@thunderid/react 1.15.0 → 1.16.0

package/dist/ThunderIDReactClient.js

@@ -93,7 +93,7 @@ var ThunderIDReactClient = class extends ThunderIDBrowserClient {
 			if (typeof arg1 === "object" && arg1 !== null && !isEmpty(arg1) && ("executionId" in arg1 || "applicationId" in arg1)) {
 				this.rejectEmbeddedFlowInBackendMode();
 				const authIdFromUrl = new URL(window.location.href).searchParams.get("authId") ?? "";
-				const authIdFromStorage = await this.getStorageManager().getHybridDataParameter("authId") ?? "";
+				const authIdFromStorage = (arg1.executionId ? await this.getStorageManager().getFlowAuthId(arg1.executionId) : void 0) ?? "";
 				const authId = authIdFromUrl || authIdFromStorage;
 				const response = await executeEmbeddedSignInFlow({
 					authId,

package/dist/ThunderIDReactClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDReactClient.js","names":["config: ThunderIDReactConfig | undefined","isInitialized: boolean","claims: User","arg1: any","arg2: any","authIdFromUrl: string","authIdFromStorage: string","authId: string","response: EmbeddedSignInFlowResponse","decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }","createdAt: number","expiresIn: number","config: ThunderIDReactConfig","firstArg: any","baseUrl: string","response: any","decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }"],"sources":["../src/ThunderIDReactClient.ts"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDBrowserClient,\n  UserProfile,\n  SignInOptions,\n  User,\n  SignUpOptions,\n  ThunderIDRuntimeError,\n  executeEmbeddedSignInFlow,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  TokenResponse,\n  HttpRequestConfig,\n  HttpResponse,\n  TokenExchangeRequestConfig,\n  isEmpty,\n  EmbeddedSignInFlowResponse,\n  executeEmbeddedSignUpFlow,\n  executeEmbeddedRecoveryFlow,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignUpFlowResponse,\n  EmbeddedSignUpFlowStatus,\n  resolveResourceEndpoint,\n} from '@thunderid/browser';\nimport {ThunderIDReactConfig} from './models/config';\n\nclass ThunderIDReactClient<T extends ThunderIDReactConfig = ThunderIDReactConfig> extends ThunderIDBrowserClient<T> {\n  private loadingState = false;\n\n  private _initializeConfig: ThunderIDReactConfig | undefined;\n\n  constructor(instanceId = 0) {\n    super(instanceId);\n  }\n\n  private setLoading(loading: boolean): void {\n    this.loadingState = loading;\n  }\n\n  private async withLoading<TResult>(operation: () => Promise<TResult>): Promise<TResult> {\n    this.setLoading(true);\n    try {\n      const result: TResult = await operation();\n      return result;\n    } finally {\n      this.setLoading(false);\n    }\n  }\n\n  /**\n   * Returns the stored config, re-running initialization first when it has gone missing.\n   *\n   * NOTE: With React 19 strict mode, the initialization logic runs twice, and there's an intermittent\n   * issue where the config object is not getting stored in the storage layer with Vite scaffolding.\n   * An operation that resolves endpoints from a lost config fails (for example \"required endpoints\n   * are missing\"), so recover it from the config this client was initialized with.\n   */\n  private async ensureConfigData(): Promise<ThunderIDReactConfig | undefined> {\n    const config: ThunderIDReactConfig | undefined = (await this.getStorageManager().getConfigData()) as\n      | ThunderIDReactConfig\n      | undefined;\n    const isConfigLost: boolean =\n      !config || Object.keys(config).length === 0 || (Boolean(this._initializeConfig?.baseUrl) && !config.baseUrl);\n\n    if (!isConfigLost || !this._initializeConfig) {\n      return config;\n    }\n\n    await this.initialize(this._initializeConfig);\n\n    // Reload the config persisted by initialization so downstream endpoint resolution\n    // (baseUrl and the flowExecute override) uses the recovered values, not the stale empty config.\n    return (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig | undefined;\n  }\n\n  override initialize(config: ThunderIDReactConfig): Promise<boolean> {\n    return this.withLoading(async () => {\n      this._initializeConfig = {\n        ...config,\n        periodicTokenRefresh:\n          config?.tokenLifecycle?.refreshToken?.autoRefresh ?? (config as any)?.periodicTokenRefresh,\n      } as any;\n\n      return super.initialize(this._initializeConfig as unknown as T);\n    });\n  }\n\n  override reInitialize(config: Partial<ThunderIDReactConfig>): Promise<boolean> {\n    return this.withLoading(async () => {\n      let isInitialized: boolean;\n\n      try {\n        await super.reInitialize(config as Partial<T>);\n        isInitialized = true;\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Failed to check if the client is initialized: ${error instanceof Error ? error.message : String(error)}`,\n          'ThunderIDReactClient-reInitialize-RuntimeError-001',\n          'react',\n          'An error occurred while checking the initialization status of the client.',\n        );\n      }\n\n      return isInitialized;\n    });\n  }\n\n  override async updateUserProfile(): Promise<User> {\n    throw new Error('Not implemented');\n  }\n\n  override async getUser(): Promise<User> {\n    return extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n  }\n\n  override async getDecodedIdToken(sessionId?: string): Promise<IdToken> {\n    return super.getDecodedIdToken(sessionId);\n  }\n\n  override async getIdToken(): Promise<string> {\n    return this.withLoading(async () => super.getIdToken());\n  }\n\n  override async getUserProfile(): Promise<UserProfile> {\n    return this.withLoading(async () => {\n      const claims: User = extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n      return {\n        flattenedProfile: claims,\n        profile: claims,\n        schemas: [],\n      };\n    });\n  }\n\n  override isLoading(): boolean {\n    return this.loadingState || super.isLoading();\n  }\n\n  override async isSignedIn(): Promise<boolean> {\n    return super.isSignedIn();\n  }\n\n  override async exchangeToken(config: TokenExchangeRequestConfig): Promise<TokenResponse | Response> {\n    return this.withLoading(async () => super.exchangeToken(config) as unknown as TokenResponse | Response);\n  }\n\n  override async signIn(...args: any[]): Promise<User | EmbeddedSignInFlowResponse> {\n    return this.withLoading(async () => {\n      const arg1: any = args[0];\n      const arg2: any = args[1];\n\n      const config: ThunderIDReactConfig | undefined = await this.ensureConfigData();\n\n      if (typeof arg1 === 'object' && arg1 !== null && arg1.callOnlyOnRedirect === true) {\n        return undefined as any;\n      }\n\n      if (\n        typeof arg1 === 'object' &&\n        arg1 !== null &&\n        !isEmpty(arg1) &&\n        ('executionId' in arg1 || 'applicationId' in arg1)\n      ) {\n        this.rejectEmbeddedFlowInBackendMode();\n\n        const authIdFromUrl: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n        const authIdFromStorage: string =\n          ((await this.getStorageManager().getHybridDataParameter('authId')) as string) ?? '';\n        const authId: string = authIdFromUrl || authIdFromStorage;\n        const baseUrl: string = config?.baseUrl ?? '';\n\n        const response: EmbeddedSignInFlowResponse = await executeEmbeddedSignInFlow({\n          authId,\n          baseUrl,\n          payload: arg1,\n          url: resolveResourceEndpoint('flowExecute', config, arg2?.url),\n        });\n\n        // A flow for an authorization request posts its SSO sessions to the callback instead.\n        if (!authId && response) {\n          await this.storeFlowSessions(response);\n        }\n\n        if (\n          response &&\n          typeof response === 'object' &&\n          response.flowStatus === EmbeddedSignInFlowStatus.Complete &&\n          response.assertion\n        ) {\n          const decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          } = await this.decodeJwtToken<{\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }>(response.assertion);\n\n          const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n          const expiresIn: number =\n            decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n          await this.setSession({\n            access_token: response.assertion,\n            created_at: createdAt,\n            expires_in: expiresIn,\n            id_token: response.assertion,\n            scope: decodedAssertion.scope,\n            token_type: 'Bearer',\n          });\n\n          this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n        }\n\n        return response;\n      }\n\n      return (await super.signIn(...args)) as unknown as User;\n    });\n  }\n\n  override async signInSilently(options?: SignInOptions): Promise<User | boolean> {\n    await this.ensureConfigData();\n\n    return super.signInSilently(options as Record<string, string | boolean>) as Promise<User | boolean>;\n  }\n\n  override async signUp(options?: SignUpOptions): Promise<void>;\n  override async signUp(payload: any): Promise<any>;\n  override async signUp(...args: any[]): Promise<void | any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n    const firstArg: any = args[0];\n    const baseUrl: string = config?.baseUrl ?? '';\n\n    const authId: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n\n    const response: any = await executeEmbeddedSignUpFlow({\n      authId,\n      baseUrl,\n      payload: typeof firstArg === 'object' && 'flowType' in firstArg ? {...firstArg, verbose: true} : firstArg,\n      url: resolveResourceEndpoint('flowExecute', config),\n    });\n\n    // A flow for an authorization request posts its SSO sessions to the callback instead.\n    if (!authId && response) {\n      await this.storeFlowSessions(response as EmbeddedSignUpFlowResponse);\n    }\n\n    if (\n      response &&\n      typeof response === 'object' &&\n      response.flowStatus === EmbeddedSignUpFlowStatus.Complete &&\n      response.assertion\n    ) {\n      const decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      } = await this.decodeJwtToken<{\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }>(response.assertion);\n\n      const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n      const expiresIn: number =\n        decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n      await this.setSession({\n        access_token: response.assertion,\n        created_at: createdAt,\n        expires_in: expiresIn,\n        id_token: response.assertion,\n        scope: decodedAssertion.scope,\n        token_type: 'Bearer',\n      });\n\n      this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n    }\n\n    return response;\n  }\n\n  override async recover(payload?: any): Promise<any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n\n    return executeEmbeddedRecoveryFlow({\n      baseUrl: config?.baseUrl,\n      payload: {...payload, verbose: true},\n      url: resolveResourceEndpoint('flowExecute', config),\n    }) as any;\n  }\n\n  /**\n   * The embedded flows keep their result in the browser, which running sign-in on the backend rules\n   * out. Running them through the backend is not supported yet.