@captello/ulc-webview-sdk 0.1.0 → 0.3.0

package/README.md

@@ -11,8 +11,9 @@ It provides:
 2. **`CaptelloWebview`** — a host-side client that wraps an `<iframe>` and handles
    the send/receive wire details (JSON-string encoding, origin/source filtering).
 3. **`buildEmbedUrl`** — a typed builder for the webview's query-string contract.
-4. **Submission rendering** — `toDisplayPairs` / `parseVisibleSubmissionsData` to turn a
-   submission's `visible_submissions_data` into typed key/value rows.
+4. **Typed submission data** — `VisibleSubmissionDataItem` and friends type a
+   submission's `visible_submissions_data` as a discriminated union you narrow on
+   `element_type` to render however you like.
 5. **Promise helpers** (`@captello/ulc-webview-sdk/promises`) — one-shot `await`-style
    utilities like `submitForm(iframe)` and `waitForFormLoad(iframe)`.
 6. **React adapter** (`@captello/ulc-webview-sdk/react`) — a `useCaptelloWebview` hook that
@@ -33,18 +34,19 @@ pnpm add @captello/ulc-webview-sdk
 import {
     CaptelloWebview,
     buildEmbedUrl,
-    targetOriginFromUrl,
     FormMode,
+    Language,
     LauncherType,
     OutboundMessageType,
 } from "@captello/ulc-webview-sdk";
 
-// 1. Build the embed URL.
-const src = buildEmbedUrl("https://capture.captello.com/", {
+// 1. Build the embed URL. Pass just the capture origin — the SDK appends the
+//    capture path for you (passing the full ".../capture/submission" URL also works).
+const src = buildEmbedUrl("https://capture.captello.com", {
     formId: 1234,
     mode: FormMode.Submit,
     launcher: LauncherType.EventGenWeb,
-    language: "en",
+    language: Language.English,
 });
 
 // 2. Point an iframe at it.
@@ -54,7 +56,7 @@ document.body.appendChild(iframe);
 
 // 3. Wire up the client (scope messages to the webview's origin).
 const webview = new CaptelloWebview(iframe, {
-    targetOrigin: targetOriginFromUrl(src),
+    targetOrigin: new URL(src).origin,
 });
 
 webview.on(OutboundMessageType.FormLoadComplete, () => {
@@ -124,7 +126,7 @@ function UlcForm({
 }) {
     const { iframeProps, isReady, submit, prefillInfo } = useCaptelloWebview({
         embedUrl: {
-            baseUrl: "https://capture.captello.com/capture/submission",
+            baseUrl: "https://capture.captello.com",
             eventWebAccessToken,
             actionButtonPosition: ActionButtonPosition.Hidden, // b=2
             mode: FormMode.Submit,
@@ -148,7 +150,7 @@ What the hook handles for you:
 
 - **URL + origin.** Pass `embedUrl: { baseUrl, ...EmbedUrlOptions }` and the hook builds
   the URL, derives `targetOrigin`, and returns it as `iframeProps.src` — no separate
-  `buildEmbedUrl` / `targetOriginFromUrl` / manual `src` wiring to keep in sync. (Prefer
+  `buildEmbedUrl` / manual `src` wiring to keep in sync. (Prefer
   to own the `src`? Omit `embedUrl`, pass `targetOrigin`, and use the returned `ref`.)
 - **Readiness.** `isReady` and `status` (`"loading" | "ready" | "error"`) — no manual
   `useState` + `onFormLoadComplete` for a spinner.
@@ -217,50 +219,59 @@ point of view.
   `ll_field_id` is optional metadata (number or string) and `value` may be a string or boolean.
 - `PrefillDataType.UlcSubmissionAndInfo` → `prefillSubmissionAndInfo({ submission, info })`.
 
-## Rendering a submission as key/value pairs
+## Rendering a submission
 
 A `submission_body` payload includes `visible_submissions_data` — one entry per filled,
-visible element, discriminated by `element_type` (so `element_value`'s shape depends on
-the type: strings, string arrays, composites like name/address, order quantities, etc.).
-
-To turn that into rows for the UI, use `toDisplayPairs` (parse + flatten in one call):
+visible element, typed as `VisibleSubmissionDataItem[]` and discriminated by
+`element_type`. Narrow on `element_type` and `element_value` is precisely typed (string,
+string array, composite name/address, order quantities, etc.), so you render it exactly
+how your UI needs — no flattening helper to fight:
 
 ```ts
-import { toDisplayPairs, OutboundMessageType } from "@captello/ulc-webview-sdk";
+import { FormElementType, OutboundMessageType } from "@captello/ulc-webview-sdk";
 
 webview.on(OutboundMessageType.SubmissionBody, (msg) => {
-    const rows = toDisplayPairs(msg.data);
-    // rows: { elementId: string; label: string; value: string }[]
-    rows.forEach((r) => addRow(r.label, r.value));
-});
-```
-
-`toDisplayPairs` (and the lower-level `parseVisibleSubmissionsData`) accept `unknown` —
-pass the whole `submission_body` data, the `visible_submissions_data` array itself, or
-any value; entries that don't match the contract (structural/unknown types, missing
-fields) are dropped, so the result is always safe to map over.
-
-For custom rendering, parse to typed items and narrow on `element_type`:
-
-```ts
-import { parseVisibleSubmissionsData, FormElementType } from "@captello/ulc-webview-sdk";
-
-for (const item of parseVisibleSubmissionsData(msg.data)) {
-    if (item.element_type === FormElementType.checkbox) {
-        item.element_value; // string[] | OrderCheckboxSubmissionData — precisely typed
+    for (const item of msg.data.visible_submissions_data ?? []) {
+        switch (item.element_type) {
+            case FormElementType.email:
+                addRow(item.element_title, item.element_value); // element_value: string
+                break;
+            case FormElementType.checkbox:
+                // element_value: string[] | OrderCheckboxSubmissionData
+                addRow(item.element_title, renderChoices(item.element_value));
+                break;
+            case FormElementType.simple_name:
+                // element_value: CompositeSubmissionValue (sub-field id → string)
+                addRow(item.element_title, Object.values(item.element_value).join(" "));
+                break;
+            // …other element types
+        }
     }
-}
+});
 ```
 
-`toDisplayValue(item, options?)` flattens one item; `options` accepts `listSeparator`
-(default `", "`), `booleanLabels` (default `{ true: "Yes", false: "No" }`), and
-`emptyText` (default `""`).
+Because `visible_submissions_data` is already typed, there's no parse/validate step in
+the SDK — read it straight off the message. The `submission_body` data is `unknown`-safe
+at the boundary (`SubmissionBody.data` is `Record<string, unknown>`), so cast or validate
+to taste if you consume untrusted sources.
 
 ## `buildEmbedUrl(baseUrl, options)`
 
 Maps friendly option names onto the webview's short query keys. Existing params on
 `baseUrl` are preserved; options override matching keys.
 
+**You only pass the capture origin** (e.g. `https://capture.captello.com`) — the SDK owns
+the capture path. The origin, the origin with a trailing slash, and the full
+`…/capture/submission` URL all normalize to the same result, so there's nothing to get
+wrong. An existing `…/capture/activation` route is preserved rather than rewritten.
+
+```ts
+buildEmbedUrl("https://capture.captello.com", { formId: 1234 });
+buildEmbedUrl("https://capture.captello.com/", { formId: 1234 });
+buildEmbedUrl("https://capture.captello.com/capture/submission", { formId: 1234 });
+// → all produce "https://capture.captello.com/capture/submission?f=1234"
+```
+
 | Option                      | Query key   | Notes                                                                             |
 | --------------------------- | ----------- | --------------------------------------------------------------------------------- |
 | `formId`                    | `f`         |                                                                                   |
@@ -314,8 +325,8 @@ one-shot `/promises` helpers set `queueUntilReady: false` automatically.
 
