\n          response.flowStatus === EmbeddedSignInFlowStatus.Complete &&\n          response.assertion\n        ) {\n          const decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          } = await this.decodeJwtToken<{\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }>(response.assertion);\n\n          const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n          const expiresIn: number =\n            decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n          await this.setSession({\n            access_token: response.assertion,\n            created_at: createdAt,\n            expires_in: expiresIn,\n            id_token: response.assertion,\n            scope: decodedAssertion.scope,\n            token_type: 'Bearer',\n          });\n\n          this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n        }\n\n        return response;\n      }\n\n      return (await super.signIn(...args)) as unknown as User;\n    });\n  }\n\n  override async signInSilently(options?: SignInOptions): Promise<User | boolean> {\n    await this.ensureConfigData();\n\n    return super.signInSilently(options as Record<string, string | boolean>) as Promise<User | boolean>;\n  }\n\n  override async signUp(options?: SignUpOptions): Promise<void>;\n  override async signUp(payload: any): Promise<any>;\n  override async signUp(...args: any[]): Promise<void | any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n    const firstArg: any = args[0];\n    const baseUrl: string = config?.baseUrl ?? '';\n\n    const authId: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n\n    const response: any = await executeEmbeddedSignUpFlow({\n      authId,\n      baseUrl,\n      payload: typeof firstArg === 'object' && 'flowType' in firstArg ? {...firstArg, verbose: true} : firstArg,\n      url: resolveResourceEndpoint('flowExecute', config),\n    });\n\n    // A flow for an authorization request posts its SSO sessions to the callback instead.\n    if (!authId && response) {\n      await this.storeFlowSessions(response as EmbeddedSignUpFlowResponse);\n    }\n\n    if (\n      response &&\n      typeof response === 'object' &&\n      response.flowStatus === EmbeddedSignUpFlowStatus.Complete &&\n      response.assertion\n    ) {\n      const decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      } = await this.decodeJwtToken<{\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }>(response.assertion);\n\n      const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n      const expiresIn: number =\n        decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n      await this.setSession({\n        access_token: response.assertion,\n        created_at: createdAt,\n        expires_in: expiresIn,\n        id_token: response.assertion,\n        scope: decodedAssertion.scope,\n        token_type: 'Bearer',\n      });\n\n      this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n    }\n\n    return response;\n  }\n\n  override async recover(payload?: any): Promise<any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n\n    return executeEmbeddedRecoveryFlow({\n      baseUrl: config?.baseUrl,\n      payload: {...payload, verbose: true},\n      url: resolveResourceEndpoint('flowExecute', config),\n    }) as any;\n  }\n\n  /**\n   * The embedded flows keep their result in the browser, which running sign-in on the backend rules\n   * out. Running them through the backend is not supported yet.\n   */\n  private rejectEmbeddedFlowInBackendMode(): void {\n    if (this.isBackendMode()) {\n      throw new ThunderIDRuntimeError(\n        'Embedded sign-in, sign-up, and recovery flows are not supported when sign-in runs on the backend.',\n        'ThunderIDReactClient-embeddedFlow-RuntimeError-001',\n        'react',\n        'Use redirect sign-in with the backend.',\n      );\n    }\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  async request(requestConfig?: HttpRequestConfig): Promise<HttpResponse<any>> {\n    return super.httpRequest(requestConfig!) as Promise<HttpResponse<any>>;\n  }\n\n  async requestAll(requestConfigs?: HttpRequestConfig[]): Promise<HttpResponse<any>[]> {\n    return super.httpRequestAll(requestConfigs!) as Promise<HttpResponse<any>[]>;\n  }\n}\n\nexport default ThunderIDReactClient;\n"],"mappings":";;;;;AA4BA,IAAM,uBAAN,cAA0FA,2CAA0B;CAClH,AAAQ,eAAe;CAEvB,AAAQ;CAER,YAAY,aAAa,GAAG;AAC1B,QAAM,WAAW;;CAGnB,AAAQ,WAAW,SAAwB;AACzC,OAAK,eAAe;;CAGtB,MAAc,YAAqB,WAAqD;AACtF,OAAK,WAAW,KAAK;AACrB,MAAI;AAEF,UADwB,MAAM,WAAW;YAEjC;AACR,QAAK,WAAW,MAAM;;;;;;;;;;;CAY1B,MAAc,mBAA8D;EAC1E,MAAMC,SAA4C,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAMhG,MAAI,EAFF,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,KAAM,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,CAAC,OAAO,YAEjF,CAAC,KAAK,kBACzB,QAAO;AAGT,QAAM,KAAK,WAAW,KAAK,kBAAkB;AAI7C,SAAQ,MAAM,KAAK,mBAAmB,CAAC,eAAe;;CAGxD,AAAS,WAAW,QAAgD;AAClE,SAAO,KAAK,YAAY,YAAY;AAClC,QAAK,oBAAoB;IACvB,GAAG;IACH,sBACE,QAAQ,gBAAgB,cAAc,eAAgB,QAAgB;IACzE;AAED,UAAO,MAAM,WAAW,KAAK,kBAAkC;IAC/D;;CAGJ,AAAS,aAAa,QAAyD;AAC7E,SAAO,KAAK,YAAY,YAAY;GAClC,IAAIC;AAEJ,OAAI;AACF,UAAM,MAAM,aAAa,OAAqB;AAC9C,oBAAgB;YACT,OAAO;AACd,UAAM,IAAIC,0CACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACvG,sDACA,SACA,4EACD;;AAGH,UAAO;IACP;;CAGJ,MAAe,oBAAmC;AAChD,QAAM,IAAI,MAAM,kBAAkB;;CAGpC,MAAe,UAAyB;AACtC,+DAAoC,MAAM,KAAK,mBAAmB,CAAC;;CAGrE,MAAe,kBAAkB,WAAsC;AACrE,SAAO,MAAM,kBAAkB,UAAU;;CAG3C,MAAe,aAA8B;AAC3C,SAAO,KAAK,YAAY,YAAY,MAAM,YAAY,CAAC;;CAGzD,MAAe,iBAAuC;AACpD,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,+DAA4C,MAAM,KAAK,mBAAmB,CAAC;AACjF,UAAO;IACL,kBAAkB;IAClB,SAAS;IACT,SAAS,EAAE;IACZ;IACD;;CAGJ,AAAS,YAAqB;AAC5B,SAAO,KAAK,gBAAgB,MAAM,WAAW;;CAG/C,MAAe,aAA+B;AAC5C,SAAO,MAAM,YAAY;;CAG3B,MAAe,cAAc,QAAuE;AAClG,SAAO,KAAK,YAAY,YAAY,MAAM,cAAc,OAAO,CAAwC;;CAGzG,MAAe,OAAO,GAAG,MAAyD;AAChF,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,OAAY,KAAK;GACvB,MAAMC,OAAY,KAAK;GAEvB,MAAML,SAA2C,MAAM,KAAK,kBAAkB;AAE9E,OAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,KAAK,uBAAuB,KAC3E;AAGF,OACE,OAAO,SAAS,YAChB,SAAS,QACT,kCAAS,KAAK,KACb,iBAAiB,QAAQ,mBAAmB,OAC7C;AACA,SAAK,iCAAiC;IAEtC,MAAMM,gBAAwB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;IAC1F,MAAMC,qBACH,KAAK,cAAc,MAAM,KAAK,mBAAmB,CAAC,cAAc,KAAK,YAAY,GAAG,WAAc;IACrG,MAAMC,SAAiB,iBAAiB;IAGxC,MAAMC,WAAuC,yDAAgC;KAC3E;KACA,SAJsB,QAAQ,WAAW;KAKzC,SAAS;KACT,sDAA6B,eAAe,QAAQ,MAAM,IAAI;KAC/D,CAAC;AAGF,QAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAS;AAGxC,QACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAeC,6CAAyB,YACjD,SAAS,WACT;KACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;KAEtB,MAAMC,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;KACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,WAAM,KAAK,WAAW;MACpB,cAAc,SAAS;MACvB,YAAY;MACZ,YAAY;MACZ,UAAU,SAAS;MACnB,OAAO,iBAAiB;MACxB,YAAY;MACb,CAAC;AAEF,UAAK,mEAA0C,iBAA4B,CAAS;;AAGtF,WAAO;;AAGT,UAAQ,MAAM,MAAM,OAAO,GAAG,KAAK;IACnC;;CAGJ,MAAe,eAAe,SAAkD;AAC9E,QAAM,KAAK,kBAAkB;AAE7B,SAAO,MAAM,eAAe,QAA4C;;CAK1E,MAAe,OAAO,GAAG,MAAkC;AACzD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACpF,MAAMC,WAAgB,KAAK;EAC3B,MAAMC,UAAkB,QAAQ,WAAW;EAE3C,MAAMR,SAAiB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;EAEnF,MAAMS,WAAgB,yDAAgC;GACpD;GACA;GACA,SAAS,OAAO,aAAa,YAAY,cAAc,WAAW;IAAC,GAAG;IAAU,SAAS;IAAK,GAAG;GACjG,sDAA6B,eAAe,OAAO;GACpD,CAAC;AAGF,MAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAuC;AAGtE,MACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAeC,6CAAyB,YACjD,SAAS,WACT;GACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;GAEtB,MAAMP,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;GACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,SAAM,KAAK,WAAW;IACpB,cAAc,SAAS;IACvB,YAAY;IACZ,YAAY;IACZ,UAAU,SAAS;IACnB,OAAO,iBAAiB;IACxB,YAAY;IACb,CAAC;AAEF,QAAK,mEAA0C,iBAA4B,CAAS;;AAGtF,SAAO;;CAGT,MAAe,QAAQ,SAA6B;AAClD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEpF,8DAAmC;GACjC,SAAS,QAAQ;GACjB,SAAS;IAAC,GAAG;IAAS,SAAS;IAAK;GACpC,sDAA6B,eAAe,OAAO;GACpD,CAAC;;;;;;CAOJ,AAAQ,kCAAwC;AAC9C,MAAI,KAAK,eAAe,CACtB,OAAM,IAAIZ,0CACR,qGACA,sDACA,SACA,yCACD;;CAIL,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAM,QAAQ,eAA+D;AAC3E,SAAO,MAAM,YAAY,cAAe;;CAG1C,MAAM,WAAW,gBAAoE;AACnF,SAAO,MAAM,eAAe,eAAgB;;;AAIhD,mCAAe"}

package/dist/cjs/components/auth/Callback/TokenCallback.cjs

@@ -82,7 +82,7 @@ const TokenCallback = ({ onNavigate, onError, onSuccess, signInPath = "/signin",
 				if (response.flowStatus === __thunderid_browser.EmbeddedSignInFlowStatus.Complete) {
 					const redirectUrl = response?.redirectUrl || response?.redirect_uri;
 					sessionStorage.removeItem(`${vendor}_execution_id`);
-					await storageManager.removeHybridDataParameter("authId");
+					await storageManager.removeFlowAuthId(executionId);
 					onSuccess?.({
 						redirectUrl,
 						...response.data || {}
@@ -97,7 +97,7 @@ const TokenCallback = ({ onNavigate, onError, onSuccess, signInPath = "/signin",
 				if (response.flowStatus === __thunderid_browser.EmbeddedSignInFlowStatus.Error) {
 					const failureReason = response?.failureReason;
 					const error = new Error(failureReason || "Token validation failed. Please try again.");
-					await storageManager.removeHybridDataParameter("authId");
+					await storageManager.removeFlowAuthId(executionId);
 					redirectWithError(error, isRegistrationFlow);
 					return;
 				}
@@ -109,7 +109,7 @@ const TokenCallback = ({ onNavigate, onError, onSuccess, signInPath = "/signin",
 				const error = err instanceof Error ? err : /* @__PURE__ */ new Error("Token callback processing failed");
 				console.error("Token callback error:", err);
 				const storageManager = await getStorageManager();
-				if (storageManager) await storageManager.removeHybridDataParameter("authId");
+				if (storageManager && executionId) await storageManager.removeFlowAuthId(executionId);
 				redirectWithError(error, isRegistrationFlow);
 			}
 		};

package/dist/cjs/components/auth/Callback/TokenCallback.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"TokenCallback.cjs","names":["TokenCallback: FC<TokenCallbackProps>","processingRef: any","useThunderID","url: URL","redirectUrlObj: URL","state: string","params: URLSearchParams","searchParams: URLSearchParams","executionId: string | null","token: string | null","applicationId: string | null","isRegistrationFlow: boolean","storageManager: any","response: any","EmbeddedSignInFlowType","redirectURL: string | undefined","nextExecutionId: string","nextExecutionId","EmbeddedSignInFlowStatus","redirectUrl: string | undefined","failureReason: string | undefined","error: Error"],"sources":["../../../../../src/components/auth/Callback/TokenCallback.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, navigate as browserNavigate} from '@thunderid/browser';\nimport {FC, useEffect, useRef} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\nexport interface TokenCallbackProps {\n  /**\n   * Callback function called when an error occurs\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Function to navigate to a different path.\n   * If not provided, falls back to the browser navigate utility (SPA navigation via History API for same-origin paths).\n   * Provide this prop to enable framework-specific navigation (e.g., from React Router).\n   */\n  onNavigate?: (path: string) => void;\n\n  /**\n   * Callback function called when authentication is successful\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Custom path for the sign-in page. Defaults to '/signin'\n   */\n  signInPath?: string;\n\n  /**\n   * Custom path for the sign-up page. Defaults to '/signup'\n   */\n  signUpPath?: string;\n}\n\nexport const TokenCallback: FC<TokenCallbackProps> = ({\n  onNavigate,\n  onError,\n  onSuccess,\n  signInPath = '/signin',\n  signUpPath = '/signup',\n}: TokenCallbackProps) => {\n  const processingRef: any = useRef(false);\n  const {isInitialized, isLoading, signIn, signUp, getStorageManager, vendor} = useThunderID();\n\n  const navigate = (path: string): void => {\n    if (onNavigate) {\n      onNavigate(path);\n    } else {\n      browserNavigate(path);\n    }\n  };\n\n  const clearTokenFromUrl = (): void => {\n    if (!window?.location?.href) {\n      return;\n    }\n\n    const url: URL = new URL(window.location.href);\n    url.searchParams.delete('token');\n    url.searchParams.delete('type');\n    window.history.replaceState({}, '', url.toString());\n  };\n\n  const initiateOAuthRedirect = (redirectURL: string, isRegistrationFlow?: boolean): void => {\n    const redirectUrlObj: URL = new URL(redirectURL);\n    const state: string = redirectUrlObj.searchParams.get('state') || crypto.randomUUID();\n\n    sessionStorage.setItem(\n      `${vendor}_oauth_${state}`,\n      JSON.stringify({\n        path: isRegistrationFlow ? signUpPath : signInPath,\n        timestamp: Date.now(),\n      }),\n    );\n\n    browserNavigate(redirectUrlObj.toString());\n  };\n\n  const buildSignInPath = (\n    executionId?: string | null,\n    applicationId?: string | null,\n    isRegistrationFlow?: boolean,\n  ): string => {\n    const params: URLSearchParams = new URLSearchParams();\n    if (executionId) {\n      params.set('executionId', executionId);\n    }\n    if (applicationId) {\n      params.set('applicationId', applicationId);\n    }\n\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    return params.toString() ? `${basePath}?${params.toString()}` : basePath;\n  };\n\n  const redirectWithError = (error: Error, isRegistrationFlow?: boolean): void => {\n    sessionStorage.removeItem(`${vendor}_execution_id`);\n\n    onError?.(error);\n\n    const params: URLSearchParams = new URLSearchParams();\n    params.set('error', 'token_verification_failed');\n    params.set('error_description', error.message);\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    navigate(`${basePath}?${params.toString()}`);\n  };\n\n  useEffect(() => {\n    if (!isInitialized || isLoading) {\n      return;\n    }\n\n    const processTokenCallback = async (): Promise<void> => {\n      if (processingRef.current) {\n        return;\n      }\n      processingRef.current = true;\n\n      // Read URL params before clearing them so they're accessible in both try and catch.\n      const searchParams: URLSearchParams = new URLSearchParams(window.location.search);\n      const executionId: string | null = searchParams.get('id') || searchParams.get('executionId');\n      const token: string | null = searchParams.get('token');\n      const applicationId: string | null = searchParams.get('applicationId');\n      const isRegistrationFlow: boolean = searchParams.get('type') === 'REGISTRATION';\n\n      clearTokenFromUrl();\n\n      try {\n        const storageManager: any = await getStorageManager();\n\n        if (!executionId || !token) {\n          const error: Error = new Error('Missing executionId or token in callback URL');\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        let response: any;\n\n        if (isRegistrationFlow) {\n          response = await signUp({executionId, inputs: {token}});\n        } else {\n          response = await signIn({executionId, inputs: {token}});\n        }\n\n        if (response.type === EmbeddedSignInFlowType.Redirection) {\n          const redirectURL: string | undefined = response.data?.redirectURL || response?.redirectURL;\n          const nextExecutionId: string = response.executionId || executionId;\n          sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n          if (redirectURL) {\n            initiateOAuthRedirect(redirectURL, isRegistrationFlow);\n            return;\n          }\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n          const redirectUrl: string | undefined = response?.redirectUrl || response?.redirect_uri;\n\n          sessionStorage.removeItem(`${vendor}_execution_id`);\n          await storageManager.removeHybridDataParameter('authId');\n\n          onSuccess?.({\n            redirectUrl,\n            ...((response.data as Record<string, any>) || {}),\n          });\n\n          if (redirectUrl) {\n            window.location.href = redirectUrl;\n            return;\n          }\n\n          navigate(isRegistrationFlow ? signUpPath : signInPath);\n          return;\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n          const failureReason: string | undefined = response?.failureReason;\n          const error: Error = new Error(failureReason || 'Token validation failed. Please try again.');\n          await storageManager.removeHybridDataParameter('authId');\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        const nextExecutionId: string = response.executionId || executionId;\n        sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n        if (response.challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', response.challengeToken);\n        }\n\n        navigate(buildSignInPath(nextExecutionId, applicationId, isRegistrationFlow));\n      } catch (err) {\n        const error: Error = err instanceof Error ? err : new Error('Token callback processing failed');\n        // eslint-disable-next-line no-console\n        console.error('Token callback error:', err);\n        const storageManager: any = await getStorageManager();\n        if (storageManager) {\n          await storageManager.removeHybridDataParameter('authId');\n        }\n        redirectWithError(error, isRegistrationFlow);\n      }\n    };\n\n    processTokenCallback();\n  }, [\n    getStorageManager,\n    isInitialized,\n    isLoading,\n    onError,\n    onNavigate,\n    onSuccess,\n    signIn,\n    signUp,\n    signInPath,\n    signUpPath,\n    vendor,\n  ]);\n\n  return null;\n};\n\nexport default TokenCallback;\n"],"mappings":";;;;;;;;AAoCA,MAAaA,iBAAyC,EACpD,YACA,SACA,WACA,aAAa,WACb,aAAa,gBACW;CACxB,MAAMC,kCAA4B,MAAM;CACxC,MAAM,EAAC,eAAe,WAAW,QAAQ,QAAQ,mBAAmB,WAAUC,8BAAc;CAE5F,MAAM,YAAY,SAAuB;AACvC,MAAI,WACF,YAAW,KAAK;MAEhB,mCAAgB,KAAK;;CAIzB,MAAM,0BAAgC;AACpC,MAAI,CAAC,QAAQ,UAAU,KACrB;EAGF,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,OAAO;AAC/B,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;CAGrD,MAAM,yBAAyB,aAAqB,uBAAuC;EACzF,MAAMC,iBAAsB,IAAI,IAAI,YAAY;EAChD,MAAMC,QAAgB,eAAe,aAAa,IAAI,QAAQ,IAAI,OAAO,YAAY;AAErF,iBAAe,QACb,GAAG,OAAO,SAAS,SACnB,KAAK,UAAU;GACb,MAAM,qBAAqB,aAAa;GACxC,WAAW,KAAK,KAAK;GACtB,CAAC,CACH;AAED,oCAAgB,eAAe,UAAU,CAAC;;CAG5C,MAAM,mBACJ,aACA,eACA,uBACW;EACX,MAAMC,SAA0B,IAAI,iBAAiB;AACrD,MAAI,YACF,QAAO,IAAI,eAAe,YAAY;AAExC,MAAI,cACF,QAAO,IAAI,iBAAiB,cAAc;EAG5C,MAAM,WAAW,qBAAqB,aAAa;AACnD,SAAO,OAAO,UAAU,GAAG,GAAG,SAAS,GAAG,OAAO,UAAU,KAAK;;CAGlE,MAAM,qBAAqB,OAAc,uBAAuC;AAC9E,iBAAe,WAAW,GAAG,OAAO,eAAe;AAEnD,YAAU,MAAM;EAEhB,MAAMA,SAA0B,IAAI,iBAAiB;AACrD,SAAO,IAAI,SAAS,4BAA4B;AAChD,SAAO,IAAI,qBAAqB,MAAM,QAAQ;AAE9C,WAAS,GADQ,qBAAqB,aAAa,WAC9B,GAAG,OAAO,UAAU,GAAG;;AAG9C,4BAAgB;AACd,MAAI,CAAC,iBAAiB,UACpB;EAGF,MAAM,uBAAuB,YAA2B;AACtD,OAAI,cAAc,QAChB;AAEF,iBAAc,UAAU;GAGxB,MAAMC,eAAgC,IAAI,gBAAgB,OAAO,SAAS,OAAO;GACjF,MAAMC,cAA6B,aAAa,IAAI,KAAK,IAAI,aAAa,IAAI,cAAc;GAC5F,MAAMC,QAAuB,aAAa,IAAI,QAAQ;GACtD,MAAMC,gBAA+B,aAAa,IAAI,gBAAgB;GACtE,MAAMC,qBAA8B,aAAa,IAAI,OAAO,KAAK;AAEjE,sBAAmB;AAEnB,OAAI;IACF,MAAMC,iBAAsB,MAAM,mBAAmB;AAErD,QAAI,CAAC,eAAe,CAAC,OAAO;AAE1B,uCADqB,IAAI,MAAM,+CAA+C,EACrD,mBAAmB;AAC5C;;IAGF,IAAIC;AAEJ,QAAI,mBACF,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;QAEvD,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;AAGzD,QAAI,SAAS,SAASC,2CAAuB,aAAa;KACxD,MAAMC,cAAkC,SAAS,MAAM,eAAe,UAAU;KAChF,MAAMC,oBAA0B,SAAS,eAAe;AACxD,oBAAe,QAAQ,GAAG,OAAO,gBAAgBC,kBAAgB;AAEjE,SAAI,aAAa;AACf,4BAAsB,aAAa,mBAAmB;AACtD;;;AAIJ,QAAI,SAAS,eAAeC,6CAAyB,UAAU;KAC7D,MAAMC,cAAkC,UAAU,eAAe,UAAU;AAE3E,oBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,WAAM,eAAe,0BAA0B,SAAS;AAExD,iBAAY;MACV;MACA,GAAK,SAAS,QAAgC,EAAE;MACjD,CAAC;AAEF,SAAI,aAAa;AACf,aAAO,SAAS,OAAO;AACvB;;AAGF,cAAS,qBAAqB,aAAa,WAAW;AACtD;;AAGF,QAAI,SAAS,eAAeD,6CAAyB,OAAO;KAC1D,MAAME,gBAAoC,UAAU;KACpD,MAAMC,QAAe,IAAI,MAAM,iBAAiB,6CAA6C;AAC7F,WAAM,eAAe,0BAA0B,SAAS;AACxD,uBAAkB,OAAO,mBAAmB;AAC5C;;IAGF,MAAML,kBAA0B,SAAS,eAAe;AACxD,mBAAe,QAAQ,GAAG,OAAO,gBAAgB,gBAAgB;AAEjE,QAAI,SAAS,eACX,OAAM,eAAe,0BAA0B,kBAAkB,SAAS,eAAe;AAG3F,aAAS,gBAAgB,iBAAiB,eAAe,mBAAmB,CAAC;YACtE,KAAK;IACZ,MAAMK,QAAe,eAAe,QAAQ,sBAAM,IAAI,MAAM,mCAAmC;AAE/F,YAAQ,MAAM,yBAAyB,IAAI;IAC3C,MAAMT,iBAAsB,MAAM,mBAAmB;AACrD,QAAI,eACF,OAAM,eAAe,0BAA0B,SAAS;AAE1D,sBAAkB,OAAO,mBAAmB;;;AAIhD,wBAAsB;IACrB;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,QAAO"}
+{"version":3,"file":"TokenCallback.cjs","names":["TokenCallback: FC<TokenCallbackProps>","processingRef: any","useThunderID","url: URL","redirectUrlObj: URL","state: string","params: URLSearchParams","searchParams: URLSearchParams","executionId: string | null","token: string | null","applicationId: string | null","isRegistrationFlow: boolean","storageManager: any","response: any","EmbeddedSignInFlowType","redirectURL: string | undefined","nextExecutionId: string","nextExecutionId","EmbeddedSignInFlowStatus","redirectUrl: string | undefined","failureReason: string | undefined","error: Error"],"sources":["../../../../../src/components/auth/Callback/TokenCallback.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, navigate as browserNavigate} from '@thunderid/browser';\nimport {FC, useEffect, useRef} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\nexport interface TokenCallbackProps {\n  /**\n   * Callback function called when an error occurs\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Function to navigate to a different path.\n   * If not provided, falls back to the browser navigate utility (SPA navigation via History API for same-origin paths).\n   * Provide this prop to enable framework-specific navigation (e.g., from React Router).\n   */\n  onNavigate?: (path: string) => void;\n\n  /**\n   * Callback function called when authentication is successful\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Custom path for the sign-in page. Defaults to '/signin'\n   */\n  signInPath?: string;\n\n  /**\n   * Custom path for the sign-up page. Defaults to '/signup'\n   */\n  signUpPath?: string;\n}\n\nexport const TokenCallback: FC<TokenCallbackProps> = ({\n  onNavigate,\n  onError,\n  onSuccess,\n  signInPath = '/signin',\n  signUpPath = '/signup',\n}: TokenCallbackProps) => {\n  const processingRef: any = useRef(false);\n  const {isInitialized, isLoading, signIn, signUp, getStorageManager, vendor} = useThunderID();\n\n  const navigate = (path: string): void => {\n    if (onNavigate) {\n      onNavigate(path);\n    } else {\n      browserNavigate(path);\n    }\n  };\n\n  const clearTokenFromUrl = (): void => {\n    if (!window?.location?.href) {\n      return;\n    }\n\n    const url: URL = new URL(window.location.href);\n    url.searchParams.delete('token');\n    url.searchParams.delete('type');\n    window.history.replaceState({}, '', url.toString());\n  };\n\n  const initiateOAuthRedirect = (redirectURL: string, isRegistrationFlow?: boolean): void => {\n    const redirectUrlObj: URL = new URL(redirectURL);\n    const state: string = redirectUrlObj.searchParams.get('state') || crypto.randomUUID();\n\n    sessionStorage.setItem(\n      `${vendor}_oauth_${state}`,\n      JSON.stringify({\n        path: isRegistrationFlow ? signUpPath : signInPath,\n        timestamp: Date.now(),\n      }),\n    );\n\n    browserNavigate(redirectUrlObj.toString());\n  };\n\n  const buildSignInPath = (\n    executionId?: string | null,\n    applicationId?: string | null,\n    isRegistrationFlow?: boolean,\n  ): string => {\n    const params: URLSearchParams = new URLSearchParams();\n    if (executionId) {\n      params.set('executionId', executionId);\n    }\n    if (applicationId) {\n      params.set('applicationId', applicationId);\n    }\n\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    return params.toString() ? `${basePath}?${params.toString()}` : basePath;\n  };\n\n  const redirectWithError = (error: Error, isRegistrationFlow?: boolean): void => {\n    sessionStorage.removeItem(`${vendor}_execution_id`);\n\n    onError?.(error);\n\n    const params: URLSearchParams = new URLSearchParams();\n    params.set('error', 'token_verification_failed');\n    params.set('error_description', error.message);\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    navigate(`${basePath}?${params.toString()}`);\n  };\n\n  useEffect(() => {\n    if (!isInitialized || isLoading) {\n      return;\n    }\n\n    const processTokenCallback = async (): Promise<void> => {\n      if (processingRef.current) {\n        return;\n      }\n      processingRef.current = true;\n\n      // Read URL params before clearing them so they're accessible in both try and catch.\n      const searchParams: URLSearchParams = new URLSearchParams(window.location.search);\n      const executionId: string | null = searchParams.get('id') || searchParams.get('executionId');\n      const token: string | null = searchParams.get('token');\n      const applicationId: string | null = searchParams.get('applicationId');\n      const isRegistrationFlow: boolean = searchParams.get('type') === 'REGISTRATION';\n\n      clearTokenFromUrl();\n\n      try {\n        const storageManager: any = await getStorageManager();\n\n        if (!executionId || !token) {\n          const error: Error = new Error('Missing executionId or token in callback URL');\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        let response: any;\n\n        if (isRegistrationFlow) {\n          response = await signUp({executionId, inputs: {token}});\n        } else {\n          response = await signIn({executionId, inputs: {token}});\n        }\n\n        if (response.type === EmbeddedSignInFlowType.Redirection) {\n          const redirectURL: string | undefined = response.data?.redirectURL || response?.redirectURL;\n          const nextExecutionId: string = response.executionId || executionId;\n          sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n          if (redirectURL) {\n            initiateOAuthRedirect(redirectURL, isRegistrationFlow);\n            return;\n          }\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n          const redirectUrl: string | undefined = response?.redirectUrl || response?.redirect_uri;\n\n          sessionStorage.removeItem(`${vendor}_execution_id`);\n          await storageManager.removeFlowAuthId(executionId);\n\n          onSuccess?.({\n            redirectUrl,\n            ...((response.data as Record<string, any>) || {}),\n          });\n\n          if (redirectUrl) {\n            window.location.href = redirectUrl;\n            return;\n          }\n\n          navigate(isRegistrationFlow ? signUpPath : signInPath);\n          return;\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n          const failureReason: string | undefined = response?.failureReason;\n          const error: Error = new Error(failureReason || 'Token validation failed. Please try again.');\n          await storageManager.removeFlowAuthId(executionId);\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        const nextExecutionId: string = response.executionId || executionId;\n        sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n        if (response.challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', response.challengeToken);\n        }\n\n        navigate(buildSignInPath(nextExecutionId, applicationId, isRegistrationFlow));\n      } catch (err) {\n        const error: Error = err instanceof Error ? err : new Error('Token callback processing failed');\n        // eslint-disable-next-line no-console\n        console.error('Token callback error:', err);\n        const storageManager: any = await getStorageManager();\n        if (storageManager && executionId) {\n          await storageManager.removeFlowAuthId(executionId);\n        }\n        redirectWithError(error, isRegistrationFlow);\n      }\n    };\n\n    processTokenCallback();\n  }, [\n    getStorageManager,\n    isInitialized,\n    isLoading,\n    onError,\n    onNavigate,\n    onSuccess,\n    signIn,\n    signUp,\n    signInPath,\n    signUpPath,\n    vendor,\n  ]);\n\n  return null;\n};\n\nexport default TokenCallback;\n"],"mappings":";;;;;;;;AAoCA,MAAaA,iBAAyC,EACpD,YACA,SACA,WACA,aAAa,WACb,aAAa,gBACW;CACxB,MAAMC,kCAA4B,MAAM;CACxC,MAAM,EAAC,eAAe,WAAW,QAAQ,QAAQ,mBAAmB,WAAUC,8BAAc;CAE5F,MAAM,YAAY,SAAuB;AACvC,MAAI,WACF,YAAW,KAAK;MAEhB,mCAAgB,KAAK;;CAIzB,MAAM,0BAAgC;AACpC,MAAI,CAAC,QAAQ,UAAU,KACrB;EAGF,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,OAAO;AAC/B,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;CAGrD,MAAM,yBAAyB,aAAqB,uBAAuC;EACzF,MAAMC,iBAAsB,IAAI,IAAI,YAAY;EAChD,MAAMC,QAAgB,eAAe,aAAa,IAAI,QAAQ,IAAI,OAAO,YAAY;AAErF,iBAAe,QACb,GAAG,OAAO,SAAS,SACnB,KAAK,UAAU;GACb,MAAM,qBAAqB,aAAa;GACxC,WAAW,KAAK,KAAK;GACtB,CAAC,CACH;AAED,oCAAgB,eAAe,UAAU,CAAC;;CAG5C,MAAM,mBACJ,aACA,eACA,uBACW;EACX,MAAMC,SAA0B,IAAI,iBAAiB;AACrD,MAAI,YACF,QAAO,IAAI,eAAe,YAAY;AAExC,MAAI,cACF,QAAO,IAAI,iBAAiB,cAAc;EAG5C,MAAM,WAAW,qBAAqB,aAAa;AACnD,SAAO,OAAO,UAAU,GAAG,GAAG,SAAS,GAAG,OAAO,UAAU,KAAK;;CAGlE,MAAM,qBAAqB,OAAc,uBAAuC;AAC9E,iBAAe,WAAW,GAAG,OAAO,eAAe;AAEnD,YAAU,MAAM;EAEhB,MAAMA,SAA0B,IAAI,iBAAiB;AACrD,SAAO,IAAI,SAAS,4BAA4B;AAChD,SAAO,IAAI,qBAAqB,MAAM,QAAQ;AAE9C,WAAS,GADQ,qBAAqB,aAAa,WAC9B,GAAG,OAAO,UAAU,GAAG;;AAG9C,4BAAgB;AACd,MAAI,CAAC,iBAAiB,UACpB;EAGF,MAAM,uBAAuB,YAA2B;AACtD,OAAI,cAAc,QAChB;AAEF,iBAAc,UAAU;GAGxB,MAAMC,eAAgC,IAAI,gBAAgB,OAAO,SAAS,OAAO;GACjF,MAAMC,cAA6B,aAAa,IAAI,KAAK,IAAI,aAAa,IAAI,cAAc;GAC5F,MAAMC,QAAuB,aAAa,IAAI,QAAQ;GACtD,MAAMC,gBAA+B,aAAa,IAAI,gBAAgB;GACtE,MAAMC,qBAA8B,aAAa,IAAI,OAAO,KAAK;AAEjE,sBAAmB;AAEnB,OAAI;IACF,MAAMC,iBAAsB,MAAM,mBAAmB;AAErD,QAAI,CAAC,eAAe,CAAC,OAAO;AAE1B,uCADqB,IAAI,MAAM,+CAA+C,EACrD,mBAAmB;AAC5C;;IAGF,IAAIC;AAEJ,QAAI,mBACF,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;QAEvD,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;AAGzD,QAAI,SAAS,SAASC,2CAAuB,aAAa;KACxD,MAAMC,cAAkC,SAAS,MAAM,eAAe,UAAU;KAChF,MAAMC,oBAA0B,SAAS,eAAe;AACxD,oBAAe,QAAQ,GAAG,OAAO,gBAAgBC,kBAAgB;AAEjE,SAAI,aAAa;AACf,4BAAsB,aAAa,mBAAmB;AACtD;;;AAIJ,QAAI,SAAS,eAAeC,6CAAyB,UAAU;KAC7D,MAAMC,cAAkC,UAAU,eAAe,UAAU;AAE3E,oBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,WAAM,eAAe,iBAAiB,YAAY;AAElD,iBAAY;MACV;MACA,GAAK,SAAS,QAAgC,EAAE;MACjD,CAAC;AAEF,SAAI,aAAa;AACf,aAAO,SAAS,OAAO;AACvB;;AAGF,cAAS,qBAAqB,aAAa,WAAW;AACtD;;AAGF,QAAI,SAAS,eAAeD,6CAAyB,OAAO;KAC1D,MAAME,gBAAoC,UAAU;KACpD,MAAMC,QAAe,IAAI,MAAM,iBAAiB,6CAA6C;AAC7F,WAAM,eAAe,iBAAiB,YAAY;AAClD,uBAAkB,OAAO,mBAAmB;AAC5C;;IAGF,MAAML,kBAA0B,SAAS,eAAe;AACxD,mBAAe,QAAQ,GAAG,OAAO,gBAAgB,gBAAgB;AAEjE,QAAI,SAAS,eACX,OAAM,eAAe,0BAA0B,kBAAkB,SAAS,eAAe;AAG3F,aAAS,gBAAgB,iBAAiB,eAAe,mBAAmB,CAAC;YACtE,KAAK;IACZ,MAAMK,QAAe,eAAe,QAAQ,sBAAM,IAAI,MAAM,mCAAmC;AAE/F,YAAQ,MAAM,yBAAyB,IAAI;IAC3C,MAAMT,iBAAsB,MAAM,mBAAmB;AACrD,QAAI,kBAAkB,YACpB,OAAM,eAAe,iBAAiB,YAAY;AAEpD,sBAAkB,OAAO,mBAAmB;;;AAIhD,wBAAsB;IACrB;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,QAAO"}

package/dist/cjs/components/auth/SignIn/SignIn.cjs

@@ -161,16 +161,13 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 	* Clear all flow-related storage and state.
 	*/
 	const clearFlowState = async () => {
+		const executionIdToClear = currentExecutionId ?? sessionStorage.getItem(`${vendor}_execution_id`);
 		setExecutionId(null);
 		setComponents([]);
 		setAdditionalData({});
 		setIsFlowInitialized(false);
 		await setChallengeToken(null);
-		try {
-			await (await getStorageManager())?.removeHybridDataParameter?.("authId");
-		} catch {
-			__thunderid_browser.logger.warn("Failed to clear authId from hybrid storage.");
-		}
+		await clearAuthId(executionIdToClear);
 		setIsTimeoutDisabled(false);
 		oauthCodeProcessedRef.current = false;
 	};
@@ -191,18 +188,29 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 		};
 	};
 	/**
-	* Handle authId from URL and persist it via the storage manager so it survives URL cleanup.
-	* ThunderIDReactClient.signIn() reads authId from storageManager.getHybridDataParameter('authId'),
-	* not from raw sessionStorage, so we must use the same storage path here.
+	* Persist the authId from the URL against its execution so it survives URL cleanup.
+	* ThunderIDReactClient.signIn() reads it back with storageManager.getFlowAuthId(executionId),
+	* so another tab's sign-in cannot replace it.
 	*/
-	const handleAuthId = async (authId) => {
-		if (authId) try {
-			await (await getStorageManager())?.setHybridDataParameter?.("authId", authId);
+	const handleAuthId = async (authId, executionId) => {
+		if (authId && executionId) try {
+			await (await getStorageManager())?.setFlowAuthId?.(executionId, authId);
 		} catch {
 			__thunderid_browser.logger.warn("Failed to store authId in hybrid storage.");
 		}
 	};
 	/**
+	* Remove the authId stored for an execution, leaving other tabs' entries in place.
+	*/
+	const clearAuthId = async (executionId) => {
+		if (!executionId) return;
+		try {
+			await (await getStorageManager())?.removeFlowAuthId?.(executionId);
+		} catch {
+			__thunderid_browser.logger.warn("Failed to clear authId from hybrid storage.");
+		}
+	};
+	/**
 	* Clean up OAuth-related URL parameters from the browser URL.