\n   */\n  private rejectEmbeddedFlowInBackendMode(): void {\n    if (this.isBackendMode()) {\n      throw new ThunderIDRuntimeError(\n        'Embedded sign-in, sign-up, and recovery flows are not supported when sign-in runs on the backend.',\n        'ThunderIDReactClient-embeddedFlow-RuntimeError-001',\n        'react',\n        'Use redirect sign-in with the backend.',\n      );\n    }\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  async request(requestConfig?: HttpRequestConfig): Promise<HttpResponse<any>> {\n    return super.httpRequest(requestConfig!) as Promise<HttpResponse<any>>;\n  }\n\n  async requestAll(requestConfigs?: HttpRequestConfig[]): Promise<HttpResponse<any>[]> {\n    return super.httpRequestAll(requestConfigs!) as Promise<HttpResponse<any>[]>;\n  }\n}\n\nexport default ThunderIDReactClient;\n"],"mappings":";;;AA4BA,IAAM,uBAAN,cAA0F,uBAA0B;CAClH,AAAQ,eAAe;CAEvB,AAAQ;CAER,YAAY,aAAa,GAAG;AAC1B,QAAM,WAAW;;CAGnB,AAAQ,WAAW,SAAwB;AACzC,OAAK,eAAe;;CAGtB,MAAc,YAAqB,WAAqD;AACtF,OAAK,WAAW,KAAK;AACrB,MAAI;AAEF,UADwB,MAAM,WAAW;YAEjC;AACR,QAAK,WAAW,MAAM;;;;;;;;;;;CAY1B,MAAc,mBAA8D;EAC1E,MAAMA,SAA4C,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAMhG,MAAI,EAFF,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,KAAM,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,CAAC,OAAO,YAEjF,CAAC,KAAK,kBACzB,QAAO;AAGT,QAAM,KAAK,WAAW,KAAK,kBAAkB;AAI7C,SAAQ,MAAM,KAAK,mBAAmB,CAAC,eAAe;;CAGxD,AAAS,WAAW,QAAgD;AAClE,SAAO,KAAK,YAAY,YAAY;AAClC,QAAK,oBAAoB;IACvB,GAAG;IACH,sBACE,QAAQ,gBAAgB,cAAc,eAAgB,QAAgB;IACzE;AAED,UAAO,MAAM,WAAW,KAAK,kBAAkC;IAC/D;;CAGJ,AAAS,aAAa,QAAyD;AAC7E,SAAO,KAAK,YAAY,YAAY;GAClC,IAAIC;AAEJ,OAAI;AACF,UAAM,MAAM,aAAa,OAAqB;AAC9C,oBAAgB;YACT,OAAO;AACd,UAAM,IAAI,sBACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACvG,sDACA,SACA,4EACD;;AAGH,UAAO;IACP;;CAGJ,MAAe,oBAAmC;AAChD,QAAM,IAAI,MAAM,kBAAkB;;CAGpC,MAAe,UAAyB;AACtC,SAAO,6BAA6B,MAAM,KAAK,mBAAmB,CAAC;;CAGrE,MAAe,kBAAkB,WAAsC;AACrE,SAAO,MAAM,kBAAkB,UAAU;;CAG3C,MAAe,aAA8B;AAC3C,SAAO,KAAK,YAAY,YAAY,MAAM,YAAY,CAAC;;CAGzD,MAAe,iBAAuC;AACpD,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,SAAe,6BAA6B,MAAM,KAAK,mBAAmB,CAAC;AACjF,UAAO;IACL,kBAAkB;IAClB,SAAS;IACT,SAAS,EAAE;IACZ;IACD;;CAGJ,AAAS,YAAqB;AAC5B,SAAO,KAAK,gBAAgB,MAAM,WAAW;;CAG/C,MAAe,aAA+B;AAC5C,SAAO,MAAM,YAAY;;CAG3B,MAAe,cAAc,QAAuE;AAClG,SAAO,KAAK,YAAY,YAAY,MAAM,cAAc,OAAO,CAAwC;;CAGzG,MAAe,OAAO,GAAG,MAAyD;AAChF,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,OAAY,KAAK;GACvB,MAAMC,OAAY,KAAK;GAEvB,MAAMJ,SAA2C,MAAM,KAAK,kBAAkB;AAE9E,OAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,KAAK,uBAAuB,KAC3E;AAGF,OACE,OAAO,SAAS,YAChB,SAAS,QACT,CAAC,QAAQ,KAAK,KACb,iBAAiB,QAAQ,mBAAmB,OAC7C;AACA,SAAK,iCAAiC;IAEtC,MAAMK,gBAAwB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;IAC1F,MAAMC,oBACF,MAAM,KAAK,mBAAmB,CAAC,uBAAuB,SAAS,IAAgB;IACnF,MAAMC,SAAiB,iBAAiB;IAGxC,MAAMC,WAAuC,MAAM,0BAA0B;KAC3E;KACA,SAJsB,QAAQ,WAAW;KAKzC,SAAS;KACT,KAAK,wBAAwB,eAAe,QAAQ,MAAM,IAAI;KAC/D,CAAC;AAGF,QAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAS;AAGxC,QACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAe,yBAAyB,YACjD,SAAS,WACT;KACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;KAEtB,MAAMC,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;KACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,WAAM,KAAK,WAAW;MACpB,cAAc,SAAS;MACvB,YAAY;MACZ,YAAY;MACZ,UAAU,SAAS;MACnB,OAAO,iBAAiB;MACxB,YAAY;MACb,CAAC;AAEF,UAAK,aAAa,6BAA6B,iBAA4B,CAAS;;AAGtF,WAAO;;AAGT,UAAQ,MAAM,MAAM,OAAO,GAAG,KAAK;IACnC;;CAGJ,MAAe,eAAe,SAAkD;AAC9E,QAAM,KAAK,kBAAkB;AAE7B,SAAO,MAAM,eAAe,QAA4C;;CAK1E,MAAe,OAAO,GAAG,MAAkC;AACzD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACpF,MAAMC,WAAgB,KAAK;EAC3B,MAAMC,UAAkB,QAAQ,WAAW;EAE3C,MAAMP,SAAiB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;EAEnF,MAAMQ,WAAgB,MAAM,0BAA0B;GACpD;GACA;GACA,SAAS,OAAO,aAAa,YAAY,cAAc,WAAW;IAAC,GAAG;IAAU,SAAS;IAAK,GAAG;GACjG,KAAK,wBAAwB,eAAe,OAAO;GACpD,CAAC;AAGF,MAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAuC;AAGtE,MACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAe,yBAAyB,YACjD,SAAS,WACT;GACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;GAEtB,MAAMN,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;GACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,SAAM,KAAK,WAAW;IACpB,cAAc,SAAS;IACvB,YAAY;IACZ,YAAY;IACZ,UAAU,SAAS;IACnB,OAAO,iBAAiB;IACxB,YAAY;IACb,CAAC;AAEF,QAAK,aAAa,6BAA6B,iBAA4B,CAAS;;AAGtF,SAAO;;CAGT,MAAe,QAAQ,SAA6B;AAClD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEpF,SAAO,4BAA4B;GACjC,SAAS,QAAQ;GACjB,SAAS;IAAC,GAAG;IAAS,SAAS;IAAK;GACpC,KAAK,wBAAwB,eAAe,OAAO;GACpD,CAAC;;;;;;CAOJ,AAAQ,kCAAwC;AAC9C,MAAI,KAAK,eAAe,CACtB,OAAM,IAAI,sBACR,qGACA,sDACA,SACA,yCACD;;CAIL,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAM,QAAQ,eAA+D;AAC3E,SAAO,MAAM,YAAY,cAAe;;CAG1C,MAAM,WAAW,gBAAoE;AACnF,SAAO,MAAM,eAAe,eAAgB;;;AAIhD,mCAAe"}
+{"version":3,"file":"ThunderIDReactClient.js","names":["config: ThunderIDReactConfig | undefined","isInitialized: boolean","claims: User","arg1: any","arg2: any","authIdFromUrl: string","authIdFromStorage: string","authId: string","response: EmbeddedSignInFlowResponse","decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }","createdAt: number","expiresIn: number","config: ThunderIDReactConfig","firstArg: any","baseUrl: string","response: any","decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }"],"sources":["../src/ThunderIDReactClient.ts"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDBrowserClient,\n  UserProfile,\n  SignInOptions,\n  User,\n  SignUpOptions,\n  ThunderIDRuntimeError,\n  executeEmbeddedSignInFlow,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  TokenResponse,\n  HttpRequestConfig,\n  HttpResponse,\n  TokenExchangeRequestConfig,\n  isEmpty,\n  EmbeddedSignInFlowResponse,\n  executeEmbeddedSignUpFlow,\n  executeEmbeddedRecoveryFlow,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignUpFlowResponse,\n  EmbeddedSignUpFlowStatus,\n  resolveResourceEndpoint,\n} from '@thunderid/browser';\nimport {ThunderIDReactConfig} from './models/config';\n\nclass ThunderIDReactClient<T extends ThunderIDReactConfig = ThunderIDReactConfig> extends ThunderIDBrowserClient<T> {\n  private loadingState = false;\n\n  private _initializeConfig: ThunderIDReactConfig | undefined;\n\n  constructor(instanceId = 0) {\n    super(instanceId);\n  }\n\n  private setLoading(loading: boolean): void {\n    this.loadingState = loading;\n  }\n\n  private async withLoading<TResult>(operation: () => Promise<TResult>): Promise<TResult> {\n    this.setLoading(true);\n    try {\n      const result: TResult = await operation();\n      return result;\n    } finally {\n      this.setLoading(false);\n    }\n  }\n\n  /**\n   * Returns the stored config, re-running initialization first when it has gone missing.\n   *\n   * NOTE: With React 19 strict mode, the initialization logic runs twice, and there's an intermittent\n   * issue where the config object is not getting stored in the storage layer with Vite scaffolding.\n   * An operation that resolves endpoints from a lost config fails (for example \"required endpoints\n   * are missing\"), so recover it from the config this client was initialized with.\n   */\n  private async ensureConfigData(): Promise<ThunderIDReactConfig | undefined> {\n    const config: ThunderIDReactConfig | undefined = (await this.getStorageManager().getConfigData()) as\n      | ThunderIDReactConfig\n      | undefined;\n    const isConfigLost: boolean =\n      !config || Object.keys(config).length === 0 || (Boolean(this._initializeConfig?.baseUrl) && !config.baseUrl);\n\n    if (!isConfigLost || !this._initializeConfig) {\n      return config;\n    }\n\n    await this.initialize(this._initializeConfig);\n\n    // Reload the config persisted by initialization so downstream endpoint resolution\n    // (baseUrl and the flowExecute override) uses the recovered values, not the stale empty config.\n    return (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig | undefined;\n  }\n\n  override initialize(config: ThunderIDReactConfig): Promise<boolean> {\n    return this.withLoading(async () => {\n      this._initializeConfig = {\n        ...config,\n        periodicTokenRefresh:\n          config?.tokenLifecycle?.refreshToken?.autoRefresh ?? (config as any)?.periodicTokenRefresh,\n      } as any;\n\n      return super.initialize(this._initializeConfig as unknown as T);\n    });\n  }\n\n  override reInitialize(config: Partial<ThunderIDReactConfig>): Promise<boolean> {\n    return this.withLoading(async () => {\n      let isInitialized: boolean;\n\n      try {\n        await super.reInitialize(config as Partial<T>);\n        isInitialized = true;\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Failed to check if the client is initialized: ${error instanceof Error ? error.message : String(error)}`,\n          'ThunderIDReactClient-reInitialize-RuntimeError-001',\n          'react',\n          'An error occurred while checking the initialization status of the client.',\n        );\n      }\n\n      return isInitialized;\n    });\n  }\n\n  override async updateUserProfile(): Promise<User> {\n    throw new Error('Not implemented');\n  }\n\n  override async getUser(): Promise<User> {\n    return extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n  }\n\n  override async getDecodedIdToken(sessionId?: string): Promise<IdToken> {\n    return super.getDecodedIdToken(sessionId);\n  }\n\n  override async getIdToken(): Promise<string> {\n    return this.withLoading(async () => super.getIdToken());\n  }\n\n  override async getUserProfile(): Promise<UserProfile> {\n    return this.withLoading(async () => {\n      const claims: User = extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n      return {\n        flattenedProfile: claims,\n        profile: claims,\n        schemas: [],\n      };\n    });\n  }\n\n  override isLoading(): boolean {\n    return this.loadingState || super.isLoading();\n  }\n\n  override async isSignedIn(): Promise<boolean> {\n    return super.isSignedIn();\n  }\n\n  override async exchangeToken(config: TokenExchangeRequestConfig): Promise<TokenResponse | Response> {\n    return this.withLoading(async () => super.exchangeToken(config) as unknown as TokenResponse | Response);\n  }\n\n  override async signIn(...args: any[]): Promise<User | EmbeddedSignInFlowResponse> {\n    return this.withLoading(async () => {\n      const arg1: any = args[0];\n      const arg2: any = args[1];\n\n      const config: ThunderIDReactConfig | undefined = await this.ensureConfigData();\n\n      if (typeof arg1 === 'object' && arg1 !== null && arg1.callOnlyOnRedirect === true) {\n        return undefined as any;\n      }\n\n      if (\n        typeof arg1 === 'object' &&\n        arg1 !== null &&\n        !isEmpty(arg1) &&\n        ('executionId' in arg1 || 'applicationId' in arg1)\n      ) {\n        this.rejectEmbeddedFlowInBackendMode();\n\n        const authIdFromUrl: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n        const authIdFromStorage: string =\n          (arg1.executionId ? await this.getStorageManager().getFlowAuthId(arg1.executionId) : undefined) ?? '';\n        const authId: string = authIdFromUrl || authIdFromStorage;\n        const baseUrl: string = config?.baseUrl ?? '';\n\n        const response: EmbeddedSignInFlowResponse = await executeEmbeddedSignInFlow({\n          authId,\n          baseUrl,\n          payload: arg1,\n          url: resolveResourceEndpoint('flowExecute', config, arg2?.url),\n        });\n\n        // A flow for an authorization request posts its SSO sessions to the callback instead.