 Always set `targetOrigin` to the webview's origin in production. With the default
 `"*"`, the client accepts messages from any origin and posts without an origin check —
-acceptable only for trusted/local development. `targetOriginFromUrl(embedUrl)` derives
-it from the URL you built.
+acceptable only for trusted/local development. Derive it from the URL you built with
+`new URL(src).origin`.
 
 ## Promise helpers — `@captello/ulc-webview-sdk/promises`
 
@@ -373,13 +384,13 @@ calls. Replace them as follows.
 // before
 const src = `${base}/capture/submission?e=${token}&b=2&m=submit&launcher=event_gen_web` + (code ? `&l=${code}` : "");
 
-// after
-const src = buildEmbedUrl(`${base}/capture/submission`, {
+// after — pass the origin; the SDK appends the capture path
+const src = buildEmbedUrl(base, {
     eventWebAccessToken: token,
     actionButtonPosition: ActionButtonPosition.Hidden,
     mode: FormMode.Submit,
     launcher: LauncherType.EventGenWeb,
-    language: code || undefined,
+    language: code as Language | undefined,
 });
 ```
 
@@ -415,7 +426,7 @@ contract — keep that code; this SDK only models host ↔ capture-webview messa
 
 ```bash
 pnpm install   # from the repo root (pnpm workspace) or this package
-pnpm build     # bundle ESM + CJS + .d.ts into dist/
+pnpm build     # bundle ESM + .d.ts into dist/
 pnpm typecheck
 ```
 

package/dist/{chunk-ETF52K7K.js → chunk-4E7OW4RJ.js}

@@ -39,6 +39,20 @@ var ActionButtonPosition = /* @__PURE__ */ ((ActionButtonPosition2) => {
   ActionButtonPosition2["Hidden"] = "2";
   return ActionButtonPosition2;
 })(ActionButtonPosition || {});
+var Language = /* @__PURE__ */ ((Language2) => {
+  Language2["Arabic"] = "ar";
+  Language2["German"] = "de";
+  Language2["English"] = "en";
+  Language2["Spanish"] = "es";
+  Language2["French"] = "fr";
+  Language2["Italian"] = "it";
+  Language2["Japanese"] = "ja";
+  Language2["Korean"] = "ko";
+  Language2["Dutch"] = "nl";
+  Language2["Portuguese"] = "pt";
+  Language2["Chinese"] = "zh";
+  return Language2;
+})(Language || {});
 var OPTION_TO_PARAM = [
   ["formId", "f" /* FormId */],
   ["submissionToken", "s" /* SubmissionToken */],
@@ -60,8 +74,20 @@ var BOOLEAN_OPTION_TO_PARAM = [
   ["connexionsEmbedMode", "cem" /* ConnexionsEmbedMode */],
   ["emro", "emro" /* Emro */]
 ];
-function buildEmbedUrl(baseUrl, options = {}) {
+var CAPTURE_SUBMISSION_PATH = "/capture/submission";
+var CAPTURE_PATH_PATTERN = /\/capture\/(submission|activation)\/?$/;
+function normalizeCaptureUrl(baseUrl) {
   const url = new URL(baseUrl);
+  if (CAPTURE_PATH_PATTERN.test(url.pathname)) {
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    return url;
+  }
+  const base = url.pathname.replace(/\/+$/, "");
+  url.pathname = `${base}${CAPTURE_SUBMISSION_PATH}`;
+  return url;
+}
+function buildEmbedUrl(baseUrl, options = {}) {
+  const url = normalizeCaptureUrl(baseUrl);
   for (const [optionKey, paramKey] of OPTION_TO_PARAM) {
     const value = options[optionKey];
     if (value !== void 0 && value !== null && value !== "") {
@@ -82,10 +108,7 @@ function buildEmbedUrl(baseUrl, options = {}) {
   }
   return url.toString();
 }
-function targetOriginFromUrl(embedUrl) {
-  return new URL(embedUrl).origin;
-}
 
-export { ActionButtonPosition, EmbedParam, FormMode, LauncherType, buildEmbedUrl, targetOriginFromUrl };
-//# sourceMappingURL=chunk-ETF52K7K.js.map
-//# sourceMappingURL=chunk-ETF52K7K.js.map
+export { ActionButtonPosition, EmbedParam, FormMode, Language, LauncherType, buildEmbedUrl };
+//# sourceMappingURL=chunk-4E7OW4RJ.js.map
+//# sourceMappingURL=chunk-4E7OW4RJ.js.map

package/dist/chunk-4E7OW4RJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/embed-url.ts"],"names":["EmbedParam","FormMode","LauncherType","ActionButtonPosition","Language"],"mappings":";AAUO,IAAK,UAAA,qBAAAA,WAAAA,KAAL;AACH,EAAAA,YAAA,QAAA,CAAA,GAAS,GAAA;AACT,EAAAA,YAAA,iBAAA,CAAA,GAAkB,GAAA;AAClB,EAAAA,YAAA,WAAA,CAAA,GAAY,IAAA;AACZ,EAAAA,YAAA,MAAA,CAAA,GAAO,GAAA;AACP,EAAAA,YAAA,qBAAA,CAAA,GAAsB,GAAA;AACtB,EAAAA,YAAA,cAAA,CAAA,GAAe,GAAA;AACf,EAAAA,YAAA,UAAA,CAAA,GAAW,GAAA;AACX,EAAAA,YAAA,sBAAA,CAAA,GAAuB,GAAA;AACvB,EAAAA,YAAA,UAAA,CAAA,GAAW,WAAA;AACX,EAAAA,YAAA,UAAA,CAAA,GAAW,UAAA;AACX,EAAAA,YAAA,gBAAA,CAAA,GAAiB,GAAA;AACjB,EAAAA,YAAA,2BAAA,CAAA,GAA4B,MAAA;AAC5B,EAAAA,YAAA,UAAA,CAAA,GAAW,UAAA;AACX,EAAAA,YAAA,WAAA,CAAA,GAAY,IAAA;AACZ,EAAAA,YAAA,qBAAA,CAAA,GAAsB,KAAA;AAEtB,EAAAA,YAAA,MAAA,CAAA,GAAO,MAAA;AAEP,EAAAA,YAAA,OAAA,CAAA,GAAQ,OAAA;AAnBA,EAAA,OAAAA,WAAAA;AAAA,CAAA,EAAA,UAAA,IAAA,EAAA;AAuBL,IAAK,QAAA,qBAAAC,SAAAA,KAAL;AACH,EAAAA,UAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,UAAA,QAAA,CAAA,GAAS,QAAA;AACT,EAAAA,UAAA,MAAA,CAAA,GAAO,MAAA;AACP,EAAAA,UAAA,MAAA,CAAA,GAAO,MAAA;AAJC,EAAA,OAAAA,SAAAA;AAAA,CAAA,EAAA,QAAA,IAAA,EAAA;AAQL,IAAK,YAAA,qBAAAC,aAAAA,KAAL;AACH,EAAAA,cAAA,gBAAA,CAAA,GAAiB,kBAAA;AACjB,EAAAA,cAAA,aAAA,CAAA,GAAc,eAAA;AACd,EAAAA,cAAA,QAAA,CAAA,GAAS,QAAA;AACT,EAAAA,cAAA,KAAA,CAAA,GAAM,KAAA;AAJE,EAAA,OAAAA,aAAAA;AAAA,CAAA,EAAA,YAAA,IAAA,EAAA;AAkBL,IAAK,oBAAA,qBAAAC,qBAAAA,KAAL;AACH,EAAAA,sBAAA,OAAA,CAAA,GAAQ,GAAA;AACR,EAAAA,sBAAA,QAAA,CAAA,GAAS,GAAA;AACT,EAAAA,sBAAA,QAAA,CAAA,GAAS,GAAA;AAHD,EAAA,OAAAA,qBAAAA;AAAA,CAAA,EAAA,oBAAA,IAAA,EAAA;AAOL,IAAK,QAAA,qBAAAC,SAAAA,KAAL;AACH,EAAAA,UAAA,QAAA,CAAA,GAAS,IAAA;AACT,EAAAA,UAAA,QAAA,CAAA,GAAS,IAAA;AACT,EAAAA,UAAA,SAAA,CAAA,GAAU,IAAA;AACV,EAAAA,UAAA,SAAA,CAAA,GAAU,IAAA;AACV,EAAAA,UAAA,QAAA,CAAA,GAAS,IAAA;AACT,EAAAA,UAAA,SAAA,CAAA,GAAU,IAAA;AACV,EAAAA,UAAA,UAAA,CAAA,GAAW,IAAA;AACX,EAAAA,UAAA,QAAA,CAAA,GAAS,IAAA;AACT,EAAAA,UAAA,OAAA,CAAA,GAAQ,IAAA;AACR,EAAAA,UAAA,YAAA,CAAA,GAAa,IAAA;AACb,EAAAA,UAAA,SAAA,CAAA,GAAU,IAAA;AAXF,EAAA,OAAAA,SAAAA;AAAA,CAAA,EAAA,QAAA,IAAA,EAAA;AAoDZ,IAAM,eAAA,GAAsE;AAAA,EACxE,CAAC,UAAU,GAAA,cAAiB;AAAA,EAC5B,CAAC,mBAAmB,GAAA,uBAA0B;AAAA,EAC9C,CAAC,aAAa,IAAA,iBAAoB;AAAA,EAClC,CAAC,QAAQ,GAAA,YAAe;AAAA,EACxB,CAAC,uBAAuB,GAAA,2BAA8B;AAAA,EACtD,CAAC,gBAAgB,GAAA,oBAAuB;AAAA,EACxC,CAAC,YAAY,GAAA,gBAAmB;AAAA,EAChC,CAAC,wBAAwB,GAAA,4BAA+B;AAAA,EACxD,CAAC,YAAY,WAAA,gBAAmB;AAAA,EAChC,CAAC,YAAY,UAAA,gBAAmB;AAAA,EAChC,CAAC,kBAAkB,GAAA,sBAAyB;AAAA,EAC5C,CAAC,6BAA6B,MAAA,iCAAoC;AAAA,EAClE,CAAC,SAAS,OAAA,aAAgB;AAAA,EAC1B,CAAC,YAAY,UAAA;AACjB,CAAA;AAIA,IAAM,uBAAA,GAA8E;AAAA,EAChF,CAAC,aAAa,IAAA,iBAAoB;AAAA,EAClC,CAAC,uBAAuB,KAAA,2BAA8B;AAAA,EACtD,CAAC,QAAQ,MAAA;AACb,CAAA;AAGO,IAAM,uBAAA,GAA0B,qBAAA;AAKvC,IAAM,oBAAA,GAAuB,wCAAA;AAgB7B,SAAS,oBAAoB,OAAA,EAAsB;AAC/C,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAO,CAAA;AAE3B,EAAA,IAAI,oBAAA,CAAqB,IAAA,CAAK,GAAA,CAAI,QAAQ,CAAA,EAAG;AACzC,IAAA,GAAA,CAAI,QAAA,GAAW,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAC9C,IAAA,OAAO,GAAA;AAAA,EACX;AAEA,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAC5C,EAAA,GAAA,CAAI,QAAA,GAAW,CAAA,EAAG,IAAI,CAAA,EAAG,uBAAuB,CAAA,CAAA;AAChD,EAAA,OAAO,GAAA;AACX;AAkBO,SAAS,aAAA,CAAc,OAAA,EAAiB,OAAA,GAA2B,EAAC,EAAW;AAClF,EAAA,MAAM,GAAA,GAAM,oBAAoB,OAAO,CAAA;AAEvC,EAAA,KAAA,MAAW,CAAC,SAAA,EAAW,QAAQ,CAAA,IAAK,eAAA,EAAiB;AACjD,IAAA,MAAM,KAAA,GAAQ,QAAQ,SAAS,CAAA;AAC/B,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,UAAU,EAAA,EAAI;AACvD,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IAChD;AAAA,EACJ;AAEA,EAAA,KAAA,MAAW,CAAC,SAAA,EAAW,QAAQ,CAAA,IAAK,uBAAA,EAAyB;AACzD,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACpB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IACtC;AAAA,EACJ;AAEA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACrB,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC5D,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACvC,QAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,MAC3C;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,OAAO,IAAI,QAAA,EAAS;AACxB","file":"chunk-4E7OW4RJ.js","sourcesContent":["/**\n * Builder for the Captello capture webview embed URL.\n *\n * The webview reads its configuration from query-string params. The short keys\n * below are the contract the webview expects (see the webview's `PARAMS` enum);\n * this builder maps friendly option names onto those keys so hosts never have to\n * hard-code `\"f\"`, `\"m\"`, etc.\n */\n\n/** Query-param keys understood by the webview. */\nexport enum EmbedParam {\n    FormId = \"f\",\n    SubmissionToken = \"s\",\n    StationId = \"st\",\n    Mode = \"m\",\n    EventWebAccessToken = \"e\",\n    ActivationId = \"a\",\n    Language = \"l\",\n    ActionButtonPosition = \"b\",\n    FormType = \"form_type\",\n    Launcher = \"launcher\",\n    SubmissionType = \"t\",\n    SubmitButtonBottomPadding = \"sbbp\",\n    Platform = \"platform\",\n    HideEmail = \"he\",\n    ConnexionsEmbedMode = \"cem\",\n    /** Edit mode read-only: locks email-mapped and invitation-code elements. */\n    Emro = \"emro\",\n    /** Context for filtering form-fill actions (e.g. MMP outbound/inbound/notes). */\n    UseIn = \"useIn\",\n}\n\n/** Form render mode (the webview's `FormMode`). */\nexport enum FormMode {\n    Preview = \"preview\",\n    Submit = \"submit\",\n    Edit = \"edit\",\n    View = \"view\",\n}\n\n/** Identifies the host embedding the webview (the webview's `LAUNCHER_TYPES`). */\nexport enum LauncherType {\n    EventGenMobile = \"event_gen_mobile\",\n    EventGenWeb = \"event_gen_web\",\n    WebApp = \"webapp\",\n    Mmp = \"MMP\",\n}\n\n/** `form_type` discriminator. */\nexport type FormType = \"template\" | \"device\";\n\n/** `t` (submission type) discriminator. */\nexport type SubmissionType = \"normal\" | \"drafted\";\n\n/**\n * Action-button position param (`b`), mirroring the webview's `CTABtnPosition`.\n * The wire values are numeric strings; use {@link ActionButtonPosition} for the\n * readable names.\n */\nexport enum ActionButtonPosition {\n    Fixed = \"0\",\n    Bottom = \"1\",\n    Hidden = \"2\",\n}\n\n/** Supported webview languages. The wire value is the two-letter code. */\nexport enum Language {\n    Arabic = \"ar\",\n    German = \"de\",\n    English = \"en\",\n    Spanish = \"es\",\n    French = \"fr\",\n    Italian = \"it\",\n    Japanese = \"ja\",\n    Korean = \"ko\",\n    Dutch = \"nl\",\n    Portuguese = \"pt\",\n    Chinese = \"zh\",\n}\n\n/** Context for filtering form-fill actions, sent as the `useIn` param. */\nexport type UseInContext = \"outbound\" | \"inbound\" | \"notes\";\n\n/**\n * Options for {@link buildEmbedUrl}. Every field is optional; only the ones you set\n * are written to the URL. `formId` is effectively required for a real embed but is\n * left optional so callers can build preview/partial URLs.\n */\nexport interface EmbedUrlOptions {\n    formId?: string | number;\n    submissionToken?: string;\n    stationId?: string | number;\n    mode?: FormMode;\n    eventWebAccessToken?: string;\n    activationId?: string | number;\n    language?: Language;\n    actionButtonPosition?: ActionButtonPosition;\n    formType?: FormType;\n    launcher?: LauncherType;\n    submissionType?: SubmissionType;\n    submitButtonBottomPadding?: string | number;\n    /** Context for filtering form-fill actions (the `useIn` param). */\n    useIn?: UseInContext;\n    platform?: \"web\" | \"mobile\";\n    hideEmail?: boolean;\n    /** Connexions embed mode: suppress in-webview redirect/vCard download. */\n    connexionsEmbedMode?: boolean;\n    /** Edit mode read-only. */\n    emro?: boolean;\n    /**\n     * Extra query params to append verbatim (e.g. prospect tracking params the\n     * webview forwards on submit). Values are stringified; `undefined`/`null` skipped.\n     */\n    extraParams?: Record<string, string | number | boolean | undefined | null>;\n}\n\n// Maps each option onto its query key. Order here defines the order params are\n// written, which keeps generated URLs stable and diffable.\nconst OPTION_TO_PARAM: ReadonlyArray<[keyof EmbedUrlOptions, EmbedParam]> = [\n    [\"formId\", EmbedParam.FormId],\n    [\"submissionToken\", EmbedParam.SubmissionToken],\n    [\"stationId\", EmbedParam.StationId],\n    [\"mode\", EmbedParam.Mode],\n    [\"eventWebAccessToken\", EmbedParam.EventWebAccessToken],\n    [\"activationId\", EmbedParam.ActivationId],\n    [\"language\", EmbedParam.Language],\n    [\"actionButtonPosition\", EmbedParam.ActionButtonPosition],\n    [\"formType\", EmbedParam.FormType],\n    [\"launcher\", EmbedParam.Launcher],\n    [\"submissionType\", EmbedParam.SubmissionType],\n    [\"submitButtonBottomPadding\", EmbedParam.SubmitButtonBottomPadding],\n    [\"useIn\", EmbedParam.UseIn],\n    [\"platform\", EmbedParam.Platform],\n];\n\n// Boolean flags are encoded as \"1\" when true and omitted when false/unset, matching\n// how the webview reads them (`Boolean(queryParams[key])` / presence checks).