 	*/
 	const cleanupOAuthUrlParams = (includeNonce = false) => {
@@ -254,7 +262,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 			if (redirectURL && window?.location) {
 				if (response.executionId) setExecutionId(response.executionId);
 				await setChallengeToken(response.challengeToken ?? null);
-				await handleAuthId(getUrlParams().authId);
+				await handleAuthId(getUrlParams().authId, response.executionId);
 				require_oauth.initiateOAuthRedirect(redirectURL, vendor);
 				return true;
 			}
@@ -291,15 +299,12 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 		if (response.flowStatus === __thunderid_browser.EmbeddedSignInFlowStatus.Complete) {
 			const finalRedirectUrl = response?.redirectUrl || response?.redirect_uri || afterSignInUrl;
 			setIsSubmitting(false);
+			const completedExecutionId = response.executionId || currentExecutionId || sessionStorage.getItem(`${vendor}_execution_id`);
 			setExecutionId(null);
 			await setChallengeToken(null);
 			setIsFlowInitialized(false);
 			sessionStorage.removeItem(`${vendor}_execution_id`);
-			try {
-				await (await getStorageManager())?.removeHybridDataParameter?.("authId");
-			} catch {
-				__thunderid_browser.logger.warn("Failed to clear authId from hybrid storage after completion.");
-			}
+			await clearAuthId(completedExecutionId);
 			cleanupOAuthUrlParams(true);
 			if (onSuccess) onSuccess({
 				redirectUrl: finalRedirectUrl,
@@ -318,7 +323,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 		const urlParams = getUrlParams();
 		oauthCodeProcessedRef.current = false;
 		setServerFieldErrors(null);
-		await handleAuthId(urlParams.authId);
+		await handleAuthId(urlParams.authId, urlParams.executionId);
 		const effectiveApplicationId = applicationId || urlParams.applicationId;
 		const storedExecutionId = !urlParams.executionId ? sessionStorage.getItem(`${vendor}_execution_id`) : null;
 		const resumeExecutionId = urlParams.executionId || storedExecutionId;
@@ -337,11 +342,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 			} catch (resumeError) {
 				if (storedExecutionId && resumeExecutionId === storedExecutionId && resumeError instanceof __thunderid_browser.ThunderIDAPIError && resumeError.statusCode === 400) {
 					setExecutionId(null);
-					try {
-						await (await getStorageManager())?.removeHybridDataParameter?.("authId");
-					} catch {
-						__thunderid_browser.logger.warn("Failed to clear authId from hybrid storage.");
-					}
+					await clearAuthId(resumeExecutionId);
 					if (!effectiveApplicationId) {
 						const expiredError = (translate) => new __thunderid_browser.ThunderIDRuntimeError(translate("errors.signin.session.expired") || "Your session has expired. Please return to the application and sign in again.", "SIGN_IN_ERROR", "react");
 						setError(expiredError);
@@ -374,6 +375,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 				setAdditionalData(normalizedAdditionalData ?? {});
 				setIsFlowInitialized(true);
 				setIsTimeoutDisabled(false);
+				await handleAuthId(urlParams.authId, normalizedExecutionId);
 				cleanupFlowUrlParams();
 			}
 		} catch (error) {
@@ -392,7 +394,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 			handleOAuthError(urlParams.error, urlParams.errorDescription);
 			return;
 		}
-		handleAuthId(urlParams.authId);
+		handleAuthId(urlParams.authId, urlParams.executionId);
 	}, []);
 	(0, react.useEffect)(() => {
 		const currentUrlParams = getUrlParams();

package/dist/cjs/components/auth/SignIn/SignIn.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.cjs","names":["submitActions: EmbeddedFlowComponent[]","SignIn: FC<SignInProps>","useThunderID","useTranslation","challengeTokenRef: any","flowError: Error | null","resolveFlowError","initializationAttemptedRef: any","oauthCodeProcessedRef: any","passkeyProcessedRef: any","tempData: any","storageManager: any","urlParams: any","url: any","ThunderIDRuntimeError","EmbeddedSignInFlowType","redirectURL: any","EmbeddedSignInFlowStatus","extractErrorMessage","finalRedirectUrl: any","effectiveApplicationId: any","storedExecutionId: any","resumeExecutionId: any","response: EmbeddedSignInFlowResponse","ThunderIDAPIError","expiredError: FlowErrorBuilder","EmbeddedFlowType","normalizeFlowResponse","err: any","currentUrlParams: any","effectiveExecutionId: any","processedInputs: Record<string, any>","consentReason: string | undefined","consentPromptRawData: any","purposes: any[]","found: any","submitAction: any","ConsentConstants","isConsentApprovalBlocked","reason: string | undefined","effectiveExecutionIdForPasskey: any","responseFieldErrors: FieldError[] | undefined","timeoutMs: number","actionId: string | undefined","timerId: ReturnType<typeof setTimeout>","inputs: Record<string, string>","passkeyResponse: any","handlePasskeyAuthentication","passkeyResponseObj: any","handlePasskeyRegistration","renderPropFieldErrors: Record<string, string>","BaseSignIn"],"sources":["../../../../../src/components/auth/SignIn/SignIn.tsx"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDRuntimeError,\n  ThunderIDAPIError,\n  ConsentConstants,\n  EmbeddedFlowComponent,\n  EmbeddedFlowType,\n  EmbeddedSignInFlowResponse,\n  EmbeddedSignInFlowRequest,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignInFlowType,\n  FieldError,\n  FlowMetadataResponse,\n  Preferences,\n  logger,\n  compileConsentDecisions,\n} from '@thunderid/browser';\nimport {FC, ReactElement, useState, useEffect, useMemo, useRef, ReactNode} from 'react';\n// eslint-disable-next-line import/no-named-as-default\nimport BaseSignIn, {BaseSignInProps} from './BaseSignIn';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport {useOAuthCallback} from '../../../hooks/auth/useOAuthCallback';\nimport useTranslation from '../../../hooks/useTranslation';\nimport {\n  extractErrorMessage,\n  FlowErrorBuilder,\n  normalizeFlowResponse,\n  resolveFlowError,\n} from '../../../utils/flowTransformer';\nimport isConsentApprovalBlocked from '../../../utils/isConsentApprovalBlocked';\nimport {initiateOAuthRedirect} from '../../../utils/oauth';\nimport {handlePasskeyAuthentication, handlePasskeyRegistration} from '../../../utils/passkey';\n\n/**\n * Render props function parameters\n */\nexport interface SignInRenderProps {\n  /**\n   * Additional data from the flow response containing contextual information\n   * like consent prompt details and session timeouts.\n   */\n  additionalData?: Record<string, any>;\n\n  /**\n   * Current flow components\n   */\n  components: EmbeddedFlowComponent[];\n\n  /**\n   * Current error if any\n   */\n  error: Error | null;\n\n  /**\n   * Server-side field-level validation errors from the most recent flow response,\n   * collapsed to one message per field (first error wins). Empty when no validation\n   * failures are active. Render-prop consumers should display these alongside their\n   * own client-side validation errors.\n   */\n  fieldErrors: Record<string, string>;\n\n  /**\n   * Function to manually initialize the flow\n   */\n  initialize: () => Promise<void>;\n\n  /**\n   * Whether the flow has been initialized\n   */\n  isInitialized: boolean;\n\n  /**\n   * Loading state indicator\n   */\n  isLoading: boolean;\n\n  /**\n   * Flag indicating whether the flow step timeout has expired.\n   * Consuming components can use this to disable submit buttons.\n   */\n  isTimeoutDisabled?: boolean;\n\n  /**\n   * Flow metadata returned by the platform (v2 only). `null` while loading or unavailable.\n   */\n  meta: FlowMetadataResponse | null;\n\n  /**\n   * Function to submit authentication data (primary)\n   */\n  onSubmit: (payload: EmbeddedSignInFlowRequest) => Promise<void>;\n}\n\n/**\n * Props for the SignIn component.\n * Matches the interface from the main SignIn component for consistency.\n */\nexport interface SignInProps {\n  /**\n   * Render props function for custom UI\n   */\n  children?: (props: SignInRenderProps) => ReactNode;\n\n  /**\n   * Custom CSS class name for the form container.\n   */\n  className?: string;\n\n  /**\n   * Bounds the sign-in to this organization unit. Sent as `ouId` on the request that starts the\n   * `AUTHENTICATION` flow only, never on a continuation.\n   */\n  organizationUnitId?: string;\n\n  /**\n   * Callback function called when authentication fails.\n   * @param error - The error that occurred during authentication.\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Callback function called when authentication is successful.\n   * @param authData - The authentication data returned upon successful completion.\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Component-level preferences to override global i18n and theme settings.\n   * Preferences are deep-merged with global ones, with component preferences\n   * taking precedence. Affects this component and all its descendants.\n   */\n  preferences?: Preferences;\n\n  /**\n   * When a field has been blurred at least once, re-run validation on every subsequent\n   * keystroke so a rendered error clears the moment the value becomes valid. Doesn't\n   * affect fields that have never been blurred — the user isn't shown errors while\n   * initially typing. Default `false` preserves prior behavior.\n   */\n  revalidateOnChangeAfterBlur?: boolean;\n\n  /**\n   * Size variant for the component.\n   */\n  size?: 'small' | 'medium' | 'large';\n\n  /**\n   * Theme variant for the component.\n   */\n  variant?: BaseSignInProps['variant'];\n}\n\n/**\n * State for tracking passkey registration\n */\ninterface PasskeyState {\n  actionId: string | null;\n  challenge: string | null;\n  creationOptions: string | null;\n  error: Error | null;\n  executionId: string | null;\n  isActive: boolean;\n}\n\n/**\n * Sentinel input key carrying the reason a consent prompt was submitted. It is folded into the\n * compiled `consent_decisions` payload and stripped from the inputs, like `__consent_opt__` keys.\n */\nconst CONSENT_REASON_KEY = '__consent_reason__';\n\n/** Flattens a component tree into a single list, parents before their children. */\nconst flattenComponents = (comps: EmbeddedFlowComponent[] | undefined): EmbeddedFlowComponent[] =>\n  (comps ?? []).flatMap((comp: EmbeddedFlowComponent) => [comp, ...flattenComponents(comp.components)]);\n\n/**\n * Finds the action to submit an expired consent prompt with. A non-primary submit action is\n * preferred so the payload reads as a denial, falling back to any submit action because the server\n * needs an action to route the prompt node. Returns undefined when the view has neither.\n */\nconst findConsentSubmitActionId = (comps: EmbeddedFlowComponent[] | undefined): string | undefined => {\n  const submitActions: EmbeddedFlowComponent[] = flattenComponents(comps).filter(\n    (comp: EmbeddedFlowComponent) => comp.id && comp.eventType?.toUpperCase() === 'SUBMIT',\n  );\n  const denyAction: EmbeddedFlowComponent | undefined = submitActions.find(\n    (comp: EmbeddedFlowComponent) => comp.variant?.toLowerCase() !== 'primary',\n  );\n\n  return (denyAction ?? submitActions[0])?.id;\n};\n\n/**\n * A component-driven SignIn component that provides authentication flow with pre-built styling.\n * This component handles the flow API calls for authentication and delegates UI logic to BaseSignIn.\n * It automatically transforms simple input-based responses into component-driven UI format.\n *\n * @example\n * // Default UI\n * ```tsx\n * import { SignIn } from '@thunderid/react/component-driven';\n *\n * const App = () => {\n *   return (\n *     <SignIn\n *       onSuccess={(authData) => {\n *         console.log('Authentication successful:', authData);\n *       }}\n *       onError={(error) => {\n *         console.error('Authentication failed:', error);\n *       }}\n *       size=\"medium\"\n *       variant=\"outlined\"\n *     />\n *   );\n * };\n * ```\n *\n * @example\n * // Custom UI with render props\n * ```tsx\n * import { SignIn } from '@thunderid/react/component-driven';\n *\n * const App = () => {\n *   return (\n *     <SignIn\n *       onSuccess={(authData) => console.log('Success:', authData)}\n *       onError={(error) => console.error('Error:', error)}\n *     >\n *       {({signIn, isLoading, components, error, isInitialized}) => (\n *         <div className=\"custom-signin\">\n *           <h1>Custom Sign In</h1>\n *           {!isInitialized ? (\n *             <p>Initializing...</p>\n *           ) : error ? (\n *             <div className=\"error\">{error.message}</div>\n *           ) : (\n *             <form onSubmit={(e) => {\n *               e.preventDefault();\n *               signIn({inputs: {username: 'user', password: 'pass'}});\n *             }}>\n *               <button type=\"submit\" disabled={isLoading}>\n *                 {isLoading ? 'Signing in...' : 'Sign In'}\n *               </button>\n *             </form>\n *           )}\n *         </div>\n *       )}\n *     </SignIn>\n *   );\n * };\n * ```\n */\nconst SignIn: FC<SignInProps> = ({\n  className,\n  preferences,\n  size = 'medium',\n  onSuccess,\n  onError,\n  variant,\n  children,\n  revalidateOnChangeAfterBlur,\n  organizationUnitId,\n}: SignInProps): ReactElement => {\n  const {applicationId, afterSignInUrl, signIn, isInitialized, isLoading, meta, getStorageManager, scopes, vendor} =\n    useThunderID();\n  const {t} = useTranslation(preferences?.i18n);\n\n  // State management for the flow\n  const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n  const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n  // Server-side validation errors from the most recent flow response. Updated on every\n  // submission; cleared when the next submission begins so stale errors don't linger.\n  const [serverFieldErrors, setServerFieldErrors] = useState<FieldError[] | null>(null);\n  const [currentExecutionId, setCurrentExecutionId] = useState<string | null>(null);\n  const challengeTokenRef: any = useRef<string | null>(null);\n  const [isStorageReady, setIsStorageReady] = useState(false);\n  const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n  // Raw banner error source, resolved on render so the message follows a language change.\n  const [flowErrorSource, setFlowErrorSource] = useState<unknown>(null);\n  const flowError: Error | null = useMemo(\n    () => (flowErrorSource === null ? null : resolveFlowError(flowErrorSource, t)),\n    [flowErrorSource, t],\n  );\n  const [isSubmitting, setIsSubmitting] = useState(false);\n  const [isTimeoutDisabled, setIsTimeoutDisabled] = useState<boolean>(false);\n  const [passkeyState, setPasskeyState] = useState<PasskeyState>({\n    actionId: null,\n    challenge: null,\n    creationOptions: null,\n    error: null,\n    executionId: null,\n    isActive: false,\n  });\n  const initializationAttemptedRef: any = useRef(false);\n  const oauthCodeProcessedRef: any = useRef(false);\n  const passkeyProcessedRef: any = useRef(false);\n  // Deadline this component has already auto-submitted for, so a re-run of the timeout effect\n  // cannot submit the same expired step twice.\n  const timeoutSubmittedForRef = useRef<number | null>(null);\n  // The timeout effect is keyed on the deadline alone, so a step that arrives carrying the same\n  // deadline would otherwise leave the pending timer holding the previous step's context.\n  const timeoutContextRef = useRef<{\n    components: EmbeddedFlowComponent[];\n    hasConsentPrompt: boolean;\n    submit: (payload: EmbeddedSignInFlowRequest) => Promise<void>;\n  } | null>(null);\n  /**\n   * Sets executionId between sessionStorage and state.\n   * This ensures both are always in sync.\n   */\n  const setExecutionId = (executionId: string | null): void => {\n    setCurrentExecutionId(executionId);\n    if (executionId) {\n      sessionStorage.setItem(`${vendor}_execution_id`, executionId);\n    } else {\n      sessionStorage.removeItem(`${vendor}_execution_id`);\n    }\n  };\n\n  /**\n   * Restore any challenge token persisted before an OAuth redirect.\n   * Waits for SDK initialization before reading from storage.\n   */\n  useEffect(() => {\n    if (!isInitialized) return;\n\n    (async (): Promise<void> => {\n      try {\n        const storageManager: any = await getStorageManager();\n        const tempData: any = await storageManager?.getTemporaryData();\n        if (tempData?.challengeToken) {\n          challengeTokenRef.current = tempData.challengeToken as string;\n        }\n      } finally {\n        setIsStorageReady(true);\n      }\n    })();\n  }, [isInitialized]);\n\n  /**\n   * Updates challengeTokenRef immediately (stale-closure safe) and persists via\n   * the provider's StorageManager so the token survives OAuth redirects.\n   */\n  const setChallengeToken = async (challengeToken: string | null): Promise<void> => {\n    challengeTokenRef.current = challengeToken;\n    try {\n      const storageManager: any = await getStorageManager();\n      if (storageManager) {\n        if (challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', challengeToken);\n        } else {\n          await storageManager.removeTemporaryDataParameter('challengeToken');\n        }\n      }\n    } catch {\n      logger.warn('Failed to persist challenge token in storage.');\n    }\n  };\n\n  /**\n   * Clear all flow-related storage and state.\n   */\n  const clearFlowState = async (): Promise<void> => {\n    // Clear the expired flow state to prevent rendering a stale form with a null executionId.\n    // Kept before the first await so callers that do not await this function still apply the\n    // reset in one batch, ahead of the setError that follows.\n    setExecutionId(null);\n    setComponents([]);\n    setAdditionalData({});\n    setIsFlowInitialized(false);\n    await setChallengeToken(null);\n    try {\n      const storageManager: any = await getStorageManager();\n      await storageManager?.removeHybridDataParameter?.('authId');\n    } catch {\n      logger.warn('Failed to clear authId from hybrid storage.');\n    }\n    setIsTimeoutDisabled(false);\n    // Reset refs to allow new flows to start properly\n    oauthCodeProcessedRef.current = false;\n  };\n\n  /**\n   * Parse URL parameters used in flows.\n   */\n  const getUrlParams = (): any => {\n    const urlParams: any = new URL(window?.location?.href ?? '').searchParams;\n\n    return {\n      applicationId: urlParams.get('applicationId'),\n      authId: urlParams.get('authId'),\n      code: urlParams.get('code'),\n      error: urlParams.get('error'),\n      errorDescription: urlParams.get('error_description'),\n      executionId: urlParams.get('executionId'),\n      nonce: urlParams.get('nonce'),\n      state: urlParams.get('state'),\n    };\n  };\n\n  /**\n   * Handle authId from URL and persist it via the storage manager so it survives URL cleanup.\n   * ThunderIDReactClient.signIn() reads authId from storageManager.getHybridDataParameter('authId'),\n   * not from raw sessionStorage, so we must use the same storage path here.\n   */\n  const handleAuthId = async (authId: string | null): Promise<void> => {\n    if (authId) {\n      try {\n        const storageManager: any = await getStorageManager();\n        await storageManager?.setHybridDataParameter?.('authId', authId);\n      } catch {\n        logger.warn('Failed to store authId in hybrid storage.');\n      }\n    }\n  };\n\n  /**\n   * Clean up OAuth-related URL parameters from the browser URL.\n   */\n  const cleanupOAuthUrlParams = (includeNonce = false): void => {\n    if (!window?.location?.href) return;\n    const url: any = new URL(window.location.href);\n    url.searchParams.delete('error');\n    url.searchParams.delete('error_description');\n    url.searchParams.delete('code');\n    url.searchParams.delete('state');\n    if (includeNonce) {\n      url.searchParams.delete('nonce');\n    }\n    window?.history?.replaceState({}, '', url.toString());\n  };\n\n  /**\n   * Clean up flow-related URL parameters (executionId, authId) from the browser URL.\n   * Used after executionId is set in state to prevent using invalidated executionId from URL.\n   */\n  const cleanupFlowUrlParams = (): void => {\n    if (!window?.location?.href) return;\n    const url: any = new URL(window.location.href);\n    url.searchParams.delete('executionId');\n    url.searchParams.delete('authId');\n    url.searchParams.delete('applicationId');\n    window?.history?.replaceState({}, '', url.toString());\n  };\n\n  /**\n   * Set error state and call onError callback.\n   * Ensures isFlowInitialized is true so errors can be displayed in the UI.\n   */\n  const setError = (source: unknown): void => {\n    // Updater form, so React stores a FlowErrorBuilder instead of calling it.\n    setFlowErrorSource(() => source);\n    setIsFlowInitialized(true);\n    onError?.(resolveFlowError(source, t));\n  };\n\n  /**\n   * Handle OAuth error from URL parameters.\n   * Clears flow state, creates error, and cleans up URL.\n   */\n  const handleOAuthError = (error: string, errorDescription: string | null): void => {\n    clearFlowState();\n    const errorMessage: any = errorDescription || `OAuth error: ${error}`;\n    const err: any = new ThunderIDRuntimeError(errorMessage, 'SIGN_IN_ERROR', 'react');\n    setError(err);\n    cleanupOAuthUrlParams(true);\n  };\n\n  /**\n   * Handle REDIRECTION response by storing flow state and redirecting to OAuth provider.\n   */\n  const handleRedirection = async (response: EmbeddedSignInFlowResponse): Promise<boolean> => {\n    if (response.type === EmbeddedSignInFlowType.Redirection) {\n      const redirectURL: any = (response.data as any)?.redirectURL || (response as any)?.redirectURL;\n\n      if (redirectURL && window?.location) {\n        if (response.executionId) {\n          setExecutionId(response.executionId);\n        }\n        await setChallengeToken(response.challengeToken ?? null);\n\n        const urlParams: any = getUrlParams();\n        await handleAuthId(urlParams.authId);\n\n        initiateOAuthRedirect(redirectURL, vendor);\n        return true;\n      }\n    }\n    return false;\n  };\n\n  /**\n   * Handle ERROR and COMPLETE responses. Returns true if fully handled.\n   * ERROR + executionId: recoverable — session preserved for retry.\n   * ERROR + no executionId: terminal — clear state and surface the error.\n   */\n  const handleTerminalResponse = async (response: EmbeddedSignInFlowResponse): Promise<boolean> => {\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n      // Propagate OAuth error to the client\n      if (response.redirectUrl && window?.location) {\n        setIsSubmitting(false);\n        await clearFlowState();\n        cleanupOAuthUrlParams(true);\n        onError?.(new Error(extractErrorMessage(response, t)));\n        window.location.href = response.redirectUrl;\n\n        return true;\n      }\n\n      if (response.executionId) {\n        // Recoverable: session still alive. Show inline error without firing onError.\n        setExecutionId(response.executionId);\n        await setChallengeToken(response.challengeToken ?? null);\n        setIsFlowInitialized(true);\n        setFlowErrorSource(response);\n        return true;\n      }\n      // Terminal: backend invalidated the session — clear all state.\n      await clearFlowState();\n      setError(response);\n      cleanupFlowUrlParams();\n      return true;\n    }\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // Get redirectUrl from response (from /oauth2/auth/callback) or fall back to afterSignInUrl\n      const redirectUrl: any = (response as any)?.redirectUrl || (response as any)?.redirect_uri;\n      const finalRedirectUrl: any = redirectUrl || afterSignInUrl;\n\n      // Clear submitting state before redirect\n      setIsSubmitting(false);\n\n      // Clear all OAuth-related storage on successful completion\n      setExecutionId(null);\n      await setChallengeToken(null);\n      setIsFlowInitialized(false);\n      sessionStorage.removeItem(`${vendor}_execution_id`);\n      try {\n        const storageManager: any = await getStorageManager();\n        await storageManager?.removeHybridDataParameter?.('authId');\n      } catch {\n        logger.warn('Failed to clear authId from hybrid storage after completion.');\n      }\n\n      // Clean up OAuth URL params before redirect\n      cleanupOAuthUrlParams(true);\n\n      if (onSuccess) {\n        onSuccess({\n          redirectUrl: finalRedirectUrl,\n          ...(response.data || {}),\n        });\n      }\n\n      if (finalRedirectUrl && window?.location) {\n        window.location.href = finalRedirectUrl;\n      }\n\n      return true;\n    }\n\n    return false;\n  };\n\n  /**\n   * Initialize the authentication flow.\n   * Priority: executionId > applicationId (from context) > applicationId (from URL)\n   */\n  const initializeFlow = async (): Promise<void> => {\n    const urlParams: any = getUrlParams();\n\n    // Reset OAuth code processed ref when starting a new flow\n    oauthCodeProcessedRef.current = false;\n    // Clear stale serverFieldErrors so the new flow doesn't inherit them via render-prop.\n    setServerFieldErrors(null);\n\n    await handleAuthId(urlParams.authId);\n\n    const effectiveApplicationId: any = applicationId || urlParams.applicationId;\n\n    // On a page refresh the executionId is no longer in the URL (it is scrubbed by\n    // cleanupFlowUrlParams after the first load). Fall back to the executionId persisted in\n    // sessionStorage so the in-progress flow can be resumed instead of starting a new flow.\n    // This is required for authorization_code apps where direct new-flow initiation is blocked\n    // server-side and the flow must be initiated through the OAuth /authorize endpoint.\n    const storedExecutionId: any = !urlParams.executionId ? sessionStorage.getItem(`${vendor}_execution_id`) : null;\n    const resumeExecutionId: any = urlParams.executionId || storedExecutionId;\n\n    if (!resumeExecutionId && !effectiveApplicationId) {\n      const error: any = new ThunderIDRuntimeError(\n        'Either executionId or applicationId is required for authentication',\n        'SIGN_IN_ERROR',\n        'react',\n      );\n      setError(error);\n\n      return;\n    }\n\n    try {\n      setFlowErrorSource(null);\n\n      let response: EmbeddedSignInFlowResponse;\n\n      if (resumeExecutionId) {\n        try {\n          response = (await signIn({\n            executionId: resumeExecutionId,\n            ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n          })) as EmbeddedSignInFlowResponse;\n        } catch (resumeError) {\n          // Only treat a stale/expired session (HTTP 400 from the server, meaning the stored\n          // executionId is no longer valid) as a recoverable condition. Transient failures\n          // such as 5xx server errors or network errors are rethrown so they surface correctly.\n          const isStaleSession: boolean =\n            storedExecutionId &&\n            resumeExecutionId === storedExecutionId &&\n            resumeError instanceof ThunderIDAPIError &&\n            resumeError.statusCode === 400;\n\n          if (isStaleSession) {\n            setExecutionId(null);\n            try {\n              const storageManager: any = await getStorageManager();\n              await storageManager?.removeHybridDataParameter?.('authId');\n            } catch {\n              logger.warn('Failed to clear authId from hybrid storage.');\n            }\n            if (!effectiveApplicationId) {\n              const expiredError: FlowErrorBuilder = (translate) =>\n                new ThunderIDRuntimeError(\n                  translate('errors.signin.session.expired') ||\n                    'Your session has expired. Please return to the application and sign in again.',\n                  'SIGN_IN_ERROR',\n                  'react',\n                );\n              setError(expiredError);\n              return;\n            }\n            response = (await signIn({\n              applicationId: effectiveApplicationId,\n              flowType: EmbeddedFlowType.Authentication,\n              ...(scopes && {scopes}),\n              ...(organizationUnitId && {ouId: organizationUnitId}),\n            })) as EmbeddedSignInFlowResponse;\n          } else {\n            throw resumeError;\n          }\n        }\n      } else {\n        response = (await signIn({\n          applicationId: effectiveApplicationId,\n          flowType: EmbeddedFlowType.Authentication,\n          ...(scopes && {scopes}),\n          ...(organizationUnitId && {ouId: organizationUnitId}),\n        })) as EmbeddedSignInFlowResponse;\n      }\n\n      if (await handleRedirection(response)) {\n        return;\n      }\n\n      // Handle a flow that completes (or errors) on the very first step — e.g. a reused SSO\n      // session lets the backend return COMPLETE immediately with no UI components. Without\n      // this the UI would fall through with no components and spin forever.\n      if (await handleTerminalResponse(response)) {\n        // Only reset the init gate for unrecoverable Error responses so the user can retry;\n        // Complete-without-redirect would otherwise kick off a fresh flow unintentionally.\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error && !response.executionId) {\n          initializationAttemptedRef.current = false;\n        }\n        return;\n      }\n\n      const {\n        executionId: normalizedExecutionId,\n        components: normalizedComponents,\n        additionalData: normalizedAdditionalData,\n      } = normalizeFlowResponse(\n        response,\n        t,\n        {\n          resolveTranslations: false,\n        },\n        meta,\n      );\n\n      await setChallengeToken(response.challengeToken ?? null);\n\n      if (normalizedExecutionId && normalizedComponents) {\n        setExecutionId(normalizedExecutionId);\n        setComponents(normalizedComponents);\n        setAdditionalData(normalizedAdditionalData ?? {});\n        setIsFlowInitialized(true);\n        setIsTimeoutDisabled(false);\n        // Clean up executionId from URL after setting it in state\n        cleanupFlowUrlParams();\n      }\n    } catch (error) {\n      const err: any = error;\n      await clearFlowState();\n\n      setError(err);\n      initializationAttemptedRef.current = false;\n    }\n  };\n\n  /**\n   * Initialize the flow and handle cleanup of stale flow state.\n   */\n  useEffect(() => {\n    const urlParams: any = getUrlParams();\n\n    // Check for OAuth error in URL\n    if (urlParams.error) {\n      handleOAuthError(urlParams.error, urlParams.errorDescription);\n      return;\n    }\n\n    handleAuthId(urlParams.authId);\n\n    // Skip OAuth code processing - let the dedicated OAuth useEffect handle it\n    // No action needed here as the dedicated useEffect will handle it\n  }, []);\n\n  useEffect(() => {\n    // Only initialize if we're not processing an OAuth callback or submission.\n    // Wait for isStorageReady so the challenge token is restored from storage before\n    // we attempt to resume a persisted executionId — the server requires it.\n    const currentUrlParams: any = getUrlParams();\n    if (\n      isInitialized &&\n      isStorageReady &&\n      !isLoading &&\n      !isFlowInitialized &&\n      !initializationAttemptedRef.current &&\n      !currentExecutionId &&\n      !currentUrlParams.code &&\n      !currentUrlParams.state &&\n      !isSubmitting &&\n      !oauthCodeProcessedRef.current\n    ) {\n      initializationAttemptedRef.current = true;\n      initializeFlow();\n    }\n  }, [isInitialized, isStorageReady, isLoading, isFlowInitialized, currentExecutionId]);\n\n  /**\n   * Handle form submission from BaseSignIn or render props.\n   */\n  const handleSubmit = async (payload: EmbeddedSignInFlowRequest): Promise<void> => {\n    // Use executionId from payload if available, otherwise fall back to currentExecutionId\n    const effectiveExecutionId: any = payload.executionId || currentExecutionId;\n\n    if (!effectiveExecutionId) {\n      throw new Error('No active flow ID');\n    }\n\n    let processedInputs: Record<string, any> = {...payload.inputs};\n\n    // Read and strip the sentinel up front so it can never reach the wire as an input\n    const consentReason: string | undefined = processedInputs[CONSENT_REASON_KEY];\n    delete processedInputs[CONSENT_REASON_KEY];\n\n    // Auto-compile consent decisions if we are currently on a consent prompt step\n    if (additionalData?.['consentPrompt']) {\n      try {\n        const consentPromptRawData: any = additionalData['consentPrompt'];\n        const purposes: any[] =\n          typeof consentPromptRawData === 'string'\n            ? JSON.parse(consentPromptRawData)\n            : consentPromptRawData.purposes || consentPromptRawData;\n\n        // Find the action component to determine if it was a deny action\n        let isDeny = false;\n        if (payload.action) {\n          // Flatten components to find the action\n          const findAction = (comps: any[]): any => {\n            if (!comps || comps.length === 0) return null;\n\n            const found: any = comps.find((c: any) => c.id === payload.action);\n            if (found) return found;\n\n            return comps.reduce((acc: any, c: any) => {\n              if (acc) return acc;\n              if (c.components) return findAction(c.components);\n              return null;\n            }, null);\n          };\n\n          const submitAction: any = findAction(components);\n\n          if (submitAction && submitAction.variant?.toLowerCase() !