\n        if (!authId && response) {\n          await this.storeFlowSessions(response);\n        }\n\n        if (\n          response &&\n          typeof response === 'object' &&\n          response.flowStatus === EmbeddedSignInFlowStatus.Complete &&\n          response.assertion\n        ) {\n          const decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          } = await this.decodeJwtToken<{\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }>(response.assertion);\n\n          const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n          const expiresIn: number =\n            decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n          await this.setSession({\n            access_token: response.assertion,\n            created_at: createdAt,\n            expires_in: expiresIn,\n            id_token: response.assertion,\n            scope: decodedAssertion.scope,\n            token_type: 'Bearer',\n          });\n\n          this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n        }\n\n        return response;\n      }\n\n      return (await super.signIn(...args)) as unknown as User;\n    });\n  }\n\n  override async signInSilently(options?: SignInOptions): Promise<User | boolean> {\n    await this.ensureConfigData();\n\n    return super.signInSilently(options as Record<string, string | boolean>) as Promise<User | boolean>;\n  }\n\n  override async signUp(options?: SignUpOptions): Promise<void>;\n  override async signUp(payload: any): Promise<any>;\n  override async signUp(...args: any[]): Promise<void | any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n    const firstArg: any = args[0];\n    const baseUrl: string = config?.baseUrl ?? '';\n\n    const authId: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n\n    const response: any = await executeEmbeddedSignUpFlow({\n      authId,\n      baseUrl,\n      payload: typeof firstArg === 'object' && 'flowType' in firstArg ? {...firstArg, verbose: true} : firstArg,\n      url: resolveResourceEndpoint('flowExecute', config),\n    });\n\n    // A flow for an authorization request posts its SSO sessions to the callback instead.\n    if (!authId && response) {\n      await this.storeFlowSessions(response as EmbeddedSignUpFlowResponse);\n    }\n\n    if (\n      response &&\n      typeof response === 'object' &&\n      response.flowStatus === EmbeddedSignUpFlowStatus.Complete &&\n      response.assertion\n    ) {\n      const decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      } = await this.decodeJwtToken<{\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }>(response.assertion);\n\n      const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n      const expiresIn: number =\n        decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n      await this.setSession({\n        access_token: response.assertion,\n        created_at: createdAt,\n        expires_in: expiresIn,\n        id_token: response.assertion,\n        scope: decodedAssertion.scope,\n        token_type: 'Bearer',\n      });\n\n      this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n    }\n\n    return response;\n  }\n\n  override async recover(payload?: any): Promise<any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n\n    return executeEmbeddedRecoveryFlow({\n      baseUrl: config?.baseUrl,\n      payload: {...payload, verbose: true},\n      url: resolveResourceEndpoint('flowExecute', config),\n    }) as any;\n  }\n\n  /**\n   * The embedded flows keep their result in the browser, which running sign-in on the backend rules\n   * out. Running them through the backend is not supported yet.\n   */\n  private rejectEmbeddedFlowInBackendMode(): void {\n    if (this.isBackendMode()) {\n      throw new ThunderIDRuntimeError(\n        'Embedded sign-in, sign-up, and recovery flows are not supported when sign-in runs on the backend.',\n        'ThunderIDReactClient-embeddedFlow-RuntimeError-001',\n        'react',\n        'Use redirect sign-in with the backend.',\n      );\n    }\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  async request(requestConfig?: HttpRequestConfig): Promise<HttpResponse<any>> {\n    return super.httpRequest(requestConfig!) as Promise<HttpResponse<any>>;\n  }\n\n  async requestAll(requestConfigs?: HttpRequestConfig[]): Promise<HttpResponse<any>[]> {\n    return super.httpRequestAll(requestConfigs!) as Promise<HttpResponse<any>[]>;\n  }\n}\n\nexport default ThunderIDReactClient;\n"],"mappings":";;;AA4BA,IAAM,uBAAN,cAA0F,uBAA0B;CAClH,AAAQ,eAAe;CAEvB,AAAQ;CAER,YAAY,aAAa,GAAG;AAC1B,QAAM,WAAW;;CAGnB,AAAQ,WAAW,SAAwB;AACzC,OAAK,eAAe;;CAGtB,MAAc,YAAqB,WAAqD;AACtF,OAAK,WAAW,KAAK;AACrB,MAAI;AAEF,UADwB,MAAM,WAAW;YAEjC;AACR,QAAK,WAAW,MAAM;;;;;;;;;;;CAY1B,MAAc,mBAA8D;EAC1E,MAAMA,SAA4C,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAMhG,MAAI,EAFF,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,KAAM,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,CAAC,OAAO,YAEjF,CAAC,KAAK,kBACzB,QAAO;AAGT,QAAM,KAAK,WAAW,KAAK,kBAAkB;AAI7C,SAAQ,MAAM,KAAK,mBAAmB,CAAC,eAAe;;CAGxD,AAAS,WAAW,QAAgD;AAClE,SAAO,KAAK,YAAY,YAAY;AAClC,QAAK,oBAAoB;IACvB,GAAG;IACH,sBACE,QAAQ,gBAAgB,cAAc,eAAgB,QAAgB;IACzE;AAED,UAAO,MAAM,WAAW,KAAK,kBAAkC;IAC/D;;CAGJ,AAAS,aAAa,QAAyD;AAC7E,SAAO,KAAK,YAAY,YAAY;GAClC,IAAIC;AAEJ,OAAI;AACF,UAAM,MAAM,aAAa,OAAqB;AAC9C,oBAAgB;YACT,OAAO;AACd,UAAM,IAAI,sBACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACvG,sDACA,SACA,4EACD;;AAGH,UAAO;IACP;;CAGJ,MAAe,oBAAmC;AAChD,QAAM,IAAI,MAAM,kBAAkB;;CAGpC,MAAe,UAAyB;AACtC,SAAO,6BAA6B,MAAM,KAAK,mBAAmB,CAAC;;CAGrE,MAAe,kBAAkB,WAAsC;AACrE,SAAO,MAAM,kBAAkB,UAAU;;CAG3C,MAAe,aAA8B;AAC3C,SAAO,KAAK,YAAY,YAAY,MAAM,YAAY,CAAC;;CAGzD,MAAe,iBAAuC;AACpD,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,SAAe,6BAA6B,MAAM,KAAK,mBAAmB,CAAC;AACjF,UAAO;IACL,kBAAkB;IAClB,SAAS;IACT,SAAS,EAAE;IACZ;IACD;;CAGJ,AAAS,YAAqB;AAC5B,SAAO,KAAK,gBAAgB,MAAM,WAAW;;CAG/C,MAAe,aAA+B;AAC5C,SAAO,MAAM,YAAY;;CAG3B,MAAe,cAAc,QAAuE;AAClG,SAAO,KAAK,YAAY,YAAY,MAAM,cAAc,OAAO,CAAwC;;CAGzG,MAAe,OAAO,GAAG,MAAyD;AAChF,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,OAAY,KAAK;GACvB,MAAMC,OAAY,KAAK;GAEvB,MAAMJ,SAA2C,MAAM,KAAK,kBAAkB;AAE9E,OAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,KAAK,uBAAuB,KAC3E;AAGF,OACE,OAAO,SAAS,YAChB,SAAS,QACT,CAAC,QAAQ,KAAK,KACb,iBAAiB,QAAQ,mBAAmB,OAC7C;AACA,SAAK,iCAAiC;IAEtC,MAAMK,gBAAwB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;IAC1F,MAAMC,qBACH,KAAK,cAAc,MAAM,KAAK,mBAAmB,CAAC,cAAc,KAAK,YAAY,GAAG,WAAc;IACrG,MAAMC,SAAiB,iBAAiB;IAGxC,MAAMC,WAAuC,MAAM,0BAA0B;KAC3E;KACA,SAJsB,QAAQ,WAAW;KAKzC,SAAS;KACT,KAAK,wBAAwB,eAAe,QAAQ,MAAM,IAAI;KAC/D,CAAC;AAGF,QAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAS;AAGxC,QACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAe,yBAAyB,YACjD,SAAS,WACT;KACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;KAEtB,MAAMC,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;KACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,WAAM,KAAK,WAAW;MACpB,cAAc,SAAS;MACvB,YAAY;MACZ,YAAY;MACZ,UAAU,SAAS;MACnB,OAAO,iBAAiB;MACxB,YAAY;MACb,CAAC;AAEF,UAAK,aAAa,6BAA6B,iBAA4B,CAAS;;AAGtF,WAAO;;AAGT,UAAQ,MAAM,MAAM,OAAO,GAAG,KAAK;IACnC;;CAGJ,MAAe,eAAe,SAAkD;AAC9E,QAAM,KAAK,kBAAkB;AAE7B,SAAO,MAAM,eAAe,QAA4C;;CAK1E,MAAe,OAAO,GAAG,MAAkC;AACzD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACpF,MAAMC,WAAgB,KAAK;EAC3B,MAAMC,UAAkB,QAAQ,WAAW;EAE3C,MAAMP,SAAiB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;EAEnF,MAAMQ,WAAgB,MAAM,0BAA0B;GACpD;GACA;GACA,SAAS,OAAO,aAAa,YAAY,cAAc,WAAW;IAAC,GAAG;IAAU,SAAS;IAAK,GAAG;GACjG,KAAK,wBAAwB,eAAe,OAAO;GACpD,CAAC;AAGF,MAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAuC;AAGtE,MACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAe,yBAAyB,YACjD,SAAS,WACT;GACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;GAEtB,MAAMN,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;GACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,SAAM,KAAK,WAAW;IACpB,cAAc,SAAS;IACvB,YAAY;IACZ,YAAY;IACZ,UAAU,SAAS;IACnB,OAAO,iBAAiB;IACxB,YAAY;IACb,CAAC;AAEF,QAAK,aAAa,6BAA6B,iBAA4B,CAAS;;AAGtF,SAAO;;CAGT,MAAe,QAAQ,SAA6B;AAClD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEpF,SAAO,4BAA4B;GACjC,SAAS,QAAQ;GACjB,SAAS;IAAC,GAAG;IAAS,SAAS;IAAK;GACpC,KAAK,wBAAwB,eAAe,OAAO;GACpD,CAAC;;;;;;CAOJ,AAAQ,kCAAwC;AAC9C,MAAI,KAAK,eAAe,CACtB,OAAM,IAAI,sBACR,qGACA,sDACA,SACA,yCACD;;CAIL,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAM,QAAQ,eAA+D;AAC3E,SAAO,MAAM,YAAY,cAAe;;CAG1C,MAAM,WAAW,gBAAoE;AACnF,SAAO,MAAM,eAAe,eAAgB;;;AAIhD,mCAAe"}

package/dist/cjs/ThunderIDReactClient.cjs

@@ -95,7 +95,7 @@ var ThunderIDReactClient = class extends __thunderid_browser.ThunderIDBrowserCli
 			if (typeof arg1 === "object" && arg1 !== null && !(0, __thunderid_browser.isEmpty)(arg1) && ("executionId" in arg1 || "applicationId" in arg1)) {
 				this.rejectEmbeddedFlowInBackendMode();
 				const authIdFromUrl = new URL(window.location.href).searchParams.get("authId") ?? "";
-				const authIdFromStorage = await this.getStorageManager().getHybridDataParameter("authId") ?? "";
+				const authIdFromStorage = (arg1.executionId ? await this.getStorageManager().getFlowAuthId(arg1.executionId) : void 0) ?? "";
 				const authId = authIdFromUrl || authIdFromStorage;
 				const response = await (0, __thunderid_browser.executeEmbeddedSignInFlow)({
 					authId,

package/dist/cjs/ThunderIDReactClient.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDReactClient.cjs","names":["ThunderIDBrowserClient","config: ThunderIDReactConfig | undefined","isInitialized: boolean","ThunderIDRuntimeError","claims: User","arg1: any","arg2: any","authIdFromUrl: string","authIdFromStorage: string","authId: string","response: EmbeddedSignInFlowResponse","EmbeddedSignInFlowStatus","decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }","createdAt: number","expiresIn: number","config: ThunderIDReactConfig","firstArg: any","baseUrl: string","response: any","EmbeddedSignUpFlowStatus","decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }"],"sources":["../../src/ThunderIDReactClient.ts"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDBrowserClient,\n  UserProfile,\n  SignInOptions,\n  User,\n  SignUpOptions,\n  ThunderIDRuntimeError,\n  executeEmbeddedSignInFlow,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  TokenResponse,\n  HttpRequestConfig,\n  HttpResponse,\n  TokenExchangeRequestConfig,\n  isEmpty,\n  EmbeddedSignInFlowResponse,\n  executeEmbeddedSignUpFlow,\n  executeEmbeddedRecoveryFlow,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignUpFlowResponse,\n  EmbeddedSignUpFlowStatus,\n  resolveResourceEndpoint,\n} from '@thunderid/browser';\nimport {ThunderIDReactConfig} from './models/config';\n\nclass ThunderIDReactClient<T extends ThunderIDReactConfig = ThunderIDReactConfig> extends ThunderIDBrowserClient<T> {\n  private loadingState = false;\n\n  private _initializeConfig: ThunderIDReactConfig | undefined;\n\n  constructor(instanceId = 0) {\n    super(instanceId);\n  }\n\n  private setLoading(loading: boolean): void {\n    this.loadingState = loading;\n  }\n\n  private async withLoading<TResult>(operation: () => Promise<TResult>): Promise<TResult> {\n    this.setLoading(true);\n    try {\n      const result: TResult = await operation();\n      return result;\n    } finally {\n      this.setLoading(false);\n    }\n  }\n\n  /**\n   * Returns the stored config, re-running initialization first when it has gone missing.\n   *\n   * NOTE: With React 19 strict mode, the initialization logic runs twice, and there's an intermittent\n   * issue where the config object is not getting stored in the storage layer with Vite scaffolding.