\nconst BOOLEAN_OPTION_TO_PARAM: ReadonlyArray<[keyof EmbedUrlOptions, EmbedParam]> = [\n    [\"hideEmail\", EmbedParam.HideEmail],\n    [\"connexionsEmbedMode\", EmbedParam.ConnexionsEmbedMode],\n    [\"emro\", EmbedParam.Emro],\n];\n\n/** The path the capture webview is served at. The SDK owns this so callers don't. */\nexport const CAPTURE_SUBMISSION_PATH = \"/capture/submission\";\n\n// Recognized capture routes — if the base URL already targets one of these, it is kept\n// as-is; otherwise the canonical submission path is appended. `capture/activation` is\n// preserved so activation embeds aren't rewritten to a submission URL.\nconst CAPTURE_PATH_PATTERN = /\\/capture\\/(submission|activation)\\/?$/;\n\n/**\n * Normalizes a base capture URL so the path is always a valid capture route, no matter\n * what the caller passed. This is the fix for the \"do I include `/capture/submission`?\"\n * footgun: the origin, the origin with a trailing slash, and the full path all converge\n * to the same correct URL.\n *\n * - Origin only (`https://capture.captello.com`) → path set to `/capture/submission`.\n * - Already a capture route (`…/capture/submission`, `…/capture/activation`, with or\n *   without a trailing slash) → kept (trailing slash trimmed).\n * - A base path (`https://host/webview`) → `/capture/submission` appended to it, so\n *   sub-path deployments still work.\n *\n * Existing query params and the origin are always preserved.\n */\nfunction normalizeCaptureUrl(baseUrl: string): URL {\n    const url = new URL(baseUrl);\n\n    if (CAPTURE_PATH_PATTERN.test(url.pathname)) {\n        url.pathname = url.pathname.replace(/\\/+$/, \"\"); // drop any trailing slash\n        return url;\n    }\n\n    const base = url.pathname.replace(/\\/+$/, \"\"); // \"\" for origin/\"/\", \"/webview\" for a sub-path\n    url.pathname = `${base}${CAPTURE_SUBMISSION_PATH}`;\n    return url;\n}\n\n/**\n * Builds an absolute embed URL from a capture base URL and typed options.\n *\n * You only need to pass the **capture origin** — the SDK appends the capture path for\n * you. Passing the origin, the origin with a trailing slash, or the full\n * `…/capture/submission` URL all produce the same correct result, so there's nothing to\n * get wrong. Existing query params on `baseUrl` are preserved; options override params\n * with the same key.\n *\n * @example\n * // All three are equivalent:\n * buildEmbedUrl(\"https://capture.captello.com\", { formId: 1234, mode: FormMode.Submit });\n * buildEmbedUrl(\"https://capture.captello.com/\", { formId: 1234, mode: FormMode.Submit });\n * buildEmbedUrl(\"https://capture.captello.com/capture/submission\", { formId: 1234, mode: FormMode.Submit });\n * // → \"https://capture.captello.com/capture/submission?f=1234&m=submit\"\n */\nexport function buildEmbedUrl(baseUrl: string, options: EmbedUrlOptions = {}): string {\n    const url = normalizeCaptureUrl(baseUrl);\n\n    for (const [optionKey, paramKey] of OPTION_TO_PARAM) {\n        const value = options[optionKey];\n        if (value !== undefined && value !== null && value !== \"\") {\n            url.searchParams.set(paramKey, String(value));\n        }\n    }\n\n    for (const [optionKey, paramKey] of BOOLEAN_OPTION_TO_PARAM) {\n        if (options[optionKey]) {\n            url.searchParams.set(paramKey, \"1\");\n        }\n    }\n\n    if (options.extraParams) {\n        for (const [key, value] of Object.entries(options.extraParams)) {\n            if (value !== undefined && value !== null) {\n                url.searchParams.set(key, String(value));\n            }\n        }\n    }\n\n    return url.toString();\n}\n"]}

package/dist/{chunk-ZMYMZK2A.js → chunk-IIOIYCUE.js}

@@ -78,6 +78,11 @@ var CaptelloWebview = class {
     this.targetOrigin = options.targetOrigin ?? "*";
     this.matchSource = options.matchSource ?? true;
     this.queueUntilReady = options.queueUntilReady ?? true;
+    if (this.targetOrigin === "*") {
+      devWarn(
+        `[captello-sdk] No targetOrigin set \u2014 defaulting to "*", which accepts messages from any origin and posts without an origin check. Set targetOrigin to the webview's origin (e.g. new URL(embedUrl).origin) in production.`
+      );
+    }
     const hostWindow = options.hostWindow ?? (typeof window !== "undefined" ? window : void 0);
     if (!hostWindow) {
       throw new Error(
@@ -324,5 +329,5 @@ var CaptelloWebview = class {
 };
 
 export { CaptelloWebview, InboundMessageType, OutboundMessageType, PrefillDataType, SubmissionError, SubmissionTimeoutError, parseOutboundMessage };
-//# sourceMappingURL=chunk-ZMYMZK2A.js.map
-//# sourceMappingURL=chunk-ZMYMZK2A.js.map
+//# sourceMappingURL=chunk-IIOIYCUE.js.map
+//# sourceMappingURL=chunk-IIOIYCUE.js.map

package/dist/chunk-IIOIYCUE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/messages.ts","../src/client.ts"],"names":["OutboundMessageType","InboundMessageType","PrefillDataType"],"mappings":";AAwBO,IAAK,mBAAA,qBAAAA,oBAAAA,KAAL;AAEH,EAAAA,qBAAA,kBAAA,CAAA,GAAmB,oBAAA;AAEnB,EAAAA,qBAAA,kBAAA,CAAA,GAAmB,oBAAA;AAKnB,EAAAA,qBAAA,gBAAA,CAAA,GAAiB,iBAAA;AAEjB,EAAAA,qBAAA,mBAAA,CAAA,GAAoB,qBAAA;AAEpB,EAAAA,qBAAA,2BAAA,CAAA,GAA4B,6BAAA;AAE5B,EAAAA,qBAAA,yBAAA,CAAA,GAA0B,2BAAA;AAflB,EAAA,OAAAA,oBAAAA;AAAA,CAAA,EAAA,mBAAA,IAAA,EAAA;AA6GL,IAAK,kBAAA,qBAAAC,mBAAAA,KAAL;AAEH,EAAAA,oBAAA,QAAA,CAAA,GAAS,aAAA;AAET,EAAAA,oBAAA,OAAA,CAAA,GAAQ,YAAA;AAER,EAAAA,oBAAA,aAAA,CAAA,GAAc,cAAA;AAEd,EAAAA,oBAAA,aAAA,CAAA,GAAc,cAAA;AAEd,EAAAA,oBAAA,mBAAA,CAAA,GAAoB,oBAAA;AAVZ,EAAA,OAAAA,mBAAAA;AAAA,CAAA,EAAA,kBAAA,IAAA,EAAA;AAcL,IAAK,eAAA,qBAAAC,gBAAAA,KAAL;AAEH,EAAAA,iBAAA,eAAA,CAAA,GAAgB,gBAAA;AAEhB,EAAAA,iBAAA,MAAA,CAAA,GAAO,MAAA;AAEP,EAAAA,iBAAA,sBAAA,CAAA,GAAuB,yBAAA;AANf,EAAA,