== 'primary') {\n            isDeny = true;\n          }\n        }\n\n        // An expired prompt is never an approval, whichever action carried the submission\n        if (consentReason === ConsentConstants.REASON_TIMEOUT) {\n          isDeny = true;\n        }\n\n        // Approval waits while an approved authorization detail shows a value that cannot be submitted\n        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument\n        if (!isDeny && isConsentApprovalBlocked(purposes, processedInputs)) {\n          return;\n        }\n\n        // An explicit denial carries a reason too, so the server never has to infer one\n        const reason: string | undefined = consentReason ?? (isDeny ? ConsentConstants.REASON_USER_DENIED : undefined);\n\n        processedInputs = compileConsentDecisions(processedInputs, purposes, {\n          approved: !isDeny,\n          ...(reason ? {reason} : {}),\n        });\n      } catch (e) {\n        // Failed to construct consent_decisions payload automatically\n      }\n    }\n\n    try {\n      setIsSubmitting(true);\n      setFlowErrorSource(null);\n      // Clear any field errors from the previous response before the new round-trip.\n      setServerFieldErrors(null);\n\n      const response: EmbeddedSignInFlowResponse = (await signIn({\n        executionId: effectiveExecutionId,\n        ...payload,\n        inputs: processedInputs,\n        ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n      })) as EmbeddedSignInFlowResponse;\n\n      if (await handleRedirection(response)) {\n        return;\n      }\n      if (\n        response.data?.additionalData?.['passkeyChallenge'] ||\n        response.data?.additionalData?.['passkeyCreationOptions']\n      ) {\n        const {passkeyChallenge, passkeyCreationOptions}: any = response.data.additionalData;\n        const effectiveExecutionIdForPasskey: any = response.executionId || effectiveExecutionId;\n\n        // Reset passkey processed ref to allow processing\n        passkeyProcessedRef.current = false;\n\n        await setChallengeToken(response.challengeToken ?? null);\n\n        // Set passkey state to trigger the passkey\n        setPasskeyState({\n          actionId: 'submit',\n          challenge: passkeyChallenge,\n          creationOptions: passkeyCreationOptions,\n          error: null,\n          executionId: effectiveExecutionIdForPasskey,\n          isActive: true,\n        });\n        setIsSubmitting(false);\n\n        return;\n      }\n\n      // Handle terminal flow statuses before normalization.\n      if (await handleTerminalResponse(response)) {\n        return;\n      }\n\n      const {\n        executionId: normalizedExecutionId,\n        components: normalizedComponents,\n        additionalData: normalizedAdditionalData,\n      } = normalizeFlowResponse(\n        response,\n        t,\n        {\n          resolveTranslations: false,\n        },\n        meta,\n      );\n\n      // Always update challenge token on any INCOMPLETE response — token rotates every step.\n      await setChallengeToken(response.challengeToken ?? null);\n\n      // Update executionId if response contains a new one\n      if (normalizedExecutionId && normalizedComponents) {\n        setExecutionId(normalizedExecutionId);\n        setComponents(normalizedComponents);\n        setAdditionalData(normalizedAdditionalData ?? {});\n        setIsTimeoutDisabled(false);\n        // Ensure flow is marked as initialized when we have components\n        setIsFlowInitialized(true);\n        // Clean up executionId from URL after setting it in state\n        cleanupFlowUrlParams();\n\n        // Surface server-side validation failures so BaseSignIn can inject them into\n        // the form-level fieldErrors state used by the render-prop / default UI.\n        const responseFieldErrors: FieldError[] | undefined = (response.data as any)?.fieldErrors;\n        if (responseFieldErrors && responseFieldErrors.length > 0) {\n          setServerFieldErrors(responseFieldErrors);\n        }\n\n        // Display error from INCOMPLETE response\n        if ((response as any)?.error) {\n          setFlowErrorSource(response);\n        }\n      }\n    } catch (error) {\n      const err: any = error;\n      await clearFlowState();\n\n      setError(err);\n      return;\n    } finally {\n      setIsSubmitting(false);\n    }\n  };\n\n  /**\n   * Handle step timeout if configured in additionalData.\n   *\n   * An expired consent prompt is auto-submitted as a denial carrying the timeout reason, because its\n   * actions no longer lead anywhere and the user would otherwise be stranded on the prompt. The\n   * server discards those decisions and records nothing. Every other kind of step surfaces the\n   * expiry error instead.\n   */\n  timeoutContextRef.current = {\n    components,\n    hasConsentPrompt: Boolean(additionalData?.['consentPrompt']),\n    submit: handleSubmit,\n  };\n\n  useEffect(() => {\n    const timeoutMs: number = Number(additionalData?.['stepTimeout']) || 0;\n    if (timeoutMs <= 0 || !isFlowInitialized) {\n      setIsTimeoutDisabled(false);\n      return undefined;\n    }\n\n    const handleTimeout = (): void => {\n      setIsTimeoutDisabled(true);\n\n      const expiredError: FlowErrorBuilder = (translate) =>\n        new Error(translate('errors.signin.timeout') || 'Time allowed to complete the step has expired.');\n\n      // Read through the ref so the timer always sees the step that is on screen when it fires\n      const context = timeoutContextRef.current;\n      const actionId: string | undefined = context?.hasConsentPrompt\n        ? findConsentSubmitActionId(context.components)\n        : undefined;\n\n      // Without an action the prompt node cannot be routed, so there is nothing to submit\n      if (actionId && context && timeoutSubmittedForRef.current !== timeoutMs) {\n        timeoutSubmittedForRef.current = timeoutMs;\n        context\n          .submit({action: actionId, inputs: {[CONSENT_REASON_KEY]: ConsentConstants.REASON_TIMEOUT}})\n          .catch(() => setError(expiredError));\n        return;\n      }\n\n      setError(expiredError);\n    };\n\n    const timerId: ReturnType<typeof setTimeout> = setTimeout(handleTimeout, Math.max(0, timeoutMs - Date.now()));\n\n    return () => clearTimeout(timerId);\n  }, [additionalData?.['stepTimeout'], isFlowInitialized, t]);\n\n  /**\n   * Handle authentication errors.\n   */\n  const handleError = (error: Error): void => {\n    setError(error);\n  };\n\n  useOAuthCallback({\n    currentExecutionId,\n    executionIdStorageKey: `${vendor}_execution_id`,\n    isInitialized: isInitialized && !isLoading && isStorageReady,\n    isSubmitting,\n    onError: (err: any) => {\n      clearFlowState();\n      setError(err instanceof Error ? err : new Error(String(err)));\n    },\n    onSubmit: async (payload: any) => handleSubmit({executionId: payload.executionId, inputs: payload.inputs}),\n    processedRef: oauthCodeProcessedRef,\n    setExecutionId,\n  });\n\n  /**\n   * Handle passkey authentication/registration when passkey state becomes active.\n   * This effect auto-triggers the browser passkey popup and submits the result.\n   */\n  useEffect(() => {\n    if (\n      !passkeyState.isActive ||\n      (!passkeyState.challenge && !passkeyState.creationOptions) ||\n      !passkeyState.executionId\n    ) {\n      return;\n    }\n\n    // Prevent re-processing\n    if (passkeyProcessedRef.current) {\n      return;\n    }\n    passkeyProcessedRef.current = true;\n\n    const performPasskeyProcess = async (): Promise<void> => {\n      let inputs: Record<string, string>;\n\n      if (passkeyState.challenge) {\n        const passkeyResponse: any = await handlePasskeyAuthentication(passkeyState.challenge);\n        const passkeyResponseObj: any = JSON.parse(passkeyResponse);\n\n        inputs = {\n          authenticatorData: passkeyResponseObj.response.authenticatorData,\n          clientDataJSON: passkeyResponseObj.response.clientDataJSON,\n          credentialId: passkeyResponseObj.id,\n          signature: passkeyResponseObj.response.signature,\n          userHandle: passkeyResponseObj.response.userHandle,\n        };\n      } else if (passkeyState.creationOptions) {\n        const passkeyResponse: any = await handlePasskeyRegistration(passkeyState.creationOptions);\n        const passkeyResponseObj: any = JSON.parse(passkeyResponse);\n\n        inputs = {\n          attestationObject: passkeyResponseObj.response.attestationObject,\n          clientDataJSON: passkeyResponseObj.response.clientDataJSON,\n          credentialId: passkeyResponseObj.id,\n        };\n      } else {\n        throw new Error('No passkey challenge or creation options available');\n      }\n\n      await handleSubmit({\n        executionId: passkeyState.executionId ?? undefined,\n        inputs,\n      });\n    };\n\n    performPasskeyProcess()\n      .then(() => {\n        setPasskeyState({\n          actionId: null,\n          challenge: null,\n          creationOptions: null,\n          error: null,\n          executionId: null,\n          isActive: false,\n        });\n      })\n      .catch((error: any) => {\n        setPasskeyState((prev: any) => ({...prev, error: error as Error, isActive: false}));\n        setError(error);\n      });\n  }, [passkeyState.isActive, passkeyState.challenge, passkeyState.creationOptions, passkeyState.executionId]);\n\n  if (children) {\n    // Collapse the server FieldError[] array to a single message per field map for\n    // render-prop consumers. First error per field wins. Multi-error cases per\n    // field are rare in practice (server typically returns one rule failure per\n    // field in current flows) and consumers needing the full array can still read\n    // it from the raw flow response.\n    const renderPropFieldErrors: Record<string, string> = {};\n    if (serverFieldErrors) {\n      for (const fe of serverFieldErrors) {\n        if (!(fe.identifier in renderPropFieldErrors)) {\n          renderPropFieldErrors[fe.identifier] = fe.message;\n        }\n      }\n    }\n\n    const renderProps: SignInRenderProps = {\n      additionalData,\n      components,\n      error: flowError,\n      fieldErrors: renderPropFieldErrors,\n      initialize: initializeFlow,\n      isInitialized: isFlowInitialized,\n      isLoading: isLoading || isSubmitting || !isInitialized,\n      isTimeoutDisabled,\n      meta,\n      onSubmit: handleSubmit,\n    };\n\n    return <>{children(renderProps)}</>;\n  }\n  // Otherwise, render the default BaseSignIn component\n  return (\n    <BaseSignIn\n      additionalData={additionalData}\n      components={components}\n      isLoading={isLoading || !isInitialized || !isFlowInitialized}\n      isTimeoutDisabled={isTimeoutDisabled}\n      onSubmit={handleSubmit}\n      onError={handleError}\n      error={flowError}\n      className={className}\n      size={size}\n      variant={variant}\n      preferences={preferences}\n      revalidateOnChangeAfterBlur={revalidateOnChangeAfterBlur}\n      serverFieldErrors={serverFieldErrors}\n    />\n  );\n};\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0KA,MAAM,qBAAqB;;AAG3B,MAAM,qBAAqB,WACxB,SAAS,EAAE,EAAE,SAAS,SAAgC,CAAC,MAAM,GAAG,kBAAkB,KAAK,WAAW,CAAC,CAAC;;;;;;AAOvG,MAAM,6BAA6B,UAAmE;CACpG,MAAMA,gBAAyC,kBAAkB,MAAM,CAAC,QACrE,SAAgC,KAAK,MAAM,KAAK,WAAW,aAAa,KAAK,SAC/E;AAKD,SAJsD,cAAc,MACjE,SAAgC,KAAK,SAAS,aAAa,KAAK,UAClE,IAEqB,cAAc,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgE3C,MAAMC,UAA2B,EAC/B,WACA,aACA,OAAO,UACP,WACA,SACA,SACA,UACA,6BACA,yBAC+B;CAC/B,MAAM,EAAC,eAAe,gBAAgB,QAAQ,eAAe,WAAW,MAAM,mBAAmB,QAAQ,WACvGC,8BAAc;CAChB,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAG7C,MAAM,CAAC,YAAY,qCAAmD,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,yCAAmD,EAAE,CAAC;CAG7E,MAAM,CAAC,mBAAmB,4CAAsD,KAAK;CACrF,MAAM,CAAC,oBAAoB,6CAAiD,KAAK;CACjF,MAAMC,sCAA+C,KAAK;CAC1D,MAAM,CAAC,gBAAgB,yCAA8B,MAAM;CAC3D,MAAM,CAAC,mBAAmB,4CAAiC,MAAM;CAEjE,MAAM,CAAC,iBAAiB,0CAAwC,KAAK;CACrE,MAAMC,qCACG,oBAAoB,OAAO,OAAOC,yCAAiB,iBAAiB,EAAE,EAC7E,CAAC,iBAAiB,EAAE,CACrB;CACD,MAAM,CAAC,cAAc,uCAA4B,MAAM;CACvD,MAAM,CAAC,mBAAmB,4CAA0C,MAAM;CAC1E,MAAM,CAAC,cAAc,uCAA0C;EAC7D,UAAU;EACV,WAAW;EACX,iBAAiB;EACjB,OAAO;EACP,aAAa;EACb,UAAU;EACX,CAAC;CACF,MAAMC,+CAAyC,MAAM;CACrD,MAAMC,0CAAoC,MAAM;CAChD,MAAMC,wCAAkC,MAAM;CAG9C,MAAM,2CAA+C,KAAK;CAG1D,MAAM,sCAII,KAAK;;;;;CAKf,MAAM,kBAAkB,gBAAqC;AAC3D,wBAAsB,YAAY;AAClC,MAAI,YACF,gBAAe,QAAQ,GAAG,OAAO,gBAAgB,YAAY;MAE7D,gBAAe,WAAW,GAAG,OAAO,eAAe;;;;;;AAQvD,4BAAgB;AACd,MAAI,CAAC,cAAe;AAEpB,GAAC,YAA2B;AAC1B,OAAI;IAEF,MAAMC,WAAgB,OADM,MAAM,mBAAmB,GACT,kBAAkB;AAC9D,QAAI,UAAU,eACZ,mBAAkB,UAAU,SAAS;aAE/B;AACR,sBAAkB,KAAK;;MAEvB;IACH,CAAC,cAAc,CAAC;;;;;CAMnB,MAAM,oBAAoB,OAAO,mBAAiD;AAChF,oBAAkB,UAAU;AAC5B,MAAI;GACF,MAAMC,iBAAsB,MAAM,mBAAmB;AACrD,OAAI,eACF,KAAI,eACF,OAAM,eAAe,0BAA0B,kBAAkB,eAAe;OAEhF,OAAM,eAAe,6BAA6B,iBAAiB;UAGjE;AACN,8BAAO,KAAK,gDAAgD;;;;;;CAOhE,MAAM,iBAAiB,YAA2B;AAIhD,iBAAe,KAAK;AACpB,gBAAc,EAAE,CAAC;AACjB,oBAAkB,EAAE,CAAC;AACrB,uBAAqB,MAAM;AAC3B,QAAM,kBAAkB,KAAK;AAC7B,MAAI;AAEF,UAD4B,MAAM,mBAAmB,GAC/B,4BAA4B,SAAS;UACrD;AACN,8BAAO,KAAK,8CAA8C;;AAE5D,uBAAqB,MAAM;AAE3B,wBAAsB,UAAU;;;;;CAMlC,MAAM,qBAA0B;EAC9B,MAAMC,YAAiB,IAAI,IAAI,QAAQ,UAAU,QAAQ,GAAG,CAAC;AAE7D,SAAO;GACL,eAAe,UAAU,IAAI,gBAAgB;GAC7C,QAAQ,UAAU,IAAI,SAAS;GAC/B,MAAM,UAAU,IAAI,OAAO;GAC3B,OAAO,UAAU,IAAI,QAAQ;GAC7B,kBAAkB,UAAU,IAAI,oBAAoB;GACpD,aAAa,UAAU,IAAI,cAAc;GACzC,OAAO,UAAU,IAAI,QAAQ;GAC7B,OAAO,UAAU,IAAI,QAAQ;GAC9B;;;;;;;CAQH,MAAM,eAAe,OAAO,WAAyC;AACnE,MAAI,OACF,KAAI;AAEF,UAD4B,MAAM,mBAAmB,GAC/B,yBAAyB,UAAU,OAAO;UAC1D;AACN,8BAAO,KAAK,4CAA4C;;;;;;CAQ9D,MAAM,yBAAyB,eAAe,UAAgB;AAC5D,MAAI,CAAC,QAAQ,UAAU,KAAM;EAC7B,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,oBAAoB;AAC5C,MAAI,aAAa,OAAO,OAAO;AAC/B,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aACF,KAAI,aAAa,OAAO,QAAQ;AAElC,UAAQ,SAAS,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;;;;;CAOvD,MAAM,6BAAmC;AACvC,MAAI,CAAC,QAAQ,UAAU,KAAM;EAC7B,MAAMA,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,cAAc;AACtC,MAAI,aAAa,OAAO,SAAS;AACjC,MAAI,aAAa,OAAO,gBAAgB;AACxC,UAAQ,SAAS,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;;;;;CAOvD,MAAM,YAAY,WAA0B;AAE1C,2BAAyB,OAAO;AAChC,uBAAqB,KAAK;AAC1B,YAAUP,yCAAiB,QAAQ,EAAE,CAAC;;;;;;CAOxC,MAAM,oBAAoB,OAAe,qBAA0C;AACjF,kBAAgB;AAGhB,WADiB,IAAIQ,0CADK,oBAAoB,gBAAgB,SACL,iBAAiB,QAAQ,CACrE;AACb,wBAAsB,KAAK;;;;;CAM7B,MAAM,oBAAoB,OAAO,aAA2D;AAC1F,MAAI,SAAS,SAASC,2CAAuB,aAAa;GACxD,MAAMC,cAAoB,SAAS,MAAc,eAAgB,UAAkB;AAEnF,OAAI,eAAe,QAAQ,UAAU;AACnC,QAAI,SAAS,YACX,gBAAe,SAAS,YAAY;AAEtC,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,UAAM,aADiB,cAAc,CACR,OAAO;AAEpC,wCAAsB,aAAa,OAAO;AAC1C,WAAO;;;AAGX,SAAO;;;;;;;CAQT,MAAM,yBAAyB,OAAO,aAA2D;AAC/F,MAAI,SAAS,eAAeC,6CAAyB,OAAO;AAE1D,OAAI,SAAS,eAAe,QAAQ,UAAU;AAC5C,oBAAgB,MAAM;AACtB,UAAM,gBAAgB;AACtB,0BAAsB,KAAK;AAC3B,cAAU,IAAI,MAAMC,4CAAoB,UAAU,EAAE,CAAC,CAAC;AACtD,WAAO,SAAS,OAAO,SAAS;AAEhC,WAAO;;AAGT,OAAI,SAAS,aAAa;AAExB,mBAAe,SAAS,YAAY;AACpC,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AACxD,yBAAqB,KAAK;AAC1B,uBAAmB,SAAS;AAC5B,WAAO;;AAGT,SAAM,gBAAgB;AACtB,YAAS,SAAS;AAClB,yBAAsB;AACtB,UAAO;;AAGT,MAAI,SAAS,eAAeD,6CAAyB,UAAU;GAG7D,MAAME,mBADoB,UAAkB,eAAgB,UAAkB,gBACjC;AAG7C,mBAAgB,MAAM;AAGtB,kBAAe,KAAK;AACpB,SAAM,kBAAkB,KAAK;AAC7B,wBAAqB,MAAM;AAC3B,kBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,OAAI;AAEF,WAD4B,MAAM,mBAAmB,GAC/B,4BAA4B,SAAS;WACrD;AACN,+BAAO,KAAK,+DAA+D;;AAI7E,yBAAsB,KAAK;AAE3B,OAAI,UACF,WAAU;IACR,aAAa;IACb,GAAI,SAAS,QAAQ,EAAE;IACxB,CAAC;AAGJ,OAAI,oBAAoB,QAAQ,SAC9B,QAAO,SAAS,OAAO;AAGzB,UAAO;;AAGT,SAAO;;;;;;CAOT,MAAM,iBAAiB,YAA2B;EAChD,MAAMP,YAAiB,cAAc;AAGrC,wBAAsB,UAAU;AAEhC,uBAAqB,KAAK;AAE1B,QAAM,aAAa,UAAU,OAAO;EAEpC,MAAMQ,yBAA8B,iBAAiB,UAAU;EAO/D,MAAMC,oBAAyB,CAAC,UAAU,cAAc,eAAe,QAAQ,GAAG,OAAO,eAAe,GAAG;EAC3G,MAAMC,oBAAyB,UAAU,eAAe;AAExD,MAAI,CAAC,qBAAqB,CAAC,wBAAwB;AAMjD,YALmB,IAAIR,0CACrB,sEACA,iBACA,QACD,CACc;AAEf;;AAGF,MAAI;AACF,sBAAmB,KAAK;GAExB,IAAIS;AAEJ,OAAI,kBACF,KAAI;AACF,eAAY,MAAM,OAAO;KACvB,aAAa;KACb,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;KACjF,CAAC;YACK,aAAa;AAUpB,QALE,qBACA,sBAAsB,qBACtB,uBAAuBC,yCACvB,YAAY,eAAe,KAET;AAClB,oBAAe,KAAK;AACpB,SAAI;AAEF,aAD4B,MAAM,mBAAmB,GAC/B,4BAA4B,SAAS;aACrD;AACN,iCAAO,KAAK,8CAA8C;;AAE5D,SAAI,CAAC,wBAAwB;MAC3B,MAAMC,gBAAkC,cACtC,IAAIX,0CACF,UAAU,gCAAgC,IACxC,iFACF,iBACA,QACD;AACH,eAAS,aAAa;AACtB;;AAEF,gBAAY,MAAM,OAAO;MACvB,eAAe;MACf,UAAUY,qCAAiB;MAC3B,GAAI,UAAU,EAAC,QAAO;MACtB,GAAI,sBAAsB,EAAC,MAAM,oBAAmB;MACrD,CAAC;UAEF,OAAM;;OAIV,YAAY,MAAM,OAAO;IACvB,eAAe;IACf,UAAUA,qCAAiB;IAC3B,GAAI,UAAU,EAAC,QAAO;IACtB,GAAI,sBAAsB,EAAC,MAAM,oBAAmB;IACrD,CAAC;AAGJ,OAAI,MAAM,kBAAkB,SAAS,CACnC;AAMF,OAAI,MAAM,uBAAuB,SAAS,EAAE;AAG1C,QAAI,SAAS,eAAeT,6CAAyB,SAAS,CAAC,SAAS,YACtE,4BAA2B,UAAU;AAEvC;;GAGF,MAAM,EACJ,aAAa,uBACb,YAAY,sBACZ,gBAAgB,6BACdU,8CACF,UACA,GACA,EACE,qBAAqB,OACtB,EACD,KACD;AAED,SAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAExD,OAAI,yBAAyB,sBAAsB;AACjD,mBAAe,sBAAsB;AACrC,kBAAc,qBAAqB;AACnC,sBAAkB,4BAA4B,EAAE,CAAC;AACjD,yBAAqB,KAAK;AAC1B,yBAAqB,MAAM;AAE3B,0BAAsB;;WAEjB,OAAO;GACd,MAAMC,MAAW;AACjB,SAAM,gBAAgB;AAEtB,YAAS,IAAI;AACb,8BAA2B,UAAU;;;;;;AAOzC,4BAAgB;EACd,MAAMhB,YAAiB,cAAc;AAGrC,MAAI,UAAU,OAAO;AACnB,oBAAiB,UAAU,OAAO,UAAU,iBAAiB;AAC7D;;AAGF,eAAa,UAAU,OAAO;IAI7B,EAAE,CAAC;AAEN,4BAAgB;EAId,MAAMiB,mBAAwB,cAAc;AAC5C,MACE,iBACA,kBACA,CAAC,aACD,CAAC,qBACD,CAAC,2BAA2B,WAC5B,CAAC,sBACD,CAAC,iBAAiB,QAClB,CAAC,iBAAiB,SAClB,CAAC,gBACD,CAAC,sBAAsB,SACvB;AACA,8BAA2B,UAAU;AACrC,mBAAgB;;IAEjB;EAAC;EAAe;EAAgB;EAAW;EAAmB;EAAmB,CAAC;;;;CAKrF,MAAM,eAAe,OAAO,YAAsD;EAEhF,MAAMC,uBAA4B,QAAQ,eAAe;AAEzD,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM,oBAAoB;EAGtC,IAAIC,kBAAuC,EAAC,GAAG,QAAQ,QAAO;EAG9D,MAAMC,gBAAoC,gBAAgB;AAC1D,SAAO,gBAAgB;AAGvB,MAAI,iBAAiB,iBACnB,KAAI;GACF,MAAMC,uBAA4B,eAAe;GACjD,MAAMC,WACJ,OAAO,yBAAyB,WAC5B,KAAK,MAAM,qBAAqB,GAChC,qBAAqB,YAAY;GAGvC,IAAI,SAAS;AACb,OAAI,QAAQ,QAAQ;IAElB,MAAM,cAAc,UAAsB;AACxC,SAAI,CAAC,SAAS,MAAM,WAAW,EAAG,QAAO;KAEzC,MAAMC,QAAa,MAAM,MAAM,MAAW,EAAE,OAAO,QAAQ,OAAO;AAClE,SAAI,MAAO,QAAO;AAElB,YAAO,MAAM,QAAQ,KAAU,MAAW;AACxC,UAAI,IAAK,QAAO;AAChB,UAAI,EAAE,WAAY,QAAO,WAAW,EAAE,WAAW;AACjD,aAAO;QACN,KAAK;;IAGV,MAAMC,eAAoB,WAAW,WAAW;AAEhD,QAAI,gBAAgB,aAAa,SAAS,aAAa,KAAK,UAC1D,UAAS;;AAKb,OAAI,kBAAkBC,qCAAiB,eACrC,UAAS;AAKX,OAAI,CAAC,UAAUC,yCAAyB,UAAU,gBAAgB,CAChE;GAIF,MAAMC,SAA6B,kBAAkB,SAASF,qCAAiB,qBAAqB;AAEpG,sEAA0C,iBAAiB,UAAU;IACnE,UAAU,CAAC;IACX,GAAI,SAAS,EAAC,QAAO,GAAG,EAAE;IAC3B,CAAC;WACK,GAAG;AAKd,MAAI;AACF,mBAAgB,KAAK;AACrB,sBAAmB,KAAK;AAExB,wBAAqB,KAAK;GAE1B,MAAMd,WAAwC,MAAM,OAAO;IACzD,aAAa;IACb,GAAG;IACH,QAAQ;IACR,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;IACjF,CAAC;AAEF,OAAI,MAAM,kBAAkB,SAAS,CACnC;AAEF,OACE,SAAS,MAAM,iBAAiB,uBAChC,SAAS,MAAM,iBAAiB,2BAChC;IACA,MAAM,EAAC,kBAAkB,2BAA+B,SAAS,KAAK;IACtE,MAAMiB,iCAAsC,SAAS,eAAe;AAGpE,wBAAoB,UAAU;AAE9B,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,oBAAgB;KACd,UAAU;KACV,WAAW;KACX,iBAAiB;KACjB,OAAO;KACP,aAAa;KACb,UAAU;KACX,CAAC;AACF,oBAAgB,MAAM;AAEtB;;AAIF,OAAI,MAAM,uBAAuB,SAAS,CACxC;GAGF,MAAM,EACJ,aAAa,uBACb,YAAY,sBACZ,gBAAgB,6BACdb,8CACF,UACA,GACA,EACE,qBAAqB,OACtB,EACD,KACD;AAGD,SAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,OAAI,yBAAyB,sBAAsB;AACjD,mBAAe,sBAAsB;AACrC,kBAAc,qBAAqB;AACnC,sBAAkB,4BAA4B,EAAE,CAAC;AACjD,yBAAqB,MAAM;AAE3B,yBAAqB,KAAK;AAE1B,0BAAsB;IAItB,MAAMc,sBAAiD,SAAS,MAAc;AAC9E,QAAI,uBAAuB,oBAAoB,SAAS,EACtD,sBAAqB,oBAAoB;AAI3C,QAAK,UAAkB,MACrB,oBAAmB,SAAS;;WAGzB,OAAO;GACd,MAAMb,MAAW;AACjB,SAAM,gBAAgB;AAEtB,YAAS,IAAI;AACb;YACQ;AACR,mBAAgB,MAAM;;;;;;;;;;;AAY1B,mBAAkB,UAAU;EAC1B;EACA,kBAAkB,QAAQ,iBAAiB,iBAAiB;EAC5D,QAAQ;EACT;AAED,4BAAgB;EACd,MAAMc,YAAoB,OAAO,iBAAiB,eAAe,IAAI;AACrE,MAAI,aAAa,KAAK,CAAC,mBAAmB;AACxC,wBAAqB,MAAM;AAC3B;;EAGF,MAAM,sBAA4B;AAChC,wBAAqB,KAAK;GAE1B,MAAMjB,gBAAkC,cACtC,IAAI,MAAM,UAAU,wBAAwB,IAAI,iDAAiD;GAGnG,MAAM,UAAU,kBAAkB;GAClC,MAAMkB,WAA+B,SAAS,mBAC1C,0BAA0B,QAAQ,WAAW,GAC7C;AAGJ,OAAI,YAAY,WAAW,uBAAuB,YAAY,WAAW;AACvE,2BAAuB,UAAU;AACjC,YACG,OAAO;KAAC,QAAQ;KAAU,QAAQ,GAAE,qBAAqBN,qCAAiB,gBAAe;KAAC,CAAC,CAC3F,YAAY,SAAS,aAAa,CAAC;AACtC;;AAGF,YAAS,aAAa;;EAGxB,MAAMO,UAAyC,WAAW,eAAe,KAAK,IAAI,GAAG,YAAY,KAAK,KAAK,CAAC,CAAC;AAE7G,eAAa,aAAa,QAAQ;IACjC;EAAC,iBAAiB;EAAgB;EAAmB;EAAE,CAAC;;;;CAK3D,MAAM,eAAe,UAAuB;AAC1C,WAAS,MAAM;;AAGjB,2CAAiB;EACf;EACA,uBAAuB,GAAG,OAAO;EACjC,eAAe,iBAAiB,CAAC,aAAa;EAC9C;EACA,UAAU,QAAa;AACrB,mBAAgB;AAChB,YAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC,CAAC;;EAE/D,UAAU,OAAO,YAAiB,aAAa;GAAC,aAAa,QAAQ;GAAa,QAAQ,QAAQ;GAAO,CAAC;EAC1G,cAAc;EACd;EACD,CAAC;;;;;AAMF,4BAAgB;AACd,MACE,CAAC,aAAa,YACb,CAAC,aAAa,aAAa,CAAC,aAAa,mBAC1C,CAAC,aAAa,YAEd;AAIF,MAAI,oBAAoB,QACtB;AAEF,sBAAoB,UAAU;EAE9B,MAAM,wBAAwB,YAA2B;GACvD,IAAIC;AAEJ,OAAI,aAAa,WAAW;IAC1B,MAAMC,kBAAuB,MAAMC,4CAA4B,aAAa,UAAU;IACtF,MAAMC,qBAA0B,KAAK,MAAM,gBAAgB;AAE3D,aAAS;KACP,mBAAmB,mBAAmB,SAAS;KAC/C,gBAAgB,mBAAmB,SAAS;KAC5C,cAAc,mBAAmB;KACjC,WAAW,mBAAmB,SAAS;KACvC,YAAY,mBAAmB,SAAS;KACzC;cACQ,aAAa,iBAAiB;IACvC,MAAMF,kBAAuB,MAAMG,0CAA0B,aAAa,gBAAgB;IAC1F,MAAMD,qBAA0B,KAAK,MAAM,gBAAgB;AAE3D,aAAS;KACP,mBAAmB,mBAAmB,SAAS;KAC/C,gBAAgB,mBAAmB,SAAS;KAC5C,cAAc,mBAAmB;KAClC;SAED,OAAM,IAAI,MAAM,qDAAqD;AAGvE,SAAM,aAAa;IACjB,aAAa,aAAa,eAAe;IACzC;IACD,CAAC;;AAGJ,yBAAuB,CACpB,WAAW;AACV,mBAAgB;IACd,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,OAAO;IACP,aAAa;IACb,UAAU;IACX,CAAC;IACF,CACD,OAAO,UAAe;AACrB,oBAAiB,UAAe;IAAC,GAAG;IAAa;IAAgB,UAAU;IAAM,EAAE;AACnF,YAAS,MAAM;IACf;IACH;EAAC,aAAa;EAAU,aAAa;EAAW,aAAa;EAAiB,aAAa;EAAY,CAAC;AAE3G,KAAI,UAAU;EAMZ,MAAME,wBAAgD,EAAE;AACxD,MAAI,mBACF;QAAK,MAAM,MAAM,kBACf,KAAI,EAAE,GAAG,cAAc,uBACrB,uBAAsB,GAAG,cAAc,GAAG;;AAkBhD,SAAO,mFAAG,SAb6B;GACrC;GACA;GACA,OAAO;GACP,aAAa;GACb,YAAY;GACZ,eAAe;GACf,WAAW,aAAa,gBAAgB,CAAC;GACzC;GACA;GACA,UAAU;GACX,CAE8B,GAAI;;AAGrC,QACE,2CAACC;EACiB;EACJ;EACZ,WAAW,aAAa,CAAC,iBAAiB,CAAC;EACxB;EACnB,UAAU;EACV,SAAS;EACT,OAAO;EACI;EACL;EACG;EACI;EACgB;EACV;GACnB;;AAIN,qBAAe"}
+{"version":3,"file":"SignIn.cjs","names":["submitActions: EmbeddedFlowComponent[]","SignIn: FC<SignInProps>","useThunderID","useTranslation","challengeTokenRef: any","flowError: Error | null","resolveFlowError","initializationAttemptedRef: any","oauthCodeProcessedRef: any","passkeyProcessedRef: any","tempData: any","storageManager: any","executionIdToClear: string | null","urlParams: any","url: any","ThunderIDRuntimeError","EmbeddedSignInFlowType","redirectURL: any","EmbeddedSignInFlowStatus","extractErrorMessage","finalRedirectUrl: any","completedExecutionId: string | null","effectiveApplicationId: any","storedExecutionId: any","resumeExecutionId: any","response: EmbeddedSignInFlowResponse","ThunderIDAPIError","expiredError: FlowErrorBuilder","EmbeddedFlowType","normalizeFlowResponse","err: any","currentUrlParams: any","effectiveExecutionId: any","processedInputs: Record<string, any>","consentReason: string | undefined","consentPromptRawData: any","purposes: any[]","found: any","submitAction: any","ConsentConstants","isConsentApprovalBlocked","reason: string | undefined","effectiveExecutionIdForPasskey: any","responseFieldErrors: FieldError[] | undefined","timeoutMs: number","actionId: string | undefined","timerId: ReturnType<typeof setTimeout>","inputs: Record<string, string>","passkeyResponse: any","handlePasskeyAuthentication","passkeyResponseObj: any","handlePasskeyRegistration","renderPropFieldErrors: Record<string, string>","BaseSignIn"],"sources":["../../../../../src/components/auth/SignIn/SignIn.tsx"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDRuntimeError,\n  ThunderIDAPIError,\n  ConsentConstants,\n  EmbeddedFlowComponent,\n  EmbeddedFlowType,\n  EmbeddedSignInFlowResponse,\n  EmbeddedSignInFlowRequest,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignInFlowType,\n  FieldError,\n  FlowMetadataResponse,\n  Preferences,\n  logger,\n  compileConsentDecisions,\n} from '@thunderid/browser';\nimport {FC, ReactElement, useState, useEffect, useMemo, useRef, ReactNode} from 'react';\n// eslint-disable-next-line import/no-named-as-default\nimport BaseSignIn, {BaseSignInProps} from './BaseSignIn';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport {useOAuthCallback} from '../../../hooks/auth/useOAuthCallback';\nimport useTranslation from '../../../hooks/useTranslation';\nimport {\n  extractErrorMessage,\n  FlowErrorBuilder,\n  normalizeFlowResponse,\n  resolveFlowError,\n} from '../../../utils/flowTransformer';\nimport isConsentApprovalBlocked from '../../../utils/isConsentApprovalBlocked';\nimport {initiateOAuthRedirect} from '../../../utils/oauth';\nimport {handlePasskeyAuthentication, handlePasskeyRegistration} from '../../../utils/passkey';\n\n/**\n * Render props function parameters\n */\nexport interface SignInRenderProps {\n  /**\n   * Additional data from the flow response containing contextual information\n   * like consent prompt details and session timeouts.\n   */\n  additionalData?: Record<string, any>;\n\n  /**\n   * Current flow components\n   */\n  components: EmbeddedFlowComponent[];\n\n  /**\n   * Current error if any\n   */\n  error: Error | null;\n\n  /**\n   * Server-side field-level validation errors from the most recent flow response,\n   * collapsed to one message per field (first error wins). Empty when no validation\n   * failures are active. Render-prop consumers should display these alongside their\n   * own client-side validation errors.\n   */\n  fieldErrors: Record<string, string>;\n\n  /**\n   * Function to manually initialize the flow\n   */\n  initialize: () => Promise<void>;\n\n  /**\n   * Whether the flow has been initialized\n   */\n  isInitialized: boolean;\n\n  /**\n   * Loading state indicator\n   */\n  isLoading: boolean;\n\n  /**\n   * Flag indicating whether the flow step timeout has expired.\n   * Consuming components can use this to disable submit buttons.\n   */\n  isTimeoutDisabled?: boolean;\n\n  /**\n   * Flow metadata returned by the platform (v2 only). `null` while loading or unavailable.\n   */\n  meta: FlowMetadataResponse | null;\n\n  /**\n   * Function to submit authentication data (primary)\n   */\n  onSubmit: (payload: EmbeddedSignInFlowRequest) => Promise<void>;\n}\n\n/**\n * Props for the SignIn component.\n * Matches the interface from the main SignIn component for consistency.\n */\nexport interface SignInProps {\n  /**\n   * Render props function for custom UI\n   */\n  children?: (props: SignInRenderProps) => ReactNode;\n\n  /**\n   * Custom CSS class name for the form container.\n   */\n  className?: string;\n\n  /**\n   * Bounds the sign-in to this organization unit. Sent as `ouId` on the request that starts the\n   * `AUTHENTICATION` flow only, never on a continuation.\n   */\n  organizationUnitId?: string;\n\n  /**\n   * Callback function called when authentication fails.\n   * @param error - The error that occurred during authentication.\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Callback function called when authentication is successful.\n   * @param authData - The authentication data returned upon successful completion.\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Component-level preferences to override global i18n and theme settings.\n   * Preferences are deep-merged with global ones, with component preferences\n   * taking precedence. Affects this component and all its descendants.\n   */\n  preferences?: Preferences;\n\n  /**\n   * When a field has been blurred at least once, re-run validation on every subsequent\n   * keystroke so a rendered error clears the moment the value becomes valid. Doesn't\n   * affect fields that have never been blurred — the user isn't shown errors while\n   * initially typing. Default `false` preserves prior behavior.\n   */\n  revalidateOnChangeAfterBlur?: boolean;\n\n  /**\n   * Size variant for the component.\n   */\n  size?: 'small' | 'medium' | 'large';\n\n  /**\n   * Theme variant for the component.\n   */\n  variant?: BaseSignInProps['variant'];\n}\n\n/**\n * State for tracking passkey registration\n */\ninterface PasskeyState {\n  actionId: string | null;\n  challenge: string | null;\n  creationOptions: string | null;\n  error: Error | null;\n  executionId: string | null;\n  isActive: boolean;\n}\n\n/**\n * Sentinel input key carrying the reason a consent prompt was submitted. It is folded into the\n * compiled `consent_decisions` payload and stripped from the inputs, like `__consent_opt__` keys.\n */\nconst CONSENT_REASON_KEY = '__consent_reason__';\n\n/** Flattens a component tree into a single list, parents before their children. */\nconst flattenComponents = (comps: EmbeddedFlowComponent[] | undefined): EmbeddedFlowComponent[] =>\n  (comps ?? []).flatMap((comp: EmbeddedFlowComponent) => [comp, ...flattenComponents(comp.components)]);\n\n/**\n * Finds the action to submit an expired consent prompt with. A non-primary submit action is\n * preferred so the payload reads as a denial, falling back to any submit action because the server\n * needs an action to route the prompt node. Returns undefined when the view has neither.\n */\nconst findConsentSubmitActionId = (comps: EmbeddedFlowComponent[] | undefined): string | undefined => {\n  const submitActions: EmbeddedFlowComponent[] = flattenComponents(comps).filter(\n    (comp: EmbeddedFlowComponent) => comp.id && comp.eventType?.toUpperCase() === 'SUBMIT',\n  );\n  const denyAction: EmbeddedFlowComponent | undefined = submitActions.find(\n    (comp: EmbeddedFlowComponent) => comp.variant?.toLowerCase() !== 'primary',\n  );\n\n  return (denyAction ?? submitActions[0])?.id;\n};\n\n/**\n * A component-driven SignIn component that provides authentication flow with pre-built styling.\n * This component handles the flow API calls for authentication and delegates UI logic to BaseSignIn.\n * It automatically transforms simple input-based responses into component-driven UI format.\n *\n * @example\n * // Default UI\n * ```tsx\n * import { SignIn } from '@thunderid/react/component-driven';\n *\n * const App = () => {\n *   return (\n *     <SignIn\n *       onSuccess={(authData) => {\n *         console.log('Authentication successful:', authData);\n *       }}\n *       onError={(error) => {\n *         console.error('Authentication failed:', error);\n *       }}\n *       size=\"medium\"\n *       variant=\"outlined\"\n *     />\n *   );\n * };\n * ```\n *\n * @example\n * // Custom UI with render props\n * ```tsx\n * import { SignIn } from '@thunderid/react/component-driven';\n *\n * const App = () => {\n *   return (\n *     <SignIn\n *       onSuccess={(authData) => console.log('Success:', authData)}\n *       onError={(error) => console.error('Error:', error)}\n *     >\n *       {({signIn, isLoading, components, error, isInitialized}) => (\n *         <div className=\"custom-signin\">\n *           <h1>Custom Sign In</h1>\n *           {!isInitialized ? (\n *             <p>Initializing...</p>\n *           ) : error ? (\n *             <div className=\"error\">{error.message}</div>\n *           ) : (\n *             <form onSubmit={(e) => {\n *               e.preventDefault();\n *               signIn({inputs: {username: 'user', password: 'pass'}});\n *             }}>\n *               <button type=\"submit\" disabled={isLoading}>\n *                 {isLoading ? 'Signing in...' : 'Sign In'}\n *               </button>\n *             </form>\n *           )}\n *         </div>\n *       )}\n *     </SignIn>\n *   );\n * };\n * ```\n */\nconst SignIn: FC<SignInProps> = ({\n  className,\n  preferences,\n  size = 'medium',\n  onSuccess,\n  onError,\n  variant,\n  children,\n  revalidateOnChangeAfterBlur,\n  organizationUnitId,\n}: SignInProps): ReactElement => {\n  const {applicationId, afterSignInUrl, signIn, isInitialized, isLoading, meta, getStorageManager, scopes, vendor} =\n    useThunderID();\n  const {t} = useTranslation(preferences?.i18n);\n\n  // State management for the flow\n  const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n  const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n  // Server-side validation errors from the most recent flow response. Updated on every\n  // submission; cleared when the next submission begins so stale errors don't linger.\n  const [serverFieldErrors, setServerFieldErrors] = useState<FieldError[] | null>(null);\n  const [currentExecutionId, setCurrentExecutionId] = useState<string | null>(null);\n  const challengeTokenRef: any = useRef<string | null>(null);\n  const [isStorageReady, setIsStorageReady] = useState(false);\n  const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n  // Raw banner error source, resolved on render so the message follows a language change.\n  const [flowErrorSource, setFlowErrorSource] = useState<unknown>(null);\n  const flowError: Error | null = useMemo(\n    () => (flowErrorSource === null ? null : resolveFlowError(flowErrorSource, t)),\n    [flowErrorSource, t],\n  );\n  const [isSubmitting, setIsSubmitting] = useState(false);\n  const [isTimeoutDisabled, setIsTimeoutDisabled] = useState<boolean>(false);\n  const [passkeyState, setPasskeyState] = useState<PasskeyState>({\n    actionId: null,\n    challenge: null,\n    creationOptions: null,\n    error: null,\n    executionId: null,\n    isActive: false,\n  });\n  const initializationAttemptedRef: any = useRef(false);\n  const oauthCodeProcessedRef: any = useRef(false);\n  const passkeyProcessedRef: any = useRef(false);\n  // Deadline this component has already auto-submitted for, so a re-run of the timeout effect\n  // cannot submit the same expired step twice.\n  const timeoutSubmittedForRef = useRef<number | null>(null);\n  // The timeout effect is keyed on the deadline alone, so a step that arrives carrying the same\n  // deadline would otherwise leave the pending timer holding the previous step's context.\n  const timeoutContextRef = useRef<{\n    components: EmbeddedFlowComponent[];\n    hasConsentPrompt: boolean;\n    submit: (payload: EmbeddedSignInFlowRequest) => Promise<void>;\n  } | null>(null);\n  /**\n   * Sets executionId between sessionStorage and state.