\n   * An operation that resolves endpoints from a lost config fails (for example \"required endpoints\n   * are missing\"), so recover it from the config this client was initialized with.\n   */\n  private async ensureConfigData(): Promise<ThunderIDReactConfig | undefined> {\n    const config: ThunderIDReactConfig | undefined = (await this.getStorageManager().getConfigData()) as\n      | ThunderIDReactConfig\n      | undefined;\n    const isConfigLost: boolean =\n      !config || Object.keys(config).length === 0 || (Boolean(this._initializeConfig?.baseUrl) && !config.baseUrl);\n\n    if (!isConfigLost || !this._initializeConfig) {\n      return config;\n    }\n\n    await this.initialize(this._initializeConfig);\n\n    // Reload the config persisted by initialization so downstream endpoint resolution\n    // (baseUrl and the flowExecute override) uses the recovered values, not the stale empty config.\n    return (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig | undefined;\n  }\n\n  override initialize(config: ThunderIDReactConfig): Promise<boolean> {\n    return this.withLoading(async () => {\n      this._initializeConfig = {\n        ...config,\n        periodicTokenRefresh:\n          config?.tokenLifecycle?.refreshToken?.autoRefresh ?? (config as any)?.periodicTokenRefresh,\n      } as any;\n\n      return super.initialize(this._initializeConfig as unknown as T);\n    });\n  }\n\n  override reInitialize(config: Partial<ThunderIDReactConfig>): Promise<boolean> {\n    return this.withLoading(async () => {\n      let isInitialized: boolean;\n\n      try {\n        await super.reInitialize(config as Partial<T>);\n        isInitialized = true;\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Failed to check if the client is initialized: ${error instanceof Error ? error.message : String(error)}`,\n          'ThunderIDReactClient-reInitialize-RuntimeError-001',\n          'react',\n          'An error occurred while checking the initialization status of the client.',\n        );\n      }\n\n      return isInitialized;\n    });\n  }\n\n  override async updateUserProfile(): Promise<User> {\n    throw new Error('Not implemented');\n  }\n\n  override async getUser(): Promise<User> {\n    return extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n  }\n\n  override async getDecodedIdToken(sessionId?: string): Promise<IdToken> {\n    return super.getDecodedIdToken(sessionId);\n  }\n\n  override async getIdToken(): Promise<string> {\n    return this.withLoading(async () => super.getIdToken());\n  }\n\n  override async getUserProfile(): Promise<UserProfile> {\n    return this.withLoading(async () => {\n      const claims: User = extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n      return {\n        flattenedProfile: claims,\n        profile: claims,\n        schemas: [],\n      };\n    });\n  }\n\n  override isLoading(): boolean {\n    return this.loadingState || super.isLoading();\n  }\n\n  override async isSignedIn(): Promise<boolean> {\n    return super.isSignedIn();\n  }\n\n  override async exchangeToken(config: TokenExchangeRequestConfig): Promise<TokenResponse | Response> {\n    return this.withLoading(async () => super.exchangeToken(config) as unknown as TokenResponse | Response);\n  }\n\n  override async signIn(...args: any[]): Promise<User | EmbeddedSignInFlowResponse> {\n    return this.withLoading(async () => {\n      const arg1: any = args[0];\n      const arg2: any = args[1];\n\n      const config: ThunderIDReactConfig | undefined = await this.ensureConfigData();\n\n      if (typeof arg1 === 'object' && arg1 !== null && arg1.callOnlyOnRedirect === true) {\n        return undefined as any;\n      }\n\n      if (\n        typeof arg1 === 'object' &&\n        arg1 !== null &&\n        !isEmpty(arg1) &&\n        ('executionId' in arg1 || 'applicationId' in arg1)\n      ) {\n        this.rejectEmbeddedFlowInBackendMode();\n\n        const authIdFromUrl: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n        const authIdFromStorage: string =\n          ((await this.getStorageManager().getHybridDataParameter('authId')) as string) ?? '';\n        const authId: string = authIdFromUrl || authIdFromStorage;\n        const baseUrl: string = config?.baseUrl ?? '';\n\n        const response: EmbeddedSignInFlowResponse = await executeEmbeddedSignInFlow({\n          authId,\n          baseUrl,\n          payload: arg1,\n          url: resolveResourceEndpoint('flowExecute', config, arg2?.url),\n        });\n\n        // A flow for an authorization request posts its SSO sessions to the callback instead.\n        if (!authId && response) {\n          await this.storeFlowSessions(response);\n        }\n\n        if (\n          response &&\n          typeof response === 'object' &&\n          response.flowStatus === EmbeddedSignInFlowStatus.Complete &&\n          response.assertion\n        ) {\n          const decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          } = await this.decodeJwtToken<{\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }>(response.assertion);\n\n          const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n          const expiresIn: number =\n            decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n          await this.setSession({\n            access_token: response.assertion,\n            created_at: createdAt,\n            expires_in: expiresIn,\n            id_token: response.assertion,\n            scope: decodedAssertion.scope,\n            token_type: 'Bearer',\n          });\n\n          this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n        }\n\n        return response;\n      }\n\n      return (await super.signIn(...args)) as unknown as User;\n    });\n  }\n\n  override async signInSilently(options?: SignInOptions): Promise<User | boolean> {\n    await this.ensureConfigData();\n\n    return super.signInSilently(options as Record<string, string | boolean>) as Promise<User | boolean>;\n  }\n\n  override async signUp(options?: SignUpOptions): Promise<void>;\n  override async signUp(payload: any): Promise<any>;\n  override async signUp(...args: any[]): Promise<void | any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n    const firstArg: any = args[0];\n    const baseUrl: string = config?.baseUrl ?? '';\n\n    const authId: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n\n    const response: any = await executeEmbeddedSignUpFlow({\n      authId,\n      baseUrl,\n      payload: typeof firstArg === 'object' && 'flowType' in firstArg ? {...firstArg, verbose: true} : firstArg,\n      url: resolveResourceEndpoint('flowExecute', config),\n    });\n\n    // A flow for an authorization request posts its SSO sessions to the callback instead.\n    if (!authId && response) {\n      await this.storeFlowSessions(response as EmbeddedSignUpFlowResponse);\n    }\n\n    if (\n      response &&\n      typeof response === 'object' &&\n      response.flowStatus === EmbeddedSignUpFlowStatus.Complete &&\n      response.assertion\n    ) {\n      const decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      } = await this.decodeJwtToken<{\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }>(response.assertion);\n\n      const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n      const expiresIn: number =\n        decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n      await this.setSession({\n        access_token: response.assertion,\n        created_at: createdAt,\n        expires_in: expiresIn,\n        id_token: response.assertion,\n        scope: decodedAssertion.scope,\n        token_type: 'Bearer',\n      });\n\n      this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n    }\n\n    return response;\n  }\n\n  override async recover(payload?: any): Promise<any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n\n    return executeEmbeddedRecoveryFlow({\n      baseUrl: config?.baseUrl,\n      payload: {...payload, verbose: true},\n      url: resolveResourceEndpoint('flowExecute', config),\n    }) as any;\n  }\n\n  /**\n   * The embedded flows keep their result in the browser, which running sign-in on the backend rules\n   * out. Running them through the backend is not supported yet.\n   */\n  private rejectEmbeddedFlowInBackendMode(): void {\n    if (this.isBackendMode()) {\n      throw new ThunderIDRuntimeError(\n        'Embedded sign-in, sign-up, and recovery flows are not supported when sign-in runs on the backend.',\n        'ThunderIDReactClient-embeddedFlow-RuntimeError-001',\n        'react',\n        'Use redirect sign-in with the backend.',\n      );\n    }\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  async request(requestConfig?: HttpRequestConfig): Promise<HttpResponse<any>> {\n    return super.httpRequest(requestConfig!) as Promise<HttpResponse<any>>;\n  }\n\n  async requestAll(requestConfigs?: HttpRequestConfig[]): Promise<HttpResponse<any>[]> {\n    return super.httpRequestAll(requestConfigs!) as Promise<HttpResponse<any>[]>;\n  }\n}\n\nexport default ThunderIDReactClient;\n"],"mappings":";;;;;AA4BA,IAAM,uBAAN,cAA0FA,2CAA0B;CAClH,AAAQ,eAAe;CAEvB,AAAQ;CAER,YAAY,aAAa,GAAG;AAC1B,QAAM,WAAW;;CAGnB,AAAQ,WAAW,SAAwB;AACzC,OAAK,eAAe;;CAGtB,MAAc,YAAqB,WAAqD;AACtF,OAAK,WAAW,KAAK;AACrB,MAAI;AAEF,UADwB,MAAM,WAAW;YAEjC;AACR,QAAK,WAAW,MAAM;;;;;;;;;;;CAY1B,MAAc,mBAA8D;EAC1E,MAAMC,SAA4C,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAMhG,MAAI,EAFF,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,KAAM,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,CAAC,OAAO,YAEjF,CAAC,KAAK,kBACzB,QAAO;AAGT,QAAM,KAAK,WAAW,KAAK,kBAAkB;AAI7C,SAAQ,MAAM,KAAK,mBAAmB,CAAC,eAAe;;CAGxD,AAAS,WAAW,QAAgD;AAClE,SAAO,KAAK,YAAY,YAAY;AAClC,QAAK,oBAAoB;IACvB,GAAG;IACH,sBACE,QAAQ,gBAAgB,cAAc,eAAgB,QAAgB;IACzE;AAED,UAAO,MAAM,WAAW,KAAK,kBAAkC;IAC/D;;CAGJ,AAAS,aAAa,QAAyD;AAC7E,SAAO,KAAK,YAAY,YAAY;GAClC,IAAIC;AAEJ,OAAI;AACF,UAAM,MAAM,aAAa,OAAqB;AAC9C,oBAAgB;YACT,OAAO;AACd,UAAM,IAAIC,0CACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACvG,sDACA,SACA,4EACD;;AAGH,UAAO;IACP;;CAGJ,MAAe,oBAAmC;AAChD,QAAM,IAAI,MAAM,kBAAkB;;CAGpC,MAAe,UAAyB;AACtC,+DAAoC,MAAM,KAAK,mBAAmB,CAAC;;CAGrE,MAAe,kBAAkB,WAAsC;AACrE,SAAO,MAAM,kBAAkB,UAAU;;CAG3C,MAAe,aAA8B;AAC3C,SAAO,KAAK,YAAY,YAAY,MAAM,YAAY,CAAC;;CAGzD,MAAe,iBAAuC;AACpD,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,+DAA4C,MAAM,KAAK,mBAAmB,CAAC;AACjF,UAAO;IACL,kBAAkB;IAClB,SAAS;IACT,SAAS,EAAE;IACZ;IACD;;CAGJ,AAAS,YAAqB;AAC5B,SAAO,KAAK,gBAAgB,MAAM,WAAW;;CAG/C,MAAe,aAA+B;AAC5C,SAAO,MAAM,YAAY;;CAG3B,MAAe,cAAc,QAAuE;AAClG,SAAO,KAAK,YAAY,YAAY,MAAM,cAAc,OAAO,CAAwC;;CAGzG,MAAe,OAAO,GAAG,MAAyD;AAChF,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,OAAY,KAAK;GACvB,MAAMC,OAAY,KAAK;GAEvB,MAAML,SAA2C,MAAM,KAAK,kBAAkB;AAE9E,OAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,KAAK,uBAAuB,KAC3E;AAGF,OACE,OAAO,SAAS,YAChB,SAAS,QACT,kCAAS,KAAK,KACb,iBAAiB,QAAQ,mBAAmB,OAC7C;AACA,SAAK,iCAAiC;IAEtC,MAAMM,gBAAwB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;IAC1F,MAAMC,oBACF,MAAM,KAAK,mBAAmB,CAAC,uBAAuB,SAAS,IAAgB;IACnF,MAAMC,SAAiB,iBAAiB;IAGxC,MAAMC,WAAuC,yDAAgC;KAC3E;KACA,SAJsB,QAAQ,WAAW;KAKzC,SAAS;KACT,sDAA6B,eAAe,QAAQ,MAAM,IAAI;KAC/D,CAAC;AAGF,QAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAS;AAGxC,QACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAeC,6CAAyB,YACjD,SAAS,WACT;KACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;KAEtB,MAAMC,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;KACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,WAAM,KAAK,WAAW;MACpB,cAAc,SAAS;MACvB,YAAY;MACZ,YAAY;MACZ,UAAU,SAAS;MACnB,OAAO,iBAAiB;MACxB,YAAY;MACb,CAAC;AAEF,UAAK,mEAA0C,iBAA4B,CAAS;;AAGtF,WAAO;;AAGT,UAAQ,MAAM,MAAM,OAAO,GAAG,KAAK;IACnC;;CAGJ,MAAe,eAAe,SAAkD;AAC9E,QAAM,KAAK,kBAAkB;AAE7B,SAAO,MAAM,eAAe,QAA4C;;CAK1E,MAAe,OAAO,GAAG,MAAkC;AACzD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACpF,MAAMC,WAAgB,KAAK;EAC3B,MAAMC,UAAkB,QAAQ,WAAW;EAE3C,MAAMR,SAAiB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;EAEnF,MAAMS,WAAgB,yDAAgC;GACpD;GACA;GACA,SAAS,OAAO,aAAa,YAAY,cAAc,WAAW;IAAC,GAAG;IAAU,SAAS;IAAK,GAAG;GACjG,sDAA6B,eAAe,OAAO;GACpD,CAAC;AAGF,MAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAuC;AAGtE,MACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAeC,6CAAyB,YACjD,SAAS,WACT;GACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;GAEtB,MAAMP,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;GACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,SAAM,KAAK,WAAW;IACpB,cAAc,SAAS;IACvB,YAAY;IACZ,YAAY;IACZ,UAAU,SAAS;IACnB,OAAO,iBAAiB;IACxB,YAAY;IACb,CAAC;AAEF,QAAK,mEAA0C,iBAA4B,CAAS;;AAGtF,SAAO;;CAGT,MAAe,QAAQ,SAA6B;AAClD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEpF,8DAAmC;GACjC,SAAS,QAAQ;GACjB,SAAS;IAAC,GAAG;IAAS,SAAS;IAAK;GACpC,sDAA6B,eAAe,OAAO;GACpD,CAAC;;;;;;CAOJ,AAAQ,kCAAwC;AAC9C,MAAI,KAAK,eAAe,CACtB,OAAM,IAAIZ,0CACR,qGACA,sDACA,SACA,yCACD;;CAIL,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAM,QAAQ,eAA+D;AAC3E,SAAO,MAAM,YAAY,cAAe;;CAG1C,MAAM,WAAW,gBAAoE;AACnF,SAAO,MAAM,eAAe,eAAgB;;;AAIhD,mCAAe"}