OAAAA,gBAAAA;AAAA,CAAA,EAAA,eAAA,IAAA,EAAA;AAsEZ,IAAM,iBAAsC,IAAI,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,mBAAmB,CAAC,CAAA;AAEtF,SAAS,cAAc,KAAA,EAAkD;AACrE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC9E;AASO,SAAS,qBAAqB,IAAA,EAAuC;AACxE,EAAA,IAAI,KAAA,GAAiB,IAAA;AACrB,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC3B,IAAA,IAAI;AACA,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC5B,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,IAAA;AAAA,IACX;AAAA,EACJ;AACA,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,IAAA;AAClC,EAAA,IAAI,OAAO,KAAA,CAAM,MAAM,CAAA,KAAM,QAAA,IAAY,CAAC,cAAA,CAAe,GAAA,CAAI,KAAA,CAAM,MAAM,CAAC,CAAA,EAAG,OAAO,IAAA;AACpF,EAAA,OAAO,KAAA;AACX;;;AC1NO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EACvC,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EAChB;AACJ;AAMO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9C,YAA4B,SAAA,EAAmB;AAC3C,IAAA,KAAA,CAAM,CAAA,kDAAA,EAAqD,SAAS,CAAA,GAAA,CAAK,CAAA;AADjD,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAExB,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AAAA,EAChB;AACJ;AAqCA,SAAS,QAAQ,OAAA,EAAuB;AACpC,EAAA,IAAI;AACA,IAAA,IAAI,OAAO,YAAY,WAAA,IAAe,OAAA,CAAQ,OAAO,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,EAAc;AAExF,MAAA,OAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,IACxB;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACJ;AAiCO,IAAM,kBAAN,MAAsB;AAAA,EAiBzB,WAAA,CAAY,KAAA,EAAuB,OAAA,GAAkC,EAAC,EAAG;AAXzE,IAAA,IAAA,CAAiB,SAAA,uBAAgB,GAAA,EAAqE;AACtG,IAAA,IAAA,CAAiB,YAAA,uBAAmB,GAAA,EAAyB;AAE7D,IAAA,IAAA,CAAQ,SAAA,GAAY,KAAA;AAIpB;AAAA,IAAA,IAAA,CAAQ,KAAA,GAAQ,KAAA;AAEhB;AAAA,IAAA,IAAA,CAAiB,SAA2B,EAAC;AAGzC,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,MAAM,IAAI,MAAM,wEAAwE,CAAA;AAAA,IAC5F;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,YAAA,GAAe,QAAQ,YAAA,IAAgB,GAAA;AAC5C,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,IAAA;AAC1C,IAAA,IAAA,CAAK,eAAA,GAAkB,QAAQ,eAAA,IAAmB,IAAA;AAMlD,IAAA,IAAI,IAAA,CAAK,iBAAiB,GAAA,EAAK;AAC3B,MAAA,OAAA;AAAA,QACI,CAAA,8NAAA;AAAA,OAGJ;AAAA,IACJ;AAEA,IAAA,MAAM,aAAa,OAAA,CAAQ,UAAA,KAAe,OAAO,MAAA,KAAW,cAAc,MAAA,GAAS,MAAA,CAAA;AACnF,IAAA,IAAI,CAAC,UAAA,EAAY;AACb,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAElB,IAAA,IAAA,CAAK,YAAA,GAAe,CAAC,KAAA,KAAwB,IAAA,CAAK,cAAc,KAAK,CAAA;AACrE,IAAA,IAAA,CAAK,UAAA,CAAW,gBAAA,CAAiB,SAAA,EAAW,IAAA,CAAK,YAAY,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,IAAI,OAAA,GAAmB;AACnB,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,EAAA,CAAkC,MAAS,QAAA,EAA4C;AACnF,IAAA,IAAI,GAAA,GAAM,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA;AACjC,IAAA,IAAI,CAAC,GAAA,EAAK;AACN,MAAA,GAAA,uBAAU,GAAA,EAAI;AACd,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IAChC;AACA,IAAA,GAAA,CAAI,IAAI,QAAiD,CAAA;AACzD,IAAA,OAAO,MAAM;AACT,MAAA,GAAA,EAAK,OAAO,QAAiD,CAAA;AAAA,IACjE,CAAA;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CAAoC,MAAS,QAAA,EAA4C;AACrF,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,EAAA,CAAG,IAAA,EAAM,CAAC,OAAA,KAAY;AACnC,MAAA,GAAA,EAAI;AACJ,MAAA,QAAA,CAAS,OAAO,CAAA;AAAA,IACpB,CAAC,CAAA;AACD,IAAA,OAAO,GAAA;AAAA,EACX;AAAA;AAAA,EAGA,MAAM,QAAA,EAA4C;AAC9C,IAAA,IAAA,CAAK,YAAA,CAAa,IAAI,QAAQ,CAAA;AAC9B,IAAA,OAAO,MAAM;AACT,MAAA,IAAA,CAAK,YAAA,CAAa,OAAO,QAAQ,CAAA;AAAA,IACrC,CAAA;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,KAAK,OAAA,EAA+B;AAChC,IAAA,IAAI,KAAK,SAAA,EAAW;AAChB,MAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,IACnE;AACA,IAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,CAAC,IAAA,CAAK,KAAA,EAAO;AACrC,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,OAAO,CAAA;AACxB,MAAA;AAAA,IACJ;AACA,IAAA,IAAA,CAAK,QAAQ,OAAO,CAAA;AAAA,EACxB;AAAA;AAAA,EAGQ,QAAQ,OAAA,EAA+B;AAC3C,IAAA,MAAM,MAAA,GAAS,KAAK,KAAA,CAAM,aAAA;AAC1B,IAAA,IAAI,CAAC,MAAA,EAAQ;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OACJ;AAAA,IACJ;AAEA,IAAA,MAAA,CAAO,YAAY,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG,KAAK,YAAY,CAAA;AAAA,EACjE;AAAA;AAAA,EAGQ,iBAAA,GAA0B;AAC9B,IAAA,IAAI,KAAK,KAAA,EAAO;AAChB,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA;AACnC,IAAA,KAAA,MAAW,WAAW,MAAA,EAAQ;AAC1B,MAAA,IAAI;AACA,QAAA,IAAA,CAAK,QAAQ,OAAO,CAAA;AAAA,MACxB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAAA,EACJ;AAAA;AAAA,EAGA,MAAA,GAAe;AACX,IAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAA,aAAA,eAAiC,CAAA;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,aAAA,CAAc,YAAY,GAAA,EAAiC;AACvD,IAAA,OAAO,IAAI,OAAA,CAAwB,CAAC,OAAA,EAAS,MAAA,KAAW;AACpD,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,IAAI,KAAA;AAEJ,MAAA,MAAM,UAAU,MAAM;AAClB,QAAA,OAAA,GAAU,IAAA;AACV,QAAA,UAAA,EAAW;AACX,QAAA,QAAA,EAAS;AACT,QAAA,IAAI,KAAA,KAAU,MAAA,EAAW,YAAA,CAAa,KAAK,CAAA;AAAA,MAC/C,CAAA;AAEA,MAAA,MAAM,UAAA,GAAa,IAAA,CAAK,EAAA,CAAA,iBAAA,uBAAuC,CAAC,OAAA,KAAY;AACxE,QAAA,IAAI,OAAA,EAAS;AACb,QAAA,OAAA,EAAQ;AACR,QAAA,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAAA,MACxB,CAAC,CAAA;AACD,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,EAAA,CAAA,oBAAA,yBAAyC,CAAC,OAAA,KAAY;AACxE,QAAA,IAAI,OAAA,EAAS;AACb,QAAA,OAAA,EAAQ;AACR,QAAA,MAAA,CAAO,IAAI,eAAA,CAAgB,OAAA,CAAQ,IAAI,CAAC,CAAA;AAAA,MAC5C,CAAC,CAAA;AAED,MAAA,IAAI,SAAA,GAAY,CAAA,IAAK,SAAA,KAAc,QAAA,EAAU;AACzC,QAAA,KAAA,GAAQ,WAAW,MAAM;AACrB,UAAA,IAAI,OAAA,EAAS;AACb,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,IAAI,sBAAA,CAAuB,SAAS,CAAC,CAAA;AAAA,QAChD,GAAG,SAAS,CAAA;AAAA,MAChB;AAEA,MAAA,IAAI;AACA,QAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAA,aAAA,eAAiC,CAAA;AAAA,MACjD,SAAS,GAAA,EAAK;AACV,QAAA,IAAI,CAAC,OAAA,EAAS;AACV,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACd;AAAA,MACJ;AAAA,IACJ,CAAC,CAAA;AAAA,EACL;AAAA;AAAA,EAGA,KAAA,GAAc;AACV,IAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAA,YAAA,cAAgC,CAAA;AAAA,EAChD;AAAA;AAAA,EAGA,WAAA,GAAoB;AAChB,IAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAA,cAAA,oBAAsC,CAAA;AAAA,EACtD;AAAA;AAAA,EAGA,kBAAkB,MAAA,EAAgC;AAC9C,IAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAA,oBAAA,0BAA4C,MAAA,EAAQ,CAAA;AAAA,EACpE;AAAA;AAAA,EAGA,kBAAkB,UAAA,EAAqC;AACnD,IAAA,IAAA,CAAK,IAAA,CAAK;AAAA,MACN,IAAA,EAAA,cAAA;AAAA,MACA,SAAA,EAAA,gBAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACT,CAAA;AAAA,EACL;AAAA;AAAA,EAGA,YAAY,IAAA,EAA+B;AACvC,IAAA,IAAA,CAAK,IAAA,CAAK;AAAA,MACN,IAAA,EAAA,cAAA;AAAA,MACA,SAAA,EAAA,MAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACT,CAAA;AAAA,EACL;AAAA;AAAA,EAGA,yBAAyB,IAAA,EAA0E;AAC/F,IAAA,IAAA,CAAK,IAAA,CAAK;AAAA,MACN,IAAA,EAAA,cAAA;AAAA,MACA,SAAA,EAAA,yBAAA;AAAA,MACA;AAAA,KACH,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAA,GAAgB;AACZ,IAAA,IAAI,KAAK,SAAA,EAAW;AACpB,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,UAAA,CAAW,mBAAA,CAAoB,SAAA,EAAW,IAAA,CAAK,YAAY,CAAA;AAChE,IAAA,IAAA,CAAK,UAAU,KAAA,EAAM;AACrB,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AACxB,IAAA,IAAA,CAAK,OAAO,MAAA,GAAS,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAMQ,cAAc,KAAA,EAA2B;AAC7C,IAAA,IAAI,KAAK,SAAA,EAAW;AAKpB,IAAA,IAAI,KAAK,YAAA,KAAiB,GAAA,IAAO,KAAA,CAAM,MAAA,KAAW,KAAK,YAAA,EAAc;AACjE,MAAA,IAAI,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA,EAAG;AAClC,QAAA,OAAA;AAAA,UACI,CAAA,uDAAA,EAA0D,KAAA,CAAM,MAAM,CAAA,aAAA,EACpD,KAAK,YAAY,CAAA,sCAAA;AAAA,SACvC;AAAA,MACJ;AACA,MAAA;AAAA,IACJ;AAGA,IAAA,IAAI,KAAK,WAAA,EAAa;AAClB,MAAA,MAAM,QAAA,GAAW,KAAK,KAAA,CAAM,aAAA;AAC5B,MAAA,IAAI,QAAA,IAAY,KAAA,CAAM,MAAA,KAAW,QAAA,EAAU;AACvC,QAAA,IAAI,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA,EAAG;AAClC,UAAA,OAAA;AAAA,YACI;AAAA,WAEJ;AAAA,QACJ;AACA,QAAA;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,MAAM,OAAA,GAAU,oBAAA,CAAqB,KAAA,CAAM,IAAI,CAAA;AAC/C,IAAA,IAAI,CAAC,OAAA,EAAS;AAId,IAAA,IAAI,QAAQ,IAAA,KAAA,oBAAA,yBAA+C;AACvD,MAAA,IAAA,CAAK,iBAAA,EAAkB;AAAA,IAC3B;AAEA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,QAAQ,IAAI,CAAA;AAC3C,IAAA,IAAI,GAAA,EAAK;AAEL,MAAA,KAAA,MAAW,YAAY,CAAC,GAAG,GAAG,CAAA,WAAY,OAAO,CAAA;AAAA,IACrD;AACA,IAAA,IAAI,IAAA,CAAK,aAAa,IAAA,EAAM;AACxB,MAAA,KAAA,MAAW,YAAY,CAAC,GAAG,KAAK,YAAY,CAAA,WAAY,OAAO,CAAA;AAAA,IACnE;AAAA,EACJ;AACJ","file":"chunk-IIOIYCUE.js","sourcesContent":["/**\n * The message protocol exchanged between the Captello capture webview (the iframe)\n * and its host page.\n *\n * Wire format (this is the contract — match it exactly):\n * - Every message is a JSON **string**. The webview sends outbound messages with\n *   `JSON.stringify(message)` and reads inbound messages with `JSON.parse(event.data)`.\n *   A host that posts a raw object instead of a string will be ignored, because the\n *   webview's parser produces a non-object and bails.\n * - Every message is an object with a `type` discriminator. Inbound and outbound\n *   types are disjoint string enums.\n *\n * Direction is named from the **webview's** point of view:\n * - {@link OutboundMessageType}: webview → host (the host listens for these).\n * - {@link InboundMessageType}: host → webview (the host sends these).\n */\n\nimport type { VisibleSubmissionDataItem } from \"./submission-data\";\n\n/* ------------------------------------------------------------------ *\n * Outbound: webview → host\n * ------------------------------------------------------------------ */\n\n/** Message `type` values the webview emits to its host. */\nexport enum OutboundMessageType {\n    /** The form finished loading and rendering. Safe to interact with it after this. */\n    FormLoadComplete = \"form_load_complete\",\n    /** A user-facing error occurred; `data` is the translated, display-ready message. */\n    FormErrorMessage = \"form_error_message\",\n    /**\n     * Emitted for embedded forms instead of submitting directly: `data` is the full\n     * submission body for the host to persist/forward.\n     */\n    SubmissionBody = \"submission_body\",\n    /** The form was submitted successfully. `action` indicates whether it was a new submission or an update. */\n    FormSubmitSuccess = \"form_submit_success\",\n    /** Connexions: the host should perform the profile redirect (embed mode). */\n    ConnexionsProfileRedirect = \"connexions_profile_redirect\",\n    /** Connexions: the host should trigger the vCard download (embed mode). */\n    ConnexionsDownloadVcard = \"connexions_download_vcard\",\n}\n\n/**\n * Opaque submission payload carried by {@link OutboundMessageType.SubmissionBody}.\n *\n * This mirrors the webview's internal `FormSubmission` model. It is intentionally\n * typed as an open record here so the SDK stays decoupled from the app's full model\n * graph; the documented fields below are stable, the rest are passed through as-is.\n * Host code that needs the deep element-value types should treat `data` as untyped\n * and key it by element id (e.g. `\"element_12\"`, `\"element_12_3\"`).\n */\nexport interface SubmissionBody {\n    id: number;\n    form_id: number;\n    prospect_id: number;\n    email: string;\n    first_name: string;\n    last_name: string;\n    full_name: string;\n    company: string;\n    phone: string;\n    /** Submitted values keyed by element id / sub-element id. */\n    data: Record<string, unknown>;\n    /**\n     * Visible, filled elements ready to render as key/value rows — one item per\n     * element, discriminated by `element_type` (narrow on it for a precisely-typed\n     * `element_value`). See {@link VisibleSubmissionDataItem}. May be absent on older\n     * webview builds.\n     */\n    visible_submissions_data?: VisibleSubmissionDataItem[];\n    submission_date: string;\n    /** Query-string params the webview was loaded with, echoed back on submit. */\n    query_parameters?: Record<string, string>;\n    /** Additional fields from the webview's submission model are passed through verbatim. */\n    [key: string]: unknown;\n}\n\n/**\n * Loose submission shape accepted when **pre-filling** the form (host → webview).\n *\n * Distinct from {@link SubmissionBody}: a received `submission_body` is always fully\n * populated, but when pre-filling you typically either round-trip a previously-received\n * body or pass a partial object assembled from your own data. A {@link SubmissionBody}\n * is assignable to this, so round-tripping just works.