\n   * This ensures both are always in sync.\n   */\n  const setExecutionId = (executionId: string | null): void => {\n    setCurrentExecutionId(executionId);\n    if (executionId) {\n      sessionStorage.setItem(`${vendor}_execution_id`, executionId);\n    } else {\n      sessionStorage.removeItem(`${vendor}_execution_id`);\n    }\n  };\n\n  /**\n   * Restore any challenge token persisted before an OAuth redirect.\n   * Waits for SDK initialization before reading from storage.\n   */\n  useEffect(() => {\n    if (!isInitialized) return;\n\n    (async (): Promise<void> => {\n      try {\n        const storageManager: any = await getStorageManager();\n        const tempData: any = await storageManager?.getTemporaryData();\n        if (tempData?.challengeToken) {\n          challengeTokenRef.current = tempData.challengeToken as string;\n        }\n      } finally {\n        setIsStorageReady(true);\n      }\n    })();\n  }, [isInitialized]);\n\n  /**\n   * Updates challengeTokenRef immediately (stale-closure safe) and persists via\n   * the provider's StorageManager so the token survives OAuth redirects.\n   */\n  const setChallengeToken = async (challengeToken: string | null): Promise<void> => {\n    challengeTokenRef.current = challengeToken;\n    try {\n      const storageManager: any = await getStorageManager();\n      if (storageManager) {\n        if (challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', challengeToken);\n        } else {\n          await storageManager.removeTemporaryDataParameter('challengeToken');\n        }\n      }\n    } catch {\n      logger.warn('Failed to persist challenge token in storage.');\n    }\n  };\n\n  /**\n   * Clear all flow-related storage and state.\n   */\n  const clearFlowState = async (): Promise<void> => {\n    // Clear the expired flow state to prevent rendering a stale form with a null executionId.\n    // Kept before the first await so callers that do not await this function still apply the\n    // reset in one batch, ahead of the setError that follows.\n    const executionIdToClear: string | null = currentExecutionId ?? sessionStorage.getItem(`${vendor}_execution_id`);\n    setExecutionId(null);\n    setComponents([]);\n    setAdditionalData({});\n    setIsFlowInitialized(false);\n    await setChallengeToken(null);\n    await clearAuthId(executionIdToClear);\n    setIsTimeoutDisabled(false);\n    // Reset refs to allow new flows to start properly\n    oauthCodeProcessedRef.current = false;\n  };\n\n  /**\n   * Parse URL parameters used in flows.\n   */\n  const getUrlParams = (): any => {\n    const urlParams: any = new URL(window?.location?.href ?? '').searchParams;\n\n    return {\n      applicationId: urlParams.get('applicationId'),\n      authId: urlParams.get('authId'),\n      code: urlParams.get('code'),\n      error: urlParams.get('error'),\n      errorDescription: urlParams.get('error_description'),\n      executionId: urlParams.get('executionId'),\n      nonce: urlParams.get('nonce'),\n      state: urlParams.get('state'),\n    };\n  };\n\n  /**\n   * Persist the authId from the URL against its execution so it survives URL cleanup.\n   * ThunderIDReactClient.signIn() reads it back with storageManager.getFlowAuthId(executionId),\n   * so another tab's sign-in cannot replace it.\n   */\n  const handleAuthId = async (authId: string | null, executionId: string | null | undefined): Promise<void> => {\n    if (authId && executionId) {\n      try {\n        const storageManager: any = await getStorageManager();\n        await storageManager?.setFlowAuthId?.(executionId, authId);\n      } catch {\n        logger.warn('Failed to store authId in hybrid storage.');\n      }\n    }\n  };\n\n  /**\n   * Remove the authId stored for an execution, leaving other tabs' entries in place.\n   */\n  const clearAuthId = async (executionId: string | null | undefined): Promise<void> => {\n    if (!executionId) {\n      return;\n    }\n    try {\n      const storageManager: any = await getStorageManager();\n      await storageManager?.removeFlowAuthId?.(executionId);\n    } catch {\n      logger.warn('Failed to clear authId from hybrid storage.');\n    }\n  };\n\n  /**\n   * Clean up OAuth-related URL parameters from the browser URL.\n   */\n  const cleanupOAuthUrlParams = (includeNonce = false): void => {\n    if (!window?.location?.href) return;\n    const url: any = new URL(window.location.href);\n    url.searchParams.delete('error');\n    url.searchParams.delete('error_description');\n    url.searchParams.delete('code');\n    url.searchParams.delete('state');\n    if (includeNonce) {\n      url.searchParams.delete('nonce');\n    }\n    window?.history?.replaceState({}, '', url.toString());\n  };\n\n  /**\n   * Clean up flow-related URL parameters (executionId, authId) from the browser URL.\n   * Used after executionId is set in state to prevent using invalidated executionId from URL.\n   */\n  const cleanupFlowUrlParams = (): void => {\n    if (!window?.location?.href) return;\n    const url: any = new URL(window.location.href);\n    url.searchParams.delete('executionId');\n    url.searchParams.delete('authId');\n    url.searchParams.delete('applicationId');\n    window?.history?.replaceState({}, '', url.toString());\n  };\n\n  /**\n   * Set error state and call onError callback.\n   * Ensures isFlowInitialized is true so errors can be displayed in the UI.\n   */\n  const setError = (source: unknown): void => {\n    // Updater form, so React stores a FlowErrorBuilder instead of calling it.\n    setFlowErrorSource(() => source);\n    setIsFlowInitialized(true);\n    onError?.(resolveFlowError(source, t));\n  };\n\n  /**\n   * Handle OAuth error from URL parameters.\n   * Clears flow state, creates error, and cleans up URL.\n   */\n  const handleOAuthError = (error: string, errorDescription: string | null): void => {\n    clearFlowState();\n    const errorMessage: any = errorDescription || `OAuth error: ${error}`;\n    const err: any = new ThunderIDRuntimeError(errorMessage, 'SIGN_IN_ERROR', 'react');\n    setError(err);\n    cleanupOAuthUrlParams(true);\n  };\n\n  /**\n   * Handle REDIRECTION response by storing flow state and redirecting to OAuth provider.\n   */\n  const handleRedirection = async (response: EmbeddedSignInFlowResponse): Promise<boolean> => {\n    if (response.type === EmbeddedSignInFlowType.Redirection) {\n      const redirectURL: any = (response.data as any)?.redirectURL || (response as any)?.redirectURL;\n\n      if (redirectURL && window?.location) {\n        if (response.executionId) {\n          setExecutionId(response.executionId);\n        }\n        await setChallengeToken(response.challengeToken ?? null);\n\n        const urlParams: any = getUrlParams();\n        await handleAuthId(urlParams.authId, response.executionId);\n\n        initiateOAuthRedirect(redirectURL, vendor);\n        return true;\n      }\n    }\n    return false;\n  };\n\n  /**\n   * Handle ERROR and COMPLETE responses. Returns true if fully handled.\n   * ERROR + executionId: recoverable — session preserved for retry.\n   * ERROR + no executionId: terminal — clear state and surface the error.\n   */\n  const handleTerminalResponse = async (response: EmbeddedSignInFlowResponse): Promise<boolean> => {\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n      // Propagate OAuth error to the client\n      if (response.redirectUrl && window?.location) {\n        setIsSubmitting(false);\n        await clearFlowState();\n        cleanupOAuthUrlParams(true);\n        onError?.(new Error(extractErrorMessage(response, t)));\n        window.location.href = response.redirectUrl;\n\n        return true;\n      }\n\n      if (response.executionId) {\n        // Recoverable: session still alive. Show inline error without firing onError.\n        setExecutionId(response.executionId);\n        await setChallengeToken(response.challengeToken ?? null);\n        setIsFlowInitialized(true);\n        setFlowErrorSource(response);\n        return true;\n      }\n      // Terminal: backend invalidated the session — clear all state.\n      await clearFlowState();\n      setError(response);\n      cleanupFlowUrlParams();\n      return true;\n    }\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // Get redirectUrl from response (from /oauth2/auth/callback) or fall back to afterSignInUrl\n      const redirectUrl: any = (response as any)?.redirectUrl || (response as any)?.redirect_uri;\n      const finalRedirectUrl: any = redirectUrl || afterSignInUrl;\n\n      // Clear submitting state before redirect\n      setIsSubmitting(false);\n\n      // Clear all OAuth-related storage on successful completion\n      const completedExecutionId: string | null =\n        response.executionId || currentExecutionId || sessionStorage.getItem(`${vendor}_execution_id`);\n      setExecutionId(null);\n      await setChallengeToken(null);\n      setIsFlowInitialized(false);\n      sessionStorage.removeItem(`${vendor}_execution_id`);\n      await clearAuthId(completedExecutionId);\n\n      // Clean up OAuth URL params before redirect\n      cleanupOAuthUrlParams(true);\n\n      if (onSuccess) {\n        onSuccess({\n          redirectUrl: finalRedirectUrl,\n          ...(response.data || {}),\n        });\n      }\n\n      if (finalRedirectUrl && window?.location) {\n        window.location.href = finalRedirectUrl;\n      }\n\n      return true;\n    }\n\n    return false;\n  };\n\n  /**\n   * Initialize the authentication flow.\n   * Priority: executionId > applicationId (from context) > applicationId (from URL)\n   */\n  const initializeFlow = async (): Promise<void> => {\n    const urlParams: any = getUrlParams();\n\n    // Reset OAuth code processed ref when starting a new flow\n    oauthCodeProcessedRef.current = false;\n    // Clear stale serverFieldErrors so the new flow doesn't inherit them via render-prop.\n    setServerFieldErrors(null);\n\n    await handleAuthId(urlParams.authId, urlParams.executionId);\n\n    const effectiveApplicationId: any = applicationId || urlParams.applicationId;\n\n    // On a page refresh the executionId is no longer in the URL (it is scrubbed by\n    // cleanupFlowUrlParams after the first load). Fall back to the executionId persisted in\n    // sessionStorage so the in-progress flow can be resumed instead of starting a new flow.\n    // This is required for authorization_code apps where direct new-flow initiation is blocked\n    // server-side and the flow must be initiated through the OAuth /authorize endpoint.\n    const storedExecutionId: any = !urlParams.executionId ? sessionStorage.getItem(`${vendor}_execution_id`) : null;\n    const resumeExecutionId: any = urlParams.executionId || storedExecutionId;\n\n    if (!resumeExecutionId && !effectiveApplicationId) {\n      const error: any = new ThunderIDRuntimeError(\n        'Either executionId or applicationId is required for authentication',\n        'SIGN_IN_ERROR',\n        'react',\n      );\n      setError(error);\n\n      return;\n    }\n\n    try {\n      setFlowErrorSource(null);\n\n      let response: EmbeddedSignInFlowResponse;\n\n      if (resumeExecutionId) {\n        try {\n          response = (await signIn({\n            executionId: resumeExecutionId,\n            ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n          })) as EmbeddedSignInFlowResponse;\n        } catch (resumeError) {\n          // Only treat a stale/expired session (HTTP 400 from the server, meaning the stored\n          // executionId is no longer valid) as a recoverable condition. Transient failures\n          // such as 5xx server errors or network errors are rethrown so they surface correctly.\n          const isStaleSession: boolean =\n            storedExecutionId &&\n            resumeExecutionId === storedExecutionId &&\n            resumeError instanceof ThunderIDAPIError &&\n            resumeError.statusCode === 400;\n\n          if (isStaleSession) {\n            setExecutionId(null);\n            await clearAuthId(resumeExecutionId);\n            if (!effectiveApplicationId) {\n              const expiredError: FlowErrorBuilder = (translate) =>\n                new ThunderIDRuntimeError(\n                  translate('errors.signin.session.expired') ||\n                    'Your session has expired. Please return to the application and sign in again.',\n                  'SIGN_IN_ERROR',\n                  'react',\n                );\n              setError(expiredError);\n              return;\n            }\n            response = (await signIn({\n              applicationId: effectiveApplicationId,\n              flowType: EmbeddedFlowType.Authentication,\n              ...(scopes && {scopes}),\n              ...(organizationUnitId && {ouId: organizationUnitId}),\n            })) as EmbeddedSignInFlowResponse;\n          } else {\n            throw resumeError;\n          }\n        }\n      } else {\n        response = (await signIn({\n          applicationId: effectiveApplicationId,\n          flowType: EmbeddedFlowType.Authentication,\n          ...(scopes && {scopes}),\n          ...(organizationUnitId && {ouId: organizationUnitId}),\n        })) as EmbeddedSignInFlowResponse;\n      }\n\n      if (await handleRedirection(response)) {\n        return;\n      }\n\n      // Handle a flow that completes (or errors) on the very first step — e.g. a reused SSO\n      // session lets the backend return COMPLETE immediately with no UI components. Without\n      // this the UI would fall through with no components and spin forever.\n      if (await handleTerminalResponse(response)) {\n        // Only reset the init gate for unrecoverable Error responses so the user can retry;\n        // Complete-without-redirect would otherwise kick off a fresh flow unintentionally.\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error && !response.executionId) {\n          initializationAttemptedRef.current = false;\n        }\n        return;\n      }\n\n      const {\n        executionId: normalizedExecutionId,\n        components: normalizedComponents,\n        additionalData: normalizedAdditionalData,\n      } = normalizeFlowResponse(\n        response,\n        t,\n        {\n          resolveTranslations: false,\n        },\n        meta,\n      );\n\n      await setChallengeToken(response.challengeToken ?? null);\n\n      if (normalizedExecutionId && normalizedComponents) {\n        setExecutionId(normalizedExecutionId);\n        setComponents(normalizedComponents);\n        setAdditionalData(normalizedAdditionalData ?? {});\n        setIsFlowInitialized(true);\n        setIsTimeoutDisabled(false);\n        // The URL's authId belongs to this execution even when the URL had no executionId.\n        await handleAuthId(urlParams.authId, normalizedExecutionId);\n        // Clean up executionId from URL after setting it in state\n        cleanupFlowUrlParams();\n      }\n    } catch (error) {\n      const err: any = error;\n      await clearFlowState();\n\n      setError(err);\n      initializationAttemptedRef.current = false;\n    }\n  };\n\n  /**\n   * Initialize the flow and handle cleanup of stale flow state.\n   */\n  useEffect(() => {\n    const urlParams: any = getUrlParams();\n\n    // Check for OAuth error in URL\n    if (urlParams.error) {\n      handleOAuthError(urlParams.error, urlParams.errorDescription);\n      return;\n    }\n\n    handleAuthId(urlParams.authId, urlParams.executionId);\n\n    // Skip OAuth code processing - let the dedicated OAuth useEffect handle it\n    // No action needed here as the dedicated useEffect will handle it\n  }, []);\n\n  useEffect(() => {\n    // Only initialize if we're not processing an OAuth callback or submission.\n    // Wait for isStorageReady so the challenge token is restored from storage before\n    // we attempt to resume a persisted executionId — the server requires it.\n    const currentUrlParams: any = getUrlParams();\n    if (\n      isInitialized &&\n      isStorageReady &&\n      !isLoading &&\n      !isFlowInitialized &&\n      !initializationAttemptedRef.current &&\n      !currentExecutionId &&\n      !currentUrlParams.code &&\n      !currentUrlParams.state &&\n      !isSubmitting &&\n      !oauthCodeProcessedRef.current\n    ) {\n      initializationAttemptedRef.current = true;\n      initializeFlow();\n    }\n  }, [isInitialized, isStorageReady, isLoading, isFlowInitialized, currentExecutionId]);\n\n  /**\n   * Handle form submission from BaseSignIn or render props.\n   */\n  const handleSubmit = async (payload: EmbeddedSignInFlowRequest): Promise<void> => {\n    // Use executionId from payload if available, otherwise fall back to currentExecutionId\n    const effectiveExecutionId: any = payload.executionId || currentExecutionId;\n\n    if (!effectiveExecutionId) {\n      throw new Error('No active flow ID');\n    }\n\n    let processedInputs: Record<string, any> = {...payload.inputs};\n\n    // Read and strip the sentinel up front so it can never reach the wire as an input\n    const consentReason: string | undefined = processedInputs[CONSENT_REASON_KEY];\n    delete processedInputs[CONSENT_REASON_KEY];\n\n    // Auto-compile consent decisions if we are currently on a consent prompt step\n    if (additionalData?.['consentPrompt']) {\n      try {\n        const consentPromptRawData: any = additionalData['consentPrompt'];\n        const purposes: any[] =\n          typeof consentPromptRawData === 'string'\n            ? JSON.parse(consentPromptRawData)\n            : consentPromptRawData.purposes || consentPromptRawData;\n\n        // Find the action component to determine if it was a deny action\n        let isDeny = false;\n        if (payload.action) {\n          // Flatten components to find the action\n          const findAction = (comps: any[]): any => {\n            if (!comps || comps.length === 0) return null;\n\n            const found: any = comps.find((c: any) => c.id === payload.action);\n            if (found) return found;\n\n            return comps.reduce((acc: any, c: any) => {\n              if (acc) return acc;\n              if (c.components) return findAction(c.components);\n              return null;\n            }, null);\n          };\n\n          const submitAction: any = findAction(components);\n\n          if (submitAction && submitAction.variant?.toLowerCase() !== 'primary') {\n            isDeny = true;\n          }\n        }\n\n        // An expired prompt is never an approval, whichever action carried the submission\n        if (consentReason === ConsentConstants.REASON_TIMEOUT) {\n          isDeny = true;\n        }\n\n        // Approval waits while an approved authorization detail shows a value that cannot be submitted\n        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument\n        if (!isDeny && isConsentApprovalBlocked(purposes, processedInputs)) {\n          return;\n        }\n\n        // An explicit denial carries a reason too, so the server never has to infer one\n        const reason: string | undefined = consentReason ?? (isDeny ? ConsentConstants.REASON_USER_DENIED : undefined);\n\n        processedInputs = compileConsentDecisions(processedInputs, purposes, {\n          approved: !isDeny,\n          ...(reason ? {reason} : {}),\n        });\n      } catch (e) {\n        // Failed to construct consent_decisions payload automatically\n      }\n    }\n\n    try {\n      setIsSubmitting(true);\n      setFlowErrorSource(null);\n      // Clear any field errors from the previous response before the new round-trip.\n      setServerFieldErrors(null);\n\n      const response: EmbeddedSignInFlowResponse = (await signIn({\n        executionId: effectiveExecutionId,\n        ...payload,\n        inputs: processedInputs,\n        ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n      })) as EmbeddedSignInFlowResponse;\n\n      if (await handleRedirection(response)) {\n        return;\n      }\n      if (\n        response.data?.additionalData?.['passkeyChallenge'] ||\n        response.data?.additionalData?.['passkeyCreationOptions']\n      ) {\n        const {passkeyChallenge, passkeyCreationOptions}: any = response.data.additionalData;\n        const effectiveExecutionIdForPasskey: any = response.executionId || effectiveExecutionId;\n\n        // Reset passkey processed ref to allow processing\n        passkeyProcessedRef.current = false;\n\n        await setChallengeToken(response.challengeToken ?? null);\n\n        // Set passkey state to trigger the passkey\n        setPasskeyState({\n          actionId: 'submit',\n          challenge: passkeyChallenge,\n          creationOptions: passkeyCreationOptions,\n          error: null,\n          executionId: effectiveExecutionIdForPasskey,\n          isActive: true,\n        });\n        setIsSubmitting(false);\n\n        return;\n      }\n\n      // Handle terminal flow statuses before normalization.\n      if (await handleTerminalResponse(response)) {\n        return;\n      }\n\n      const {\n        executionId: normalizedExecutionId,\n        components: normalizedComponents,\n        additionalData: normalizedAdditionalData,\n      } = normalizeFlowResponse(\n        response,\n        t,\n        {\n          resolveTranslations: false,\n        },\n        meta,\n      );\n\n      // Always update challenge token on any INCOMPLETE response — token rotates every step.\n      await setChallengeToken(response.challengeToken ?? null);\n\n      // Update executionId if response contains a new one\n      if (normalizedExecutionId && normalizedComponents) {\n        setExecutionId(normalizedExecutionId);\n        setComponents(normalizedComponents);\n        setAdditionalData(normalizedAdditionalData ?? {});\n        setIsTimeoutDisabled(false);\n        // Ensure flow is marked as initialized when we have components\n        setIsFlowInitialized(true);\n        // Clean up executionId from URL after setting it in state\n        cleanupFlowUrlParams();\n\n        // Surface server-side validation failures so BaseSignIn can inject them into\n        // the form-level fieldErrors state used by the render-prop / default UI.\n        const responseFieldErrors: FieldError[] | undefined = (response.data as any)?.fieldErrors;\n        if (responseFieldErrors && responseFieldErrors.length > 0) {\n          setServerFieldErrors(responseFieldErrors);\n        }\n\n        // Display error from INCOMPLETE response\n        if ((response as any)?.error) {\n          setFlowErrorSource(response);\n        }\n      }\n    } catch (error) {\n      const err: any = error;\n      await clearFlowState();\n\n      setError(err);\n      return;\n    } finally {\n      setIsSubmitting(false);\n    }\n  };\n\n  /**\n   * Handle step timeout if configured in additionalData.\n   *\n   * An expired consent prompt is auto-submitted as a denial carrying the timeout reason, because its\n   * actions no longer lead anywhere and the user would otherwise be stranded on the prompt. The\n   * server discards those decisions and records nothing. Every other kind of step surfaces the\n   * expiry error instead.\n   */\n  timeoutContextRef.current = {\n    components,\n    hasConsentPrompt: Boolean(additionalData?.['consentPrompt']),\n    submit: handleSubmit,\n  };\n\n  useEffect(() => {\n    const timeoutMs: number = Number(additionalData?.['stepTimeout']) || 0;\n    if (timeoutMs <= 0 || !isFlowInitialized) {\n      setIsTimeoutDisabled(false);\n      return undefined;\n    }\n\n    const handleTimeout = (): void => {\n      setIsTimeoutDisabled(true);\n\n      const expiredError: FlowErrorBuilder = (translate) =>\n        new Error(translate('errors.signin.timeout') || 'Time allowed to complete the step has expired.');\n\n      // Read through the ref so the timer always sees the step that is on screen when it fires\n      const context = timeoutContextRef.current;\n      const actionId: string | undefined = context?.hasConsentPrompt\n        ? findConsentSubmitActionId(context.components)\n        : undefined;\n\n      // Without an action the prompt node cannot be routed, so there is nothing to submit\n      if (actionId && context && timeoutSubmittedForRef.current !== timeoutMs) {\n        timeoutSubmittedForRef.current = timeoutMs;\n        context\n          .submit({action: actionId, inputs: {[CONSENT_REASON_KEY]: ConsentConstants.REASON_TIMEOUT}})\n          .catch(() => setError(expiredError));\n        return;\n      }\n\n      setError(expiredError);\n    };\n\n    const timerId: ReturnType<typeof setTimeout> = setTimeout(handleTimeout, Math.max(0, timeoutMs - Date.now()));\n\n    return () => clearTimeout(timerId);\n  }, [additionalData?.['stepTimeout'], isFlowInitialized, t]);\n\n  /**\n   * Handle authentication errors.\n   */\n  const handleError = (error: Error): void => {\n    setError(error);\n  };\n\n  useOAuthCallback({\n    currentExecutionId,\n    executionIdStorageKey: `${vendor}_execution_id`,\n    isInitialized: isInitialized && !isLoading && isStorageReady,\n    isSubmitting,\n    onError: (err: any) => {\n      clearFlowState();\n      setError(err instanceof Error ? err : new Error(String(err)));\n    },\n    onSubmit: async (payload: any) => handleSubmit({executionId: payload.executionId, inputs: payload.inputs}),\n    processedRef: oauthCodeProcessedRef,\n    setExecutionId,\n  });\n\n  /**\n   * Handle passkey authentication/registration when passkey state becomes active.\n   * This effect auto-triggers the browser passkey popup and submits the result.\n   */\n  useEffect(() => {\n    if (\n      !passkeyState.isActive ||\n      (!passkeyState.challenge && !passkeyState.creationOptions) ||\n      !passkeyState.executionId\n    ) {\n      return;\n    }\n\n    // Prevent re-processing\n    if (passkeyProcessedRef.current) {\n      return;\n    }\n    passkeyProcessedRef.current = true;\n\n    const performPasskeyProcess = async (): Promise<void> => {\n      let inputs: Record<string, string>;\n\n      if (passkeyState.challenge) {\n        const passkeyResponse: any = await handlePasskeyAuthentication(passkeyState.challenge);\n        const passkeyResponseObj: any = JSON.parse(passkeyResponse);\n\n        inputs = {\n          authenticatorData: passkeyResponseObj.response.authenticatorData,\n          clientDataJSON: passkeyResponseObj.response.clientDataJSON,\n          credentialId: passkeyResponseObj.id,\n          signature: passkeyResponseObj.response.signature,\n          userHandle: passkeyResponseObj.response.userHandle,\n        };\n      } else if (passkeyState.creationOptions) {\n        const passkeyResponse: any = await handlePasskeyRegistration(passkeyState.creationOptions);\n        const passkeyResponseObj: any = JSON.parse(passkeyResponse);\n\n        inputs = {\n          attestationObject: passkeyResponseObj.response.attestationObject,\n          clientDataJSON: passkeyResponseObj.response.clientDataJSON,\n          credentialId: passkeyResponseObj.id,\n        };\n      } else {\n        throw new Error('No passkey challenge or creation options available');\n      }\n\n      await handleSubmit({\n        executionId: passkeyState.executionId ?? undefined,\n        inputs,\n      });\n    };\n\n    performPasskeyProcess()\n      .then(() => {\n        setPasskeyState({\n          actionId: null,\n          challenge: null,\n          creationOptions: null,\n          error: null,\n          executionId: null,\n          isActive: false,\n        });\n      })\n      .catch((error: any) => {\n        setPasskeyState((prev: any) => ({...prev, error: error as Error, isActive: false}));\n        setError(error);\n      });\n  }, [passkeyState.isActive, passkeyState.challenge, passkeyState.creationOptions, passkeyState.executionId]);\n\n  if (children) {\n    // Collapse the server FieldError[] array to a single message per field map for\n    // render-prop consumers. First error per field wins. Multi-error cases per\n    // field are rare in practice (server typically returns one rule failure per\n    // field in current flows) and consumers needing the full array can still read\n    // it from the raw flow response.\n    const renderPropFieldErrors: Record<string, string> = {};\n    if (serverFieldErrors) {\n      for (const fe of serverFieldErrors) {\n        if (!(fe.identifier in renderPropFieldErrors)) {\n          renderPropFieldErrors[fe.identifier] = fe.message;\n        }\n      }\n    }\n\n    const renderProps: SignInRenderProps = {\n      additionalData,\n      components,\n      error: flowError,\n      fieldErrors: renderPropFieldErrors,\n      initialize: initializeFlow,\n      isInitialized: isFlowInitialized,\n      isLoading: isLoading || isSubmitting || !isInitialized,\n      isTimeoutDisabled,\n      meta,\n      onSubmit: handleSubmit,\n    };\n\n    return <>{children(renderProps)}</>;\n  }\n  // Otherwise, render the default BaseSignIn component\n  return (\n    <BaseSignIn\n      additionalData={additionalData}\n      components={components}\n      isLoading={isLoading || !isInitialized || !isFlowInitialized}\n      isTimeoutDisabled={isTimeoutDisabled}\n      onSubmit={handleSubmit}\n      onError={handleError}\n      error={flowError}\n      className={className}\n      size={size}\n      variant={variant}\n      preferences={preferences}\n      revalidateOnChangeAfterBlur={revalidateOnChangeAfterBlur}\n      serverFieldErrors={serverFieldErrors}\n    />\n  );\n};\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0KA,MAAM,qBAAqB;;AAG3B,MAAM,qBAAqB,WACxB,SAAS,EAAE,EAAE,SAAS,SAAgC,CAAC,MAAM,GAAG,kBAAkB,KAAK,WAAW,CAAC,CAAC;;;;;;AAOvG,MAAM,6BAA6B,UAAmE;CACpG,MAAMA,gBAAyC,kBAAkB,MAAM,CAAC,QACrE,SAAgC,KAAK,MAAM,KAAK,WAAW,aAAa,KAAK,SAC/E;AAKD,SAJsD,cAAc,MACjE,SAAgC,KAAK,SAAS,aAAa,KAAK,UAClE,IAEqB,cAAc,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgE3C,MAAMC,UAA2B,EAC/B,WACA,aACA,OAAO,UACP,WACA,SACA,SACA,UACA,6BACA,yBAC+B;CAC/B,MAAM,EAAC,eAAe,gBAAgB,QAAQ,eAAe,WAAW,MAAM,mBAAmB,QAAQ,WACvGC,8BAAc;CAChB,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAG7C,MAAM,CAAC,YAAY,qCAAmD,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,yCAAmD,EAAE,CAAC;CAG7E,MAAM,CAAC,mBAAmB,4CAAsD,KAAK;CACrF,MAAM,CAAC,oBAAoB,6CAAiD,KAAK;CACjF,MAAMC,sCAA+C,KAAK;CAC1D,MAAM,CAAC,gBAAgB,yCAA8B,MAAM;CAC3D,MAAM,CAAC,mBAAmB,4CAAiC,MAAM;CAEjE,MAAM,CAAC,iBAAiB,0CAAwC,KAAK;CACrE,MAAMC,qCACG,oBAAoB,OAAO,OAAOC,yCAAiB,iBAAiB,EAAE,EAC7E,CAAC,iBAAiB,EAAE,CACrB;CACD,MAAM,CAAC,cAAc,uCAA4B,MAAM;CACvD,MAAM,CAAC,mBAAmB,4CAA0C,MAAM;CAC1E,MAAM,CAAC,cAAc,uCAA0C;EAC7D,UAAU;EACV,WAAW;EACX,iBAAiB;EACjB,OAAO;EACP,aAAa;EACb,UAAU;EACX,CAAC;CACF,MAAMC,+CAAyC,MAAM;CACrD,MAAMC,0CAAoC,MAAM;CAChD,MAAMC,wCAAkC,MAAM;CAG9C,MAAM,2CAA+C,KAAK;CAG1D,MAAM,sCAII,KAAK;;;;;CAKf,MAAM,kBAAkB,gBAAqC;AAC3D,wBAAsB,YAAY;AAClC,MAAI,YACF,gBAAe,QAAQ,GAAG,OAAO,gBAAgB,YAAY;MAE7D,gBAAe,WAAW,GAAG,OAAO,eAAe;;;;;;AAQvD,4BAAgB;AACd,MAAI,CAAC,cAAe;AAEpB,GAAC,YAA2B;AAC1B,OAAI;IAEF,MAAMC,WAAgB,OADM,MAAM,mBAAmB,GACT,kBAAkB;AAC9D,QAAI,UAAU,eACZ,mBAAkB,UAAU,SAAS;aAE/B;AACR,sBAAkB,KAAK;;MAEvB;IACH,CAAC,cAAc,CAAC;;;;;CAMnB,MAAM,oBAAoB,OAAO,mBAAiD;AAChF,oBAAkB,UAAU;AAC5B,MAAI;GACF,MAAMC,iBAAsB,MAAM,mBAAmB;AACrD,OAAI,eACF,KAAI,eACF,OAAM,eAAe,0BAA0B,kBAAkB,eAAe;OAEhF,OAAM,eAAe,6BAA6B,iBAAiB;UAGjE;AACN,8BAAO,KAAK,gDAAgD;;;;;;CAOhE,MAAM,iBAAiB,YAA2B;EAIhD,MAAMC,qBAAoC,sBAAsB,eAAe,QAAQ,GAAG,OAAO,eAAe;AAChH,iBAAe,KAAK;AACpB,gBAAc,EAAE,CAAC;AACjB,oBAAkB,EAAE,CAAC;AACrB,uBAAqB,MAAM;AAC3B,QAAM,kBAAkB,KAAK;AAC7B,QAAM,YAAY,mBAAmB;AACrC,uBAAqB,MAAM;AAE3B,wBAAsB,UAAU;;;;;CAMlC,MAAM,qBAA0B;EAC9B,MAAMC,YAAiB,IAAI,IAAI,QAAQ,UAAU,QAAQ,GAAG,CAAC;AAE7D,SAAO;GACL,eAAe,UAAU,IAAI,gBAAgB;GAC7C,QAAQ,UAAU,IAAI,SAAS;GAC/B,MAAM,UAAU,IAAI,OAAO;GAC3B,OAAO,UAAU,IAAI,QAAQ;GAC7B,kBAAkB,UAAU,IAAI,oBAAoB;GACpD,aAAa,UAAU,IAAI,cAAc;GACzC,OAAO,UAAU,IAAI,QAAQ;GAC7B,OAAO,UAAU,IAAI,QAAQ;GAC9B;;;;;;;CAQH,MAAM,eAAe,OAAO,QAAuB,gBAA0D;AAC3G,MAAI,UAAU,YACZ,KAAI;AAEF,UAD4B,MAAM,mBAAmB,GAC/B,gBAAgB,aAAa,OAAO;UACpD;AACN,8BAAO,KAAK,4CAA4C;;;;;;CAQ9D,MAAM,cAAc,OAAO,gBAA0D;AACnF,MAAI,CAAC,YACH;AAEF,MAAI;AAEF,UAD4B,MAAM,mBAAmB,GAC/B,mBAAmB,YAAY;UAC/C;AACN,8BAAO,KAAK,8CAA8C;;;;;;CAO9D,MAAM,yBAAyB,eAAe,UAAgB;AAC5D,MAAI,CAAC,QAAQ,UAAU,KAAM;EAC7B,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,oBAAoB;AAC5C,MAAI,aAAa,OAAO,OAAO;AAC/B,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aACF,KAAI,aAAa,OAAO,QAAQ;AAElC,UAAQ,SAAS,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;;;;;CAOvD,MAAM,6BAAmC;AACvC,MAAI,CAAC,QAAQ,UAAU,KAAM;EAC7B,MAAMA,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,cAAc;AACtC,MAAI,aAAa,OAAO,SAAS;AACjC,MAAI,aAAa,OAAO,gBAAgB;AACxC,UAAQ,SAAS,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;;;;;CAOvD,MAAM,YAAY,WAA0B;AAE1C,2BAAyB,OAAO;AAChC,uBAAqB,KAAK;AAC1B,YAAUR,yCAAiB,QAAQ,EAAE,CAAC;;;;;;CAOxC,MAAM,oBAAoB,OAAe,qBAA0C;AACjF,kBAAgB;AAGhB,WADiB,IAAIS,0CADK,oBAAoB,gBAAgB,SACL,iBAAiB,QAAQ,CACrE;AACb,wBAAsB,KAAK;;;;;CAM7B,MAAM,oBAAoB,OAAO,aAA2D;AAC1F,MAAI,SAAS,SAASC,2CAAuB,aAAa;GACxD,MAAMC,cAAoB,SAAS,MAAc,eAAgB,UAAkB;AAEnF,OAAI,eAAe,QAAQ,UAAU;AACnC,QAAI,SAAS,YACX,gBAAe,SAAS,YAAY;AAEtC,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,UAAM,aADiB,cAAc,CACR,QAAQ,SAAS,YAAY;AAE1D,wCAAsB,aAAa,OAAO;AAC1C,WAAO;;;AAGX,SAAO;;;;;;;CAQT,MAAM,yBAAyB,OAAO,aAA2D;AAC/F,MAAI,SAAS,eAAeC,6CAAyB,OAAO;AAE1D,OAAI,SAAS,eAAe,QAAQ,UAAU;AAC5C,oBAAgB,MAAM;AACtB,UAAM,gBAAgB;AACtB,0BAAsB,KAAK;AAC3B,cAAU,IAAI,MAAMC,4CAAoB,UAAU,EAAE,CAAC,CAAC;AACtD,WAAO,SAAS,OAAO,SAAS;AAEhC,WAAO;;AAGT,OAAI,SAAS,aAAa;AAExB,mBAAe,SAAS,YAAY;AACpC,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AACxD,yBAAqB,KAAK;AAC1B,uBAAmB,SAAS;AAC5B,WAAO;;AAGT,SAAM,gBAAgB;AACtB,YAAS,SAAS;AAClB,yBAAsB;AACtB,UAAO;;AAGT,MAAI,SAAS,eAAeD,6CAAyB,UAAU;GAG7D,MAAME,mBADoB,UAAkB,eAAgB,UAAkB,gBACjC;AAG7C,mBAAgB,MAAM;GAGtB,MAAMC,uBACJ,SAAS,eAAe,sBAAsB,eAAe,QAAQ,GAAG,OAAO,eAAe;AAChG,kBAAe,KAAK;AACpB,SAAM,kBAAkB,KAAK;AAC7B,wBAAqB,MAAM;AAC3B,kBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,SAAM,YAAY,qBAAqB;AAGvC,yBAAsB,KAAK;AAE3B,OAAI,UACF,WAAU;IACR,aAAa;IACb,GAAI,SAAS,QAAQ,EAAE;IACxB,CAAC;AAGJ,OAAI,oBAAoB,QAAQ,SAC9B,QAAO,SAAS,OAAO;AAGzB,UAAO;;AAGT,SAAO;;;;;;CAOT,MAAM,iBAAiB,YAA2B;EAChD,MAAMR,YAAiB,cAAc;AAGrC,wBAAsB,UAAU;AAEhC,uBAAqB,KAAK;AAE1B,QAAM,aAAa,UAAU,QAAQ,UAAU,YAAY;EAE3D,MAAMS,yBAA8B,iBAAiB,UAAU;EAO/D,MAAMC,oBAAyB,CAAC,UAAU,cAAc,eAAe,QAAQ,GAAG,OAAO,eAAe,GAAG;EAC3G,MAAMC,oBAAyB,UAAU,eAAe;AAExD,MAAI,CAAC,qBAAqB,CAAC,wBAAwB;AAMjD,YALmB,IAAIT,0CACrB,sEACA,iBACA,QACD,CACc;AAEf;;AAGF,MAAI;AACF,sBAAmB,KAAK;GAExB,IAAIU;AAEJ,OAAI,kBACF,KAAI;AACF,eAAY,MAAM,OAAO;KACvB,aAAa;KACb,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;KACjF,CAAC;YACK,aAAa;AAUpB,QALE,qBACA,sBAAsB,qBACtB,uBAAuBC,yCACvB,YAAY,eAAe,KAET;AAClB,oBAAe,KAAK;AACpB,WAAM,YAAY,kBAAkB;AACpC,SAAI,CAAC,wBAAwB;MAC3B,MAAMC,gBAAkC,cACtC,IAAIZ,0CACF,UAAU,gCAAgC,IACxC,iFACF,iBACA,QACD;AACH,eAAS,aAAa;AACtB;;AAEF,gBAAY,MAAM,OAAO;MACvB,eAAe;MACf,UAAUa,qCAAiB;MAC3B,GAAI,UAAU,EAAC,QAAO;MACtB,GAAI,sBAAsB,EAAC,MAAM,oBAAmB;MACrD,CAAC;UAEF,OAAM;;OAIV,YAAY,MAAM,OAAO;IACvB,eAAe;IACf,UAAUA,qCAAiB;IAC3B,GAAI,UAAU,EAAC,QAAO;IACtB,GAAI,sBAAsB,EAAC,MAAM,oBAAmB;IACrD,CAAC;AAGJ,OAAI,MAAM,kBAAkB,SAAS,CACnC;AAMF,OAAI,MAAM,uBAAuB,SAAS,EAAE;AAG1C,QAAI,SAAS,eAAeV,6CAAyB,SAAS,CAAC,SAAS,YACtE,4BAA2B,UAAU;AAEvC;;GAGF,MAAM,EACJ,aAAa,uBACb,YAAY,sBACZ,gBAAgB,6BACdW,8CACF,UACA,GACA,EACE,qBAAqB,OACtB,EACD,KACD;AAED,SAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAExD,OAAI,yBAAyB,sBAAsB;AACjD,mBAAe,sBAAsB;AACrC,kBAAc,qBAAqB;AACnC,sBAAkB,4BAA4B,EAAE,CAAC;AACjD,yBAAqB,KAAK;AAC1B,yBAAqB,MAAM;AAE3B,UAAM,aAAa,UAAU,QAAQ,sBAAsB;AAE3D,0BAAsB;;WAEjB,OAAO;GACd,MAAMC,MAAW;AACjB,SAAM,gBAAgB;AAEtB,YAAS,IAAI;AACb,8BAA2B,UAAU;;;;;;AAOzC,4BAAgB;EACd,MAAMjB,YAAiB,cAAc;AAGrC,MAAI,UAAU,OAAO;AACnB,oBAAiB,UAAU,OAAO,UAAU,iBAAiB;AAC7D;;AAGF,eAAa,UAAU,QAAQ,UAAU,YAAY;IAIpD,EAAE,CAAC;AAEN,4BAAgB;EAId,MAAMkB,mBAAwB,cAAc;AAC5C,MACE,iBACA,kBACA,CAAC,aACD,CAAC,qBACD,CAAC,2BAA2B,WAC5B,CAAC,sBACD,CAAC,iBAAiB,QAClB,CAAC,iBAAiB,SAClB,CAAC,gBACD,CAAC,sBAAsB,SACvB;AACA,8BAA2B,UAAU;AACrC,mBAAgB;;IAEjB;EAAC;EAAe;EAAgB;EAAW;EAAmB;EAAmB,CAAC;;;;CAKrF,MAAM,eAAe,OAAO,YAAsD;EAEhF,MAAMC,uBAA4B,QAAQ,eAAe;AAEzD,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM,oBAAoB;EAGtC,IAAIC,kBAAuC,EAAC,GAAG,QAAQ,QAAO;EAG9D,MAAMC,gBAAoC,gBAAgB;AAC1D,SAAO,gBAAgB;AAGvB,MAAI,iBAAiB,iBACnB,KAAI;GACF,MAAMC,uBAA4B,eAAe;GACjD,MAAMC,WACJ,OAAO,yBAAyB,WAC5B,KAAK,MAAM,qBAAqB,GAChC,qBAAqB,YAAY;GAGvC,IAAI,SAAS;AACb,OAAI,QAAQ,QAAQ;IAElB,MAAM,cAAc,UAAsB;AACxC,SAAI,CAAC,SAAS,MAAM,WAAW,EAAG,QAAO;KAEzC,MAAMC,QAAa,MAAM,MAAM,MAAW,EAAE,OAAO,QAAQ,OAAO;AAClE,SAAI,MAAO,QAAO;AAElB,YAAO,MAAM,QAAQ,KAAU,MAAW;AACxC,UAAI,IAAK,QAAO;AAChB,UAAI,EAAE,WAAY,QAAO,WAAW,EAAE,WAAW;AACjD,aAAO;QACN,KAAK;;IAGV,MAAMC,eAAoB,WAAW,WAAW;AAEhD,QAAI,gBAAgB,aAAa,SAAS,aAAa,KAAK,UAC1D,UAAS;;AAKb,OAAI,kBAAkBC,qCAAiB,eACrC,UAAS;AAKX,OAAI,CAAC,UAAUC,yCAAyB,UAAU,gBAAgB,CAChE;GAIF,MAAMC,SAA6B,kBAAkB,SAASF,qCAAiB,qBAAqB;AAEpG,sEAA0C,iBAAiB,UAAU;IACnE,UAAU,CAAC;IACX,GAAI,SAAS,EAAC,QAAO,GAAG,EAAE;IAC3B,CAAC;WACK,GAAG;AAKd,MAAI;AACF,mBAAgB,KAAK;AACrB,sBAAmB,KAAK;AAExB,wBAAqB,KAAK;GAE1B,MAAMd,WAAwC,MAAM,OAAO;IACzD,aAAa;IACb,GAAG;IACH,QAAQ;IACR,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;IACjF,CAAC;AAEF,OAAI,MAAM,kBAAkB,SAAS,CACnC;AAEF,OACE,SAAS,MAAM,iBAAiB,uBAChC,SAAS,MAAM,iBAAiB,2BAChC;IACA,MAAM,EAAC,kBAAkB,2BAA+B,SAAS,KAAK;IACtE,MAAMiB,iCAAsC,SAAS,eAAe;AAGpE,wBAAoB,UAAU;AAE9B,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,oBAAgB;KACd,UAAU;KACV,WAAW;KACX,iBAAiB;KACjB,OAAO;KACP,aAAa;KACb,UAAU;KACX,CAAC;AACF,oBAAgB,MAAM;AAEtB;;AAIF,OAAI,MAAM,uBAAuB,SAAS,CACxC;GAGF,MAAM,EACJ,aAAa,uBACb,YAAY,sBACZ,gBAAgB,6BACdb,8CACF,UACA,GACA,EACE,qBAAqB,OACtB,EACD,KACD;AAGD,SAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,OAAI,yBAAyB,sBAAsB;AACjD,mBAAe,sBAAsB;AACrC,kBAAc,qBAAqB;AACnC,sBAAkB,4BAA4B,EAAE,CAAC;AACjD,yBAAqB,MAAM;AAE3B,yBAAqB,KAAK;AAE1B,0BAAsB;IAItB,MAAMc,sBAAiD,SAAS,MAAc;AAC9E,QAAI,uBAAuB,oBAAoB,SAAS,EACtD,sBAAqB,oBAAoB;AAI3C,QAAK,UAAkB,MACrB,oBAAmB,SAAS;;WAGzB,OAAO;GACd,MAAMb,MAAW;AACjB,SAAM,gBAAgB;AAEtB,YAAS,IAAI;AACb;YACQ;AACR,mBAAgB,MAAM;;;;;;;;;;;AAY1B,mBAAkB,UAAU;EAC1B;EACA,kBAAkB,QAAQ,iBAAiB,iBAAiB;EAC5D,QAAQ;EACT;AAED,4BAAgB;EACd,MAAMc,YAAoB,OAAO,iBAAiB,eAAe,IAAI;AACrE,MAAI,aAAa,KAAK,CAAC,mBAAmB;AACxC,wBAAqB,MAAM;AAC3B;;EAGF,MAAM,sBAA4B;AAChC,wBAAqB,KAAK;GAE1B,MAAMjB,gBAAkC,cACtC,IAAI,MAAM,UAAU,wBAAwB,IAAI,iDAAiD;GAGnG,MAAM,UAAU,kBAAkB;GAClC,MAAMkB,WAA+B,SAAS,mBAC1C,0BAA0B,QAAQ,WAAW,GAC7C;AAGJ,OAAI,YAAY,WAAW,uBAAuB,YAAY,WAAW;AACvE,2BAAuB,UAAU;AACjC,YACG,OAAO;KAAC,QAAQ;KAAU,QAAQ,GAAE,qBAAqBN,qCAAiB,gBAAe;KAAC,CAAC,CAC3F,YAAY,SAAS,aAAa,CAAC;AACtC;;AAGF,YAAS,aAAa;;EAGxB,MAAMO,UAAyC,WAAW,eAAe,KAAK,IAAI,GAAG,YAAY,KAAK,KAAK,CAAC,CAAC;AAE7G,eAAa,aAAa,QAAQ;IACjC;EAAC,iBAAiB;EAAgB;EAAmB;EAAE,CAAC;;;;CAK3D,MAAM,eAAe,UAAuB;AAC1C,WAAS,MAAM;;AAGjB,2CAAiB;EACf;EACA,uBAAuB,GAAG,OAAO;EACjC,eAAe,iBAAiB,CAAC,aAAa;EAC9C;EACA,UAAU,QAAa;AACrB,mBAAgB;AAChB,YAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC,CAAC;;EAE/D,UAAU,OAAO,YAAiB,aAAa;GAAC,aAAa,QAAQ;GAAa,QAAQ,QAAQ;GAAO,CAAC;EAC1G,cAAc;EACd;EACD,CAAC;;;;;AAMF,4BAAgB;AACd,MACE,CAAC,aAAa,YACb,CAAC,aAAa,aAAa,CAAC,aAAa,mBAC1C,CAAC,aAAa,YAEd;AAIF,MAAI,oBAAoB,QACtB;AAEF,sBAAoB,UAAU;EAE9B,MAAM,wBAAwB,YAA2B;GACvD,IAAIC;AAEJ,OAAI,aAAa,WAAW;IAC1B,MAAMC,kBAAuB,MAAMC,4CAA4B,aAAa,UAAU;IACtF,MAAMC,qBAA0B,KAAK,MAAM,gBAAgB;AAE3D,aAAS;KACP,mBAAmB,mBAAmB,SAAS;KAC/C,gBAAgB,mBAAmB,SAAS;KAC5C,cAAc,mBAAmB;KACjC,WAAW,mBAAmB,SAAS;KACvC,YAAY,mBAAmB,SAAS;KACzC;cACQ,aAAa,iBAAiB;IACvC,MAAMF,kBAAuB,MAAMG,0CAA0B,aAAa,gBAAgB;IAC1F,MAAMD,qBAA0B,KAAK,MAAM,gBAAgB;AAE3D,aAAS;KACP,mBAAmB,mBAAmB,SAAS;KAC/C,gBAAgB,mBAAmB,SAAS;KAC5C,cAAc,mBAAmB;KAClC;SAED,OAAM,IAAI,MAAM,qDAAqD;AAGvE,SAAM,aAAa;IACjB,aAAa,aAAa,eAAe;IACzC;IACD,CAAC;;AAGJ,yBAAuB,CACpB,WAAW;AACV,mBAAgB;IACd,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,OAAO;IACP,aAAa;IACb,UAAU;IACX,CAAC;IACF,CACD,OAAO,UAAe;AACrB,oBAAiB,UAAe;IAAC,GAAG;IAAa;IAAgB,UAAU;IAAM,EAAE;AACnF,YAAS,MAAM;IACf;IACH;EAAC,aAAa;EAAU,aAAa;EAAW,aAAa;EAAiB,aAAa;EAAY,CAAC;AAE3G,KAAI,UAAU;EAMZ,MAAME,wBAAgD,EAAE;AACxD,MAAI,mBACF;QAAK,MAAM,MAAM,kBACf,KAAI,EAAE,GAAG,cAAc,uBACrB,uBAAsB,GAAG,cAAc,GAAG;;AAkBhD,SAAO,mFAAG,SAb6B;GACrC;GACA;GACA,OAAO;GACP,aAAa;GACb,YAAY;GACZ,eAAe;GACf,WAAW,aAAa,gBAAgB,CAAC;GACzC;GACA;GACA,UAAU;GACX,CAE8B,GAAI;;AAGrC,QACE,2CAACC;EACiB;EACJ;EACZ,WAAW,aAAa,CAAC,iBAAiB,CAAC;EACxB;EACnB,UAAU;EACV,SAAS;EACT,OAAO;EACI;EACL;EACG;EACI;EACgB;EACV;GACnB;;AAIN,qBAAe"}

package/dist/components/auth/Callback/TokenCallback.js

@@ -79,7 +79,7 @@ const TokenCallback = ({ onNavigate, onError, onSuccess, signInPath = "/signin",
 				if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {
 					const redirectUrl = response?.redirectUrl || response?.redirect_uri;
 					sessionStorage.removeItem(`${vendor}_execution_id`);
-					await storageManager.removeHybridDataParameter("authId");
+					await storageManager.removeFlowAuthId(executionId);
 					onSuccess?.({
 						redirectUrl,
 						...response.data || {}
@@ -94,7 +94,7 @@ const TokenCallback = ({ onNavigate, onError, onSuccess, signInPath = "/signin",
 				if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {
 					const failureReason = response?.failureReason;
 					const error = new Error(failureReason || "Token validation failed. Please try again.");
-					await storageManager.removeHybridDataParameter("authId");
+					await storageManager.removeFlowAuthId(executionId);
 					redirectWithError(error, isRegistrationFlow);
 					return;
 				}
@@ -106,7 +106,7 @@ const TokenCallback = ({ onNavigate, onError, onSuccess, signInPath = "/signin",
 				const error = err instanceof Error ? err : /* @__PURE__ */ new Error("Token callback processing failed");
 				console.error("Token callback error:", err);
 				const storageManager = await getStorageManager();
-				if (storageManager) await storageManager.removeHybridDataParameter("authId");
+				if (storageManager && executionId) await storageManager.removeFlowAuthId(executionId);
 				redirectWithError(error, isRegistrationFlow);
 			}
 		};

package/dist/components/auth/Callback/TokenCallback.js.map

@@ -1 +1 @@
-{"version":3,"file":"TokenCallback.js","names":["TokenCallback: FC<TokenCallbackProps>","processingRef: any","useThunderID","navigate","url: URL","redirectUrlObj: URL","state: string","params: URLSearchParams","searchParams: URLSearchParams","executionId: string | null","token: string | null","applicationId: string | null","isRegistrationFlow: boolean","storageManager: any","response: any","redirectURL: string | undefined","nextExecutionId: string","nextExecutionId","redirectUrl: string | undefined","failureReason: string | undefined","error: Error"],"sources":["../../../../src/components/auth/Callback/TokenCallback.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, navigate as browserNavigate} from '@thunderid/browser';\nimport {FC, useEffect, useRef} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\nexport interface TokenCallbackProps {\n  /**\n   * Callback function called when an error occurs\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Function to navigate to a different path.\n   * If not provided, falls back to the browser navigate utility (SPA navigation via History API for same-origin paths).\n   * Provide this prop to enable framework-specific navigation (e.g., from React Router).\n   */\n  onNavigate?: (path: string) => void;\n\n  /**\n   * Callback function called when authentication is successful\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Custom path for the sign-in page. Defaults to '/signin'\n   */\n  signInPath?: string;\n\n  /**\n   * Custom path for the sign-up page. Defaults to '/signup'\n   */\n  signUpPath?: string;\n}\n\nexport const TokenCallback: FC<TokenCallbackProps> = ({\n  onNavigate,\n  onError,\n  onSuccess,\n  signInPath = '/signin',\n  signUpPath = '/signup',\n}: TokenCallbackProps) => {\n  const processingRef: any = useRef(false);\n  const {isInitialized, isLoading, signIn, signUp, getStorageManager, vendor} = useThunderID();\n\n  const navigate = (path: string): void => {\n    if (onNavigate) {\n      onNavigate(path);\n    } else {\n      browserNavigate(path);\n    }\n  };\n\n  const clearTokenFromUrl = (): void => {\n    if (!window?.location?.href) {\n      return;\n    }\n\n    const url: URL = new URL(window.location.href);\n    url.searchParams.delete('token');\n    url.searchParams.delete('type');\n    window.history.replaceState({}, '', url.toString());\n  };\n\n  const initiateOAuthRedirect = (redirectURL: string, isRegistrationFlow?: boolean): void => {\n    const redirectUrlObj: URL = new URL(redirectURL);\n    const state: string = redirectUrlObj.searchParams.get('state') || crypto.randomUUID();\n\n    sessionStorage.setItem(\n      `${vendor}_oauth_${state}`,\n      JSON.stringify({\n        path: isRegistrationFlow ? signUpPath : signInPath,\n        timestamp: Date.now(),\n      }),\n    );\n\n    browserNavigate(redirectUrlObj.toString());\n  };\n\n  const buildSignInPath = (\n    executionId?: string | null,\n    applicationId?: string | null,\n    isRegistrationFlow?: boolean,\n  ): string => {\n    const params: URLSearchParams = new URLSearchParams();\n    if (executionId) {\n      params.set('executionId', executionId);\n    }\n    if (applicationId) {\n      params.set('applicationId', applicationId);\n    }\n\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    return params.toString() ? `${basePath}?${params.toString()}` : basePath;\n  };\n\n  const redirectWithError = (error: Error, isRegistrationFlow?: boolean): void => {\n    sessionStorage.removeItem(`${vendor}_execution_id`);\n\n    onError?.(error);\n\n    const params: URLSearchParams = new URLSearchParams();\n    params.set('error', 'token_verification_failed');\n    params.set('error_description', error.message);\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    navigate(`${basePath}?${params.toString()}`);\n  };\n\n  useEffect(() => {\n    if (!isInitialized || isLoading) {\n      return;\n    }\n\n    const processTokenCallback = async (): Promise<void> => {\n      if (processingRef.current) {\n        return;\n      }\n      processingRef.current = true;\n\n      // Read URL params before clearing them so they're accessible in both try and catch.\n      const searchParams: URLSearchParams = new URLSearchParams(window.location.search);\n      const executionId: string | null = searchParams.get('id') || searchParams.get('executionId');\n      const token: string | null = searchParams.get('token');\n      const applicationId: string | null = searchParams.get('applicationId');\n      const isRegistrationFlow: boolean = searchParams.get('type') === 'REGISTRATION';\n\n      clearTokenFromUrl();\n\n      try {\n        const storageManager: any = await getStorageManager();\n\n        if (!executionId || !token) {\n          const error: Error = new Error('Missing executionId or token in callback URL');\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        let response: any;\n\n        if (isRegistrationFlow) {\n          response = await signUp({executionId, inputs: {token}});\n        } else {\n          response = await signIn({executionId, inputs: {token}});\n        }\n\n        if (response.type === EmbeddedSignInFlowType.Redirection) {\n          const redirectURL: string | undefined = response.data?.redirectURL || response?.redirectURL;\n          const nextExecutionId: string = response.executionId || executionId;\n          sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n          if (redirectURL) {\n            initiateOAuthRedirect(redirectURL, isRegistrationFlow);\n            return;\n          }\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n          const redirectUrl: string | undefined = response?.redirectUrl || response?.redirect_uri;\n\n          sessionStorage.removeItem(`${vendor}_execution_id`);\n          await storageManager.removeHybridDataParameter('authId');\n\n          onSuccess?.({\n            redirectUrl,\n            ...((response.data as Record<string, any>) || {}),\n          });\n\n          if (redirectUrl) {\n            window.location.href = redirectUrl;\n            return;\n          }\n\n          navigate(isRegistrationFlow ? signUpPath : signInPath);\n          return;\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n          const failureReason: string | undefined = response?.failureReason;\n          const error: Error = new Error(failureReason || 'Token validation failed. Please try again.');\n          await storageManager.removeHybridDataParameter('authId');\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        const nextExecutionId: string = response.executionId || executionId;\n        sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n        if (response.challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', response.challengeToken);\n        }\n\n        navigate(buildSignInPath(nextExecutionId, applicationId, isRegistrationFlow));\n      } catch (err) {\n        const error: Error = err instanceof Error ? err : new Error('Token callback processing failed');\n        // eslint-disable-next-line no-console\n        console.error('Token callback error:', err);\n        const storageManager: any = await getStorageManager();\n        if (storageManager) {\n          await storageManager.removeHybridDataParameter('authId');\n        }\n        redirectWithError(error, isRegistrationFlow);\n      }\n    };\n\n    processTokenCallback();\n  }, [\n    getStorageManager,\n    isInitialized,\n    isLoading,\n    onError,\n    onNavigate,\n    onSuccess,\n    signIn,\n    signUp,\n    signInPath,\n    signUpPath,\n    vendor,\n  ]);\n\n  return null;\n};\n\nexport default TokenCallback;\n"],"mappings":";;;;;AAoCA,MAAaA,iBAAyC,EACpD,YACA,SACA,WACA,aAAa,WACb,aAAa,gBACW;CACxB,MAAMC,gBAAqB,OAAO,MAAM;CACxC,MAAM,EAAC,eAAe,WAAW,QAAQ,QAAQ,mBAAmB,WAAUC,sBAAc;CAE5F,MAAMC,cAAY,SAAuB;AACvC,MAAI,WACF,YAAW,KAAK;MAEhB,UAAgB,KAAK;;CAIzB,MAAM,0BAAgC;AACpC,MAAI,CAAC,QAAQ,UAAU,KACrB;EAGF,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,OAAO;AAC/B,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;CAGrD,MAAM,yBAAyB,aAAqB,uBAAuC;EACzF,MAAMC,iBAAsB,IAAI,IAAI,YAAY;EAChD,MAAMC,QAAgB,eAAe,aAAa,IAAI,QAAQ,IAAI,OAAO,YAAY;AAErF,iBAAe,QACb,GAAG,OAAO,SAAS,SACnB,KAAK,UAAU;GACb,MAAM,qBAAqB,aAAa;GACxC,WAAW,KAAK,KAAK;GACtB,CAAC,CACH;AAED,WAAgB,eAAe,UAAU,CAAC;;CAG5C,MAAM,mBACJ,aACA,eACA,uBACW;EACX,MAAMC,SAA0B,IAAI,iBAAiB;AACrD,MAAI,YACF,QAAO,IAAI,eAAe,YAAY;AAExC,MAAI,cACF,QAAO,IAAI,iBAAiB,cAAc;EAG5C,MAAM,WAAW,qBAAqB,aAAa;AACnD,SAAO,OAAO,UAAU,GAAG,GAAG,SAAS,GAAG,OAAO,UAAU,KAAK;;CAGlE,MAAM,qBAAqB,OAAc,uBAAuC;AAC9E,iBAAe,WAAW,GAAG,OAAO,eAAe;AAEnD,YAAU,MAAM;EAEhB,MAAMA,SAA0B,IAAI,iBAAiB;AACrD,SAAO,IAAI,SAAS,4BAA4B;AAChD,SAAO,IAAI,qBAAqB,MAAM,QAAQ;AAE9C,aAAS,GADQ,qBAAqB,aAAa,WAC9B,GAAG,OAAO,UAAU,GAAG;;AAG9C,iBAAgB;AACd,MAAI,CAAC,iBAAiB,UACpB;EAGF,MAAM,uBAAuB,YAA2B;AACtD,OAAI,cAAc,QAChB;AAEF,iBAAc,UAAU;GAGxB,MAAMC,eAAgC,IAAI,gBAAgB,OAAO,SAAS,OAAO;GACjF,MAAMC,cAA6B,aAAa,IAAI,KAAK,IAAI,aAAa,IAAI,cAAc;GAC5F,MAAMC,QAAuB,aAAa,IAAI,QAAQ;GACtD,MAAMC,gBAA+B,aAAa,IAAI,gBAAgB;GACtE,MAAMC,qBAA8B,aAAa,IAAI,OAAO,KAAK;AAEjE,sBAAmB;AAEnB,OAAI;IACF,MAAMC,iBAAsB,MAAM,mBAAmB;AAErD,QAAI,CAAC,eAAe,CAAC,OAAO;AAE1B,uCADqB,IAAI,MAAM,+CAA+C,EACrD,mBAAmB;AAC5C;;IAGF,IAAIC;AAEJ,QAAI,mBACF,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;QAEvD,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;AAGzD,QAAI,SAAS,SAAS,uBAAuB,aAAa;KACxD,MAAMC,cAAkC,SAAS,MAAM,eAAe,UAAU;KAChF,MAAMC,oBAA0B,SAAS,eAAe;AACxD,oBAAe,QAAQ,GAAG,OAAO,gBAAgBC,kBAAgB;AAEjE,SAAI,aAAa;AACf,4BAAsB,aAAa,mBAAmB;AACtD;;;AAIJ,QAAI,SAAS,eAAe,yBAAyB,UAAU;KAC7D,MAAMC,cAAkC,UAAU,eAAe,UAAU;AAE3E,oBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,WAAM,eAAe,0BAA0B,SAAS;AAExD,iBAAY;MACV;MACA,GAAK,SAAS,QAAgC,EAAE;MACjD,CAAC;AAEF,SAAI,aAAa;AACf,aAAO,SAAS,OAAO;AACvB;;AAGF,gBAAS,qBAAqB,aAAa,WAAW;AACtD;;AAGF,QAAI,SAAS,eAAe,yBAAyB,OAAO;KAC1D,MAAMC,gBAAoC,UAAU;KACpD,MAAMC,QAAe,IAAI,MAAM,iBAAiB,6CAA6C;AAC7F,WAAM,eAAe,0BAA0B,SAAS;AACxD,uBAAkB,OAAO,mBAAmB;AAC5C;;IAGF,MAAMJ,kBAA0B,SAAS,eAAe;AACxD,mBAAe,QAAQ,GAAG,OAAO,gBAAgB,gBAAgB;AAEjE,QAAI,SAAS,eACX,OAAM,eAAe,0BAA0B,kBAAkB,SAAS,eAAe;AAG3F,eAAS,gBAAgB,iBAAiB,eAAe,mBAAmB,CAAC;YACtE,KAAK;IACZ,MAAMI,QAAe,eAAe,QAAQ,sBAAM,IAAI,MAAM,mCAAmC;AAE/F,YAAQ,MAAM,yBAAyB,IAAI;IAC3C,MAAMP,iBAAsB,MAAM,mBAAmB;AACrD,QAAI,eACF,OAAM,eAAe,0BAA0B,SAAS;AAE1D,sBAAkB,OAAO,mBAAmB;;;AAIhD,wBAAsB;IACrB;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,QAAO"}
+{"version":3,"file":"TokenCallback.js","names":["TokenCallback: FC<TokenCallbackProps>","processingRef: any","useThunderID","navigate","url: URL","redirectUrlObj: URL","state: string","params: URLSearchParams","searchParams: URLSearchParams","executionId: string | null","token: string | null","applicationId: string | null","isRegistrationFlow: boolean","storageManager: any","response: any","redirectURL: string | undefined","nextExecutionId: string","nextExecutionId","redirectUrl: string | undefined","failureReason: string | undefined","error: Error"],"sources":["../../../../src/components/auth/Callback/TokenCallback.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, navigate as browserNavigate} from '@thunderid/browser';\nimport {FC, useEffect, useRef} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\nexport interface TokenCallbackProps {\n  /**\n   * Callback function called when an error occurs\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Function to navigate to a different path.\n   * If not provided, falls back to the browser navigate utility (SPA navigation via History API for same-origin paths).\n   * Provide this prop to enable framework-specific navigation (e.g., from React Router).\n   */\n  onNavigate?: (path: string) => void;\n\n  /**\n   * Callback function called when authentication is successful\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Custom path for the sign-in page. Defaults to '/signin'\n   */\n  signInPath?: string;\n\n  /**\n   * Custom path for the sign-up page. Defaults to '/signup'\n   */\n  signUpPath?: string;\n}\n\nexport const TokenCallback: FC<TokenCallbackProps> = ({\n  onNavigate,\n  onError,\n  onSuccess,\n  signInPath = '/signin',\n  signUpPath = '/signup',\n}: TokenCallbackProps) => {\n  const processingRef: any = useRef(false);\n  const {isInitialized, isLoading, signIn, signUp, getStorageManager, vendor} = useThunderID();\n\n  const navigate = (path: string): void => {\n    if (onNavigate) {\n      onNavigate(path);\n    } else {\n      browserNavigate(path);\n    }\n  };\n\n  const clearTokenFromUrl = (): void => {\n    if (!window?.location?.href) {\n      return;\n    }\n\n    const url: URL = new URL(window.location.href);\n    url.searchParams.delete('token');\n    url.searchParams.delete('type');\n    window.history.replaceState({}, '', url.toString());\n  };\n\n  const initiateOAuthRedirect = (redirectURL: string, isRegistrationFlow?: boolean): void => {\n    const redirectUrlObj: URL = new URL(redirectURL);\n    const state: string = redirectUrlObj.searchParams.get('state') || crypto.randomUUID();\n\n    sessionStorage.setItem(\n      `${vendor}_oauth_${state}`,\n      JSON.stringify({\n        path: isRegistrationFlow ? signUpPath : signInPath,\n        timestamp: Date.now(),\n      }),\n    );\n\n    browserNavigate(redirectUrlObj.toString());\n  };\n\n  const buildSignInPath = (\n    executionId?: string | null,\n    applicationId?: string | null,\n    isRegistrationFlow?: boolean,\n  ): string => {\n    const params: URLSearchParams = new URLSearchParams();\n    if (executionId) {\n      params.set('executionId', executionId);\n    }\n    if (applicationId) {\n      params.set('applicationId', applicationId);\n    }\n\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    return params.toString() ? `${basePath}?${params.toString()}` : basePath;\n  };\n\n  const redirectWithError = (error: Error, isRegistrationFlow?: boolean): void => {\n    sessionStorage.removeItem(`${vendor}_execution_id`);\n\n    onError?.(error);\n\n    const params: URLSearchParams = new URLSearchParams();\n    params.set('error', 'token_verification_failed');\n    params.set('error_description', error.message);\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    navigate(`${basePath}?${params.toString()}`);\n  };\n\n  useEffect(() => {\n    if (!isInitialized || isLoading) {\n      return;\n    }\n\n    const processTokenCallback = async (): Promise<void> => {\n      if (processingRef.current) {\n        return;\n      }\n      processingRef.current = true;\n\n      // Read URL params before clearing them so they're accessible in both try and catch.\n      const searchParams: URLSearchParams = new URLSearchParams(window.location.search);\n      const executionId: string | null = searchParams.get('id') || searchParams.get('executionId');\n      const token: string | null = searchParams.get('token');\n      const applicationId: string | null = searchParams.get('applicationId');\n      const isRegistrationFlow: boolean = searchParams.get('type') === 'REGISTRATION';\n\n      clearTokenFromUrl();\n\n      try {\n        const storageManager: any = await getStorageManager();\n\n        if (!executionId || !token) {\n          const error: Error = new Error('Missing executionId or token in callback URL');\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        let response: any;\n\n        if (isRegistrationFlow) {\n          response = await signUp({executionId, inputs: {token}});\n        } else {\n          response = await signIn({executionId, inputs: {token}});\n        }\n\n        if (response.type === EmbeddedSignInFlowType.Redirection) {\n          const redirectURL: string | undefined = response.data?.redirectURL || response?.redirectURL;\n          const nextExecutionId: string = response.executionId || executionId;\n          sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n          if (redirectURL) {\n            initiateOAuthRedirect(redirectURL, isRegistrationFlow);\n            return;\n          }\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n          const redirectUrl: string | undefined = response?.redirectUrl || response?.redirect_uri;\n\n          sessionStorage.removeItem(`${vendor}_execution_id`);\n          await storageManager.removeFlowAuthId(executionId);\n\n          onSuccess?.({\n            redirectUrl,\n            ...((response.data as Record<string, any>) || {}),\n          });\n\n          if (redirectUrl) {\n            window.location.href = redirectUrl;\n            return;\n          }\n\n          navigate(isRegistrationFlow ? signUpPath : signInPath);\n          return;\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n          const failureReason: string | undefined = response?.failureReason;\n          const error: Error = new Error(failureReason || 'Token validation failed. Please try again.');\n          await storageManager.removeFlowAuthId(executionId);\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        const nextExecutionId: string = response.executionId || executionId;\n        sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n        if (response.challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', response.challengeToken);\n        }\n\n        navigate(buildSignInPath(nextExecutionId, applicationId, isRegistrationFlow));\n      } catch (err) {\n        const error: Error = err instanceof Error ? err : new Error('Token callback processing failed');\n        // eslint-disable-next-line no-console\n        console.error('Token callback error:', err);\n        const storageManager: any = await getStorageManager();\n        if (storageManager && executionId) {\n          await storageManager.removeFlowAuthId(executionId);\n        }\n        redirectWithError(error, isRegistrationFlow);\n      }\n    };\n\n    processTokenCallback();\n  }, [\n    getStorageManager,\n    isInitialized,\n    isLoading,\n    onError,\n    onNavigate,\n    onSuccess,\n    signIn,\n    signUp,\n    signInPath,\n    signUpPath,\n    vendor,\n  ]);\n\n  return null;\n};\n\nexport default TokenCallback;\n"],"mappings":";;;;;AAoCA,MAAaA,iBAAyC,EACpD,YACA,SACA,WACA,aAAa,WACb,aAAa,gBACW;CACxB,MAAMC,gBAAqB,OAAO,MAAM;CACxC,MAAM,EAAC,eAAe,WAAW,QAAQ,QAAQ,mBAAmB,WAAUC,sBAAc;CAE5F,MAAMC,cAAY,SAAuB;AACvC,MAAI,WACF,YAAW,KAAK;MAEhB,UAAgB,KAAK;;CAIzB,MAAM,0BAAgC;AACpC,MAAI,CAAC,QAAQ,UAAU,KACrB;EAGF,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,OAAO;AAC/B,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;CAGrD,MAAM,yBAAyB,aAAqB,uBAAuC;EACzF,MAAMC,iBAAsB,IAAI,IAAI,YAAY;EAChD,MAAMC,QAAgB,eAAe,aAAa,IAAI,QAAQ,IAAI,OAAO,YAAY;AAErF,iBAAe,QACb,GAAG,OAAO,SAAS,SACnB,KAAK,UAAU;GACb,MAAM,qBAAqB,aAAa;GACxC,WAAW,KAAK,KAAK;GACtB,CAAC,CACH;AAED,WAAgB,eAAe,UAAU,CAAC;;CAG5C,MAAM,mBACJ,aACA,eACA,uBACW;EACX,MAAMC,SAA0B,IAAI,iBAAiB;AACrD,MAAI,YACF,QAAO,IAAI,eAAe,YAAY;AAExC,MAAI,cACF,QAAO,IAAI,iBAAiB,cAAc;EAG5C,MAAM,WAAW,qBAAqB,aAAa;AACnD,SAAO,OAAO,UAAU,GAAG,GAAG,SAAS,GAAG,OAAO,UAAU,KAAK;;CAGlE,MAAM,qBAAqB,OAAc,uBAAuC;AAC9E,iBAAe,WAAW,GAAG,OAAO,eAAe;AAEnD,YAAU,MAAM;EAEhB,MAAMA,SAA0B,IAAI,iBAAiB;AACrD,SAAO,IAAI,SAAS,4BAA4B;AAChD,SAAO,IAAI,qBAAqB,MAAM,QAAQ;AAE9C,aAAS,GADQ,qBAAqB,aAAa,WAC9B,GAAG,OAAO,UAAU,GAAG;;AAG9C,iBAAgB;AACd,MAAI,CAAC,iBAAiB,UACpB;EAGF,MAAM,uBAAuB,YAA2B;AACtD,OAAI,cAAc,QAChB;AAEF,iBAAc,UAAU;GAGxB,MAAMC,eAAgC,IAAI,gBAAgB,OAAO,SAAS,OAAO;GACjF,MAAMC,cAA6B,aAAa,IAAI,KAAK,IAAI,aAAa,IAAI,cAAc;GAC5F,MAAMC,QAAuB,aAAa,IAAI,QAAQ;GACtD,MAAMC,gBAA+B,aAAa,IAAI,gBAAgB;GACtE,MAAMC,qBAA8B,aAAa,IAAI,OAAO,KAAK;AAEjE,sBAAmB;AAEnB,OAAI;IACF,MAAMC,iBAAsB,MAAM,mBAAmB;AAErD,QAAI,CAAC,eAAe,CAAC,OAAO;AAE1B,uCADqB,IAAI,MAAM,+CAA+C,EACrD,mBAAmB;AAC5C;;IAGF,IAAIC;AAEJ,QAAI,mBACF,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;QAEvD,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;AAGzD,QAAI,SAAS,SAAS,uBAAuB,aAAa;KACxD,MAAMC,cAAkC,SAAS,MAAM,eAAe,UAAU;KAChF,MAAMC,oBAA0B,SAAS,eAAe;AACxD,oBAAe,QAAQ,GAAG,OAAO,gBAAgBC,kBAAgB;AAEjE,SAAI,aAAa;AACf,4BAAsB,aAAa,mBAAmB;AACtD;;;AAIJ,QAAI,SAAS,eAAe,yBAAyB,UAAU;KAC7D,MAAMC,cAAkC,UAAU,eAAe,UAAU;AAE3E,oBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,WAAM,eAAe,iBAAiB,YAAY;AAElD,iBAAY;MACV;MACA,GAAK,SAAS,QAAgC,EAAE;MACjD,CAAC;AAEF,SAAI,aAAa;AACf,aAAO,SAAS,OAAO;AACvB;;AAGF,gBAAS,qBAAqB,aAAa,WAAW;AACtD;;AAGF,QAAI,SAAS,eAAe,yBAAyB,OAAO;KAC1D,MAAMC,gBAAoC,UAAU;KACpD,MAAMC,QAAe,IAAI,MAAM,iBAAiB,6CAA6C;AAC7F,WAAM,eAAe,iBAAiB,YAAY;AAClD,uBAAkB,OAAO,mBAAmB;AAC5C;;IAGF,MAAMJ,kBAA0B,SAAS,eAAe;AACxD,mBAAe,QAAQ,GAAG,OAAO,gBAAgB,gBAAgB;AAEjE,QAAI,SAAS,eACX,OAAM,eAAe,0BAA0B,kBAAkB,SAAS,eAAe;AAG3F,eAAS,gBAAgB,iBAAiB,eAAe,mBAAmB,CAAC;YACtE,KAAK;IACZ,MAAMI,QAAe,eAAe,QAAQ,sBAAM,IAAI,MAAM,mCAAmC;AAE/F,YAAQ,MAAM,yBAAyB,IAAI;IAC3C,MAAMP,iBAAsB,MAAM,mBAAmB;AACrD,QAAI,kBAAkB,YACpB,OAAM,eAAe,iBAAiB,YAAY;AAEpD,sBAAkB,OAAO,mBAAmB;;;AAIhD,wBAAsB;IACrB;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,QAAO"}

package/dist/components/auth/SignIn/SignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/SignIn/SignIn.tsx"],"names":[],"mappings":"AAGA,OAAO,EAIL,qBAAqB,EAGrB,yBAAyB,EAIzB,oBAAoB,EACpB,WAAW,EAGZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAC,EAAE,EAAsD,SAAS,EAAC,MAAM,OAAO,CAAC;AAExF,OAAmB,EAAC,eAAe,EAAC,MAAM,cAAc,CAAC;AAczD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAErC;;OAEG;IACH,UAAU,EAAE,qBAAqB,EAAE,CAAC;IAEpC;;OAEG;IACH,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC;;OAEG;IACH,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAElC;;OAEG;IACH,QAAQ,EAAE,CAAC,OAAO,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,SAAS,CAAC;IAEnD;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAEjC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;IAEpD;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IAEtC;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IAEpC;;OAEG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;CACtC;AAwCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CAq1B3B,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"SignIn.d.ts","sourceRoot":"","sources":["../../../../src/components/auth/SignIn/SignIn.tsx"],"names":[],"mappings":"AAGA,OAAO,EAIL,qBAAqB,EAGrB,yBAAyB,EAIzB,oBAAoB,EACpB,WAAW,EAGZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAC,EAAE,EAAsD,SAAS,EAAC,MAAM,OAAO,CAAC;AAExF,OAAmB,EAAC,eAAe,EAAC,MAAM,cAAc,CAAC;AAczD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAErC;;OAEG;IACH,UAAU,EAAE,qBAAqB,EAAE,CAAC;IAEpC;;OAEG;IACH,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAEpB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC;;OAEG;IACH,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhC;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAElC;;OAEG;IACH,QAAQ,EAAE,CAAC,OAAO,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,SAAS,CAAC;IAEnD;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAEjC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;IAEpD;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IAEtC;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IAEpC;;OAEG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;CACtC;AAwCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,QAAA,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CA01B3B,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/components/auth/SignIn/SignIn.js

@@ -157,16 +157,13 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 	* Clear all flow-related storage and state.
 	*/
 	const clearFlowState = async () => {
+		const executionIdToClear = currentExecutionId ?? sessionStorage.getItem(`${vendor}_execution_id`);
 		setExecutionId(null);
 		setComponents([]);
 		setAdditionalData({});
 		setIsFlowInitialized(false);
 		await setChallengeToken(null);
-		try {
-			await (await getStorageManager())?.removeHybridDataParameter?.("authId");
-		} catch {
-			logger.warn("Failed to clear authId from hybrid storage.");
-		}
+		await clearAuthId(executionIdToClear);
 		setIsTimeoutDisabled(false);
 		oauthCodeProcessedRef.current = false;
 	};
@@ -187,18 +184,29 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 		};
 	};
 	/**
-	* Handle authId from URL and persist it via the storage manager so it survives URL cleanup.
-	* ThunderIDReactClient.signIn() reads authId from storageManager.getHybridDataParameter('authId'),
-	* not from raw sessionStorage, so we must use the same storage path here.
+	* Persist the authId from the URL against its execution so it survives URL cleanup.
+	* ThunderIDReactClient.signIn() reads it back with storageManager.getFlowAuthId(executionId),
+	* so another tab's sign-in cannot replace it.
 	*/
-	const handleAuthId = async (authId) => {
-		if (authId) try {
-			await (await getStorageManager())?.setHybridDataParameter?.("authId", authId);
+	const handleAuthId = async (authId, executionId) => {
+		if (authId && executionId) try {
+			await (await getStorageManager())?.setFlowAuthId?.(executionId, authId);
 		} catch {
 			logger.warn("Failed to store authId in hybrid storage.");
 		}
 	};
 	/**
+	* Remove the authId stored for an execution, leaving other tabs' entries in place.
+	*/
+	const clearAuthId = async (executionId) => {
+		if (!executionId) return;
+		try {
+			await (await getStorageManager())?.removeFlowAuthId?.(executionId);
+		} catch {
+			logger.warn("Failed to clear authId from hybrid storage.");
+		}
+	};
+	/**
 	* Clean up OAuth-related URL parameters from the browser URL.