+{"version":3,"file":"ThunderIDReactClient.cjs","names":["ThunderIDBrowserClient","config: ThunderIDReactConfig | undefined","isInitialized: boolean","ThunderIDRuntimeError","claims: User","arg1: any","arg2: any","authIdFromUrl: string","authIdFromStorage: string","authId: string","response: EmbeddedSignInFlowResponse","EmbeddedSignInFlowStatus","decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }","createdAt: number","expiresIn: number","config: ThunderIDReactConfig","firstArg: any","baseUrl: string","response: any","EmbeddedSignUpFlowStatus","decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }"],"sources":["../../src/ThunderIDReactClient.ts"],"sourcesContent":["// Copyright 2025-2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  ThunderIDBrowserClient,\n  UserProfile,\n  SignInOptions,\n  User,\n  SignUpOptions,\n  ThunderIDRuntimeError,\n  executeEmbeddedSignInFlow,\n  IdToken,\n  extractUserClaimsFromIdToken,\n  TokenResponse,\n  HttpRequestConfig,\n  HttpResponse,\n  TokenExchangeRequestConfig,\n  isEmpty,\n  EmbeddedSignInFlowResponse,\n  executeEmbeddedSignUpFlow,\n  executeEmbeddedRecoveryFlow,\n  EmbeddedSignInFlowStatus,\n  EmbeddedSignUpFlowResponse,\n  EmbeddedSignUpFlowStatus,\n  resolveResourceEndpoint,\n} from '@thunderid/browser';\nimport {ThunderIDReactConfig} from './models/config';\n\nclass ThunderIDReactClient<T extends ThunderIDReactConfig = ThunderIDReactConfig> extends ThunderIDBrowserClient<T> {\n  private loadingState = false;\n\n  private _initializeConfig: ThunderIDReactConfig | undefined;\n\n  constructor(instanceId = 0) {\n    super(instanceId);\n  }\n\n  private setLoading(loading: boolean): void {\n    this.loadingState = loading;\n  }\n\n  private async withLoading<TResult>(operation: () => Promise<TResult>): Promise<TResult> {\n    this.setLoading(true);\n    try {\n      const result: TResult = await operation();\n      return result;\n    } finally {\n      this.setLoading(false);\n    }\n  }\n\n  /**\n   * Returns the stored config, re-running initialization first when it has gone missing.\n   *\n   * NOTE: With React 19 strict mode, the initialization logic runs twice, and there's an intermittent\n   * issue where the config object is not getting stored in the storage layer with Vite scaffolding.\n   * An operation that resolves endpoints from a lost config fails (for example \"required endpoints\n   * are missing\"), so recover it from the config this client was initialized with.\n   */\n  private async ensureConfigData(): Promise<ThunderIDReactConfig | undefined> {\n    const config: ThunderIDReactConfig | undefined = (await this.getStorageManager().getConfigData()) as\n      | ThunderIDReactConfig\n      | undefined;\n    const isConfigLost: boolean =\n      !config || Object.keys(config).length === 0 || (Boolean(this._initializeConfig?.baseUrl) && !config.baseUrl);\n\n    if (!isConfigLost || !this._initializeConfig) {\n      return config;\n    }\n\n    await this.initialize(this._initializeConfig);\n\n    // Reload the config persisted by initialization so downstream endpoint resolution\n    // (baseUrl and the flowExecute override) uses the recovered values, not the stale empty config.\n    return (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig | undefined;\n  }\n\n  override initialize(config: ThunderIDReactConfig): Promise<boolean> {\n    return this.withLoading(async () => {\n      this._initializeConfig = {\n        ...config,\n        periodicTokenRefresh:\n          config?.tokenLifecycle?.refreshToken?.autoRefresh ?? (config as any)?.periodicTokenRefresh,\n      } as any;\n\n      return super.initialize(this._initializeConfig as unknown as T);\n    });\n  }\n\n  override reInitialize(config: Partial<ThunderIDReactConfig>): Promise<boolean> {\n    return this.withLoading(async () => {\n      let isInitialized: boolean;\n\n      try {\n        await super.reInitialize(config as Partial<T>);\n        isInitialized = true;\n      } catch (error) {\n        throw new ThunderIDRuntimeError(\n          `Failed to check if the client is initialized: ${error instanceof Error ? error.message : String(error)}`,\n          'ThunderIDReactClient-reInitialize-RuntimeError-001',\n          'react',\n          'An error occurred while checking the initialization status of the client.',\n        );\n      }\n\n      return isInitialized;\n    });\n  }\n\n  override async updateUserProfile(): Promise<User> {\n    throw new Error('Not implemented');\n  }\n\n  override async getUser(): Promise<User> {\n    return extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n  }\n\n  override async getDecodedIdToken(sessionId?: string): Promise<IdToken> {\n    return super.getDecodedIdToken(sessionId);\n  }\n\n  override async getIdToken(): Promise<string> {\n    return this.withLoading(async () => super.getIdToken());\n  }\n\n  override async getUserProfile(): Promise<UserProfile> {\n    return this.withLoading(async () => {\n      const claims: User = extractUserClaimsFromIdToken(await this.getDecodedIdToken());\n      return {\n        flattenedProfile: claims,\n        profile: claims,\n        schemas: [],\n      };\n    });\n  }\n\n  override isLoading(): boolean {\n    return this.loadingState || super.isLoading();\n  }\n\n  override async isSignedIn(): Promise<boolean> {\n    return super.isSignedIn();\n  }\n\n  override async exchangeToken(config: TokenExchangeRequestConfig): Promise<TokenResponse | Response> {\n    return this.withLoading(async () => super.exchangeToken(config) as unknown as TokenResponse | Response);\n  }\n\n  override async signIn(...args: any[]): Promise<User | EmbeddedSignInFlowResponse> {\n    return this.withLoading(async () => {\n      const arg1: any = args[0];\n      const arg2: any = args[1];\n\n      const config: ThunderIDReactConfig | undefined = await this.ensureConfigData();\n\n      if (typeof arg1 === 'object' && arg1 !== null && arg1.callOnlyOnRedirect === true) {\n        return undefined as any;\n      }\n\n      if (\n        typeof arg1 === 'object' &&\n        arg1 !== null &&\n        !isEmpty(arg1) &&\n        ('executionId' in arg1 || 'applicationId' in arg1)\n      ) {\n        this.rejectEmbeddedFlowInBackendMode();\n\n        const authIdFromUrl: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n        const authIdFromStorage: string =\n          (arg1.executionId ? await this.getStorageManager().getFlowAuthId(arg1.executionId) : undefined) ?? '';\n        const authId: string = authIdFromUrl || authIdFromStorage;\n        const baseUrl: string = config?.baseUrl ?? '';\n\n        const response: EmbeddedSignInFlowResponse = await executeEmbeddedSignInFlow({\n          authId,\n          baseUrl,\n          payload: arg1,\n          url: resolveResourceEndpoint('flowExecute', config, arg2?.url),\n        });\n\n        // A flow for an authorization request posts its SSO sessions to the callback instead.\n        if (!authId && response) {\n          await this.storeFlowSessions(response);\n        }\n\n        if (\n          response &&\n          typeof response === 'object' &&\n          response.flowStatus === EmbeddedSignInFlowStatus.Complete &&\n          response.assertion\n        ) {\n          const decodedAssertion: {\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          } = await this.decodeJwtToken<{\n            [key: string]: unknown;\n            exp?: number;\n            iat?: number;\n            scope?: string;\n          }>(response.assertion);\n\n          const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n          const expiresIn: number =\n            decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n          await this.setSession({\n            access_token: response.assertion,\n            created_at: createdAt,\n            expires_in: expiresIn,\n            id_token: response.assertion,\n            scope: decodedAssertion.scope,\n            token_type: 'Bearer',\n          });\n\n          this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n        }\n\n        return response;\n      }\n\n      return (await super.signIn(...args)) as unknown as User;\n    });\n  }\n\n  override async signInSilently(options?: SignInOptions): Promise<User | boolean> {\n    await this.ensureConfigData();\n\n    return super.signInSilently(options as Record<string, string | boolean>) as Promise<User | boolean>;\n  }\n\n  override async signUp(options?: SignUpOptions): Promise<void>;\n  override async signUp(payload: any): Promise<any>;\n  override async signUp(...args: any[]): Promise<void | any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n    const firstArg: any = args[0];\n    const baseUrl: string = config?.baseUrl ?? '';\n\n    const authId: string = new URL(window.location.href).searchParams.get('authId') ?? '';\n\n    const response: any = await executeEmbeddedSignUpFlow({\n      authId,\n      baseUrl,\n      payload: typeof firstArg === 'object' && 'flowType' in firstArg ? {...firstArg, verbose: true} : firstArg,\n      url: resolveResourceEndpoint('flowExecute', config),\n    });\n\n    // A flow for an authorization request posts its SSO sessions to the callback instead.