\n */\nexport interface SubmissionPrefill {\n    /** Submitted values keyed by element id / sub-element id. */\n    data?: Record<string, unknown>;\n    [key: string]: unknown;\n}\n\ninterface FormLoadCompleteMessage {\n    type: OutboundMessageType.FormLoadComplete;\n}\ninterface FormSubmitSuccessMessage {\n    type: OutboundMessageType.FormSubmitSuccess;\n    action: \"create\" | \"update\";\n}\ninterface FormErrorMessageMessage {\n    type: OutboundMessageType.FormErrorMessage;\n    /** Translated, display-ready error text. */\n    data: string;\n}\ninterface SubmissionBodyMessage {\n    type: OutboundMessageType.SubmissionBody;\n    data: SubmissionBody;\n}\ninterface ConnexionsProfileRedirectMessage {\n    type: OutboundMessageType.ConnexionsProfileRedirect;\n}\ninterface ConnexionsDownloadVcardMessage {\n    type: OutboundMessageType.ConnexionsDownloadVcard;\n}\n\n/** Discriminated union of every message the webview can emit to its host. */\nexport type OutboundMessage =\n    | FormLoadCompleteMessage\n    | FormSubmitSuccessMessage\n    | FormErrorMessageMessage\n    | SubmissionBodyMessage\n    | ConnexionsProfileRedirectMessage\n    | ConnexionsDownloadVcardMessage;\n\n/** Maps each outbound `type` to its full message shape (used by the client's `.on`). */\nexport type OutboundMessageMap = {\n    [M in OutboundMessage as M[\"type\"]]: M;\n};\n\n/* ------------------------------------------------------------------ *\n * Inbound: host → webview\n * ------------------------------------------------------------------ */\n\n/** Message `type` values the host sends into the webview. */\nexport enum InboundMessageType {\n    /** Programmatically trigger form submission (as if the user pressed submit). */\n    Submit = \"submit_form\",\n    /** Reset the form, clearing all entered values. */\n    Reset = \"reset_form\",\n    /** Pre-fill the form with existing data. See {@link PrefillDataType}. */\n    FormPrefill = \"form_prefill\",\n    /** Switch the current submission into draft-update mode. */\n    UpdateDraft = \"update_draft\",\n    /** Run validation against a target field (or the whole form). */\n    TriggerValidation = \"trigger_validation\",\n}\n\n/** Shape selector for {@link InboundMessageType.FormPrefill} payloads. */\nexport enum PrefillDataType {\n    /** `data` is a full ULC submission (the webview's submission model). */\n    UlcSubmission = \"ulc_submission\",\n    /** `data` is a list of transcription field/value items. */\n    Info = \"info\",\n    /** `data` is `{ submission, info }` — a submission plus transcription items. */\n    UlcSubmissionAndInfo = \"ulc_submission_and_info\",\n}\n\n/** Targets for {@link InboundMessageType.TriggerValidation}. */\nexport type ValidationTarget = \"invitation_code\" | \"email\" | \"all\";\n\n/**\n * A single transcription field/value item used by {@link PrefillDataType.Info}.\n *\n * The webview matches each item to a form element by `ll_field_unique_identifier`\n * alone (e.g. `\"FirstName\"`, `\"Email\"`); `ll_field_id` is catalog metadata and is not\n * used for matching, so it is accepted as either a number or a string. `value` is\n * typically a string but may be a boolean (e.g. the PII opt-out field).\n */\nexport interface PrefillInfoItem {\n    ll_field_unique_identifier: string;\n    ll_field_id?: string | number;\n    value: string | boolean;\n}\n\ninterface SubmitMessage {\n    type: InboundMessageType.Submit;\n}\ninterface ResetMessage {\n    type: InboundMessageType.Reset;\n}\ninterface UpdateDraftMessage {\n    type: InboundMessageType.UpdateDraft;\n}\ninterface TriggerValidationMessage {\n    type: InboundMessageType.TriggerValidation;\n    target: ValidationTarget;\n}\ninterface PrefillSubmissionMessage {\n    type: InboundMessageType.FormPrefill;\n    data_type: PrefillDataType.UlcSubmission;\n    /** A submission body to pre-fill from (a received {@link SubmissionBody} or a partial). */\n    data: SubmissionPrefill;\n}\ninterface PrefillInfoMessage {\n    type: InboundMessageType.FormPrefill;\n    data_type: PrefillDataType.Info;\n    data: PrefillInfoItem[];\n}\ninterface PrefillSubmissionAndInfoMessage {\n    type: InboundMessageType.FormPrefill;\n    data_type: PrefillDataType.UlcSubmissionAndInfo;\n    data: { submission?: SubmissionPrefill; info?: PrefillInfoItem[] };\n}\n\n/** Discriminated union of every message the host can send into the webview. */\nexport type InboundMessage =\n    | SubmitMessage\n    | ResetMessage\n    | UpdateDraftMessage\n    | TriggerValidationMessage\n    | PrefillSubmissionMessage\n    | PrefillInfoMessage\n    | PrefillSubmissionAndInfoMessage;\n\n/* ------------------------------------------------------------------ *\n * Runtime guards / parsing\n * ------------------------------------------------------------------ */\n\nconst OUTBOUND_TYPES: ReadonlySet<string> = new Set(Object.values(OutboundMessageType));\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * Parses a raw `MessageEvent.data` value into a typed {@link OutboundMessage}, or\n * returns `null` if it is not a recognized Captello webview message.\n *\n * Accepts either a JSON string (the webview always sends strings) or an\n * already-parsed object, so it is robust to hosts/proxies that pre-parse.\n */\nexport function parseOutboundMessage(data: unknown): OutboundMessage | null {\n    let value: unknown = data;\n    if (typeof value === \"string\") {\n        try {\n            value = JSON.parse(value);\n        } catch {\n            return null;\n        }\n    }\n    if (!isPlainObject(value)) return null;\n    if (typeof value[\"type\"] !== \"string\" || !OUTBOUND_TYPES.has(value[\"type\"])) return null;\n    return value as unknown as OutboundMessage;\n}\n","import { InboundMessageType, OutboundMessageType, parseOutboundMessage, PrefillDataType } from \"./messages\";\nimport type {\n    InboundMessage,\n    OutboundMessage,\n    OutboundMessageMap,\n    PrefillInfoItem,\n    SubmissionBody,\n    SubmissionPrefill,\n    ValidationTarget,\n} from \"./messages\";\n\n/** Listener for a specific outbound message type. */\nexport type OutboundListener<T extends OutboundMessageType> = (message: OutboundMessageMap[T]) => void;\n\n/** Listener for every outbound message (used by {@link CaptelloWebview.onAny}). */\nexport type AnyOutboundListener = (message: OutboundMessage) => void;\n\n/** Unsubscribe handle returned by every `on*` method. Calling it removes the listener. */\nexport type Unsubscribe = () => void;\n\n/**\n * Rejection reason from {@link CaptelloWebview.submitAndWait} when the webview reports\n * a `form_error_message`. `message` is the translated, display-ready text.