Attempt SSO using the new hook method

.changeset/dynamic-flow-factor-resolution.md

@@ -0,0 +1,5 @@
+---
+"@slashid/react": patch
+---
+
+Tell the user when `<DynamicFlow>` cannot resolve any factor, always offer a way back to the identifier step, and keep an in-flight `getFactors` result when the parent re-renders

.changeset/dynamic-flow-sso-middleware.md

@@ -0,0 +1,5 @@
+---
+"@slashid/react": patch
+---
+
+Apply `middleware` to the SSO provider buttons in `<DynamicFlow>`

.changeset/one-step-sso-hook.md

@@ -0,0 +1,5 @@
+---
+"@slashid/react": minor
+---
+
+Add the internal `attemptSSO` prop to `<DynamicFlow>` for one-step SSO. Requires `@slashid/slashid` 3.30.0 or later.

.changeset/release-flow-subscriptions.md

@@ -0,0 +1,5 @@
+---
+"@slashid/react": patch
+---
+
+Keep the authenticating step's challenge listener alive across React StrictMode re-runs, release it on unmount, and fix the inverted observer filter in the login flows

packages/demo-form/package.json

@@ -17,7 +17,7 @@
   "dependencies": {
     "@radix-ui/react-dropdown-menu": "^0.1.6",
     "@slashid/react": "workspace:*",
-    "@slashid/slashid": "3.25.0",
+    "@slashid/slashid": "3.30.0",
     "next": "13.0.2",
     "react": "18.2.0",
     "react-dom": "18.2.0",

packages/react-primitives/package.json

@@ -76,7 +76,7 @@
   },
   "devDependencies": {
     "@faker-js/faker": "^8.0.2",
-    "@slashid/slashid": "3.29.0",
+    "@slashid/slashid": "3.30.0",
     "@storybook/addon-essentials": "7.6.19",
     "@storybook/addon-interactions": "7.4.0",
     "@storybook/addon-links": "7.4.0",

packages/react/README.md

@@ -73,3 +73,23 @@ function App() {
 ```
 
 Once the `logIn` function resolves, your component will render again with the newly logged-in `user` object.
+
+### DynamicFlow
+
+`DynamicFlow` asks for an identifier first and then picks the factors to offer from the `getFactors` callback.
+
+`getFactors` decides what happens next:
+
+- Two or more factors show the picker.
+- A single factor is submitted directly, skipping the picker.
+- An empty array means there is no way to sign this person in. The user is told so and sent back to the identifier step.
+
+If `getFactors` throws, the user is shown a generic error with a retry button that calls it again with the same identifier. The rejection itself is not forwarded — catch it inside `getFactors` if you need to report or log it.
+
+#### One-step SSO (`attemptSSO`)
+
+```tsx
+<DynamicFlow attemptSSO getFactors={() => [{ method: "email_link" }, { method: "password" }]} />
+```
+
+With `attemptSSO`, `DynamicFlow` submits the `hook` factor right after the identifier step for email identifiers. The organization's `identify_user` webhook picks the factor (for example a SAML or OIDC provider), and the flow continues with it. When nothing is resolved, `getFactors` is called with the same identifier as usual: a single factor is submitted directly, otherwise the picker is shown. Other identifier types never attempt SSO.

packages/react/package.json

@@ -60,7 +60,7 @@
   },
   "devDependencies": {
     "@faker-js/faker": "^8.0.2",
-    "@slashid/slashid": "3.29.6",
+    "@slashid/slashid": "3.30.0",
     "@storybook/addon-essentials": "7.6.19",
     "@storybook/addon-interactions": "7.4.0",
     "@storybook/addon-links": "7.4.0",
@@ -95,7 +95,7 @@
     "yalc": "1.0.0-pre.53"
   },
   "peerDependencies": {
-    "@slashid/slashid": ">= 3.29.6",
+    "@slashid/slashid": ">= 3.30.0",
     "react": ">=16",
     "react-dom": ">=16"
   }