 	*/
 	const cleanupOAuthUrlParams = (includeNonce = false) => {
@@ -250,7 +258,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 			if (redirectURL && window?.location) {
 				if (response.executionId) setExecutionId(response.executionId);
 				await setChallengeToken(response.challengeToken ?? null);
-				await handleAuthId(getUrlParams().authId);
+				await handleAuthId(getUrlParams().authId, response.executionId);
 				initiateOAuthRedirect(redirectURL, vendor);
 				return true;
 			}
@@ -287,15 +295,12 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 		if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {
 			const finalRedirectUrl = response?.redirectUrl || response?.redirect_uri || afterSignInUrl;
 			setIsSubmitting(false);
+			const completedExecutionId = response.executionId || currentExecutionId || sessionStorage.getItem(`${vendor}_execution_id`);
 			setExecutionId(null);
 			await setChallengeToken(null);
 			setIsFlowInitialized(false);
 			sessionStorage.removeItem(`${vendor}_execution_id`);
-			try {
-				await (await getStorageManager())?.removeHybridDataParameter?.("authId");
-			} catch {
-				logger.warn("Failed to clear authId from hybrid storage after completion.");
-			}
+			await clearAuthId(completedExecutionId);
 			cleanupOAuthUrlParams(true);
 			if (onSuccess) onSuccess({
 				redirectUrl: finalRedirectUrl,
@@ -314,7 +319,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 		const urlParams = getUrlParams();
 		oauthCodeProcessedRef.current = false;
 		setServerFieldErrors(null);
-		await handleAuthId(urlParams.authId);
+		await handleAuthId(urlParams.authId, urlParams.executionId);
 		const effectiveApplicationId = applicationId || urlParams.applicationId;
 		const storedExecutionId = !urlParams.executionId ? sessionStorage.getItem(`${vendor}_execution_id`) : null;
 		const resumeExecutionId = urlParams.executionId || storedExecutionId;
@@ -333,11 +338,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 			} catch (resumeError) {
 				if (storedExecutionId && resumeExecutionId === storedExecutionId && resumeError instanceof ThunderIDAPIError && resumeError.statusCode === 400) {
 					setExecutionId(null);
-					try {
-						await (await getStorageManager())?.removeHybridDataParameter?.("authId");
-					} catch {
-						logger.warn("Failed to clear authId from hybrid storage.");
-					}
+					await clearAuthId(resumeExecutionId);
 					if (!effectiveApplicationId) {
 						const expiredError = (translate) => new ThunderIDRuntimeError(translate("errors.signin.session.expired") || "Your session has expired. Please return to the application and sign in again.", "SIGN_IN_ERROR", "react");
 						setError(expiredError);
@@ -370,6 +371,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 				setAdditionalData(normalizedAdditionalData ?? {});
 				setIsFlowInitialized(true);
 				setIsTimeoutDisabled(false);
+				await handleAuthId(urlParams.authId, normalizedExecutionId);
 				cleanupFlowUrlParams();
 			}
 		} catch (error) {
@@ -388,7 +390,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 			handleOAuthError(urlParams.error, urlParams.errorDescription);
 			return;
 		}
-		handleAuthId(urlParams.authId);
+		handleAuthId(urlParams.authId, urlParams.executionId);
 	}, []);
 	useEffect(() => {
 		const currentUrlParams = getUrlParams();

package/dist/components/auth/SignIn/SignIn.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignIn.js","names":["submitActions: EmbeddedFlowComponent[]","SignIn: FC<SignInProps>","useThunderID","useTranslation","challengeTokenRef: any","flowError: Error | null","initializationAttemptedRef: any","oauthCodeProcessedRef: any","passkeyProcessedRef: any","tempData: any","storageManager: any","urlParams: any","url: any","redirectURL: any","finalRedirectUrl: any","effectiveApplicationId: any","storedExecutionId: any","resumeExecutionId: any","response: EmbeddedSignInFlowResponse","expiredError: FlowErrorBuilder","err: any","currentUrlParams: any","effectiveExecutionId: any","processedInputs: Record<string, any>","consentReason: string | undefined","consentPromptRawData: any","purposes: any[]","found: any","submitAction: any","isConsentApprovalBlocked","reason: string | undefined","effectiveExecutionIdForPasskey: any","responseFieldErrors: FieldError[] | undefined","timeoutMs: number","actionId: string | undefined","timerId: ReturnType<typeof setTimeout>","inputs: Record<string, string>","passkeyResponse: any","passkeyResponseObj: any","renderPropFieldErrors: Record<string, string>","BaseSignIn"],"sources":["../../../../src/components/auth/SignIn/SignIn.tsx"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDRuntimeError,\n  ThunderIDAPIError,\n  ConsentConstants,\n  EmbeddedFlowComponent,\n  EmbeddedFlowType,\n  EmbeddedSignInFlowResponse,\n  EmbeddedSignInFlowRequest,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignInFlowType,\n  FieldError,\n  FlowMetadataResponse,\n  Preferences,\n  logger,\n  compileConsentDecisions,\n} from '@thunderid/browser';\nimport {FC, ReactElement, useState, useEffect, useMemo, useRef, ReactNode} from 'react';\n// eslint-disable-next-line import/no-named-as-default\nimport BaseSignIn, {BaseSignInProps} from './BaseSignIn';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport {useOAuthCallback} from '../../../hooks/auth/useOAuthCallback';\nimport useTranslation from '../../../hooks/useTranslation';\nimport {\n  extractErrorMessage,\n  FlowErrorBuilder,\n  normalizeFlowResponse,\n  resolveFlowError,\n} from '../../../utils/flowTransformer';\nimport isConsentApprovalBlocked from '../../../utils/isConsentApprovalBlocked';\nimport {initiateOAuthRedirect} from '../../../utils/oauth';\nimport {handlePasskeyAuthentication, handlePasskeyRegistration} from '../../../utils/passkey';\n\n/**\n * Render props function parameters\n */\nexport interface SignInRenderProps {\n  /**\n   * Additional data from the flow response containing contextual information\n   * like consent prompt details and session timeouts.\n   */\n  additionalData?: Record<string, any>;\n\n  /**\n   * Current flow components\n   */\n  components: EmbeddedFlowComponent[];\n\n  /**\n   * Current error if any\n   */\n  error: Error | null;\n\n  /**\n   * Server-side field-level validation errors from the most recent flow response,\n   * collapsed to one message per field (first error wins). Empty when no validation\n   * failures are active. Render-prop consumers should display these alongside their\n   * own client-side validation errors.\n   */\n  fieldErrors: Record<string, string>;\n\n  /**\n   * Function to manually initialize the flow\n   */\n  initialize: () => Promise<void>;\n\n  /**\n   * Whether the flow has been initialized\n   */\n  isInitialized: boolean;\n\n  /**\n   * Loading state indicator\n   */\n  isLoading: boolean;\n\n  /**\n   * Flag indicating whether the flow step timeout has expired.\n   * Consuming components can use this to disable submit buttons.\n   */\n  isTimeoutDisabled?: boolean;\n\n  /**\n   * Flow metadata returned by the platform (v2 only). `null` while loading or unavailable.\n   */\n  meta: FlowMetadataResponse | null;\n\n  /**\n   * Function to submit authentication data (primary)\n   */\n  onSubmit: (payload: EmbeddedSignInFlowRequest) => Promise<void>;\n}\n\n/**\n * Props for the SignIn component.\n * Matches the interface from the main SignIn component for consistency.\n */\nexport interface SignInProps {\n  /**\n   * Render props function for custom UI\n   */\n  children?: (props: SignInRenderProps) => ReactNode;\n\n  /**\n   * Custom CSS class name for the form container.\n   */\n  className?: string;\n\n  /**\n   * Bounds the sign-in to this organization unit. Sent as `ouId` on the request that starts the\n   * `AUTHENTICATION` flow only, never on a continuation.\n   */\n  organizationUnitId?: string;\n\n  /**\n   * Callback function called when authentication fails.\n   * @param error - The error that occurred during authentication.\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Callback function called when authentication is successful.\n   * @param authData - The authentication data returned upon successful completion.\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Component-level preferences to override global i18n and theme settings.\n   * Preferences are deep-merged with global ones, with component preferences\n   * taking precedence. Affects this component and all its descendants.\n   */\n  preferences?: Preferences;\n\n  /**\n   * When a field has been blurred at least once, re-run validation on every subsequent\n   * keystroke so a rendered error clears the moment the value becomes valid. Doesn't\n   * affect fields that have never been blurred — the user isn't shown errors while\n   * initially typing. Default `false` preserves prior behavior.\n   */\n  revalidateOnChangeAfterBlur?: boolean;\n\n  /**\n   * Size variant for the component.\n   */\n  size?: 'small' | 'medium' | 'large';\n\n  /**\n   * Theme variant for the component.\n   */\n  variant?: BaseSignInProps['variant'];\n}\n\n/**\n * State for tracking passkey registration\n */\ninterface PasskeyState {\n  actionId: string | null;\n  challenge: string | null;\n  creationOptions: string | null;\n  error: Error | null;\n  executionId: string | null;\n  isActive: boolean;\n}\n\n/**\n * Sentinel input key carrying the reason a consent prompt was submitted. It is folded into the\n * compiled `consent_decisions` payload and stripped from the inputs, like `__consent_opt__` keys.\n */\nconst CONSENT_REASON_KEY = '__consent_reason__';\n\n/** Flattens a component tree into a single list, parents before their children. */\nconst flattenComponents = (comps: EmbeddedFlowComponent[] | undefined): EmbeddedFlowComponent[] =>\n  (comps ?? []).flatMap((comp: EmbeddedFlowComponent) => [comp, ...flattenComponents(comp.components)]);\n\n/**\n * Finds the action to submit an expired consent prompt with. A non-primary submit action is\n * preferred so the payload reads as a denial, falling back to any submit action because the server\n * needs an action to route the prompt node. Returns undefined when the view has neither.\n */\nconst findConsentSubmitActionId = (comps: EmbeddedFlowComponent[] | undefined): string | undefined => {\n  const submitActions: EmbeddedFlowComponent[] = flattenComponents(comps).filter(\n    (comp: EmbeddedFlowComponent) => comp.id && comp.eventType?.toUpperCase() === 'SUBMIT',\n  );\n  const denyAction: EmbeddedFlowComponent | undefined = submitActions.find(\n    (comp: EmbeddedFlowComponent) => comp.variant?.toLowerCase() !== 'primary',\n  );\n\n  return (denyAction ?? submitActions[0])?.id;\n};\n\n/**\n * A component-driven SignIn component that provides authentication flow with pre-built styling.\n * This component handles the flow API calls for authentication and delegates UI logic to BaseSignIn.\n * It automatically transforms simple input-based responses into component-driven UI format.\n *\n * @example\n * // Default UI\n * ```tsx\n * import { SignIn } from '@thunderid/react/component-driven';\n *\n * const App = () => {\n *   return (\n *     <SignIn\n *       onSuccess={(authData) => {\n *         console.log('Authentication successful:', authData);\n *       }}\n *       onError={(error) => {\n *         console.error('Authentication failed:', error);\n *       }}\n *       size=\"medium\"\n *       variant=\"outlined\"\n *     />\n *   );\n * };\n * ```\n *\n * @example\n * // Custom UI with render props\n * ```tsx\n * import { SignIn } from '@thunderid/react/component-driven';\n *\n * const App = () => {\n *   return (\n *     <SignIn\n *       onSuccess={(authData) => console.log('Success:', authData)}\n *       onError={(error) => console.error('Error:', error)}\n *     >\n *       {({signIn, isLoading, components, error, isInitialized}) => (\n *         <div className=\"custom-signin\">\n *           <h1>Custom Sign In</h1>\n *           {!isInitialized ? (\n *             <p>Initializing...</p>\n *           ) : error ? (\n *             <div className=\"error\">{error.message}</div>\n *           ) : (\n *             <form onSubmit={(e) => {\n *               e.preventDefault();\n *               signIn({inputs: {username: 'user', password: 'pass'}});\n *             }}>\n *               <button type=\"submit\" disabled={isLoading}>\n *                 {isLoading ? 'Signing in...' : 'Sign In'}\n *               </button>\n *             </form>\n *           )}\n *         </div>\n *       )}\n *     </SignIn>\n *   );\n * };\n * ```\n */\nconst SignIn: FC<SignInProps> = ({\n  className,\n  preferences,\n  size = 'medium',\n  onSuccess,\n  onError,\n  variant,\n  children,\n  revalidateOnChangeAfterBlur,\n  organizationUnitId,\n}: SignInProps): ReactElement => {\n  const {applicationId, afterSignInUrl, signIn, isInitialized, isLoading, meta, getStorageManager, scopes, vendor} =\n    useThunderID();\n  const {t} = useTranslation(preferences?.i18n);\n\n  // State management for the flow\n  const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n  const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n  // Server-side validation errors from the most recent flow response. Updated on every\n  // submission; cleared when the next submission begins so stale errors don't linger.\n  const [serverFieldErrors, setServerFieldErrors] = useState<FieldError[] | null>(null);\n  const [currentExecutionId, setCurrentExecutionId] = useState<string | null>(null);\n  const challengeTokenRef: any = useRef<string | null>(null);\n  const [isStorageReady, setIsStorageReady] = useState(false);\n  const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n  // Raw banner error source, resolved on render so the message follows a language change.\n  const [flowErrorSource, setFlowErrorSource] = useState<unknown>(null);\n  const flowError: Error | null = useMemo(\n    () => (flowErrorSource === null ? null : resolveFlowError(flowErrorSource, t)),\n    [flowErrorSource, t],\n  );\n  const [isSubmitting, setIsSubmitting] = useState(false);\n  const [isTimeoutDisabled, setIsTimeoutDisabled] = useState<boolean>(false);\n  const [passkeyState, setPasskeyState] = useState<PasskeyState>({\n    actionId: null,\n    challenge: null,\n    creationOptions: null,\n    error: null,\n    executionId: null,\n    isActive: false,\n  });\n  const initializationAttemptedRef: any = useRef(false);\n  const oauthCodeProcessedRef: any = useRef(false);\n  const passkeyProcessedRef: any = useRef(false);\n  // Deadline this component has already auto-submitted for, so a re-run of the timeout effect\n  // cannot submit the same expired step twice.\n  const timeoutSubmittedForRef = useRef<number | null>(null);\n  // The timeout effect is keyed on the deadline alone, so a step that arrives carrying the same\n  // deadline would otherwise leave the pending timer holding the previous step's context.\n  const timeoutContextRef = useRef<{\n    components: EmbeddedFlowComponent[];\n    hasConsentPrompt: boolean;\n    submit: (payload: EmbeddedSignInFlowRequest) => Promise<void>;\n  } | null>(null);\n  /**\n   * Sets executionId between sessionStorage and state.\n   * This ensures both are always in sync.\n   */\n  const setExecutionId = (executionId: string | null): void => {\n    setCurrentExecutionId(executionId);\n    if (executionId) {\n      sessionStorage.setItem(`${vendor}_execution_id`, executionId);\n    } else {\n      sessionStorage.removeItem(`${vendor}_execution_id`);\n    }\n  };\n\n  /**\n   * Restore any challenge token persisted before an OAuth redirect.\n   * Waits for SDK initialization before reading from storage.\n   */\n  useEffect(() => {\n    if (!isInitialized) return;\n\n    (async (): Promise<void> => {\n      try {\n        const storageManager: any = await getStorageManager();\n        const tempData: any = await storageManager?.getTemporaryData();\n        if (tempData?.challengeToken) {\n          challengeTokenRef.current = tempData.challengeToken as string;\n        }\n      } finally {\n        setIsStorageReady(true);\n      }\n    })();\n  }, [isInitialized]);\n\n  /**\n   * Updates challengeTokenRef immediately (stale-closure safe) and persists via\n   * the provider's StorageManager so the token survives OAuth redirects.\n   */\n  const setChallengeToken = async (challengeToken: string | null): Promise<void> => {\n    challengeTokenRef.current = challengeToken;\n    try {\n      const storageManager: any = await getStorageManager();\n      if (storageManager) {\n        if (challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', challengeToken);\n        } else {\n          await storageManager.removeTemporaryDataParameter('challengeToken');\n        }\n      }\n    } catch {\n      logger.warn('Failed to persist challenge token in storage.');\n    }\n  };\n\n  /**\n   * Clear all flow-related storage and state.\n   */\n  const clearFlowState = async (): Promise<void> => {\n    // Clear the expired flow state to prevent rendering a stale form with a null executionId.\n    // Kept before the first await so callers that do not await this function still apply the\n    // reset in one batch, ahead of the setError that follows.\n    setExecutionId(null);\n    setComponents([]);\n    setAdditionalData({});\n    setIsFlowInitialized(false);\n    await setChallengeToken(null);\n    try {\n      const storageManager: any = await getStorageManager();\n      await storageManager?.removeHybridDataParameter?.('authId');\n    } catch {\n      logger.warn('Failed to clear authId from hybrid storage.');\n    }\n    setIsTimeoutDisabled(false);\n    // Reset refs to allow new flows to start properly\n    oauthCodeProcessedRef.current = false;\n  };\n\n  /**\n   * Parse URL parameters used in flows.\n   */\n  const getUrlParams = (): any => {\n    const urlParams: any = new URL(window?.location?.href ?? '').searchParams;\n\n    return {\n      applicationId: urlParams.get('applicationId'),\n      authId: urlParams.get('authId'),\n      code: urlParams.get('code'),\n      error: urlParams.get('error'),\n      errorDescription: urlParams.get('error_description'),\n      executionId: urlParams.get('executionId'),\n      nonce: urlParams.get('nonce'),\n      state: urlParams.get('state'),\n    };\n  };\n\n  /**\n   * Handle authId from URL and persist it via the storage manager so it survives URL cleanup.\n   * ThunderIDReactClient.signIn() reads authId from storageManager.getHybridDataParameter('authId'),\n   * not from raw sessionStorage, so we must use the same storage path here.\n   */\n  const handleAuthId = async (authId: string | null): Promise<void> => {\n    if (authId) {\n      try {\n        const storageManager: any = await getStorageManager();\n        await storageManager?.setHybridDataParameter?.('authId', authId);\n      } catch {\n        logger.warn('Failed to store authId in hybrid storage.');\n      }\n    }\n  };\n\n  /**\n   * Clean up OAuth-related URL parameters from the browser URL.\n   */\n  const cleanupOAuthUrlParams = (includeNonce = false): void => {\n    if (!window?.location?.href) return;\n    const url: any = new URL(window.location.href);\n    url.searchParams.delete('error');\n    url.searchParams.delete('error_description');\n    url.searchParams.delete('code');\n    url.searchParams.delete('state');\n    if (includeNonce) {\n      url.searchParams.delete('nonce');\n    }\n    window?.history?.replaceState({}, '', url.toString());\n  };\n\n  /**\n   * Clean up flow-related URL parameters (executionId, authId) from the browser URL.\n   * Used after executionId is set in state to prevent using invalidated executionId from URL.\n   */\n  const cleanupFlowUrlParams = (): void => {\n    if (!window?.location?.href) return;\n    const url: any = new URL(window.location.href);\n    url.searchParams.delete('executionId');\n    url.searchParams.delete('authId');\n    url.searchParams.delete('applicationId');\n    window?.history?.replaceState({}, '', url.toString());\n  };\n\n  /**\n   * Set error state and call onError callback.\n   * Ensures isFlowInitialized is true so errors can be displayed in the UI.\n   */\n  const setError = (source: unknown): void => {\n    // Updater form, so React stores a FlowErrorBuilder instead of calling it.\n    setFlowErrorSource(() => source);\n    setIsFlowInitialized(true);\n    onError?.(resolveFlowError(source, t));\n  };\n\n  /**\n   * Handle OAuth error from URL parameters.\n   * Clears flow state, creates error, and cleans up URL.\n   */\n  const handleOAuthError = (error: string, errorDescription: string | null): void => {\n    clearFlowState();\n    const errorMessage: any = errorDescription || `OAuth error: ${error}`;\n    const err: any = new ThunderIDRuntimeError(errorMessage, 'SIGN_IN_ERROR', 'react');\n    setError(err);\n    cleanupOAuthUrlParams(true);\n  };\n\n  /**\n   * Handle REDIRECTION response by storing flow state and redirecting to OAuth provider.\n   */\n  const handleRedirection = async (response: EmbeddedSignInFlowResponse): Promise<boolean> => {\n    if (response.type === EmbeddedSignInFlowType.Redirection) {\n      const redirectURL: any = (response.data as any)?.redirectURL || (response as any)?.redirectURL;\n\n      if (redirectURL && window?.location) {\n        if (response.executionId) {\n          setExecutionId(response.executionId);\n        }\n        await setChallengeToken(response.challengeToken ?? null);\n\n        const urlParams: any = getUrlParams();\n        await handleAuthId(urlParams.authId);\n\n        initiateOAuthRedirect(redirectURL, vendor);\n        return true;\n      }\n    }\n    return false;\n  };\n\n  /**\n   * Handle ERROR and COMPLETE responses. Returns true if fully handled.\n   * ERROR + executionId: recoverable — session preserved for retry.\n   * ERROR + no executionId: terminal — clear state and surface the error.\n   */\n  const handleTerminalResponse = async (response: EmbeddedSignInFlowResponse): Promise<boolean> => {\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n      // Propagate OAuth error to the client\n      if (response.redirectUrl && window?.location) {\n        setIsSubmitting(false);\n        await clearFlowState();\n        cleanupOAuthUrlParams(true);\n        onError?.(new Error(extractErrorMessage(response, t)));\n        window.location.href = response.redirectUrl;\n\n        return true;\n      }\n\n      if (response.executionId) {\n        // Recoverable: session still alive. Show inline error without firing onError.\n        setExecutionId(response.executionId);\n        await setChallengeToken(response.challengeToken ?? null);\n        setIsFlowInitialized(true);\n        setFlowErrorSource(response);\n        return true;\n      }\n      // Terminal: backend invalidated the session — clear all state.\n      await clearFlowState();\n      setError(response);\n      cleanupFlowUrlParams();\n      return true;\n    }\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // Get redirectUrl from response (from /oauth2/auth/callback) or fall back to afterSignInUrl\n      const redirectUrl: any = (response as any)?.redirectUrl || (response as any)?.redirect_uri;\n      const finalRedirectUrl: any = redirectUrl || afterSignInUrl;\n\n      // Clear submitting state before redirect\n      setIsSubmitting(false);\n\n      // Clear all OAuth-related storage on successful completion\n      setExecutionId(null);\n      await setChallengeToken(null);\n      setIsFlowInitialized(false);\n      sessionStorage.removeItem(`${vendor}_execution_id`);\n      try {\n        const storageManager: any = await getStorageManager();\n        await storageManager?.removeHybridDataParameter?.('authId');\n      } catch {\n        logger.warn('Failed to clear authId from hybrid storage after completion.');\n      }\n\n      // Clean up OAuth URL params before redirect\n      cleanupOAuthUrlParams(true);\n\n      if (onSuccess) {\n        onSuccess({\n          redirectUrl: finalRedirectUrl,\n          ...(response.data || {}),\n        });\n      }\n\n      if (finalRedirectUrl && window?.location) {\n        window.location.href = finalRedirectUrl;\n      }\n\n      return true;\n    }\n\n    return false;\n  };\n\n  /**\n   * Initialize the authentication flow.\n   * Priority: executionId > applicationId (from context) > applicationId (from URL)\n   */\n  const initializeFlow = async (): Promise<void> => {\n    const urlParams: any = getUrlParams();\n\n    // Reset OAuth code processed ref when starting a new flow\n    oauthCodeProcessedRef.current = false;\n    // Clear stale serverFieldErrors so the new flow doesn't inherit them via render-prop.\n    setServerFieldErrors(null);\n\n    await handleAuthId(urlParams.authId);\n\n    const effectiveApplicationId: any = applicationId || urlParams.applicationId;\n\n    // On a page refresh the executionId is no longer in the URL (it is scrubbed by\n    // cleanupFlowUrlParams after the first load). Fall back to the executionId persisted in\n    // sessionStorage so the in-progress flow can be resumed instead of starting a new flow.\n    // This is required for authorization_code apps where direct new-flow initiation is blocked\n    // server-side and the flow must be initiated through the OAuth /authorize endpoint.\n    const storedExecutionId: any = !urlParams.executionId ? sessionStorage.getItem(`${vendor}_execution_id`) : null;\n    const resumeExecutionId: any = urlParams.executionId || storedExecutionId;\n\n    if (!resumeExecutionId && !effectiveApplicationId) {\n      const error: any = new ThunderIDRuntimeError(\n        'Either executionId or applicationId is required for authentication',\n        'SIGN_IN_ERROR',\n        'react',\n      );\n      setError(error);\n\n      return;\n    }\n\n    try {\n      setFlowErrorSource(null);\n\n      let response: EmbeddedSignInFlowResponse;\n\n      if (resumeExecutionId) {\n        try {\n          response = (await signIn({\n            executionId: resumeExecutionId,\n            ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n          })) as EmbeddedSignInFlowResponse;\n        } catch (resumeError) {\n          // Only treat a stale/expired session (HTTP 400 from the server, meaning the stored\n          // executionId is no longer valid) as a recoverable condition. Transient failures\n          // such as 5xx server errors or network errors are rethrown so they surface correctly.\n          const isStaleSession: boolean =\n            storedExecutionId &&\n            resumeExecutionId === storedExecutionId &&\n            resumeError instanceof ThunderIDAPIError &&\n            resumeError.statusCode === 400;\n\n          if (isStaleSession) {\n            setExecutionId(null);\n            try {\n              const storageManager: any = await getStorageManager();\n              await storageManager?.removeHybridDataParameter?.('authId');\n            } catch {\n              logger.warn('Failed to clear authId from hybrid storage.');\n            }\n            if (!effectiveApplicationId) {\n              const expiredError: FlowErrorBuilder = (translate) =>\n                new ThunderIDRuntimeError(\n                  translate('errors.signin.session.expired') ||\n                    'Your session has expired. Please return to the application and sign in again.',\n                  'SIGN_IN_ERROR',\n                  'react',\n                );\n              setError(expiredError);\n              return;\n            }\n            response = (await signIn({\n              applicationId: effectiveApplicationId,\n              flowType: EmbeddedFlowType.Authentication,\n              ...(scopes && {scopes}),\n              ...(organizationUnitId && {ouId: organizationUnitId}),\n            })) as EmbeddedSignInFlowResponse;\n          } else {\n            throw resumeError;\n          }\n        }\n      } else {\n        response = (await signIn({\n          applicationId: effectiveApplicationId,\n          flowType: EmbeddedFlowType.Authentication,\n          ...(scopes && {scopes}),\n          ...(organizationUnitId && {ouId: organizationUnitId}),\n        })) as EmbeddedSignInFlowResponse;\n      }\n\n      if (await handleRedirection(response)) {\n        return;\n      }\n\n      // Handle a flow that completes (or errors) on the very first step — e.g. a reused SSO\n      // session lets the backend return COMPLETE immediately with no UI components. Without\n      // this the UI would fall through with no components and spin forever.\n      if (await handleTerminalResponse(response)) {\n        // Only reset the init gate for unrecoverable Error responses so the user can retry;\n        // Complete-without-redirect would otherwise kick off a fresh flow unintentionally.\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error && !response.executionId) {\n          initializationAttemptedRef.current = false;\n        }\n        return;\n      }\n\n      const {\n        executionId: normalizedExecutionId,\n        components: normalizedComponents,\n        additionalData: normalizedAdditionalData,\n      } = normalizeFlowResponse(\n        response,\n        t,\n        {\n          resolveTranslations: false,\n        },\n        meta,\n      );\n\n      await setChallengeToken(response.challengeToken ?? null);\n\n      if (normalizedExecutionId && normalizedComponents) {\n        setExecutionId(normalizedExecutionId);\n        setComponents(normalizedComponents);\n        setAdditionalData(normalizedAdditionalData ?? {});\n        setIsFlowInitialized(true);\n        setIsTimeoutDisabled(false);\n        // Clean up executionId from URL after setting it in state\n        cleanupFlowUrlParams();\n      }\n    } catch (error) {\n      const err: any = error;\n      await clearFlowState();\n\n      setError(err);\n      initializationAttemptedRef.current = false;\n    }\n  };\n\n  /**\n   * Initialize the flow and handle cleanup of stale flow state.\n   */\n  useEffect(() => {\n    const urlParams: any = getUrlParams();\n\n    // Check for OAuth error in URL\n    if (urlParams.error) {\n      handleOAuthError(urlParams.error, urlParams.errorDescription);\n      return;\n    }\n\n    handleAuthId(urlParams.authId);\n\n    // Skip OAuth code processing - let the dedicated OAuth useEffect handle it\n    // No action needed here as the dedicated useEffect will handle it\n  }, []);\n\n  useEffect(() => {\n    // Only initialize if we're not processing an OAuth callback or submission.\n    // Wait for isStorageReady so the challenge token is restored from storage before\n    // we attempt to resume a persisted executionId — the server requires it.\n    const currentUrlParams: any = getUrlParams();\n    if (\n      isInitialized &&\n      isStorageReady &&\n      !isLoading &&\n      !isFlowInitialized &&\n      !initializationAttemptedRef.current &&\n      !currentExecutionId &&\n      !currentUrlParams.code &&\n      !currentUrlParams.state &&\n      !isSubmitting &&\n      !oauthCodeProcessedRef.current\n    ) {\n      initializationAttemptedRef.current = true;\n      initializeFlow();\n    }\n  }, [isInitialized, isStorageReady, isLoading, isFlowInitialized, currentExecutionId]);\n\n  /**\n   * Handle form submission from BaseSignIn or render props.\n   */\n  const handleSubmit = async (payload: EmbeddedSignInFlowRequest): Promise<void> => {\n    // Use executionId from payload if available, otherwise fall back to currentExecutionId\n    const effectiveExecutionId: any = payload.executionId || currentExecutionId;\n\n    if (!effectiveExecutionId) {\n      throw new Error('No active flow ID');\n    }\n\n    let processedInputs: Record<string, any> = {...payload.inputs};\n\n    // Read and strip the sentinel up front so it can never reach the wire as an input\n    const consentReason: string | undefined = processedInputs[CONSENT_REASON_KEY];\n    delete processedInputs[CONSENT_REASON_KEY];\n\n    // Auto-compile consent decisions if we are currently on a consent prompt step\n    if (additionalData?.['consentPrompt']) {\n      try {\n        const consentPromptRawData: any = additionalData['consentPrompt'];\n        const purposes: any[] =\n          typeof consentPromptRawData === 'string'\n            ? JSON.parse(consentPromptRawData)\n            : consentPromptRawData.purposes || consentPromptRawData;\n\n        // Find the action component to determine if it was a deny action\n        let isDeny = false;\n        if (payload.action) {\n          // Flatten components to find the action\n          const findAction = (comps: any[]): any => {\n            if (!comps || comps.length === 0) return null;\n\n            const found: any = comps.find((c: any) => c.id === payload.action);\n            if (found) return found;\n\n            return comps.reduce((acc: any, c: any) => {\n              if (acc) return acc;\n              if (c.components) return findAction(c.components);\n              return null;\n            }, null);\n          };\n\n          const submitAction: any = findAction(components);\n\n          if (submitAction && submitAction.variant?.toLowerCase() !== 'primary') {\n            isDeny = true;\n          }\n        }\n\n        // An expired prompt is never an approval, whichever action carried the submission\n        if (consentReason === ConsentConstants.REASON_TIMEOUT) {\n          isDeny = true;\n        }\n\n        // Approval waits while an approved authorization detail shows a value that cannot be submitted\n        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument\n        if (!isDeny && isConsentApprovalBlocked(purposes, processedInputs)) {\n          return;\n        }\n\n        // An explicit denial carries a reason too, so the server never has to infer one\n        const reason: string | undefined = consentReason ?? (isDeny ? ConsentConstants.REASON_USER_DENIED : undefined);\n\n        processedInputs = compileConsentDecisions(processedInputs, purposes, {\n          approved: !isDeny,\n          ...(reason ? {reason} : {}),\n        });\n      } catch (e) {\n        // Failed to construct consent_decisions payload automatically\n      }\n    }\n\n    try {\n      setIsSubmitting(true);\n      setFlowErrorSource(null);\n      // Clear any field errors from the previous response before the new round-trip.\n      setServerFieldErrors(null);\n\n      const response: EmbeddedSignInFlowResponse = (await signIn({\n        executionId: effectiveExecutionId,\n        ...payload,\n        inputs: processedInputs,\n        ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n      })) as EmbeddedSignInFlowResponse;\n\n      if (await handleRedirection(response)) {\n        return;\n      }\n      if (\n        response.data?.additionalData?.['passkeyChallenge'] ||\n        response.data?.additionalData?.['passkeyCreationOptions']\n      ) {\n        const {passkeyChallenge, passkeyCreationOptions}: any = response.data.additionalData;\n        const effectiveExecutionIdForPasskey: any = response.executionId || effectiveExecutionId;\n\n        // Reset passkey processed ref to allow processing\n        passkeyProcessedRef.current = false;\n\n        await setChallengeToken(response.challengeToken ?? null);\n\n        // Set passkey state to trigger the passkey\n        setPasskeyState({\n          actionId: 'submit',\n          challenge: passkeyChallenge,\n          creationOptions: passkeyCreationOptions,\n          error: null,\n          executionId: effectiveExecutionIdForPasskey,\n          isActive: true,\n        });\n        setIsSubmitting(false);\n\n        return;\n      }\n\n      // Handle terminal flow statuses before normalization.