\n    if (!authId && response) {\n      await this.storeFlowSessions(response as EmbeddedSignUpFlowResponse);\n    }\n\n    if (\n      response &&\n      typeof response === 'object' &&\n      response.flowStatus === EmbeddedSignUpFlowStatus.Complete &&\n      response.assertion\n    ) {\n      const decodedAssertion: {\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      } = await this.decodeJwtToken<{\n        [key: string]: unknown;\n        exp?: number;\n        iat?: number;\n        scope?: string;\n      }>(response.assertion);\n\n      const createdAt: number = decodedAssertion.iat ? decodedAssertion.iat * 1000 : Date.now();\n      const expiresIn: number =\n        decodedAssertion.exp && decodedAssertion.iat ? decodedAssertion.exp - decodedAssertion.iat : 3600;\n\n      await this.setSession({\n        access_token: response.assertion,\n        created_at: createdAt,\n        expires_in: expiresIn,\n        id_token: response.assertion,\n        scope: decodedAssertion.scope,\n        token_type: 'Bearer',\n      });\n\n      this.notifySignIn(extractUserClaimsFromIdToken(decodedAssertion as IdToken) as User);\n    }\n\n    return response;\n  }\n\n  override async recover(payload?: any): Promise<any> {\n    this.rejectEmbeddedFlowInBackendMode();\n\n    const config: ThunderIDReactConfig = (await this.getStorageManager().getConfigData()) as ThunderIDReactConfig;\n\n    return executeEmbeddedRecoveryFlow({\n      baseUrl: config?.baseUrl,\n      payload: {...payload, verbose: true},\n      url: resolveResourceEndpoint('flowExecute', config),\n    }) as any;\n  }\n\n  /**\n   * The embedded flows keep their result in the browser, which running sign-in on the backend rules\n   * out. Running them through the backend is not supported yet.\n   */\n  private rejectEmbeddedFlowInBackendMode(): void {\n    if (this.isBackendMode()) {\n      throw new ThunderIDRuntimeError(\n        'Embedded sign-in, sign-up, and recovery flows are not supported when sign-in runs on the backend.',\n        'ThunderIDReactClient-embeddedFlow-RuntimeError-001',\n        'react',\n        'Use redirect sign-in with the backend.',\n      );\n    }\n  }\n\n  public override getStorageManager(): any {\n    return super.getStorageManager();\n  }\n\n  async request(requestConfig?: HttpRequestConfig): Promise<HttpResponse<any>> {\n    return super.httpRequest(requestConfig!) as Promise<HttpResponse<any>>;\n  }\n\n  async requestAll(requestConfigs?: HttpRequestConfig[]): Promise<HttpResponse<any>[]> {\n    return super.httpRequestAll(requestConfigs!) as Promise<HttpResponse<any>[]>;\n  }\n}\n\nexport default ThunderIDReactClient;\n"],"mappings":";;;;;AA4BA,IAAM,uBAAN,cAA0FA,2CAA0B;CAClH,AAAQ,eAAe;CAEvB,AAAQ;CAER,YAAY,aAAa,GAAG;AAC1B,QAAM,WAAW;;CAGnB,AAAQ,WAAW,SAAwB;AACzC,OAAK,eAAe;;CAGtB,MAAc,YAAqB,WAAqD;AACtF,OAAK,WAAW,KAAK;AACrB,MAAI;AAEF,UADwB,MAAM,WAAW;YAEjC;AACR,QAAK,WAAW,MAAM;;;;;;;;;;;CAY1B,MAAc,mBAA8D;EAC1E,MAAMC,SAA4C,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAMhG,MAAI,EAFF,CAAC,UAAU,OAAO,KAAK,OAAO,CAAC,WAAW,KAAM,QAAQ,KAAK,mBAAmB,QAAQ,IAAI,CAAC,OAAO,YAEjF,CAAC,KAAK,kBACzB,QAAO;AAGT,QAAM,KAAK,WAAW,KAAK,kBAAkB;AAI7C,SAAQ,MAAM,KAAK,mBAAmB,CAAC,eAAe;;CAGxD,AAAS,WAAW,QAAgD;AAClE,SAAO,KAAK,YAAY,YAAY;AAClC,QAAK,oBAAoB;IACvB,GAAG;IACH,sBACE,QAAQ,gBAAgB,cAAc,eAAgB,QAAgB;IACzE;AAED,UAAO,MAAM,WAAW,KAAK,kBAAkC;IAC/D;;CAGJ,AAAS,aAAa,QAAyD;AAC7E,SAAO,KAAK,YAAY,YAAY;GAClC,IAAIC;AAEJ,OAAI;AACF,UAAM,MAAM,aAAa,OAAqB;AAC9C,oBAAgB;YACT,OAAO;AACd,UAAM,IAAIC,0CACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACvG,sDACA,SACA,4EACD;;AAGH,UAAO;IACP;;CAGJ,MAAe,oBAAmC;AAChD,QAAM,IAAI,MAAM,kBAAkB;;CAGpC,MAAe,UAAyB;AACtC,+DAAoC,MAAM,KAAK,mBAAmB,CAAC;;CAGrE,MAAe,kBAAkB,WAAsC;AACrE,SAAO,MAAM,kBAAkB,UAAU;;CAG3C,MAAe,aAA8B;AAC3C,SAAO,KAAK,YAAY,YAAY,MAAM,YAAY,CAAC;;CAGzD,MAAe,iBAAuC;AACpD,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,+DAA4C,MAAM,KAAK,mBAAmB,CAAC;AACjF,UAAO;IACL,kBAAkB;IAClB,SAAS;IACT,SAAS,EAAE;IACZ;IACD;;CAGJ,AAAS,YAAqB;AAC5B,SAAO,KAAK,gBAAgB,MAAM,WAAW;;CAG/C,MAAe,aAA+B;AAC5C,SAAO,MAAM,YAAY;;CAG3B,MAAe,cAAc,QAAuE;AAClG,SAAO,KAAK,YAAY,YAAY,MAAM,cAAc,OAAO,CAAwC;;CAGzG,MAAe,OAAO,GAAG,MAAyD;AAChF,SAAO,KAAK,YAAY,YAAY;GAClC,MAAMC,OAAY,KAAK;GACvB,MAAMC,OAAY,KAAK;GAEvB,MAAML,SAA2C,MAAM,KAAK,kBAAkB;AAE9E,OAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,KAAK,uBAAuB,KAC3E;AAGF,OACE,OAAO,SAAS,YAChB,SAAS,QACT,kCAAS,KAAK,KACb,iBAAiB,QAAQ,mBAAmB,OAC7C;AACA,SAAK,iCAAiC;IAEtC,MAAMM,gBAAwB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;IAC1F,MAAMC,qBACH,KAAK,cAAc,MAAM,KAAK,mBAAmB,CAAC,cAAc,KAAK,YAAY,GAAG,WAAc;IACrG,MAAMC,SAAiB,iBAAiB;IAGxC,MAAMC,WAAuC,yDAAgC;KAC3E;KACA,SAJsB,QAAQ,WAAW;KAKzC,SAAS;KACT,sDAA6B,eAAe,QAAQ,MAAM,IAAI;KAC/D,CAAC;AAGF,QAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAS;AAGxC,QACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAeC,6CAAyB,YACjD,SAAS,WACT;KACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;KAEtB,MAAMC,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;KACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,WAAM,KAAK,WAAW;MACpB,cAAc,SAAS;MACvB,YAAY;MACZ,YAAY;MACZ,UAAU,SAAS;MACnB,OAAO,iBAAiB;MACxB,YAAY;MACb,CAAC;AAEF,UAAK,mEAA0C,iBAA4B,CAAS;;AAGtF,WAAO;;AAGT,UAAQ,MAAM,MAAM,OAAO,GAAG,KAAK;IACnC;;CAGJ,MAAe,eAAe,SAAkD;AAC9E,QAAM,KAAK,kBAAkB;AAE7B,SAAO,MAAM,eAAe,QAA4C;;CAK1E,MAAe,OAAO,GAAG,MAAkC;AACzD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;EACpF,MAAMC,WAAgB,KAAK;EAC3B,MAAMC,UAAkB,QAAQ,WAAW;EAE3C,MAAMR,SAAiB,IAAI,IAAI,OAAO,SAAS,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI;EAEnF,MAAMS,WAAgB,yDAAgC;GACpD;GACA;GACA,SAAS,OAAO,aAAa,YAAY,cAAc,WAAW;IAAC,GAAG;IAAU,SAAS;IAAK,GAAG;GACjG,sDAA6B,eAAe,OAAO;GACpD,CAAC;AAGF,MAAI,CAAC,UAAU,SACb,OAAM,KAAK,kBAAkB,SAAuC;AAGtE,MACE,YACA,OAAO,aAAa,YACpB,SAAS,eAAeC,6CAAyB,YACjD,SAAS,WACT;GACA,MAAMC,mBAKF,MAAM,KAAK,eAKZ,SAAS,UAAU;GAEtB,MAAMP,YAAoB,iBAAiB,MAAM,iBAAiB,MAAM,MAAO,KAAK,KAAK;GACzF,MAAMC,YACJ,iBAAiB,OAAO,iBAAiB,MAAM,iBAAiB,MAAM,iBAAiB,MAAM;AAE/F,SAAM,KAAK,WAAW;IACpB,cAAc,SAAS;IACvB,YAAY;IACZ,YAAY;IACZ,UAAU,SAAS;IACnB,OAAO,iBAAiB;IACxB,YAAY;IACb,CAAC;AAEF,QAAK,mEAA0C,iBAA4B,CAAS;;AAGtF,SAAO;;CAGT,MAAe,QAAQ,SAA6B;AAClD,OAAK,iCAAiC;EAEtC,MAAMC,SAAgC,MAAM,KAAK,mBAAmB,CAAC,eAAe;AAEpF,8DAAmC;GACjC,SAAS,QAAQ;GACjB,SAAS;IAAC,GAAG;IAAS,SAAS;IAAK;GACpC,sDAA6B,eAAe,OAAO;GACpD,CAAC;;;;;;CAOJ,AAAQ,kCAAwC;AAC9C,MAAI,KAAK,eAAe,CACtB,OAAM,IAAIZ,0CACR,qGACA,sDACA,SACA,yCACD;;CAIL,AAAgB,oBAAyB;AACvC,SAAO,MAAM,mBAAmB;;CAGlC,MAAM,QAAQ,eAA+D;AAC3E,SAAO,MAAM,YAAY,cAAe;;CAG1C,MAAM,WAAW,gBAAoE;AACnF,SAAO,MAAM,eAAe,eAAgB;;;AAIhD,mCAAe"}

package/dist/cjs/components/auth/Callback/TokenCallback.cjs

@@ -82,7 +82,7 @@ const TokenCallback = ({ onNavigate, onError, onSuccess, signInPath = "/signin",
 				if (response.flowStatus === __thunderid_browser.EmbeddedSignInFlowStatus.Complete) {
 					const redirectUrl = response?.redirectUrl || response?.redirect_uri;
 					sessionStorage.removeItem(`${vendor}_execution_id`);
-					await storageManager.removeHybridDataParameter("authId");
+					await storageManager.removeFlowAuthId(executionId);
 					onSuccess?.({
 						redirectUrl,
 						...response.data || {}
@@ -97,7 +97,7 @@ const TokenCallback = ({ onNavigate, onError, onSuccess, signInPath = "/signin",
 				if (response.flowStatus === __thunderid_browser.EmbeddedSignInFlowStatus.Error) {
 					const failureReason = response?.failureReason;
 					const error = new Error(failureReason || "Token validation failed. Please try again.");
-					await storageManager.removeHybridDataParameter("authId");
+					await storageManager.removeFlowAuthId(executionId);
 					redirectWithError(error, isRegistrationFlow);
 					return;
 				}
@@ -109,7 +109,7 @@ const TokenCallback = ({ onNavigate, onError, onSuccess, signInPath = "/signin",
 				const error = err instanceof Error ? err : /* @__PURE__ */ new Error("Token callback processing failed");
 				console.error("Token callback error:", err);
 				const storageManager = await getStorageManager();
-				if (storageManager) await storageManager.removeHybridDataParameter("authId");
+				if (storageManager && executionId) await storageManager.removeFlowAuthId(executionId);
 				redirectWithError(error, isRegistrationFlow);
 			}
 		};

package/dist/cjs/components/auth/Callback/TokenCallback.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"TokenCallback.cjs","names":["TokenCallback: FC<TokenCallbackProps>","processingRef: any","useThunderID","url: URL","redirectUrlObj: URL","state: string","params: URLSearchParams","searchParams: URLSearchParams","executionId: string | null","token: string | null","applicationId: string | null","isRegistrationFlow: boolean","storageManager: any","response: any","EmbeddedSignInFlowType","redirectURL: string | undefined","nextExecutionId: string","nextExecutionId","EmbeddedSignInFlowStatus","redirectUrl: string | undefined","failureReason: string | undefined","error: Error"],"sources":["../../../../../src/components/auth/Callback/TokenCallback.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, navigate as browserNavigate} from '@thunderid/browser';\nimport {FC, useEffect, useRef} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\nexport interface TokenCallbackProps {\n  /**\n   * Callback function called when an error occurs\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Function to navigate to a different path.\n   * If not provided, falls back to the browser navigate utility (SPA navigation via History API for same-origin paths).\n   * Provide this prop to enable framework-specific navigation (e.g., from React Router).\n   */\n  onNavigate?: (path: string) => void;\n\n  /**\n   * Callback function called when authentication is successful\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Custom path for the sign-in page. Defaults to '/signin'\n   */\n  signInPath?: string;\n\n  /**\n   * Custom path for the sign-up page. Defaults to '/signup'\n   */\n  signUpPath?: string;\n}\n\nexport const TokenCallback: FC<TokenCallbackProps> = ({\n  onNavigate,\n  onError,\n  onSuccess,\n  signInPath = '/signin',\n  signUpPath = '/signup',\n}: TokenCallbackProps) => {\n  const processingRef: any = useRef(false);\n  const {isInitialized, isLoading, signIn, signUp, getStorageManager, vendor} = useThunderID();\n\n  const navigate = (path: string): void => {\n    if (onNavigate) {\n      onNavigate(path);\n    } else {\n      browserNavigate(path);\n    }\n  };\n\n  const clearTokenFromUrl = (): void => {\n    if (!window?.location?.href) {\n      return;\n    }\n\n    const url: URL = new URL(window.location.href);\n    url.searchParams.delete('token');\n    url.searchParams.delete('type');\n    window.history.replaceState({}, '', url.toString());\n  };\n\n  const initiateOAuthRedirect = (redirectURL: string, isRegistrationFlow?: boolean): void => {\n    const redirectUrlObj: URL = new URL(redirectURL);\n    const state: string = redirectUrlObj.searchParams.get('state') || crypto.randomUUID();\n\n    sessionStorage.setItem(\n      `${vendor}_oauth_${state}`,\n      JSON.stringify({\n        path: isRegistrationFlow ? signUpPath : signInPath,\n        timestamp: Date.now(),\n      }),\n    );\n\n    browserNavigate(redirectUrlObj.toString());\n  };\n\n  const buildSignInPath = (\n    executionId?: string | null,\n    applicationId?: string | null,\n    isRegistrationFlow?: boolean,\n  ): string => {\n    const params: URLSearchParams = new URLSearchParams();\n    if (executionId) {\n      params.set('executionId', executionId);\n    }\n    if (applicationId) {\n      params.set('applicationId', applicationId);\n    }\n\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    return params.toString() ? `${basePath}?${params.toString()}` : basePath;\n  };\n\n  const redirectWithError = (error: Error, isRegistrationFlow?: boolean): void => {\n    sessionStorage.removeItem(`${vendor}_execution_id`);\n\n    onError?.(error);\n\n    const params: URLSearchParams = new URLSearchParams();\n    params.set('error', 'token_verification_failed');\n    params.set('error_description', error.message);\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    navigate(`${basePath}?