\n      if (await handleTerminalResponse(response)) {\n        return;\n      }\n\n      const {\n        executionId: normalizedExecutionId,\n        components: normalizedComponents,\n        additionalData: normalizedAdditionalData,\n      } = normalizeFlowResponse(\n        response,\n        t,\n        {\n          resolveTranslations: false,\n        },\n        meta,\n      );\n\n      // Always update challenge token on any INCOMPLETE response — token rotates every step.\n      await setChallengeToken(response.challengeToken ?? null);\n\n      // Update executionId if response contains a new one\n      if (normalizedExecutionId && normalizedComponents) {\n        setExecutionId(normalizedExecutionId);\n        setComponents(normalizedComponents);\n        setAdditionalData(normalizedAdditionalData ?? {});\n        setIsTimeoutDisabled(false);\n        // Ensure flow is marked as initialized when we have components\n        setIsFlowInitialized(true);\n        // Clean up executionId from URL after setting it in state\n        cleanupFlowUrlParams();\n\n        // Surface server-side validation failures so BaseSignIn can inject them into\n        // the form-level fieldErrors state used by the render-prop / default UI.\n        const responseFieldErrors: FieldError[] | undefined = (response.data as any)?.fieldErrors;\n        if (responseFieldErrors && responseFieldErrors.length > 0) {\n          setServerFieldErrors(responseFieldErrors);\n        }\n\n        // Display error from INCOMPLETE response\n        if ((response as any)?.error) {\n          setFlowErrorSource(response);\n        }\n      }\n    } catch (error) {\n      const err: any = error;\n      await clearFlowState();\n\n      setError(err);\n      return;\n    } finally {\n      setIsSubmitting(false);\n    }\n  };\n\n  /**\n   * Handle step timeout if configured in additionalData.\n   *\n   * An expired consent prompt is auto-submitted as a denial carrying the timeout reason, because its\n   * actions no longer lead anywhere and the user would otherwise be stranded on the prompt. The\n   * server discards those decisions and records nothing. Every other kind of step surfaces the\n   * expiry error instead.\n   */\n  timeoutContextRef.current = {\n    components,\n    hasConsentPrompt: Boolean(additionalData?.['consentPrompt']),\n    submit: handleSubmit,\n  };\n\n  useEffect(() => {\n    const timeoutMs: number = Number(additionalData?.['stepTimeout']) || 0;\n    if (timeoutMs <= 0 || !isFlowInitialized) {\n      setIsTimeoutDisabled(false);\n      return undefined;\n    }\n\n    const handleTimeout = (): void => {\n      setIsTimeoutDisabled(true);\n\n      const expiredError: FlowErrorBuilder = (translate) =>\n        new Error(translate('errors.signin.timeout') || 'Time allowed to complete the step has expired.');\n\n      // Read through the ref so the timer always sees the step that is on screen when it fires\n      const context = timeoutContextRef.current;\n      const actionId: string | undefined = context?.hasConsentPrompt\n        ? findConsentSubmitActionId(context.components)\n        : undefined;\n\n      // Without an action the prompt node cannot be routed, so there is nothing to submit\n      if (actionId && context && timeoutSubmittedForRef.current !== timeoutMs) {\n        timeoutSubmittedForRef.current = timeoutMs;\n        context\n          .submit({action: actionId, inputs: {[CONSENT_REASON_KEY]: ConsentConstants.REASON_TIMEOUT}})\n          .catch(() => setError(expiredError));\n        return;\n      }\n\n      setError(expiredError);\n    };\n\n    const timerId: ReturnType<typeof setTimeout> = setTimeout(handleTimeout, Math.max(0, timeoutMs - Date.now()));\n\n    return () => clearTimeout(timerId);\n  }, [additionalData?.['stepTimeout'], isFlowInitialized, t]);\n\n  /**\n   * Handle authentication errors.\n   */\n  const handleError = (error: Error): void => {\n    setError(error);\n  };\n\n  useOAuthCallback({\n    currentExecutionId,\n    executionIdStorageKey: `${vendor}_execution_id`,\n    isInitialized: isInitialized && !isLoading && isStorageReady,\n    isSubmitting,\n    onError: (err: any) => {\n      clearFlowState();\n      setError(err instanceof Error ? err : new Error(String(err)));\n    },\n    onSubmit: async (payload: any) => handleSubmit({executionId: payload.executionId, inputs: payload.inputs}),\n    processedRef: oauthCodeProcessedRef,\n    setExecutionId,\n  });\n\n  /**\n   * Handle passkey authentication/registration when passkey state becomes active.\n   * This effect auto-triggers the browser passkey popup and submits the result.\n   */\n  useEffect(() => {\n    if (\n      !passkeyState.isActive ||\n      (!passkeyState.challenge && !passkeyState.creationOptions) ||\n      !passkeyState.executionId\n    ) {\n      return;\n    }\n\n    // Prevent re-processing\n    if (passkeyProcessedRef.current) {\n      return;\n    }\n    passkeyProcessedRef.current = true;\n\n    const performPasskeyProcess = async (): Promise<void> => {\n      let inputs: Record<string, string>;\n\n      if (passkeyState.challenge) {\n        const passkeyResponse: any = await handlePasskeyAuthentication(passkeyState.challenge);\n        const passkeyResponseObj: any = JSON.parse(passkeyResponse);\n\n        inputs = {\n          authenticatorData: passkeyResponseObj.response.authenticatorData,\n          clientDataJSON: passkeyResponseObj.response.clientDataJSON,\n          credentialId: passkeyResponseObj.id,\n          signature: passkeyResponseObj.response.signature,\n          userHandle: passkeyResponseObj.response.userHandle,\n        };\n      } else if (passkeyState.creationOptions) {\n        const passkeyResponse: any = await handlePasskeyRegistration(passkeyState.creationOptions);\n        const passkeyResponseObj: any = JSON.parse(passkeyResponse);\n\n        inputs = {\n          attestationObject: passkeyResponseObj.response.attestationObject,\n          clientDataJSON: passkeyResponseObj.response.clientDataJSON,\n          credentialId: passkeyResponseObj.id,\n        };\n      } else {\n        throw new Error('No passkey challenge or creation options available');\n      }\n\n      await handleSubmit({\n        executionId: passkeyState.executionId ?? undefined,\n        inputs,\n      });\n    };\n\n    performPasskeyProcess()\n      .then(() => {\n        setPasskeyState({\n          actionId: null,\n          challenge: null,\n          creationOptions: null,\n          error: null,\n          executionId: null,\n          isActive: false,\n        });\n      })\n      .catch((error: any) => {\n        setPasskeyState((prev: any) => ({...prev, error: error as Error, isActive: false}));\n        setError(error);\n      });\n  }, [passkeyState.isActive, passkeyState.challenge, passkeyState.creationOptions, passkeyState.executionId]);\n\n  if (children) {\n    // Collapse the server FieldError[] array to a single message per field map for\n    // render-prop consumers. First error per field wins. Multi-error cases per\n    // field are rare in practice (server typically returns one rule failure per\n    // field in current flows) and consumers needing the full array can still read\n    // it from the raw flow response.\n    const renderPropFieldErrors: Record<string, string> = {};\n    if (serverFieldErrors) {\n      for (const fe of serverFieldErrors) {\n        if (!(fe.identifier in renderPropFieldErrors)) {\n          renderPropFieldErrors[fe.identifier] = fe.message;\n        }\n      }\n    }\n\n    const renderProps: SignInRenderProps = {\n      additionalData,\n      components,\n      error: flowError,\n      fieldErrors: renderPropFieldErrors,\n      initialize: initializeFlow,\n      isInitialized: isFlowInitialized,\n      isLoading: isLoading || isSubmitting || !isInitialized,\n      isTimeoutDisabled,\n      meta,\n      onSubmit: handleSubmit,\n    };\n\n    return <>{children(renderProps)}</>;\n  }\n  // Otherwise, render the default BaseSignIn component\n  return (\n    <BaseSignIn\n      additionalData={additionalData}\n      components={components}\n      isLoading={isLoading || !isInitialized || !isFlowInitialized}\n      isTimeoutDisabled={isTimeoutDisabled}\n      onSubmit={handleSubmit}\n      onError={handleError}\n      error={flowError}\n      className={className}\n      size={size}\n      variant={variant}\n      preferences={preferences}\n      revalidateOnChangeAfterBlur={revalidateOnChangeAfterBlur}\n      serverFieldErrors={serverFieldErrors}\n    />\n  );\n};\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;;AA0KA,MAAM,qBAAqB;;AAG3B,MAAM,qBAAqB,WACxB,SAAS,EAAE,EAAE,SAAS,SAAgC,CAAC,MAAM,GAAG,kBAAkB,KAAK,WAAW,CAAC,CAAC;;;;;;AAOvG,MAAM,6BAA6B,UAAmE;CACpG,MAAMA,gBAAyC,kBAAkB,MAAM,CAAC,QACrE,SAAgC,KAAK,MAAM,KAAK,WAAW,aAAa,KAAK,SAC/E;AAKD,SAJsD,cAAc,MACjE,SAAgC,KAAK,SAAS,aAAa,KAAK,UAClE,IAEqB,cAAc,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgE3C,MAAMC,UAA2B,EAC/B,WACA,aACA,OAAO,UACP,WACA,SACA,SACA,UACA,6BACA,yBAC+B;CAC/B,MAAM,EAAC,eAAe,gBAAgB,QAAQ,eAAe,WAAW,MAAM,mBAAmB,QAAQ,WACvGC,sBAAc;CAChB,MAAM,EAAC,MAAKC,uBAAe,aAAa,KAAK;CAG7C,MAAM,CAAC,YAAY,iBAAiB,SAAkC,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,qBAAqB,SAA8B,EAAE,CAAC;CAG7E,MAAM,CAAC,mBAAmB,wBAAwB,SAA8B,KAAK;CACrF,MAAM,CAAC,oBAAoB,yBAAyB,SAAwB,KAAK;CACjF,MAAMC,oBAAyB,OAAsB,KAAK;CAC1D,MAAM,CAAC,gBAAgB,qBAAqB,SAAS,MAAM;CAC3D,MAAM,CAAC,mBAAmB,wBAAwB,SAAS,MAAM;CAEjE,MAAM,CAAC,iBAAiB,sBAAsB,SAAkB,KAAK;CACrE,MAAMC,YAA0B,cACvB,oBAAoB,OAAO,OAAO,iBAAiB,iBAAiB,EAAE,EAC7E,CAAC,iBAAiB,EAAE,CACrB;CACD,MAAM,CAAC,cAAc,mBAAmB,SAAS,MAAM;CACvD,MAAM,CAAC,mBAAmB,wBAAwB,SAAkB,MAAM;CAC1E,MAAM,CAAC,cAAc,mBAAmB,SAAuB;EAC7D,UAAU;EACV,WAAW;EACX,iBAAiB;EACjB,OAAO;EACP,aAAa;EACb,UAAU;EACX,CAAC;CACF,MAAMC,6BAAkC,OAAO,MAAM;CACrD,MAAMC,wBAA6B,OAAO,MAAM;CAChD,MAAMC,sBAA2B,OAAO,MAAM;CAG9C,MAAM,yBAAyB,OAAsB,KAAK;CAG1D,MAAM,oBAAoB,OAIhB,KAAK;;;;;CAKf,MAAM,kBAAkB,gBAAqC;AAC3D,wBAAsB,YAAY;AAClC,MAAI,YACF,gBAAe,QAAQ,GAAG,OAAO,gBAAgB,YAAY;MAE7D,gBAAe,WAAW,GAAG,OAAO,eAAe;;;;;;AAQvD,iBAAgB;AACd,MAAI,CAAC,cAAe;AAEpB,GAAC,YAA2B;AAC1B,OAAI;IAEF,MAAMC,WAAgB,OADM,MAAM,mBAAmB,GACT,kBAAkB;AAC9D,QAAI,UAAU,eACZ,mBAAkB,UAAU,SAAS;aAE/B;AACR,sBAAkB,KAAK;;MAEvB;IACH,CAAC,cAAc,CAAC;;;;;CAMnB,MAAM,oBAAoB,OAAO,mBAAiD;AAChF,oBAAkB,UAAU;AAC5B,MAAI;GACF,MAAMC,iBAAsB,MAAM,mBAAmB;AACrD,OAAI,eACF,KAAI,eACF,OAAM,eAAe,0BAA0B,kBAAkB,eAAe;OAEhF,OAAM,eAAe,6BAA6B,iBAAiB;UAGjE;AACN,UAAO,KAAK,gDAAgD;;;;;;CAOhE,MAAM,iBAAiB,YAA2B;AAIhD,iBAAe,KAAK;AACpB,gBAAc,EAAE,CAAC;AACjB,oBAAkB,EAAE,CAAC;AACrB,uBAAqB,MAAM;AAC3B,QAAM,kBAAkB,KAAK;AAC7B,MAAI;AAEF,UAD4B,MAAM,mBAAmB,GAC/B,4BAA4B,SAAS;UACrD;AACN,UAAO,KAAK,8CAA8C;;AAE5D,uBAAqB,MAAM;AAE3B,wBAAsB,UAAU;;;;;CAMlC,MAAM,qBAA0B;EAC9B,MAAMC,YAAiB,IAAI,IAAI,QAAQ,UAAU,QAAQ,GAAG,CAAC;AAE7D,SAAO;GACL,eAAe,UAAU,IAAI,gBAAgB;GAC7C,QAAQ,UAAU,IAAI,SAAS;GAC/B,MAAM,UAAU,IAAI,OAAO;GAC3B,OAAO,UAAU,IAAI,QAAQ;GAC7B,kBAAkB,UAAU,IAAI,oBAAoB;GACpD,aAAa,UAAU,IAAI,cAAc;GACzC,OAAO,UAAU,IAAI,QAAQ;GAC7B,OAAO,UAAU,IAAI,QAAQ;GAC9B;;;;;;;CAQH,MAAM,eAAe,OAAO,WAAyC;AACnE,MAAI,OACF,KAAI;AAEF,UAD4B,MAAM,mBAAmB,GAC/B,yBAAyB,UAAU,OAAO;UAC1D;AACN,UAAO,KAAK,4CAA4C;;;;;;CAQ9D,MAAM,yBAAyB,eAAe,UAAgB;AAC5D,MAAI,CAAC,QAAQ,UAAU,KAAM;EAC7B,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,oBAAoB;AAC5C,MAAI,aAAa,OAAO,OAAO;AAC/B,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aACF,KAAI,aAAa,OAAO,QAAQ;AAElC,UAAQ,SAAS,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;;;;;CAOvD,MAAM,6BAAmC;AACvC,MAAI,CAAC,QAAQ,UAAU,KAAM;EAC7B,MAAMA,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,cAAc;AACtC,MAAI,aAAa,OAAO,SAAS;AACjC,MAAI,aAAa,OAAO,gBAAgB;AACxC,UAAQ,SAAS,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;;;;;CAOvD,MAAM,YAAY,WAA0B;AAE1C,2BAAyB,OAAO;AAChC,uBAAqB,KAAK;AAC1B,YAAU,iBAAiB,QAAQ,EAAE,CAAC;;;;;;CAOxC,MAAM,oBAAoB,OAAe,qBAA0C;AACjF,kBAAgB;AAGhB,WADiB,IAAI,sBADK,oBAAoB,gBAAgB,SACL,iBAAiB,QAAQ,CACrE;AACb,wBAAsB,KAAK;;;;;CAM7B,MAAM,oBAAoB,OAAO,aAA2D;AAC1F,MAAI,SAAS,SAAS,uBAAuB,aAAa;GACxD,MAAMC,cAAoB,SAAS,MAAc,eAAgB,UAAkB;AAEnF,OAAI,eAAe,QAAQ,UAAU;AACnC,QAAI,SAAS,YACX,gBAAe,SAAS,YAAY;AAEtC,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,UAAM,aADiB,cAAc,CACR,OAAO;AAEpC,0BAAsB,aAAa,OAAO;AAC1C,WAAO;;;AAGX,SAAO;;;;;;;CAQT,MAAM,yBAAyB,OAAO,aAA2D;AAC/F,MAAI,SAAS,eAAe,yBAAyB,OAAO;AAE1D,OAAI,SAAS,eAAe,QAAQ,UAAU;AAC5C,oBAAgB,MAAM;AACtB,UAAM,gBAAgB;AACtB,0BAAsB,KAAK;AAC3B,cAAU,IAAI,MAAM,oBAAoB,UAAU,EAAE,CAAC,CAAC;AACtD,WAAO,SAAS,OAAO,SAAS;AAEhC,WAAO;;AAGT,OAAI,SAAS,aAAa;AAExB,mBAAe,SAAS,YAAY;AACpC,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AACxD,yBAAqB,KAAK;AAC1B,uBAAmB,SAAS;AAC5B,WAAO;;AAGT,SAAM,gBAAgB;AACtB,YAAS,SAAS;AAClB,yBAAsB;AACtB,UAAO;;AAGT,MAAI,SAAS,eAAe,yBAAyB,UAAU;GAG7D,MAAMC,mBADoB,UAAkB,eAAgB,UAAkB,gBACjC;AAG7C,mBAAgB,MAAM;AAGtB,kBAAe,KAAK;AACpB,SAAM,kBAAkB,KAAK;AAC7B,wBAAqB,MAAM;AAC3B,kBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,OAAI;AAEF,WAD4B,MAAM,mBAAmB,GAC/B,4BAA4B,SAAS;WACrD;AACN,WAAO,KAAK,+DAA+D;;AAI7E,yBAAsB,KAAK;AAE3B,OAAI,UACF,WAAU;IACR,aAAa;IACb,GAAI,SAAS,QAAQ,EAAE;IACxB,CAAC;AAGJ,OAAI,oBAAoB,QAAQ,SAC9B,QAAO,SAAS,OAAO;AAGzB,UAAO;;AAGT,SAAO;;;;;;CAOT,MAAM,iBAAiB,YAA2B;EAChD,MAAMH,YAAiB,cAAc;AAGrC,wBAAsB,UAAU;AAEhC,uBAAqB,KAAK;AAE1B,QAAM,aAAa,UAAU,OAAO;EAEpC,MAAMI,yBAA8B,iBAAiB,UAAU;EAO/D,MAAMC,oBAAyB,CAAC,UAAU,cAAc,eAAe,QAAQ,GAAG,OAAO,eAAe,GAAG;EAC3G,MAAMC,oBAAyB,UAAU,eAAe;AAExD,MAAI,CAAC,qBAAqB,CAAC,wBAAwB;AAMjD,YALmB,IAAI,sBACrB,sEACA,iBACA,QACD,CACc;AAEf;;AAGF,MAAI;AACF,sBAAmB,KAAK;GAExB,IAAIC;AAEJ,OAAI,kBACF,KAAI;AACF,eAAY,MAAM,OAAO;KACvB,aAAa;KACb,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;KACjF,CAAC;YACK,aAAa;AAUpB,QALE,qBACA,sBAAsB,qBACtB,uBAAuB,qBACvB,YAAY,eAAe,KAET;AAClB,oBAAe,KAAK;AACpB,SAAI;AAEF,aAD4B,MAAM,mBAAmB,GAC/B,4BAA4B,SAAS;aACrD;AACN,aAAO,KAAK,8CAA8C;;AAE5D,SAAI,CAAC,wBAAwB;MAC3B,MAAMC,gBAAkC,cACtC,IAAI,sBACF,UAAU,gCAAgC,IACxC,iFACF,iBACA,QACD;AACH,eAAS,aAAa;AACtB;;AAEF,gBAAY,MAAM,OAAO;MACvB,eAAe;MACf,UAAU,iBAAiB;MAC3B,GAAI,UAAU,EAAC,QAAO;MACtB,GAAI,sBAAsB,EAAC,MAAM,oBAAmB;MACrD,CAAC;UAEF,OAAM;;OAIV,YAAY,MAAM,OAAO;IACvB,eAAe;IACf,UAAU,iBAAiB;IAC3B,GAAI,UAAU,EAAC,QAAO;IACtB,GAAI,sBAAsB,EAAC,MAAM,oBAAmB;IACrD,CAAC;AAGJ,OAAI,MAAM,kBAAkB,SAAS,CACnC;AAMF,OAAI,MAAM,uBAAuB,SAAS,EAAE;AAG1C,QAAI,SAAS,eAAe,yBAAyB,SAAS,CAAC,SAAS,YACtE,4BAA2B,UAAU;AAEvC;;GAGF,MAAM,EACJ,aAAa,uBACb,YAAY,sBACZ,gBAAgB,6BACd,sBACF,UACA,GACA,EACE,qBAAqB,OACtB,EACD,KACD;AAED,SAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAExD,OAAI,yBAAyB,sBAAsB;AACjD,mBAAe,sBAAsB;AACrC,kBAAc,qBAAqB;AACnC,sBAAkB,4BAA4B,EAAE,CAAC;AACjD,yBAAqB,KAAK;AAC1B,yBAAqB,MAAM;AAE3B,0BAAsB;;WAEjB,OAAO;GACd,MAAMC,MAAW;AACjB,SAAM,gBAAgB;AAEtB,YAAS,IAAI;AACb,8BAA2B,UAAU;;;;;;AAOzC,iBAAgB;EACd,MAAMT,YAAiB,cAAc;AAGrC,MAAI,UAAU,OAAO;AACnB,oBAAiB,UAAU,OAAO,UAAU,iBAAiB;AAC7D;;AAGF,eAAa,UAAU,OAAO;IAI7B,EAAE,CAAC;AAEN,iBAAgB;EAId,MAAMU,mBAAwB,cAAc;AAC5C,MACE,iBACA,kBACA,CAAC,aACD,CAAC,qBACD,CAAC,2BAA2B,WAC5B,CAAC,sBACD,CAAC,iBAAiB,QAClB,CAAC,iBAAiB,SAClB,CAAC,gBACD,CAAC,sBAAsB,SACvB;AACA,8BAA2B,UAAU;AACrC,mBAAgB;;IAEjB;EAAC;EAAe;EAAgB;EAAW;EAAmB;EAAmB,CAAC;;;;CAKrF,MAAM,eAAe,OAAO,YAAsD;EAEhF,MAAMC,uBAA4B,QAAQ,eAAe;AAEzD,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM,oBAAoB;EAGtC,IAAIC,kBAAuC,EAAC,GAAG,QAAQ,QAAO;EAG9D,MAAMC,gBAAoC,gBAAgB;AAC1D,SAAO,gBAAgB;AAGvB,MAAI,iBAAiB,iBACnB,KAAI;GACF,MAAMC,uBAA4B,eAAe;GACjD,MAAMC,WACJ,OAAO,yBAAyB,WAC5B,KAAK,MAAM,qBAAqB,GAChC,qBAAqB,YAAY;GAGvC,IAAI,SAAS;AACb,OAAI,QAAQ,QAAQ;IAElB,MAAM,cAAc,UAAsB;AACxC,SAAI,CAAC,SAAS,MAAM,WAAW,EAAG,QAAO;KAEzC,MAAMC,QAAa,MAAM,MAAM,MAAW,EAAE,OAAO,QAAQ,OAAO;AAClE,SAAI,MAAO,QAAO;AAElB,YAAO,MAAM,QAAQ,KAAU,MAAW;AACxC,UAAI,IAAK,QAAO;AAChB,UAAI,EAAE,WAAY,QAAO,WAAW,EAAE,WAAW;AACjD,aAAO;QACN,KAAK;;IAGV,MAAMC,eAAoB,WAAW,WAAW;AAEhD,QAAI,gBAAgB,aAAa,SAAS,aAAa,KAAK,UAC1D,UAAS;;AAKb,OAAI,kBAAkB,iBAAiB,eACrC,UAAS;AAKX,OAAI,CAAC,UAAUC,iCAAyB,UAAU,gBAAgB,CAChE;GAIF,MAAMC,SAA6B,kBAAkB,SAAS,iBAAiB,qBAAqB;AAEpG,qBAAkB,wBAAwB,iBAAiB,UAAU;IACnE,UAAU,CAAC;IACX,GAAI,SAAS,EAAC,QAAO,GAAG,EAAE;IAC3B,CAAC;WACK,GAAG;AAKd,MAAI;AACF,mBAAgB,KAAK;AACrB,sBAAmB,KAAK;AAExB,wBAAqB,KAAK;GAE1B,MAAMZ,WAAwC,MAAM,OAAO;IACzD,aAAa;IACb,GAAG;IACH,QAAQ;IACR,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;IACjF,CAAC;AAEF,OAAI,MAAM,kBAAkB,SAAS,CACnC;AAEF,OACE,SAAS,MAAM,iBAAiB,uBAChC,SAAS,MAAM,iBAAiB,2BAChC;IACA,MAAM,EAAC,kBAAkB,2BAA+B,SAAS,KAAK;IACtE,MAAMa,iCAAsC,SAAS,eAAe;AAGpE,wBAAoB,UAAU;AAE9B,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,oBAAgB;KACd,UAAU;KACV,WAAW;KACX,iBAAiB;KACjB,OAAO;KACP,aAAa;KACb,UAAU;KACX,CAAC;AACF,oBAAgB,MAAM;AAEtB;;AAIF,OAAI,MAAM,uBAAuB,SAAS,CACxC;GAGF,MAAM,EACJ,aAAa,uBACb,YAAY,sBACZ,gBAAgB,6BACd,sBACF,UACA,GACA,EACE,qBAAqB,OACtB,EACD,KACD;AAGD,SAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,OAAI,yBAAyB,sBAAsB;AACjD,mBAAe,sBAAsB;AACrC,kBAAc,qBAAqB;AACnC,sBAAkB,4BAA4B,EAAE,CAAC;AACjD,yBAAqB,MAAM;AAE3B,yBAAqB,KAAK;AAE1B,0BAAsB;IAItB,MAAMC,sBAAiD,SAAS,MAAc;AAC9E,QAAI,uBAAuB,oBAAoB,SAAS,EACtD,sBAAqB,oBAAoB;AAI3C,QAAK,UAAkB,MACrB,oBAAmB,SAAS;;WAGzB,OAAO;GACd,MAAMZ,MAAW;AACjB,SAAM,gBAAgB;AAEtB,YAAS,IAAI;AACb;YACQ;AACR,mBAAgB,MAAM;;;;;;;;;;;AAY1B,mBAAkB,UAAU;EAC1B;EACA,kBAAkB,QAAQ,iBAAiB,iBAAiB;EAC5D,QAAQ;EACT;AAED,iBAAgB;EACd,MAAMa,YAAoB,OAAO,iBAAiB,eAAe,IAAI;AACrE,MAAI,aAAa,KAAK,CAAC,mBAAmB;AACxC,wBAAqB,MAAM;AAC3B;;EAGF,MAAM,sBAA4B;AAChC,wBAAqB,KAAK;GAE1B,MAAMd,gBAAkC,cACtC,IAAI,MAAM,UAAU,wBAAwB,IAAI,iDAAiD;GAGnG,MAAM,UAAU,kBAAkB;GAClC,MAAMe,WAA+B,SAAS,mBAC1C,0BAA0B,QAAQ,WAAW,GAC7C;AAGJ,OAAI,YAAY,WAAW,uBAAuB,YAAY,WAAW;AACvE,2BAAuB,UAAU;AACjC,YACG,OAAO;KAAC,QAAQ;KAAU,QAAQ,GAAE,qBAAqB,iBAAiB,gBAAe;KAAC,CAAC,CAC3F,YAAY,SAAS,aAAa,CAAC;AACtC;;AAGF,YAAS,aAAa;;EAGxB,MAAMC,UAAyC,WAAW,eAAe,KAAK,IAAI,GAAG,YAAY,KAAK,KAAK,CAAC,CAAC;AAE7G,eAAa,aAAa,QAAQ;IACjC;EAAC,iBAAiB;EAAgB;EAAmB;EAAE,CAAC;;;;CAK3D,MAAM,eAAe,UAAuB;AAC1C,WAAS,MAAM;;AAGjB,kBAAiB;EACf;EACA,uBAAuB,GAAG,OAAO;EACjC,eAAe,iBAAiB,CAAC,aAAa;EAC9C;EACA,UAAU,QAAa;AACrB,mBAAgB;AAChB,YAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC,CAAC;;EAE/D,UAAU,OAAO,YAAiB,aAAa;GAAC,aAAa,QAAQ;GAAa,QAAQ,QAAQ;GAAO,CAAC;EAC1G,cAAc;EACd;EACD,CAAC;;;;;AAMF,iBAAgB;AACd,MACE,CAAC,aAAa,YACb,CAAC,aAAa,aAAa,CAAC,aAAa,mBAC1C,CAAC,aAAa,YAEd;AAIF,MAAI,oBAAoB,QACtB;AAEF,sBAAoB,UAAU;EAE9B,MAAM,wBAAwB,YAA2B;GACvD,IAAIC;AAEJ,OAAI,aAAa,WAAW;IAC1B,MAAMC,kBAAuB,MAAM,4BAA4B,aAAa,UAAU;IACtF,MAAMC,qBAA0B,KAAK,MAAM,gBAAgB;AAE3D,aAAS;KACP,mBAAmB,mBAAmB,SAAS;KAC/C,gBAAgB,mBAAmB,SAAS;KAC5C,cAAc,mBAAmB;KACjC,WAAW,mBAAmB,SAAS;KACvC,YAAY,mBAAmB,SAAS;KACzC;cACQ,aAAa,iBAAiB;IACvC,MAAMD,kBAAuB,MAAM,0BAA0B,aAAa,gBAAgB;IAC1F,MAAMC,qBAA0B,KAAK,MAAM,gBAAgB;AAE3D,aAAS;KACP,mBAAmB,mBAAmB,SAAS;KAC/C,gBAAgB,mBAAmB,SAAS;KAC5C,cAAc,mBAAmB;KAClC;SAED,OAAM,IAAI,MAAM,qDAAqD;AAGvE,SAAM,aAAa;IACjB,aAAa,aAAa,eAAe;IACzC;IACD,CAAC;;AAGJ,yBAAuB,CACpB,WAAW;AACV,mBAAgB;IACd,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,OAAO;IACP,aAAa;IACb,UAAU;IACX,CAAC;IACF,CACD,OAAO,UAAe;AACrB,oBAAiB,UAAe;IAAC,GAAG;IAAa;IAAgB,UAAU;IAAM,EAAE;AACnF,YAAS,MAAM;IACf;IACH;EAAC,aAAa;EAAU,aAAa;EAAW,aAAa;EAAiB,aAAa;EAAY,CAAC;AAE3G,KAAI,UAAU;EAMZ,MAAMC,wBAAgD,EAAE;AACxD,MAAI,mBACF;QAAK,MAAM,MAAM,kBACf,KAAI,EAAE,GAAG,cAAc,uBACrB,uBAAsB,GAAG,cAAc,GAAG;;AAkBhD,SAAO,4CAAG,SAb6B;GACrC;GACA;GACA,OAAO;GACP,aAAa;GACb,YAAY;GACZ,eAAe;GACf,WAAW,aAAa,gBAAgB,CAAC;GACzC;GACA;GACA,UAAU;GACX,CAE8B,GAAI;;AAGrC,QACE,oBAACC;EACiB;EACJ;EACZ,WAAW,aAAa,CAAC,iBAAiB,CAAC;EACxB;EACnB,UAAU;EACV,SAAS;EACT,OAAO;EACI;EACL;EACG;EACI;EACgB;EACV;GACnB;;AAIN,qBAAe"}
+{"version":3,"file":"SignIn.js","names":["submitActions: EmbeddedFlowComponent[]","SignIn: FC<SignInProps>","useThunderID","useTranslation","challengeTokenRef: any","flowError: Error | null","initializationAttemptedRef: any","oauthCodeProcessedRef: any","passkeyProcessedRef: any","tempData: any","storageManager: any","executionIdToClear: string | null","urlParams: any","url: any","redirectURL: any","finalRedirectUrl: any","completedExecutionId: string | null","effectiveApplicationId: any","storedExecutionId: any","resumeExecutionId: any","response: EmbeddedSignInFlowResponse","expiredError: FlowErrorBuilder","err: any","currentUrlParams: any","effectiveExecutionId: any","processedInputs: Record<string, any>","consentReason: string | undefined","consentPromptRawData: any","purposes: any[]","found: any","submitAction: any","isConsentApprovalBlocked","reason: string | undefined","effectiveExecutionIdForPasskey: any","responseFieldErrors: FieldError[] | undefined","timeoutMs: number","actionId: string | undefined","timerId: ReturnType<typeof setTimeout>","inputs: Record<string, string>","passkeyResponse: any","passkeyResponseObj: any","renderPropFieldErrors: Record<string, string>","BaseSignIn"],"sources":["../../../../src/components/auth/SignIn/SignIn.tsx"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDRuntimeError,\n  ThunderIDAPIError,\n  ConsentConstants,\n  EmbeddedFlowComponent,\n  EmbeddedFlowType,\n  EmbeddedSignInFlowResponse,\n  EmbeddedSignInFlowRequest,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignInFlowType,\n  FieldError,\n  FlowMetadataResponse,\n  Preferences,\n  logger,\n  compileConsentDecisions,\n} from '@thunderid/browser';\nimport {FC, ReactElement, useState, useEffect, useMemo, useRef, ReactNode} from 'react';\n// eslint-disable-next-line import/no-named-as-default\nimport BaseSignIn, {BaseSignInProps} from './BaseSignIn';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\nimport {useOAuthCallback} from '../../../hooks/auth/useOAuthCallback';\nimport useTranslation from '../../../hooks/useTranslation';\nimport {\n  extractErrorMessage,\n  FlowErrorBuilder,\n  normalizeFlowResponse,\n  resolveFlowError,\n} from '../../../utils/flowTransformer';\nimport isConsentApprovalBlocked from '../../../utils/isConsentApprovalBlocked';\nimport {initiateOAuthRedirect} from '../../../utils/oauth';\nimport {handlePasskeyAuthentication, handlePasskeyRegistration} from '../../../utils/passkey';\n\n/**\n * Render props function parameters\n */\nexport interface SignInRenderProps {\n  /**\n   * Additional data from the flow response containing contextual information\n   * like consent prompt details and session timeouts.\n   */\n  additionalData?: Record<string, any>;\n\n  /**\n   * Current flow components\n   */\n  components: EmbeddedFlowComponent[];\n\n  /**\n   * Current error if any\n   */\n  error: Error | null;\n\n  /**\n   * Server-side field-level validation errors from the most recent flow response,\n   * collapsed to one message per field (first error wins). Empty when no validation\n   * failures are active. Render-prop consumers should display these alongside their\n   * own client-side validation errors.\n   */\n  fieldErrors: Record<string, string>;\n\n  /**\n   * Function to manually initialize the flow\n   */\n  initialize: () => Promise<void>;\n\n  /**\n   * Whether the flow has been initialized\n   */\n  isInitialized: boolean;\n\n  /**\n   * Loading state indicator\n   */\n  isLoading: boolean;\n\n  /**\n   * Flag indicating whether the flow step timeout has expired.\n   * Consuming components can use this to disable submit buttons.\n   */\n  isTimeoutDisabled?: boolean;\n\n  /**\n   * Flow metadata returned by the platform (v2 only). `null` while loading or unavailable.\n   */\n  meta: FlowMetadataResponse | null;\n\n  /**\n   * Function to submit authentication data (primary)\n   */\n  onSubmit: (payload: EmbeddedSignInFlowRequest) => Promise<void>;\n}\n\n/**\n * Props for the SignIn component.\n * Matches the interface from the main SignIn component for consistency.\n */\nexport interface SignInProps {\n  /**\n   * Render props function for custom UI\n   */\n  children?: (props: SignInRenderProps) => ReactNode;\n\n  /**\n   * Custom CSS class name for the form container.\n   */\n  className?: string;\n\n  /**\n   * Bounds the sign-in to this organization unit. Sent as `ouId` on the request that starts the\n   * `AUTHENTICATION` flow only, never on a continuation.\n   */\n  organizationUnitId?: string;\n\n  /**\n   * Callback function called when authentication fails.\n   * @param error - The error that occurred during authentication.\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Callback function called when authentication is successful.\n   * @param authData - The authentication data returned upon successful completion.\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Component-level preferences to override global i18n and theme settings.\n   * Preferences are deep-merged with global ones, with component preferences\n   * taking precedence. Affects this component and all its descendants.\n   */\n  preferences?: Preferences;\n\n  /**\n   * When a field has been blurred at least once, re-run validation on every subsequent\n   * keystroke so a rendered error clears the moment the value becomes valid. Doesn't\n   * affect fields that have never been blurred — the user isn't shown errors while\n   * initially typing. Default `false` preserves prior behavior.\n   */\n  revalidateOnChangeAfterBlur?: boolean;\n\n  /**\n   * Size variant for the component.\n   */\n  size?: 'small' | 'medium' | 'large';\n\n  /**\n   * Theme variant for the component.\n   */\n  variant?: BaseSignInProps['variant'];\n}\n\n/**\n * State for tracking passkey registration\n */\ninterface PasskeyState {\n  actionId: string | null;\n  challenge: string | null;\n  creationOptions: string | null;\n  error: Error | null;\n  executionId: string | null;\n  isActive: boolean;\n}\n\n/**\n * Sentinel input key carrying the reason a consent prompt was submitted. It is folded into the\n * compiled `consent_decisions` payload and stripped from the inputs, like `__consent_opt__` keys.\n */\nconst CONSENT_REASON_KEY = '__consent_reason__';\n\n/** Flattens a component tree into a single list, parents before their children. */\nconst flattenComponents = (comps: EmbeddedFlowComponent[] | undefined): EmbeddedFlowComponent[] =>\n  (comps ?? []).flatMap((comp: EmbeddedFlowComponent) => [comp, ...flattenComponents(comp.components)]);\n\n/**\n * Finds the action to submit an expired consent prompt with. A non-primary submit action is\n * preferred so the payload reads as a denial, falling back to any submit action because the server\n * needs an action to route the prompt node. Returns undefined when the view has neither.\n */\nconst findConsentSubmitActionId = (comps: EmbeddedFlowComponent[] | undefined): string | undefined => {\n  const submitActions: EmbeddedFlowComponent[] = flattenComponents(comps).filter(\n    (comp: EmbeddedFlowComponent) => comp.id && comp.eventType?.toUpperCase() === 'SUBMIT',\n  );\n  const denyAction: EmbeddedFlowComponent | undefined = submitActions.find(\n    (comp: EmbeddedFlowComponent) => comp.variant?.toLowerCase() !== 'primary',\n  );\n\n  return (denyAction ?? submitActions[0])?.id;\n};\n\n/**\n * A component-driven SignIn component that provides authentication flow with pre-built styling.\n * This component handles the flow API calls for authentication and delegates UI logic to BaseSignIn.\n * It automatically transforms simple input-based responses into component-driven UI format.\n *\n * @example\n * // Default UI\n * ```tsx\n * import { SignIn } from '@thunderid/react/component-driven';\n *\n * const App = () => {\n *   return (\n *     <SignIn\n *       onSuccess={(authData) => {\n *         console.log('Authentication successful:', authData);\n *       }}\n *       onError={(error) => {\n *         console.error('Authentication failed:', error);\n *       }}\n *       size=\"medium\"\n *       variant=\"outlined\"\n *     />\n *   );\n * };\n * ```\n *\n * @example\n * // Custom UI with render props\n * ```tsx\n * import { SignIn } from '@thunderid/react/component-driven';\n *\n * const App = () => {\n *   return (\n *     <SignIn\n *       onSuccess={(authData) => console.log('Success:', authData)}\n *       onError={(error) => console.error('Error:', error)}\n *     >\n *       {({signIn, isLoading, components, error, isInitialized}) => (\n *         <div className=\"custom-signin\">\n *           <h1>Custom Sign In</h1>\n *           {!isInitialized ? (\n *             <p>Initializing...</p>\n *           ) : error ? (\n *             <div className=\"error\">{error.message}</div>\n *           ) : (\n *             <form onSubmit={(e) => {\n *               e.preventDefault();\n *               signIn({inputs: {username: 'user', password: 'pass'}});\n *             }}>\n *               <button type=\"submit\" disabled={isLoading}>\n *                 {isLoading ? 'Signing in...' : 'Sign In'}\n *               </button>\n *             </form>\n *           )}\n *         </div>\n *       )}\n *     </SignIn>\n *   );\n * };\n * ```\n */\nconst SignIn: FC<SignInProps> = ({\n  className,\n  preferences,\n  size = 'medium',\n  onSuccess,\n  onError,\n  variant,\n  children,\n  revalidateOnChangeAfterBlur,\n  organizationUnitId,\n}: SignInProps): ReactElement => {\n  const {applicationId, afterSignInUrl, signIn, isInitialized, isLoading, meta, getStorageManager, scopes, vendor} =\n    useThunderID();\n  const {t} = useTranslation(preferences?.i18n);\n\n  // State management for the flow\n  const [components, setComponents] = useState<EmbeddedFlowComponent[]>([]);\n  const [additionalData, setAdditionalData] = useState<Record<string, any>>({});\n  // Server-side validation errors from the most recent flow response. Updated on every\n  // submission; cleared when the next submission begins so stale errors don't linger.\n  const [serverFieldErrors, setServerFieldErrors] = useState<FieldError[] | null>(null);\n  const [currentExecutionId, setCurrentExecutionId] = useState<string | null>(null);\n  const challengeTokenRef: any = useRef<string | null>(null);\n  const [isStorageReady, setIsStorageReady] = useState(false);\n  const [isFlowInitialized, setIsFlowInitialized] = useState(false);\n  // Raw banner error source, resolved on render so the message follows a language change.\n  const [flowErrorSource, setFlowErrorSource] = useState<unknown>(null);\n  const flowError: Error | null = useMemo(\n    () => (flowErrorSource === null ? null : resolveFlowError(flowErrorSource, t)),\n    [flowErrorSource, t],\n  );\n  const [isSubmitting, setIsSubmitting] = useState(false);\n  const [isTimeoutDisabled, setIsTimeoutDisabled] = useState<boolean>(false);\n  const [passkeyState, setPasskeyState] = useState<PasskeyState>({\n    actionId: null,\n    challenge: null,\n    creationOptions: null,\n    error: null,\n    executionId: null,\n    isActive: false,\n  });\n  const initializationAttemptedRef: any = useRef(false);\n  const oauthCodeProcessedRef: any = useRef(false);\n  const passkeyProcessedRef: any = useRef(false);\n  // Deadline this component has already auto-submitted for, so a re-run of the timeout effect\n  // cannot submit the same expired step twice.\n  const timeoutSubmittedForRef = useRef<number | null>(null);\n  // The timeout effect is keyed on the deadline alone, so a step that arrives carrying the same\n  // deadline would otherwise leave the pending timer holding the previous step's context.\n  const timeoutContextRef = useRef<{\n    components: EmbeddedFlowComponent[];\n    hasConsentPrompt: boolean;\n    submit: (payload: EmbeddedSignInFlowRequest) => Promise<void>;\n  } | null>(null);\n  /**\n   * Sets executionId between sessionStorage and state.\n   * This ensures both are always in sync.\n   */\n  const setExecutionId = (executionId: string | null): void => {\n    setCurrentExecutionId(executionId);\n    if (executionId) {\n      sessionStorage.setItem(`${vendor}_execution_id`, executionId);\n    } else {\n      sessionStorage.removeItem(`${vendor}_execution_id`);\n    }\n  };\n\n  /**\n   * Restore any challenge token persisted before an OAuth redirect.\n   * Waits for SDK initialization before reading from storage.\n   */\n  useEffect(() => {\n    if (!isInitialized) return;\n\n    (async (): Promise<void> => {\n      try {\n        const storageManager: any = await getStorageManager();\n        const tempData: any = await storageManager?.getTemporaryData();\n        if (tempData?.challengeToken) {\n          challengeTokenRef.current = tempData.challengeToken as string;\n        }\n      } finally {\n        setIsStorageReady(true);\n      }\n    })();\n  }, [isInitialized]);\n\n  /**\n   * Updates challengeTokenRef immediately (stale-closure safe) and persists via\n   * the provider's StorageManager so the token survives OAuth redirects.\n   */\n  const setChallengeToken = async (challengeToken: string | null): Promise<void> => {\n    challengeTokenRef.current = challengeToken;\n    try {\n      const storageManager: any = await getStorageManager();\n      if (storageManager) {\n        if (challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', challengeToken);\n        } else {\n          await storageManager.removeTemporaryDataParameter('challengeToken');\n        }\n      }\n    } catch {\n      logger.warn('Failed to persist challenge token in storage.');\n    }\n  };\n\n  /**\n   * Clear all flow-related storage and state.\n   */\n  const clearFlowState = async (): Promise<void> => {\n    // Clear the expired flow state to prevent rendering a stale form with a null executionId.\n    // Kept before the first await so callers that do not await this function still apply the\n    // reset in one batch, ahead of the setError that follows.\n    const executionIdToClear: string | null = currentExecutionId ?? sessionStorage.getItem(`${vendor}_execution_id`);\n    setExecutionId(null);\n    setComponents([]);\n    setAdditionalData({});\n    setIsFlowInitialized(false);\n    await setChallengeToken(null);\n    await clearAuthId(executionIdToClear);\n    setIsTimeoutDisabled(false);\n    // Reset refs to allow new flows to start properly\n    oauthCodeProcessedRef.current = false;\n  };\n\n  /**\n   * Parse URL parameters used in flows.\n   */\n  const getUrlParams = (): any => {\n    const urlParams: any = new URL(window?.location?.href ?? '').searchParams;\n\n    return {\n      applicationId: urlParams.get('applicationId'),\n      authId: urlParams.get('authId'),\n      code: urlParams.get('code'),\n      error: urlParams.get('error'),\n      errorDescription: urlParams.get('error_description'),\n      executionId: urlParams.get('executionId'),\n      nonce: urlParams.get('nonce'),\n      state: urlParams.get('state'),\n    };\n  };\n\n  /**\n   * Persist the authId from the URL against its execution so it survives URL cleanup.\n   * ThunderIDReactClient.signIn() reads it back with storageManager.getFlowAuthId(executionId),\n   * so another tab's sign-in cannot replace it.\n   */\n  const handleAuthId = async (authId: string | null, executionId: string | null | undefined): Promise<void> => {\n    if (authId && executionId) {\n      try {\n        const storageManager: any = await getStorageManager();\n        await storageManager?.setFlowAuthId?.(executionId, authId);\n      } catch {\n        logger.warn('Failed to store authId in hybrid storage.');\n      }\n    }\n  };\n\n  /**\n   * Remove the authId stored for an execution, leaving other tabs' entries in place.\n   */\n  const clearAuthId = async (executionId: string | null | undefined): Promise<void> => {\n    if (!executionId) {\n      return;\n    }\n    try {\n      const storageManager: any = await getStorageManager();\n      await storageManager?.removeFlowAuthId?.(executionId);\n    } catch {\n      logger.warn('Failed to clear authId from hybrid storage.');\n    }\n  };\n\n  /**\n   * Clean up OAuth-related URL parameters from the browser URL.\n   */\n  const cleanupOAuthUrlParams = (includeNonce = false): void => {\n    if (!window?.location?.href) return;\n    const url: any = new URL(window.location.href);\n    url.searchParams.delete('error');\n    url.searchParams.delete('error_description');\n    url.searchParams.delete('code');\n    url.searchParams.delete('state');\n    if (includeNonce) {\n      url.searchParams.delete('nonce');\n    }\n    window?.history?.replaceState({}, '', url.toString());\n  };\n\n  /**\n   * Clean up flow-related URL parameters (executionId, authId) from the browser URL.