${params.toString()}`);\n  };\n\n  useEffect(() => {\n    if (!isInitialized || isLoading) {\n      return;\n    }\n\n    const processTokenCallback = async (): Promise<void> => {\n      if (processingRef.current) {\n        return;\n      }\n      processingRef.current = true;\n\n      // Read URL params before clearing them so they're accessible in both try and catch.\n      const searchParams: URLSearchParams = new URLSearchParams(window.location.search);\n      const executionId: string | null = searchParams.get('id') || searchParams.get('executionId');\n      const token: string | null = searchParams.get('token');\n      const applicationId: string | null = searchParams.get('applicationId');\n      const isRegistrationFlow: boolean = searchParams.get('type') === 'REGISTRATION';\n\n      clearTokenFromUrl();\n\n      try {\n        const storageManager: any = await getStorageManager();\n\n        if (!executionId || !token) {\n          const error: Error = new Error('Missing executionId or token in callback URL');\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        let response: any;\n\n        if (isRegistrationFlow) {\n          response = await signUp({executionId, inputs: {token}});\n        } else {\n          response = await signIn({executionId, inputs: {token}});\n        }\n\n        if (response.type === EmbeddedSignInFlowType.Redirection) {\n          const redirectURL: string | undefined = response.data?.redirectURL || response?.redirectURL;\n          const nextExecutionId: string = response.executionId || executionId;\n          sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n          if (redirectURL) {\n            initiateOAuthRedirect(redirectURL, isRegistrationFlow);\n            return;\n          }\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n          const redirectUrl: string | undefined = response?.redirectUrl || response?.redirect_uri;\n\n          sessionStorage.removeItem(`${vendor}_execution_id`);\n          await storageManager.removeHybridDataParameter('authId');\n\n          onSuccess?.({\n            redirectUrl,\n            ...((response.data as Record<string, any>) || {}),\n          });\n\n          if (redirectUrl) {\n            window.location.href = redirectUrl;\n            return;\n          }\n\n          navigate(isRegistrationFlow ? signUpPath : signInPath);\n          return;\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n          const failureReason: string | undefined = response?.failureReason;\n          const error: Error = new Error(failureReason || 'Token validation failed. Please try again.');\n          await storageManager.removeHybridDataParameter('authId');\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        const nextExecutionId: string = response.executionId || executionId;\n        sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n        if (response.challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', response.challengeToken);\n        }\n\n        navigate(buildSignInPath(nextExecutionId, applicationId, isRegistrationFlow));\n      } catch (err) {\n        const error: Error = err instanceof Error ? err : new Error('Token callback processing failed');\n        // eslint-disable-next-line no-console\n        console.error('Token callback error:', err);\n        const storageManager: any = await getStorageManager();\n        if (storageManager) {\n          await storageManager.removeHybridDataParameter('authId');\n        }\n        redirectWithError(error, isRegistrationFlow);\n      }\n    };\n\n    processTokenCallback();\n  }, [\n    getStorageManager,\n    isInitialized,\n    isLoading,\n    onError,\n    onNavigate,\n    onSuccess,\n    signIn,\n    signUp,\n    signInPath,\n    signUpPath,\n    vendor,\n  ]);\n\n  return null;\n};\n\nexport default TokenCallback;\n"],"mappings":";;;;;;;;AAoCA,MAAaA,iBAAyC,EACpD,YACA,SACA,WACA,aAAa,WACb,aAAa,gBACW;CACxB,MAAMC,kCAA4B,MAAM;CACxC,MAAM,EAAC,eAAe,WAAW,QAAQ,QAAQ,mBAAmB,WAAUC,8BAAc;CAE5F,MAAM,YAAY,SAAuB;AACvC,MAAI,WACF,YAAW,KAAK;MAEhB,mCAAgB,KAAK;;CAIzB,MAAM,0BAAgC;AACpC,MAAI,CAAC,QAAQ,UAAU,KACrB;EAGF,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,OAAO;AAC/B,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;CAGrD,MAAM,yBAAyB,aAAqB,uBAAuC;EACzF,MAAMC,iBAAsB,IAAI,IAAI,YAAY;EAChD,MAAMC,QAAgB,eAAe,aAAa,IAAI,QAAQ,IAAI,OAAO,YAAY;AAErF,iBAAe,QACb,GAAG,OAAO,SAAS,SACnB,KAAK,UAAU;GACb,MAAM,qBAAqB,aAAa;GACxC,WAAW,KAAK,KAAK;GACtB,CAAC,CACH;AAED,oCAAgB,eAAe,UAAU,CAAC;;CAG5C,MAAM,mBACJ,aACA,eACA,uBACW;EACX,MAAMC,SAA0B,IAAI,iBAAiB;AACrD,MAAI,YACF,QAAO,IAAI,eAAe,YAAY;AAExC,MAAI,cACF,QAAO,IAAI,iBAAiB,cAAc;EAG5C,MAAM,WAAW,qBAAqB,aAAa;AACnD,SAAO,OAAO,UAAU,GAAG,GAAG,SAAS,GAAG,OAAO,UAAU,KAAK;;CAGlE,MAAM,qBAAqB,OAAc,uBAAuC;AAC9E,iBAAe,WAAW,GAAG,OAAO,eAAe;AAEnD,YAAU,MAAM;EAEhB,MAAMA,SAA0B,IAAI,iBAAiB;AACrD,SAAO,IAAI,SAAS,4BAA4B;AAChD,SAAO,IAAI,qBAAqB,MAAM,QAAQ;AAE9C,WAAS,GADQ,qBAAqB,aAAa,WAC9B,GAAG,OAAO,UAAU,GAAG;;AAG9C,4BAAgB;AACd,MAAI,CAAC,iBAAiB,UACpB;EAGF,MAAM,uBAAuB,YAA2B;AACtD,OAAI,cAAc,QAChB;AAEF,iBAAc,UAAU;GAGxB,MAAMC,eAAgC,IAAI,gBAAgB,OAAO,SAAS,OAAO;GACjF,MAAMC,cAA6B,aAAa,IAAI,KAAK,IAAI,aAAa,IAAI,cAAc;GAC5F,MAAMC,QAAuB,aAAa,IAAI,QAAQ;GACtD,MAAMC,gBAA+B,aAAa,IAAI,gBAAgB;GACtE,MAAMC,qBAA8B,aAAa,IAAI,OAAO,KAAK;AAEjE,sBAAmB;AAEnB,OAAI;IACF,MAAMC,iBAAsB,MAAM,mBAAmB;AAErD,QAAI,CAAC,eAAe,CAAC,OAAO;AAE1B,uCADqB,IAAI,MAAM,+CAA+C,EACrD,mBAAmB;AAC5C;;IAGF,IAAIC;AAEJ,QAAI,mBACF,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;QAEvD,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;AAGzD,QAAI,SAAS,SAASC,2CAAuB,aAAa;KACxD,MAAMC,cAAkC,SAAS,MAAM,eAAe,UAAU;KAChF,MAAMC,oBAA0B,SAAS,eAAe;AACxD,oBAAe,QAAQ,GAAG,OAAO,gBAAgBC,kBAAgB;AAEjE,SAAI,aAAa;AACf,4BAAsB,aAAa,mBAAmB;AACtD;;;AAIJ,QAAI,SAAS,eAAeC,6CAAyB,UAAU;KAC7D,MAAMC,cAAkC,UAAU,eAAe,UAAU;AAE3E,oBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,WAAM,eAAe,0BAA0B,SAAS;AAExD,iBAAY;MACV;MACA,GAAK,SAAS,QAAgC,EAAE;MACjD,CAAC;AAEF,SAAI,aAAa;AACf,aAAO,SAAS,OAAO;AACvB;;AAGF,cAAS,qBAAqB,aAAa,WAAW;AACtD;;AAGF,QAAI,SAAS,eAAeD,6CAAyB,OAAO;KAC1D,MAAME,gBAAoC,UAAU;KACpD,MAAMC,QAAe,IAAI,MAAM,iBAAiB,6CAA6C;AAC7F,WAAM,eAAe,0BAA0B,SAAS;AACxD,uBAAkB,OAAO,mBAAmB;AAC5C;;IAGF,MAAML,kBAA0B,SAAS,eAAe;AACxD,mBAAe,QAAQ,GAAG,OAAO,gBAAgB,gBAAgB;AAEjE,QAAI,SAAS,eACX,OAAM,eAAe,0BAA0B,kBAAkB,SAAS,eAAe;AAG3F,aAAS,gBAAgB,iBAAiB,eAAe,mBAAmB,CAAC;YACtE,KAAK;IACZ,MAAMK,QAAe,eAAe,QAAQ,sBAAM,IAAI,MAAM,mCAAmC;AAE/F,YAAQ,MAAM,yBAAyB,IAAI;IAC3C,MAAMT,iBAAsB,MAAM,mBAAmB;AACrD,QAAI,eACF,OAAM,eAAe,0BAA0B,SAAS;AAE1D,sBAAkB,OAAO,mBAAmB;;;AAIhD,wBAAsB;IACrB;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,QAAO"}
+{"version":3,"file":"TokenCallback.cjs","names":["TokenCallback: FC<TokenCallbackProps>","processingRef: any","useThunderID","url: URL","redirectUrlObj: URL","state: string","params: URLSearchParams","searchParams: URLSearchParams","executionId: string | null","token: string | null","applicationId: string | null","isRegistrationFlow: boolean","storageManager: any","response: any","EmbeddedSignInFlowType","redirectURL: string | undefined","nextExecutionId: string","nextExecutionId","EmbeddedSignInFlowStatus","redirectUrl: string | undefined","failureReason: string | undefined","error: Error"],"sources":["../../../../../src/components/auth/Callback/TokenCallback.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {EmbeddedSignInFlowStatus, EmbeddedSignInFlowType, navigate as browserNavigate} from '@thunderid/browser';\nimport {FC, useEffect, useRef} from 'react';\nimport useThunderID from '../../../contexts/ThunderID/useThunderID';\n\nexport interface TokenCallbackProps {\n  /**\n   * Callback function called when an error occurs\n   */\n  onError?: (error: Error) => void;\n\n  /**\n   * Function to navigate to a different path.\n   * If not provided, falls back to the browser navigate utility (SPA navigation via History API for same-origin paths).\n   * Provide this prop to enable framework-specific navigation (e.g., from React Router).\n   */\n  onNavigate?: (path: string) => void;\n\n  /**\n   * Callback function called when authentication is successful\n   */\n  onSuccess?: (authData: Record<string, any>) => void;\n\n  /**\n   * Custom path for the sign-in page. Defaults to '/signin'\n   */\n  signInPath?: string;\n\n  /**\n   * Custom path for the sign-up page. Defaults to '/signup'\n   */\n  signUpPath?: string;\n}\n\nexport const TokenCallback: FC<TokenCallbackProps> = ({\n  onNavigate,\n  onError,\n  onSuccess,\n  signInPath = '/signin',\n  signUpPath = '/signup',\n}: TokenCallbackProps) => {\n  const processingRef: any = useRef(false);\n  const {isInitialized, isLoading, signIn, signUp, getStorageManager, vendor} = useThunderID();\n\n  const navigate = (path: string): void => {\n    if (onNavigate) {\n      onNavigate(path);\n    } else {\n      browserNavigate(path);\n    }\n  };\n\n  const clearTokenFromUrl = (): void => {\n    if (!window?.location?.href) {\n      return;\n    }\n\n    const url: URL = new URL(window.location.href);\n    url.searchParams.delete('token');\n    url.searchParams.delete('type');\n    window.history.replaceState({}, '', url.toString());\n  };\n\n  const initiateOAuthRedirect = (redirectURL: string, isRegistrationFlow?: boolean): void => {\n    const redirectUrlObj: URL = new URL(redirectURL);\n    const state: string = redirectUrlObj.searchParams.get('state') || crypto.randomUUID();\n\n    sessionStorage.setItem(\n      `${vendor}_oauth_${state}`,\n      JSON.stringify({\n        path: isRegistrationFlow ? signUpPath : signInPath,\n        timestamp: Date.now(),\n      }),\n    );\n\n    browserNavigate(redirectUrlObj.toString());\n  };\n\n  const buildSignInPath = (\n    executionId?: string | null,\n    applicationId?: string | null,\n    isRegistrationFlow?: boolean,\n  ): string => {\n    const params: URLSearchParams = new URLSearchParams();\n    if (executionId) {\n      params.set('executionId', executionId);\n    }\n    if (applicationId) {\n      params.set('applicationId', applicationId);\n    }\n\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    return params.toString() ? `${basePath}?${params.toString()}` : basePath;\n  };\n\n  const redirectWithError = (error: Error, isRegistrationFlow?: boolean): void => {\n    sessionStorage.removeItem(`${vendor}_execution_id`);\n\n    onError?.(error);\n\n    const params: URLSearchParams = new URLSearchParams();\n    params.set('error', 'token_verification_failed');\n    params.set('error_description', error.message);\n    const basePath = isRegistrationFlow ? signUpPath : signInPath;\n    navigate(`${basePath}?${params.toString()}`);\n  };\n\n  useEffect(() => {\n    if (!isInitialized || isLoading) {\n      return;\n    }\n\n    const processTokenCallback = async (): Promise<void> => {\n      if (processingRef.current) {\n        return;\n      }\n      processingRef.current = true;\n\n      // Read URL params before clearing them so they're accessible in both try and catch.