\n   * Used after executionId is set in state to prevent using invalidated executionId from URL.\n   */\n  const cleanupFlowUrlParams = (): void => {\n    if (!window?.location?.href) return;\n    const url: any = new URL(window.location.href);\n    url.searchParams.delete('executionId');\n    url.searchParams.delete('authId');\n    url.searchParams.delete('applicationId');\n    window?.history?.replaceState({}, '', url.toString());\n  };\n\n  /**\n   * Set error state and call onError callback.\n   * Ensures isFlowInitialized is true so errors can be displayed in the UI.\n   */\n  const setError = (source: unknown): void => {\n    // Updater form, so React stores a FlowErrorBuilder instead of calling it.\n    setFlowErrorSource(() => source);\n    setIsFlowInitialized(true);\n    onError?.(resolveFlowError(source, t));\n  };\n\n  /**\n   * Handle OAuth error from URL parameters.\n   * Clears flow state, creates error, and cleans up URL.\n   */\n  const handleOAuthError = (error: string, errorDescription: string | null): void => {\n    clearFlowState();\n    const errorMessage: any = errorDescription || `OAuth error: ${error}`;\n    const err: any = new ThunderIDRuntimeError(errorMessage, 'SIGN_IN_ERROR', 'react');\n    setError(err);\n    cleanupOAuthUrlParams(true);\n  };\n\n  /**\n   * Handle REDIRECTION response by storing flow state and redirecting to OAuth provider.\n   */\n  const handleRedirection = async (response: EmbeddedSignInFlowResponse): Promise<boolean> => {\n    if (response.type === EmbeddedSignInFlowType.Redirection) {\n      const redirectURL: any = (response.data as any)?.redirectURL || (response as any)?.redirectURL;\n\n      if (redirectURL && window?.location) {\n        if (response.executionId) {\n          setExecutionId(response.executionId);\n        }\n        await setChallengeToken(response.challengeToken ?? null);\n\n        const urlParams: any = getUrlParams();\n        await handleAuthId(urlParams.authId, response.executionId);\n\n        initiateOAuthRedirect(redirectURL, vendor);\n        return true;\n      }\n    }\n    return false;\n  };\n\n  /**\n   * Handle ERROR and COMPLETE responses. Returns true if fully handled.\n   * ERROR + executionId: recoverable — session preserved for retry.\n   * ERROR + no executionId: terminal — clear state and surface the error.\n   */\n  const handleTerminalResponse = async (response: EmbeddedSignInFlowResponse): Promise<boolean> => {\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n      // Propagate OAuth error to the client\n      if (response.redirectUrl && window?.location) {\n        setIsSubmitting(false);\n        await clearFlowState();\n        cleanupOAuthUrlParams(true);\n        onError?.(new Error(extractErrorMessage(response, t)));\n        window.location.href = response.redirectUrl;\n\n        return true;\n      }\n\n      if (response.executionId) {\n        // Recoverable: session still alive. Show inline error without firing onError.\n        setExecutionId(response.executionId);\n        await setChallengeToken(response.challengeToken ?? null);\n        setIsFlowInitialized(true);\n        setFlowErrorSource(response);\n        return true;\n      }\n      // Terminal: backend invalidated the session — clear all state.\n      await clearFlowState();\n      setError(response);\n      cleanupFlowUrlParams();\n      return true;\n    }\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // Get redirectUrl from response (from /oauth2/auth/callback) or fall back to afterSignInUrl\n      const redirectUrl: any = (response as any)?.redirectUrl || (response as any)?.redirect_uri;\n      const finalRedirectUrl: any = redirectUrl || afterSignInUrl;\n\n      // Clear submitting state before redirect\n      setIsSubmitting(false);\n\n      // Clear all OAuth-related storage on successful completion\n      const completedExecutionId: string | null =\n        response.executionId || currentExecutionId || sessionStorage.getItem(`${vendor}_execution_id`);\n      setExecutionId(null);\n      await setChallengeToken(null);\n      setIsFlowInitialized(false);\n      sessionStorage.removeItem(`${vendor}_execution_id`);\n      await clearAuthId(completedExecutionId);\n\n      // Clean up OAuth URL params before redirect\n      cleanupOAuthUrlParams(true);\n\n      if (onSuccess) {\n        onSuccess({\n          redirectUrl: finalRedirectUrl,\n          ...(response.data || {}),\n        });\n      }\n\n      if (finalRedirectUrl && window?.location) {\n        window.location.href = finalRedirectUrl;\n      }\n\n      return true;\n    }\n\n    return false;\n  };\n\n  /**\n   * Initialize the authentication flow.\n   * Priority: executionId > applicationId (from context) > applicationId (from URL)\n   */\n  const initializeFlow = async (): Promise<void> => {\n    const urlParams: any = getUrlParams();\n\n    // Reset OAuth code processed ref when starting a new flow\n    oauthCodeProcessedRef.current = false;\n    // Clear stale serverFieldErrors so the new flow doesn't inherit them via render-prop.\n    setServerFieldErrors(null);\n\n    await handleAuthId(urlParams.authId, urlParams.executionId);\n\n    const effectiveApplicationId: any = applicationId || urlParams.applicationId;\n\n    // On a page refresh the executionId is no longer in the URL (it is scrubbed by\n    // cleanupFlowUrlParams after the first load). Fall back to the executionId persisted in\n    // sessionStorage so the in-progress flow can be resumed instead of starting a new flow.\n    // This is required for authorization_code apps where direct new-flow initiation is blocked\n    // server-side and the flow must be initiated through the OAuth /authorize endpoint.\n    const storedExecutionId: any = !urlParams.executionId ? sessionStorage.getItem(`${vendor}_execution_id`) : null;\n    const resumeExecutionId: any = urlParams.executionId || storedExecutionId;\n\n    if (!resumeExecutionId && !effectiveApplicationId) {\n      const error: any = new ThunderIDRuntimeError(\n        'Either executionId or applicationId is required for authentication',\n        'SIGN_IN_ERROR',\n        'react',\n      );\n      setError(error);\n\n      return;\n    }\n\n    try {\n      setFlowErrorSource(null);\n\n      let response: EmbeddedSignInFlowResponse;\n\n      if (resumeExecutionId) {\n        try {\n          response = (await signIn({\n            executionId: resumeExecutionId,\n            ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n          })) as EmbeddedSignInFlowResponse;\n        } catch (resumeError) {\n          // Only treat a stale/expired session (HTTP 400 from the server, meaning the stored\n          // executionId is no longer valid) as a recoverable condition. Transient failures\n          // such as 5xx server errors or network errors are rethrown so they surface correctly.\n          const isStaleSession: boolean =\n            storedExecutionId &&\n            resumeExecutionId === storedExecutionId &&\n            resumeError instanceof ThunderIDAPIError &&\n            resumeError.statusCode === 400;\n\n          if (isStaleSession) {\n            setExecutionId(null);\n            await clearAuthId(resumeExecutionId);\n            if (!effectiveApplicationId) {\n              const expiredError: FlowErrorBuilder = (translate) =>\n                new ThunderIDRuntimeError(\n                  translate('errors.signin.session.expired') ||\n                    'Your session has expired. Please return to the application and sign in again.',\n                  'SIGN_IN_ERROR',\n                  'react',\n                );\n              setError(expiredError);\n              return;\n            }\n            response = (await signIn({\n              applicationId: effectiveApplicationId,\n              flowType: EmbeddedFlowType.Authentication,\n              ...(scopes && {scopes}),\n              ...(organizationUnitId && {ouId: organizationUnitId}),\n            })) as EmbeddedSignInFlowResponse;\n          } else {\n            throw resumeError;\n          }\n        }\n      } else {\n        response = (await signIn({\n          applicationId: effectiveApplicationId,\n          flowType: EmbeddedFlowType.Authentication,\n          ...(scopes && {scopes}),\n          ...(organizationUnitId && {ouId: organizationUnitId}),\n        })) as EmbeddedSignInFlowResponse;\n      }\n\n      if (await handleRedirection(response)) {\n        return;\n      }\n\n      // Handle a flow that completes (or errors) on the very first step — e.g. a reused SSO\n      // session lets the backend return COMPLETE immediately with no UI components. Without\n      // this the UI would fall through with no components and spin forever.\n      if (await handleTerminalResponse(response)) {\n        // Only reset the init gate for unrecoverable Error responses so the user can retry;\n        // Complete-without-redirect would otherwise kick off a fresh flow unintentionally.\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error && !response.executionId) {\n          initializationAttemptedRef.current = false;\n        }\n        return;\n      }\n\n      const {\n        executionId: normalizedExecutionId,\n        components: normalizedComponents,\n        additionalData: normalizedAdditionalData,\n      } = normalizeFlowResponse(\n        response,\n        t,\n        {\n          resolveTranslations: false,\n        },\n        meta,\n      );\n\n      await setChallengeToken(response.challengeToken ?? null);\n\n      if (normalizedExecutionId && normalizedComponents) {\n        setExecutionId(normalizedExecutionId);\n        setComponents(normalizedComponents);\n        setAdditionalData(normalizedAdditionalData ?? {});\n        setIsFlowInitialized(true);\n        setIsTimeoutDisabled(false);\n        // The URL's authId belongs to this execution even when the URL had no executionId.\n        await handleAuthId(urlParams.authId, normalizedExecutionId);\n        // Clean up executionId from URL after setting it in state\n        cleanupFlowUrlParams();\n      }\n    } catch (error) {\n      const err: any = error;\n      await clearFlowState();\n\n      setError(err);\n      initializationAttemptedRef.current = false;\n    }\n  };\n\n  /**\n   * Initialize the flow and handle cleanup of stale flow state.\n   */\n  useEffect(() => {\n    const urlParams: any = getUrlParams();\n\n    // Check for OAuth error in URL\n    if (urlParams.error) {\n      handleOAuthError(urlParams.error, urlParams.errorDescription);\n      return;\n    }\n\n    handleAuthId(urlParams.authId, urlParams.executionId);\n\n    // Skip OAuth code processing - let the dedicated OAuth useEffect handle it\n    // No action needed here as the dedicated useEffect will handle it\n  }, []);\n\n  useEffect(() => {\n    // Only initialize if we're not processing an OAuth callback or submission.\n    // Wait for isStorageReady so the challenge token is restored from storage before\n    // we attempt to resume a persisted executionId — the server requires it.\n    const currentUrlParams: any = getUrlParams();\n    if (\n      isInitialized &&\n      isStorageReady &&\n      !isLoading &&\n      !isFlowInitialized &&\n      !initializationAttemptedRef.current &&\n      !currentExecutionId &&\n      !currentUrlParams.code &&\n      !currentUrlParams.state &&\n      !isSubmitting &&\n      !oauthCodeProcessedRef.current\n    ) {\n      initializationAttemptedRef.current = true;\n      initializeFlow();\n    }\n  }, [isInitialized, isStorageReady, isLoading, isFlowInitialized, currentExecutionId]);\n\n  /**\n   * Handle form submission from BaseSignIn or render props.\n   */\n  const handleSubmit = async (payload: EmbeddedSignInFlowRequest): Promise<void> => {\n    // Use executionId from payload if available, otherwise fall back to currentExecutionId\n    const effectiveExecutionId: any = payload.executionId || currentExecutionId;\n\n    if (!effectiveExecutionId) {\n      throw new Error('No active flow ID');\n    }\n\n    let processedInputs: Record<string, any> = {...payload.inputs};\n\n    // Read and strip the sentinel up front so it can never reach the wire as an input\n    const consentReason: string | undefined = processedInputs[CONSENT_REASON_KEY];\n    delete processedInputs[CONSENT_REASON_KEY];\n\n    // Auto-compile consent decisions if we are currently on a consent prompt step\n    if (additionalData?.['consentPrompt']) {\n      try {\n        const consentPromptRawData: any = additionalData['consentPrompt'];\n        const purposes: any[] =\n          typeof consentPromptRawData === 'string'\n            ? JSON.parse(consentPromptRawData)\n            : consentPromptRawData.purposes || consentPromptRawData;\n\n        // Find the action component to determine if it was a deny action\n        let isDeny = false;\n        if (payload.action) {\n          // Flatten components to find the action\n          const findAction = (comps: any[]): any => {\n            if (!comps || comps.length === 0) return null;\n\n            const found: any = comps.find((c: any) => c.id === payload.action);\n            if (found) return found;\n\n            return comps.reduce((acc: any, c: any) => {\n              if (acc) return acc;\n              if (c.components) return findAction(c.components);\n              return null;\n            }, null);\n          };\n\n          const submitAction: any = findAction(components);\n\n          if (submitAction && submitAction.variant?.toLowerCase() !== 'primary') {\n            isDeny = true;\n          }\n        }\n\n        // An expired prompt is never an approval, whichever action carried the submission\n        if (consentReason === ConsentConstants.REASON_TIMEOUT) {\n          isDeny = true;\n        }\n\n        // Approval waits while an approved authorization detail shows a value that cannot be submitted\n        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument\n        if (!isDeny && isConsentApprovalBlocked(purposes, processedInputs)) {\n          return;\n        }\n\n        // An explicit denial carries a reason too, so the server never has to infer one\n        const reason: string | undefined = consentReason ?? (isDeny ? ConsentConstants.REASON_USER_DENIED : undefined);\n\n        processedInputs = compileConsentDecisions(processedInputs, purposes, {\n          approved: !isDeny,\n          ...(reason ? {reason} : {}),\n        });\n      } catch (e) {\n        // Failed to construct consent_decisions payload automatically\n      }\n    }\n\n    try {\n      setIsSubmitting(true);\n      setFlowErrorSource(null);\n      // Clear any field errors from the previous response before the new round-trip.\n      setServerFieldErrors(null);\n\n      const response: EmbeddedSignInFlowResponse = (await signIn({\n        executionId: effectiveExecutionId,\n        ...payload,\n        inputs: processedInputs,\n        ...(challengeTokenRef.current ? {challengeToken: challengeTokenRef.current} : {}),\n      })) as EmbeddedSignInFlowResponse;\n\n      if (await handleRedirection(response)) {\n        return;\n      }\n      if (\n        response.data?.additionalData?.['passkeyChallenge'] ||\n        response.data?.additionalData?.['passkeyCreationOptions']\n      ) {\n        const {passkeyChallenge, passkeyCreationOptions}: any = response.data.additionalData;\n        const effectiveExecutionIdForPasskey: any = response.executionId || effectiveExecutionId;\n\n        // Reset passkey processed ref to allow processing\n        passkeyProcessedRef.current = false;\n\n        await setChallengeToken(response.challengeToken ?? null);\n\n        // Set passkey state to trigger the passkey\n        setPasskeyState({\n          actionId: 'submit',\n          challenge: passkeyChallenge,\n          creationOptions: passkeyCreationOptions,\n          error: null,\n          executionId: effectiveExecutionIdForPasskey,\n          isActive: true,\n        });\n        setIsSubmitting(false);\n\n        return;\n      }\n\n      // Handle terminal flow statuses before normalization.\n      if (await handleTerminalResponse(response)) {\n        return;\n      }\n\n      const {\n        executionId: normalizedExecutionId,\n        components: normalizedComponents,\n        additionalData: normalizedAdditionalData,\n      } = normalizeFlowResponse(\n        response,\n        t,\n        {\n          resolveTranslations: false,\n        },\n        meta,\n      );\n\n      // Always update challenge token on any INCOMPLETE response — token rotates every step.\n      await setChallengeToken(response.challengeToken ?? null);\n\n      // Update executionId if response contains a new one\n      if (normalizedExecutionId && normalizedComponents) {\n        setExecutionId(normalizedExecutionId);\n        setComponents(normalizedComponents);\n        setAdditionalData(normalizedAdditionalData ?? {});\n        setIsTimeoutDisabled(false);\n        // Ensure flow is marked as initialized when we have components\n        setIsFlowInitialized(true);\n        // Clean up executionId from URL after setting it in state\n        cleanupFlowUrlParams();\n\n        // Surface server-side validation failures so BaseSignIn can inject them into\n        // the form-level fieldErrors state used by the render-prop / default UI.\n        const responseFieldErrors: FieldError[] | undefined = (response.data as any)?.fieldErrors;\n        if (responseFieldErrors && responseFieldErrors.length > 0) {\n          setServerFieldErrors(responseFieldErrors);\n        }\n\n        // Display error from INCOMPLETE response\n        if ((response as any)?.error) {\n          setFlowErrorSource(response);\n        }\n      }\n    } catch (error) {\n      const err: any = error;\n      await clearFlowState();\n\n      setError(err);\n      return;\n    } finally {\n      setIsSubmitting(false);\n    }\n  };\n\n  /**\n   * Handle step timeout if configured in additionalData.\n   *\n   * An expired consent prompt is auto-submitted as a denial carrying the timeout reason, because its\n   * actions no longer lead anywhere and the user would otherwise be stranded on the prompt. The\n   * server discards those decisions and records nothing. Every other kind of step surfaces the\n   * expiry error instead.\n   */\n  timeoutContextRef.current = {\n    components,\n    hasConsentPrompt: Boolean(additionalData?.['consentPrompt']),\n    submit: handleSubmit,\n  };\n\n  useEffect(() => {\n    const timeoutMs: number = Number(additionalData?.['stepTimeout']) || 0;\n    if (timeoutMs <= 0 || !isFlowInitialized) {\n      setIsTimeoutDisabled(false);\n      return undefined;\n    }\n\n    const handleTimeout = (): void => {\n      setIsTimeoutDisabled(true);\n\n      const expiredError: FlowErrorBuilder = (translate) =>\n        new Error(translate('errors.signin.timeout') || 'Time allowed to complete the step has expired.');\n\n      // Read through the ref so the timer always sees the step that is on screen when it fires\n      const context = timeoutContextRef.current;\n      const actionId: string | undefined = context?.hasConsentPrompt\n        ? findConsentSubmitActionId(context.components)\n        : undefined;\n\n      // Without an action the prompt node cannot be routed, so there is nothing to submit\n      if (actionId && context && timeoutSubmittedForRef.current !== timeoutMs) {\n        timeoutSubmittedForRef.current = timeoutMs;\n        context\n          .submit({action: actionId, inputs: {[CONSENT_REASON_KEY]: ConsentConstants.REASON_TIMEOUT}})\n          .catch(() => setError(expiredError));\n        return;\n      }\n\n      setError(expiredError);\n    };\n\n    const timerId: ReturnType<typeof setTimeout> = setTimeout(handleTimeout, Math.max(0, timeoutMs - Date.now()));\n\n    return () => clearTimeout(timerId);\n  }, [additionalData?.['stepTimeout'], isFlowInitialized, t]);\n\n  /**\n   * Handle authentication errors.\n   */\n  const handleError = (error: Error): void => {\n    setError(error);\n  };\n\n  useOAuthCallback({\n    currentExecutionId,\n    executionIdStorageKey: `${vendor}_execution_id`,\n    isInitialized: isInitialized && !isLoading && isStorageReady,\n    isSubmitting,\n    onError: (err: any) => {\n      clearFlowState();\n      setError(err instanceof Error ? err : new Error(String(err)));\n    },\n    onSubmit: async (payload: any) => handleSubmit({executionId: payload.executionId, inputs: payload.inputs}),\n    processedRef: oauthCodeProcessedRef,\n    setExecutionId,\n  });\n\n  /**\n   * Handle passkey authentication/registration when passkey state becomes active.\n   * This effect auto-triggers the browser passkey popup and submits the result.\n   */\n  useEffect(() => {\n    if (\n      !passkeyState.isActive ||\n      (!passkeyState.challenge && !passkeyState.creationOptions) ||\n      !passkeyState.executionId\n    ) {\n      return;\n    }\n\n    // Prevent re-processing\n    if (passkeyProcessedRef.current) {\n      return;\n    }\n    passkeyProcessedRef.current = true;\n\n    const performPasskeyProcess = async (): Promise<void> => {\n      let inputs: Record<string, string>;\n\n      if (passkeyState.challenge) {\n        const passkeyResponse: any = await handlePasskeyAuthentication(passkeyState.challenge);\n        const passkeyResponseObj: any = JSON.parse(passkeyResponse);\n\n        inputs = {\n          authenticatorData: passkeyResponseObj.response.authenticatorData,\n          clientDataJSON: passkeyResponseObj.response.clientDataJSON,\n          credentialId: passkeyResponseObj.id,\n          signature: passkeyResponseObj.response.signature,\n          userHandle: passkeyResponseObj.response.userHandle,\n        };\n      } else if (passkeyState.creationOptions) {\n        const passkeyResponse: any = await handlePasskeyRegistration(passkeyState.creationOptions);\n        const passkeyResponseObj: any = JSON.parse(passkeyResponse);\n\n        inputs = {\n          attestationObject: passkeyResponseObj.response.attestationObject,\n          clientDataJSON: passkeyResponseObj.response.clientDataJSON,\n          credentialId: passkeyResponseObj.id,\n        };\n      } else {\n        throw new Error('No passkey challenge or creation options available');\n      }\n\n      await handleSubmit({\n        executionId: passkeyState.executionId ?? undefined,\n        inputs,\n      });\n    };\n\n    performPasskeyProcess()\n      .then(() => {\n        setPasskeyState({\n          actionId: null,\n          challenge: null,\n          creationOptions: null,\n          error: null,\n          executionId: null,\n          isActive: false,\n        });\n      })\n      .catch((error: any) => {\n        setPasskeyState((prev: any) => ({...prev, error: error as Error, isActive: false}));\n        setError(error);\n      });\n  }, [passkeyState.isActive, passkeyState.challenge, passkeyState.creationOptions, passkeyState.executionId]);\n\n  if (children) {\n    // Collapse the server FieldError[] array to a single message per field map for\n    // render-prop consumers. First error per field wins. Multi-error cases per\n    // field are rare in practice (server typically returns one rule failure per\n    // field in current flows) and consumers needing the full array can still read\n    // it from the raw flow response.\n    const renderPropFieldErrors: Record<string, string> = {};\n    if (serverFieldErrors) {\n      for (const fe of serverFieldErrors) {\n        if (!(fe.identifier in renderPropFieldErrors)) {\n          renderPropFieldErrors[fe.identifier] = fe.message;\n        }\n      }\n    }\n\n    const renderProps: SignInRenderProps = {\n      additionalData,\n      components,\n      error: flowError,\n      fieldErrors: renderPropFieldErrors,\n      initialize: initializeFlow,\n      isInitialized: isFlowInitialized,\n      isLoading: isLoading || isSubmitting || !isInitialized,\n      isTimeoutDisabled,\n      meta,\n      onSubmit: handleSubmit,\n    };\n\n    return <>{children(renderProps)}</>;\n  }\n  // Otherwise, render the default BaseSignIn component\n  return (\n    <BaseSignIn\n      additionalData={additionalData}\n      components={components}\n      isLoading={isLoading || !isInitialized || !isFlowInitialized}\n      isTimeoutDisabled={isTimeoutDisabled}\n      onSubmit={handleSubmit}\n      onError={handleError}\n      error={flowError}\n      className={className}\n      size={size}\n      variant={variant}\n      preferences={preferences}\n      revalidateOnChangeAfterBlur={revalidateOnChangeAfterBlur}\n      serverFieldErrors={serverFieldErrors}\n    />\n  );\n};\n\nexport default SignIn;\n"],"mappings":";;;;;;;;;;;;;;;;;AA0KA,MAAM,qBAAqB;;AAG3B,MAAM,qBAAqB,WACxB,SAAS,EAAE,EAAE,SAAS,SAAgC,CAAC,MAAM,GAAG,kBAAkB,KAAK,WAAW,CAAC,CAAC;;;;;;AAOvG,MAAM,6BAA6B,UAAmE;CACpG,MAAMA,gBAAyC,kBAAkB,MAAM,CAAC,QACrE,SAAgC,KAAK,MAAM,KAAK,WAAW,aAAa,KAAK,SAC/E;AAKD,SAJsD,cAAc,MACjE,SAAgC,KAAK,SAAS,aAAa,KAAK,UAClE,IAEqB,cAAc,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgE3C,MAAMC,UAA2B,EAC/B,WACA,aACA,OAAO,UACP,WACA,SACA,SACA,UACA,6BACA,yBAC+B;CAC/B,MAAM,EAAC,eAAe,gBAAgB,QAAQ,eAAe,WAAW,MAAM,mBAAmB,QAAQ,WACvGC,sBAAc;CAChB,MAAM,EAAC,MAAKC,uBAAe,aAAa,KAAK;CAG7C,MAAM,CAAC,YAAY,iBAAiB,SAAkC,EAAE,CAAC;CACzE,MAAM,CAAC,gBAAgB,qBAAqB,SAA8B,EAAE,CAAC;CAG7E,MAAM,CAAC,mBAAmB,wBAAwB,SAA8B,KAAK;CACrF,MAAM,CAAC,oBAAoB,yBAAyB,SAAwB,KAAK;CACjF,MAAMC,oBAAyB,OAAsB,KAAK;CAC1D,MAAM,CAAC,gBAAgB,qBAAqB,SAAS,MAAM;CAC3D,MAAM,CAAC,mBAAmB,wBAAwB,SAAS,MAAM;CAEjE,MAAM,CAAC,iBAAiB,sBAAsB,SAAkB,KAAK;CACrE,MAAMC,YAA0B,cACvB,oBAAoB,OAAO,OAAO,iBAAiB,iBAAiB,EAAE,EAC7E,CAAC,iBAAiB,EAAE,CACrB;CACD,MAAM,CAAC,cAAc,mBAAmB,SAAS,MAAM;CACvD,MAAM,CAAC,mBAAmB,wBAAwB,SAAkB,MAAM;CAC1E,MAAM,CAAC,cAAc,mBAAmB,SAAuB;EAC7D,UAAU;EACV,WAAW;EACX,iBAAiB;EACjB,OAAO;EACP,aAAa;EACb,UAAU;EACX,CAAC;CACF,MAAMC,6BAAkC,OAAO,MAAM;CACrD,MAAMC,wBAA6B,OAAO,MAAM;CAChD,MAAMC,sBAA2B,OAAO,MAAM;CAG9C,MAAM,yBAAyB,OAAsB,KAAK;CAG1D,MAAM,oBAAoB,OAIhB,KAAK;;;;;CAKf,MAAM,kBAAkB,gBAAqC;AAC3D,wBAAsB,YAAY;AAClC,MAAI,YACF,gBAAe,QAAQ,GAAG,OAAO,gBAAgB,YAAY;MAE7D,gBAAe,WAAW,GAAG,OAAO,eAAe;;;;;;AAQvD,iBAAgB;AACd,MAAI,CAAC,cAAe;AAEpB,GAAC,YAA2B;AAC1B,OAAI;IAEF,MAAMC,WAAgB,OADM,MAAM,mBAAmB,GACT,kBAAkB;AAC9D,QAAI,UAAU,eACZ,mBAAkB,UAAU,SAAS;aAE/B;AACR,sBAAkB,KAAK;;MAEvB;IACH,CAAC,cAAc,CAAC;;;;;CAMnB,MAAM,oBAAoB,OAAO,mBAAiD;AAChF,oBAAkB,UAAU;AAC5B,MAAI;GACF,MAAMC,iBAAsB,MAAM,mBAAmB;AACrD,OAAI,eACF,KAAI,eACF,OAAM,eAAe,0BAA0B,kBAAkB,eAAe;OAEhF,OAAM,eAAe,6BAA6B,iBAAiB;UAGjE;AACN,UAAO,KAAK,gDAAgD;;;;;;CAOhE,MAAM,iBAAiB,YAA2B;EAIhD,MAAMC,qBAAoC,sBAAsB,eAAe,QAAQ,GAAG,OAAO,eAAe;AAChH,iBAAe,KAAK;AACpB,gBAAc,EAAE,CAAC;AACjB,oBAAkB,EAAE,CAAC;AACrB,uBAAqB,MAAM;AAC3B,QAAM,kBAAkB,KAAK;AAC7B,QAAM,YAAY,mBAAmB;AACrC,uBAAqB,MAAM;AAE3B,wBAAsB,UAAU;;;;;CAMlC,MAAM,qBAA0B;EAC9B,MAAMC,YAAiB,IAAI,IAAI,QAAQ,UAAU,QAAQ,GAAG,CAAC;AAE7D,SAAO;GACL,eAAe,UAAU,IAAI,gBAAgB;GAC7C,QAAQ,UAAU,IAAI,SAAS;GAC/B,MAAM,UAAU,IAAI,OAAO;GAC3B,OAAO,UAAU,IAAI,QAAQ;GAC7B,kBAAkB,UAAU,IAAI,oBAAoB;GACpD,aAAa,UAAU,IAAI,cAAc;GACzC,OAAO,UAAU,IAAI,QAAQ;GAC7B,OAAO,UAAU,IAAI,QAAQ;GAC9B;;;;;;;CAQH,MAAM,eAAe,OAAO,QAAuB,gBAA0D;AAC3G,MAAI,UAAU,YACZ,KAAI;AAEF,UAD4B,MAAM,mBAAmB,GAC/B,gBAAgB,aAAa,OAAO;UACpD;AACN,UAAO,KAAK,4CAA4C;;;;;;CAQ9D,MAAM,cAAc,OAAO,gBAA0D;AACnF,MAAI,CAAC,YACH;AAEF,MAAI;AAEF,UAD4B,MAAM,mBAAmB,GAC/B,mBAAmB,YAAY;UAC/C;AACN,UAAO,KAAK,8CAA8C;;;;;;CAO9D,MAAM,yBAAyB,eAAe,UAAgB;AAC5D,MAAI,CAAC,QAAQ,UAAU,KAAM;EAC7B,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,oBAAoB;AAC5C,MAAI,aAAa,OAAO,OAAO;AAC/B,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aACF,KAAI,aAAa,OAAO,QAAQ;AAElC,UAAQ,SAAS,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;;;;;CAOvD,MAAM,6BAAmC;AACvC,MAAI,CAAC,QAAQ,UAAU,KAAM;EAC7B,MAAMA,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,cAAc;AACtC,MAAI,aAAa,OAAO,SAAS;AACjC,MAAI,aAAa,OAAO,gBAAgB;AACxC,UAAQ,SAAS,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;;;;;CAOvD,MAAM,YAAY,WAA0B;AAE1C,2BAAyB,OAAO;AAChC,uBAAqB,KAAK;AAC1B,YAAU,iBAAiB,QAAQ,EAAE,CAAC;;;;;;CAOxC,MAAM,oBAAoB,OAAe,qBAA0C;AACjF,kBAAgB;AAGhB,WADiB,IAAI,sBADK,oBAAoB,gBAAgB,SACL,iBAAiB,QAAQ,CACrE;AACb,wBAAsB,KAAK;;;;;CAM7B,MAAM,oBAAoB,OAAO,aAA2D;AAC1F,MAAI,SAAS,SAAS,uBAAuB,aAAa;GACxD,MAAMC,cAAoB,SAAS,MAAc,eAAgB,UAAkB;AAEnF,OAAI,eAAe,QAAQ,UAAU;AACnC,QAAI,SAAS,YACX,gBAAe,SAAS,YAAY;AAEtC,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,UAAM,aADiB,cAAc,CACR,QAAQ,SAAS,YAAY;AAE1D,0BAAsB,aAAa,OAAO;AAC1C,WAAO;;;AAGX,SAAO;;;;;;;CAQT,MAAM,yBAAyB,OAAO,aAA2D;AAC/F,MAAI,SAAS,eAAe,yBAAyB,OAAO;AAE1D,OAAI,SAAS,eAAe,QAAQ,UAAU;AAC5C,oBAAgB,MAAM;AACtB,UAAM,gBAAgB;AACtB,0BAAsB,KAAK;AAC3B,cAAU,IAAI,MAAM,oBAAoB,UAAU,EAAE,CAAC,CAAC;AACtD,WAAO,SAAS,OAAO,SAAS;AAEhC,WAAO;;AAGT,OAAI,SAAS,aAAa;AAExB,mBAAe,SAAS,YAAY;AACpC,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AACxD,yBAAqB,KAAK;AAC1B,uBAAmB,SAAS;AAC5B,WAAO;;AAGT,SAAM,gBAAgB;AACtB,YAAS,SAAS;AAClB,yBAAsB;AACtB,UAAO;;AAGT,MAAI,SAAS,eAAe,yBAAyB,UAAU;GAG7D,MAAMC,mBADoB,UAAkB,eAAgB,UAAkB,gBACjC;AAG7C,mBAAgB,MAAM;GAGtB,MAAMC,uBACJ,SAAS,eAAe,sBAAsB,eAAe,QAAQ,GAAG,OAAO,eAAe;AAChG,kBAAe,KAAK;AACpB,SAAM,kBAAkB,KAAK;AAC7B,wBAAqB,MAAM;AAC3B,kBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,SAAM,YAAY,qBAAqB;AAGvC,yBAAsB,KAAK;AAE3B,OAAI,UACF,WAAU;IACR,aAAa;IACb,GAAI,SAAS,QAAQ,EAAE;IACxB,CAAC;AAGJ,OAAI,oBAAoB,QAAQ,SAC9B,QAAO,SAAS,OAAO;AAGzB,UAAO;;AAGT,SAAO;;;;;;CAOT,MAAM,iBAAiB,YAA2B;EAChD,MAAMJ,YAAiB,cAAc;AAGrC,wBAAsB,UAAU;AAEhC,uBAAqB,KAAK;AAE1B,QAAM,aAAa,UAAU,QAAQ,UAAU,YAAY;EAE3D,MAAMK,yBAA8B,iBAAiB,UAAU;EAO/D,MAAMC,oBAAyB,CAAC,UAAU,cAAc,eAAe,QAAQ,GAAG,OAAO,eAAe,GAAG;EAC3G,MAAMC,oBAAyB,UAAU,eAAe;AAExD,MAAI,CAAC,qBAAqB,CAAC,wBAAwB;AAMjD,YALmB,IAAI,sBACrB,sEACA,iBACA,QACD,CACc;AAEf;;AAGF,MAAI;AACF,sBAAmB,KAAK;GAExB,IAAIC;AAEJ,OAAI,kBACF,KAAI;AACF,eAAY,MAAM,OAAO;KACvB,aAAa;KACb,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;KACjF,CAAC;YACK,aAAa;AAUpB,QALE,qBACA,sBAAsB,qBACtB,uBAAuB,qBACvB,YAAY,eAAe,KAET;AAClB,oBAAe,KAAK;AACpB,WAAM,YAAY,kBAAkB;AACpC,SAAI,CAAC,wBAAwB;MAC3B,MAAMC,gBAAkC,cACtC,IAAI,sBACF,UAAU,gCAAgC,IACxC,iFACF,iBACA,QACD;AACH,eAAS,aAAa;AACtB;;AAEF,gBAAY,MAAM,OAAO;MACvB,eAAe;MACf,UAAU,iBAAiB;MAC3B,GAAI,UAAU,EAAC,QAAO;MACtB,GAAI,sBAAsB,EAAC,MAAM,oBAAmB;MACrD,CAAC;UAEF,OAAM;;OAIV,YAAY,MAAM,OAAO;IACvB,eAAe;IACf,UAAU,iBAAiB;IAC3B,GAAI,UAAU,EAAC,QAAO;IACtB,GAAI,sBAAsB,EAAC,MAAM,oBAAmB;IACrD,CAAC;AAGJ,OAAI,MAAM,kBAAkB,SAAS,CACnC;AAMF,OAAI,MAAM,uBAAuB,SAAS,EAAE;AAG1C,QAAI,SAAS,eAAe,yBAAyB,SAAS,CAAC,SAAS,YACtE,4BAA2B,UAAU;AAEvC;;GAGF,MAAM,EACJ,aAAa,uBACb,YAAY,sBACZ,gBAAgB,6BACd,sBACF,UACA,GACA,EACE,qBAAqB,OACtB,EACD,KACD;AAED,SAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAExD,OAAI,yBAAyB,sBAAsB;AACjD,mBAAe,sBAAsB;AACrC,kBAAc,qBAAqB;AACnC,sBAAkB,4BAA4B,EAAE,CAAC;AACjD,yBAAqB,KAAK;AAC1B,yBAAqB,MAAM;AAE3B,UAAM,aAAa,UAAU,QAAQ,sBAAsB;AAE3D,0BAAsB;;WAEjB,OAAO;GACd,MAAMC,MAAW;AACjB,SAAM,gBAAgB;AAEtB,YAAS,IAAI;AACb,8BAA2B,UAAU;;;;;;AAOzC,iBAAgB;EACd,MAAMV,YAAiB,cAAc;AAGrC,MAAI,UAAU,OAAO;AACnB,oBAAiB,UAAU,OAAO,UAAU,iBAAiB;AAC7D;;AAGF,eAAa,UAAU,QAAQ,UAAU,YAAY;IAIpD,EAAE,CAAC;AAEN,iBAAgB;EAId,MAAMW,mBAAwB,cAAc;AAC5C,MACE,iBACA,kBACA,CAAC,aACD,CAAC,qBACD,CAAC,2BAA2B,WAC5B,CAAC,sBACD,CAAC,iBAAiB,QAClB,CAAC,iBAAiB,SAClB,CAAC,gBACD,CAAC,sBAAsB,SACvB;AACA,8BAA2B,UAAU;AACrC,mBAAgB;;IAEjB;EAAC;EAAe;EAAgB;EAAW;EAAmB;EAAmB,CAAC;;;;CAKrF,MAAM,eAAe,OAAO,YAAsD;EAEhF,MAAMC,uBAA4B,QAAQ,eAAe;AAEzD,MAAI,CAAC,qBACH,OAAM,IAAI,MAAM,oBAAoB;EAGtC,IAAIC,kBAAuC,EAAC,GAAG,QAAQ,QAAO;EAG9D,MAAMC,gBAAoC,gBAAgB;AAC1D,SAAO,gBAAgB;AAGvB,MAAI,iBAAiB,iBACnB,KAAI;GACF,MAAMC,uBAA4B,eAAe;GACjD,MAAMC,WACJ,OAAO,yBAAyB,WAC5B,KAAK,MAAM,qBAAqB,GAChC,qBAAqB,YAAY;GAGvC,IAAI,SAAS;AACb,OAAI,QAAQ,QAAQ;IAElB,MAAM,cAAc,UAAsB;AACxC,SAAI,CAAC,SAAS,MAAM,WAAW,EAAG,QAAO;KAEzC,MAAMC,QAAa,MAAM,MAAM,MAAW,EAAE,OAAO,QAAQ,OAAO;AAClE,SAAI,MAAO,QAAO;AAElB,YAAO,MAAM,QAAQ,KAAU,MAAW;AACxC,UAAI,IAAK,QAAO;AAChB,UAAI,EAAE,WAAY,QAAO,WAAW,EAAE,WAAW;AACjD,aAAO;QACN,KAAK;;IAGV,MAAMC,eAAoB,WAAW,WAAW;AAEhD,QAAI,gBAAgB,aAAa,SAAS,aAAa,KAAK,UAC1D,UAAS;;AAKb,OAAI,kBAAkB,iBAAiB,eACrC,UAAS;AAKX,OAAI,CAAC,UAAUC,iCAAyB,UAAU,gBAAgB,CAChE;GAIF,MAAMC,SAA6B,kBAAkB,SAAS,iBAAiB,qBAAqB;AAEpG,qBAAkB,wBAAwB,iBAAiB,UAAU;IACnE,UAAU,CAAC;IACX,GAAI,SAAS,EAAC,QAAO,GAAG,EAAE;IAC3B,CAAC;WACK,GAAG;AAKd,MAAI;AACF,mBAAgB,KAAK;AACrB,sBAAmB,KAAK;AAExB,wBAAqB,KAAK;GAE1B,MAAMZ,WAAwC,MAAM,OAAO;IACzD,aAAa;IACb,GAAG;IACH,QAAQ;IACR,GAAI,kBAAkB,UAAU,EAAC,gBAAgB,kBAAkB,SAAQ,GAAG,EAAE;IACjF,CAAC;AAEF,OAAI,MAAM,kBAAkB,SAAS,CACnC;AAEF,OACE,SAAS,MAAM,iBAAiB,uBAChC,SAAS,MAAM,iBAAiB,2BAChC;IACA,MAAM,EAAC,kBAAkB,2BAA+B,SAAS,KAAK;IACtE,MAAMa,iCAAsC,SAAS,eAAe;AAGpE,wBAAoB,UAAU;AAE9B,UAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,oBAAgB;KACd,UAAU;KACV,WAAW;KACX,iBAAiB;KACjB,OAAO;KACP,aAAa;KACb,UAAU;KACX,CAAC;AACF,oBAAgB,MAAM;AAEtB;;AAIF,OAAI,MAAM,uBAAuB,SAAS,CACxC;GAGF,MAAM,EACJ,aAAa,uBACb,YAAY,sBACZ,gBAAgB,6BACd,sBACF,UACA,GACA,EACE,qBAAqB,OACtB,EACD,KACD;AAGD,SAAM,kBAAkB,SAAS,kBAAkB,KAAK;AAGxD,OAAI,yBAAyB,sBAAsB;AACjD,mBAAe,sBAAsB;AACrC,kBAAc,qBAAqB;AACnC,sBAAkB,4BAA4B,EAAE,CAAC;AACjD,yBAAqB,MAAM;AAE3B,yBAAqB,KAAK;AAE1B,0BAAsB;IAItB,MAAMC,sBAAiD,SAAS,MAAc;AAC9E,QAAI,uBAAuB,oBAAoB,SAAS,EACtD,sBAAqB,oBAAoB;AAI3C,QAAK,UAAkB,MACrB,oBAAmB,SAAS;;WAGzB,OAAO;GACd,MAAMZ,MAAW;AACjB,SAAM,gBAAgB;AAEtB,YAAS,IAAI;AACb;YACQ;AACR,mBAAgB,MAAM;;;;;;;;;;;AAY1B,mBAAkB,UAAU;EAC1B;EACA,kBAAkB,QAAQ,iBAAiB,iBAAiB;EAC5D,QAAQ;EACT;AAED,iBAAgB;EACd,MAAMa,YAAoB,OAAO,iBAAiB,eAAe,IAAI;AACrE,MAAI,aAAa,KAAK,CAAC,mBAAmB;AACxC,wBAAqB,MAAM;AAC3B;;EAGF,MAAM,sBAA4B;AAChC,wBAAqB,KAAK;GAE1B,MAAMd,gBAAkC,cACtC,IAAI,MAAM,UAAU,wBAAwB,IAAI,iDAAiD;GAGnG,MAAM,UAAU,kBAAkB;GAClC,MAAMe,WAA+B,SAAS,mBAC1C,0BAA0B,QAAQ,WAAW,GAC7C;AAGJ,OAAI,YAAY,WAAW,uBAAuB,YAAY,WAAW;AACvE,2BAAuB,UAAU;AACjC,YACG,OAAO;KAAC,QAAQ;KAAU,QAAQ,GAAE,qBAAqB,iBAAiB,gBAAe;KAAC,CAAC,CAC3F,YAAY,SAAS,aAAa,CAAC;AACtC;;AAGF,YAAS,aAAa;;EAGxB,MAAMC,UAAyC,WAAW,eAAe,KAAK,IAAI,GAAG,YAAY,KAAK,KAAK,CAAC,CAAC;AAE7G,eAAa,aAAa,QAAQ;IACjC;EAAC,iBAAiB;EAAgB;EAAmB;EAAE,CAAC;;;;CAK3D,MAAM,eAAe,UAAuB;AAC1C,WAAS,MAAM;;AAGjB,kBAAiB;EACf;EACA,uBAAuB,GAAG,OAAO;EACjC,eAAe,iBAAiB,CAAC,aAAa;EAC9C;EACA,UAAU,QAAa;AACrB,mBAAgB;AAChB,YAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC,CAAC;;EAE/D,UAAU,OAAO,YAAiB,aAAa;GAAC,aAAa,QAAQ;GAAa,QAAQ,QAAQ;GAAO,CAAC;EAC1G,cAAc;EACd;EACD,CAAC;;;;;AAMF,iBAAgB;AACd,MACE,CAAC,aAAa,YACb,CAAC,aAAa,aAAa,CAAC,aAAa,mBAC1C,CAAC,aAAa,YAEd;AAIF,MAAI,oBAAoB,QACtB;AAEF,sBAAoB,UAAU;EAE9B,MAAM,wBAAwB,YAA2B;GACvD,IAAIC;AAEJ,OAAI,aAAa,WAAW;IAC1B,MAAMC,kBAAuB,MAAM,4BAA4B,aAAa,UAAU;IACtF,MAAMC,qBAA0B,KAAK,MAAM,gBAAgB;AAE3D,aAAS;KACP,mBAAmB,mBAAmB,SAAS;KAC/C,gBAAgB,mBAAmB,SAAS;KAC5C,cAAc,mBAAmB;KACjC,WAAW,mBAAmB,SAAS;KACvC,YAAY,mBAAmB,SAAS;KACzC;cACQ,aAAa,iBAAiB;IACvC,MAAMD,kBAAuB,MAAM,0BAA0B,aAAa,gBAAgB;IAC1F,MAAMC,qBAA0B,KAAK,MAAM,gBAAgB;AAE3D,aAAS;KACP,mBAAmB,mBAAmB,SAAS;KAC/C,gBAAgB,mBAAmB,SAAS;KAC5C,cAAc,mBAAmB;KAClC;SAED,OAAM,IAAI,MAAM,qDAAqD;AAGvE,SAAM,aAAa;IACjB,aAAa,aAAa,eAAe;IACzC;IACD,CAAC;;AAGJ,yBAAuB,CACpB,WAAW;AACV,mBAAgB;IACd,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,OAAO;IACP,aAAa;IACb,UAAU;IACX,CAAC;IACF,CACD,OAAO,UAAe;AACrB,oBAAiB,UAAe;IAAC,GAAG;IAAa;IAAgB,UAAU;IAAM,EAAE;AACnF,YAAS,MAAM;IACf;IACH;EAAC,aAAa;EAAU,aAAa;EAAW,aAAa;EAAiB,aAAa;EAAY,CAAC;AAE3G,KAAI,UAAU;EAMZ,MAAMC,wBAAgD,EAAE;AACxD,MAAI,mBACF;QAAK,MAAM,MAAM,kBACf,KAAI,EAAE,GAAG,cAAc,uBACrB,uBAAsB,GAAG,cAAc,GAAG;;AAkBhD,SAAO,4CAAG,SAb6B;GACrC;GACA;GACA,OAAO;GACP,aAAa;GACb,YAAY;GACZ,eAAe;GACf,WAAW,aAAa,gBAAgB,CAAC;GACzC;GACA;GACA,UAAU;GACX,CAE8B,GAAI;;AAGrC,QACE,oBAACC;EACiB;EACJ;EACZ,WAAW,aAAa,CAAC,iBAAiB,CAAC;EACxB;EACnB,UAAU;EACV,SAAS;EACT,OAAO;EACI;EACL;EACG;EACI;EACgB;EACV;GACnB;;AAIN,qBAAe"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/react",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "description": "React SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -60,7 +60,7 @@
   "dependencies": {
     "@emotion/css": "11.13.5",
     "@floating-ui/react": "0.27.12",
-    "@thunderid/browser": "^1.12.0",
+    "@thunderid/browser": "^1.12.1",
     "dompurify": "3.4.17",
     "tslib": "2.8.1"
   },