\n      const searchParams: URLSearchParams = new URLSearchParams(window.location.search);\n      const executionId: string | null = searchParams.get('id') || searchParams.get('executionId');\n      const token: string | null = searchParams.get('token');\n      const applicationId: string | null = searchParams.get('applicationId');\n      const isRegistrationFlow: boolean = searchParams.get('type') === 'REGISTRATION';\n\n      clearTokenFromUrl();\n\n      try {\n        const storageManager: any = await getStorageManager();\n\n        if (!executionId || !token) {\n          const error: Error = new Error('Missing executionId or token in callback URL');\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        let response: any;\n\n        if (isRegistrationFlow) {\n          response = await signUp({executionId, inputs: {token}});\n        } else {\n          response = await signIn({executionId, inputs: {token}});\n        }\n\n        if (response.type === EmbeddedSignInFlowType.Redirection) {\n          const redirectURL: string | undefined = response.data?.redirectURL || response?.redirectURL;\n          const nextExecutionId: string = response.executionId || executionId;\n          sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n          if (redirectURL) {\n            initiateOAuthRedirect(redirectURL, isRegistrationFlow);\n            return;\n          }\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n          const redirectUrl: string | undefined = response?.redirectUrl || response?.redirect_uri;\n\n          sessionStorage.removeItem(`${vendor}_execution_id`);\n          await storageManager.removeFlowAuthId(executionId);\n\n          onSuccess?.({\n            redirectUrl,\n            ...((response.data as Record<string, any>) || {}),\n          });\n\n          if (redirectUrl) {\n            window.location.href = redirectUrl;\n            return;\n          }\n\n          navigate(isRegistrationFlow ? signUpPath : signInPath);\n          return;\n        }\n\n        if (response.flowStatus === EmbeddedSignInFlowStatus.Error) {\n          const failureReason: string | undefined = response?.failureReason;\n          const error: Error = new Error(failureReason || 'Token validation failed. Please try again.');\n          await storageManager.removeFlowAuthId(executionId);\n          redirectWithError(error, isRegistrationFlow);\n          return;\n        }\n\n        const nextExecutionId: string = response.executionId || executionId;\n        sessionStorage.setItem(`${vendor}_execution_id`, nextExecutionId);\n\n        if (response.challengeToken) {\n          await storageManager.setTemporaryDataParameter('challengeToken', response.challengeToken);\n        }\n\n        navigate(buildSignInPath(nextExecutionId, applicationId, isRegistrationFlow));\n      } catch (err) {\n        const error: Error = err instanceof Error ? err : new Error('Token callback processing failed');\n        // eslint-disable-next-line no-console\n        console.error('Token callback error:', err);\n        const storageManager: any = await getStorageManager();\n        if (storageManager && executionId) {\n          await storageManager.removeFlowAuthId(executionId);\n        }\n        redirectWithError(error, isRegistrationFlow);\n      }\n    };\n\n    processTokenCallback();\n  }, [\n    getStorageManager,\n    isInitialized,\n    isLoading,\n    onError,\n    onNavigate,\n    onSuccess,\n    signIn,\n    signUp,\n    signInPath,\n    signUpPath,\n    vendor,\n  ]);\n\n  return null;\n};\n\nexport default TokenCallback;\n"],"mappings":";;;;;;;;AAoCA,MAAaA,iBAAyC,EACpD,YACA,SACA,WACA,aAAa,WACb,aAAa,gBACW;CACxB,MAAMC,kCAA4B,MAAM;CACxC,MAAM,EAAC,eAAe,WAAW,QAAQ,QAAQ,mBAAmB,WAAUC,8BAAc;CAE5F,MAAM,YAAY,SAAuB;AACvC,MAAI,WACF,YAAW,KAAK;MAEhB,mCAAgB,KAAK;;CAIzB,MAAM,0BAAgC;AACpC,MAAI,CAAC,QAAQ,UAAU,KACrB;EAGF,MAAMC,MAAW,IAAI,IAAI,OAAO,SAAS,KAAK;AAC9C,MAAI,aAAa,OAAO,QAAQ;AAChC,MAAI,aAAa,OAAO,OAAO;AAC/B,SAAO,QAAQ,aAAa,EAAE,EAAE,IAAI,IAAI,UAAU,CAAC;;CAGrD,MAAM,yBAAyB,aAAqB,uBAAuC;EACzF,MAAMC,iBAAsB,IAAI,IAAI,YAAY;EAChD,MAAMC,QAAgB,eAAe,aAAa,IAAI,QAAQ,IAAI,OAAO,YAAY;AAErF,iBAAe,QACb,GAAG,OAAO,SAAS,SACnB,KAAK,UAAU;GACb,MAAM,qBAAqB,aAAa;GACxC,WAAW,KAAK,KAAK;GACtB,CAAC,CACH;AAED,oCAAgB,eAAe,UAAU,CAAC;;CAG5C,MAAM,mBACJ,aACA,eACA,uBACW;EACX,MAAMC,SAA0B,IAAI,iBAAiB;AACrD,MAAI,YACF,QAAO,IAAI,eAAe,YAAY;AAExC,MAAI,cACF,QAAO,IAAI,iBAAiB,cAAc;EAG5C,MAAM,WAAW,qBAAqB,aAAa;AACnD,SAAO,OAAO,UAAU,GAAG,GAAG,SAAS,GAAG,OAAO,UAAU,KAAK;;CAGlE,MAAM,qBAAqB,OAAc,uBAAuC;AAC9E,iBAAe,WAAW,GAAG,OAAO,eAAe;AAEnD,YAAU,MAAM;EAEhB,MAAMA,SAA0B,IAAI,iBAAiB;AACrD,SAAO,IAAI,SAAS,4BAA4B;AAChD,SAAO,IAAI,qBAAqB,MAAM,QAAQ;AAE9C,WAAS,GADQ,qBAAqB,aAAa,WAC9B,GAAG,OAAO,UAAU,GAAG;;AAG9C,4BAAgB;AACd,MAAI,CAAC,iBAAiB,UACpB;EAGF,MAAM,uBAAuB,YAA2B;AACtD,OAAI,cAAc,QAChB;AAEF,iBAAc,UAAU;GAGxB,MAAMC,eAAgC,IAAI,gBAAgB,OAAO,SAAS,OAAO;GACjF,MAAMC,cAA6B,aAAa,IAAI,KAAK,IAAI,aAAa,IAAI,cAAc;GAC5F,MAAMC,QAAuB,aAAa,IAAI,QAAQ;GACtD,MAAMC,gBAA+B,aAAa,IAAI,gBAAgB;GACtE,MAAMC,qBAA8B,aAAa,IAAI,OAAO,KAAK;AAEjE,sBAAmB;AAEnB,OAAI;IACF,MAAMC,iBAAsB,MAAM,mBAAmB;AAErD,QAAI,CAAC,eAAe,CAAC,OAAO;AAE1B,uCADqB,IAAI,MAAM,+CAA+C,EACrD,mBAAmB;AAC5C;;IAGF,IAAIC;AAEJ,QAAI,mBACF,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;QAEvD,YAAW,MAAM,OAAO;KAAC;KAAa,QAAQ,EAAC,OAAM;KAAC,CAAC;AAGzD,QAAI,SAAS,SAASC,2CAAuB,aAAa;KACxD,MAAMC,cAAkC,SAAS,MAAM,eAAe,UAAU;KAChF,MAAMC,oBAA0B,SAAS,eAAe;AACxD,oBAAe,QAAQ,GAAG,OAAO,gBAAgBC,kBAAgB;AAEjE,SAAI,aAAa;AACf,4BAAsB,aAAa,mBAAmB;AACtD;;;AAIJ,QAAI,SAAS,eAAeC,6CAAyB,UAAU;KAC7D,MAAMC,cAAkC,UAAU,eAAe,UAAU;AAE3E,oBAAe,WAAW,GAAG,OAAO,eAAe;AACnD,WAAM,eAAe,iBAAiB,YAAY;AAElD,iBAAY;MACV;MACA,GAAK,SAAS,QAAgC,EAAE;MACjD,CAAC;AAEF,SAAI,aAAa;AACf,aAAO,SAAS,OAAO;AACvB;;AAGF,cAAS,qBAAqB,aAAa,WAAW;AACtD;;AAGF,QAAI,SAAS,eAAeD,6CAAyB,OAAO;KAC1D,MAAME,gBAAoC,UAAU;KACpD,MAAMC,QAAe,IAAI,MAAM,iBAAiB,6CAA6C;AAC7F,WAAM,eAAe,iBAAiB,YAAY;AAClD,uBAAkB,OAAO,mBAAmB;AAC5C;;IAGF,MAAML,kBAA0B,SAAS,eAAe;AACxD,mBAAe,QAAQ,GAAG,OAAO,gBAAgB,gBAAgB;AAEjE,QAAI,SAAS,eACX,OAAM,eAAe,0BAA0B,kBAAkB,SAAS,eAAe;AAG3F,aAAS,gBAAgB,iBAAiB,eAAe,mBAAmB,CAAC;YACtE,KAAK;IACZ,MAAMK,QAAe,eAAe,QAAQ,sBAAM,IAAI,MAAM,mCAAmC;AAE/F,YAAQ,MAAM,yBAAyB,IAAI;IAC3C,MAAMT,iBAAsB,MAAM,mBAAmB;AACrD,QAAI,kBAAkB,YACpB,OAAM,eAAe,iBAAiB,YAAY;AAEpD,sBAAkB,OAAO,mBAAmB;;;AAIhD,wBAAsB;IACrB;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;AAEF,QAAO"}

package/dist/cjs/components/auth/SignIn/SignIn.cjs

@@ -161,16 +161,13 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 	* Clear all flow-related storage and state.
 	*/
 	const clearFlowState = async () => {
+		const executionIdToClear = currentExecutionId ?? sessionStorage.getItem(`${vendor}_execution_id`);
 		setExecutionId(null);
 		setComponents([]);
 		setAdditionalData({});
 		setIsFlowInitialized(false);
 		await setChallengeToken(null);
-		try {
-			await (await getStorageManager())?.removeHybridDataParameter?.("authId");
-		} catch {
-			__thunderid_browser.logger.warn("Failed to clear authId from hybrid storage.");
-		}
+		await clearAuthId(executionIdToClear);
 		setIsTimeoutDisabled(false);
 		oauthCodeProcessedRef.current = false;
 	};
@@ -191,18 +188,29 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 		};
 	};
 	/**
-	* Handle authId from URL and persist it via the storage manager so it survives URL cleanup.
-	* ThunderIDReactClient.signIn() reads authId from storageManager.getHybridDataParameter('authId'),
-	* not from raw sessionStorage, so we must use the same storage path here.
+	* Persist the authId from the URL against its execution so it survives URL cleanup.
+	* ThunderIDReactClient.signIn() reads it back with storageManager.getFlowAuthId(executionId),
+	* so another tab's sign-in cannot replace it.
 	*/
-	const handleAuthId = async (authId) => {
-		if (authId) try {
-			await (await getStorageManager())?.setHybridDataParameter?.("authId", authId);
+	const handleAuthId = async (authId, executionId) => {
+		if (authId && executionId) try {
+			await (await getStorageManager())?.setFlowAuthId?.(executionId, authId);
 		} catch {
 			__thunderid_browser.logger.warn("Failed to store authId in hybrid storage.");
 		}
 	};
 	/**
+	* Remove the authId stored for an execution, leaving other tabs' entries in place.
+	*/
+	const clearAuthId = async (executionId) => {
+		if (!executionId) return;
+		try {
+			await (await getStorageManager())?.removeFlowAuthId?.(executionId);
+		} catch {
+			__thunderid_browser.logger.warn("Failed to clear authId from hybrid storage.");
+		}
+	};
+	/**
 	* Clean up OAuth-related URL parameters from the browser URL.
 	*/
 	const cleanupOAuthUrlParams = (includeNonce = false) => {
@@ -254,7 +262,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 			if (redirectURL && window?.location) {
 				if (response.executionId) setExecutionId(response.executionId);
 				await setChallengeToken(response.challengeToken ?? null);
-				await handleAuthId(getUrlParams().authId);
+				await handleAuthId(getUrlParams().authId, response.executionId);
 				require_oauth.initiateOAuthRedirect(redirectURL, vendor);
 				return true;
 			}
@@ -291,15 +299,12 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 		if (response.flowStatus === __thunderid_browser.EmbeddedSignInFlowStatus.Complete) {
 			const finalRedirectUrl = response?.redirectUrl || response?.redirect_uri || afterSignInUrl;
 			setIsSubmitting(false);
+			const completedExecutionId = response.executionId || currentExecutionId || sessionStorage.getItem(`${vendor}_execution_id`);
 			setExecutionId(null);
 			await setChallengeToken(null);
 			setIsFlowInitialized(false);
 			sessionStorage.removeItem(`${vendor}_execution_id`);
-			try {
-				await (await getStorageManager())?.removeHybridDataParameter?.("authId");
-			} catch {
-				__thunderid_browser.logger.warn("Failed to clear authId from hybrid storage after completion.");
-			}
+			await clearAuthId(completedExecutionId);
 			cleanupOAuthUrlParams(true);
 			if (onSuccess) onSuccess({
 				redirectUrl: finalRedirectUrl,
@@ -318,7 +323,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 		const urlParams = getUrlParams();
 		oauthCodeProcessedRef.current = false;
 		setServerFieldErrors(null);
-		await handleAuthId(urlParams.authId);
+		await handleAuthId(urlParams.authId, urlParams.executionId);
 		const effectiveApplicationId = applicationId || urlParams.applicationId;
 		const storedExecutionId = !urlParams.executionId ? sessionStorage.getItem(`${vendor}_execution_id`) : null;
 		const resumeExecutionId = urlParams.executionId || storedExecutionId;
@@ -337,11 +342,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 			} catch (resumeError) {
 				if (storedExecutionId && resumeExecutionId === storedExecutionId && resumeError instanceof __thunderid_browser.ThunderIDAPIError && resumeError.statusCode === 400) {
 					setExecutionId(null);
-					try {
-						await (await getStorageManager())?.removeHybridDataParameter?.("authId");
-					} catch {
-						__thunderid_browser.logger.warn("Failed to clear authId from hybrid storage.");
-					}
+					await clearAuthId(resumeExecutionId);
 					if (!effectiveApplicationId) {
 						const expiredError = (translate) => new __thunderid_browser.ThunderIDRuntimeError(translate("errors.signin.session.expired") || "Your session has expired. Please return to the application and sign in again.", "SIGN_IN_ERROR", "react");
 						setError(expiredError);
@@ -374,6 +375,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 				setAdditionalData(normalizedAdditionalData ?? {});
 				setIsFlowInitialized(true);
 				setIsTimeoutDisabled(false);
+				await handleAuthId(urlParams.authId, normalizedExecutionId);
 				cleanupFlowUrlParams();
 			}
 		} catch (error) {
@@ -392,7 +394,7 @@ const SignIn = ({ className, preferences, size = "medium", onSuccess, onError, v
 			handleOAuthError(urlParams.error, urlParams.errorDescription);
 			return;
 		}
-		handleAuthId(urlParams.authId);
+		handleAuthId(urlParams.authId, urlParams.executionId);
 	}, []);
 	(0, react.useEffect)(() => {
 		const currentUrlParams = getUrlParams();