\n */\nexport class SubmissionError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"SubmissionError\";\n    }\n}\n\n/**\n * Rejection reason from {@link CaptelloWebview.submitAndWait} when no `submission_body`\n * or `form_error_message` arrives within the timeout.\n */\nexport class SubmissionTimeoutError extends Error {\n    constructor(public readonly timeoutMs: number) {\n        super(`Captello webview did not respond to submit within ${timeoutMs}ms.`);\n        this.name = \"SubmissionTimeoutError\";\n    }\n}\n\nexport interface CaptelloWebviewOptions {\n    /**\n     * Origin to validate incoming messages against and to target outgoing messages.\n     * Strongly recommended — set it to the webview's origin (e.g.\n     * `\"https://capture.captello.com\"`), e.g. `new URL(embedUrl).origin`.\n     *\n     * Defaults to `\"*\"`, which accepts messages from any origin and posts without an\n     * origin check. Only acceptable for trusted/local development.\n     */\n    targetOrigin?: string;\n    /**\n     * The window to attach the `message` listener to. Defaults to the global `window`.\n     * Override for testing or non-standard host environments.\n     */\n    hostWindow?: Window;\n    /**\n     * If `true` (default), incoming messages are accepted only when they originate\n     * from the bound iframe's `contentWindow`. Set `false` only if the webview relays\n     * messages through an intermediate window and source matching is impossible.\n     */\n    matchSource?: boolean;\n    /**\n     * If `true` (default), messages sent before the webview reports\n     * `form_load_complete` are buffered and flushed, in order, once it's ready. This\n     * removes a common footgun: calling `prefillInfo(...)` right after mount would\n     * otherwise post to a form that isn't listening yet and be silently dropped.\n     *\n     * Set `false` to send immediately (the legacy behavior). Note: a client that\n     * attaches *after* the form already loaded will not have seen `form_load_complete`,\n     * so its queued messages won't flush — create the client with the iframe.\n     */\n    queueUntilReady?: boolean;\n}\n\n/** Emits a console warning in development builds only. No-op in production / no bundler. */\nfunction devWarn(message: string): void {\n    try {\n        if (typeof process !== \"undefined\" && process.env && process.env.NODE_ENV !== \"production\") {\n            // eslint-disable-next-line no-console\n            console.warn(message);\n        }\n    } catch {\n        /* `process` not defined (pure browser, no bundler define) → stay silent */\n    }\n}\n\ntype ElementOrFrame = HTMLIFrameElement | { contentWindow: Window | null };\n\n/**\n * Host-side controller for an embedded Captello capture webview.\n *\n * Wraps a single `<iframe>` and encodes the full message protocol:\n * - **Receiving** (webview → host): subscribe with {@link on} / {@link onAny}.\n * - **Sending** (host → webview): use {@link submit}, {@link reset}, {@link prefill},\n *   {@link triggerValidation}, {@link updateDraft}, or the lower-level {@link send}.\n *\n * Wire details handled for you: outgoing messages are `JSON.stringify`'d (the webview\n * parses inbound data with `JSON.parse`, so a raw object would be ignored), and\n * incoming messages are validated by origin + source before being parsed.\n *\n * @example\n * ```ts\n * const iframe = document.querySelector(\"iframe\")!;\n * const webview = new CaptelloWebview(iframe, {\n *   targetOrigin: \"https://capture.captello.com\",\n * });\n *\n * webview.on(OutboundMessageType.FormLoadComplete, () => console.log(\"ready\"));\n * webview.on(OutboundMessageType.SubmissionBody, (msg) => save(msg.data));\n *\n * // later, drive the form:\n * webview.submit();\n *\n * // on teardown:\n * webview.destroy();\n * ```\n */\nexport class CaptelloWebview {\n    private readonly frame: ElementOrFrame;\n    private readonly targetOrigin: string;\n    private readonly hostWindow: Window;\n    private readonly matchSource: boolean;\n\n    private readonly listeners = new Map<OutboundMessageType, Set<OutboundListener<OutboundMessageType>>>();\n    private readonly anyListeners = new Set<AnyOutboundListener>();\n    private readonly boundHandler: (event: MessageEvent) => void;\n    private destroyed = false;\n\n    private readonly queueUntilReady: boolean;\n    /** True once `form_load_complete` has been observed. */\n    private ready = false;\n    /** Messages sent before ready, flushed in order on load. */\n    private readonly outbox: InboundMessage[] = [];\n\n    constructor(frame: ElementOrFrame, options: CaptelloWebviewOptions = {}) {\n        if (!frame) {\n            throw new Error(\"CaptelloWebview: an iframe element (or { contentWindow }) is required.\");\n        }\n        this.frame = frame;\n        this.targetOrigin = options.targetOrigin ?? \"*\";\n        this.matchSource = options.matchSource ?? true;\n        this.queueUntilReady = options.queueUntilReady ?? true;\n\n        // Nudge (dev only) when running without origin scoping. \"*\" accepts inbound\n        // messages from any origin and posts outbound without an origin check — fine\n        // for local/trusted dev, unsafe in production. Set targetOrigin to the\n        // webview's origin, e.g. `new URL(embedUrl).origin`.\n        if (this.targetOrigin === \"*\") {\n            devWarn(\n                '[captello-sdk] No targetOrigin set — defaulting to \"*\", which accepts messages ' +\n                    \"from any origin and posts without an origin check. Set targetOrigin to the webview's \" +\n                    \"origin (e.g. new URL(embedUrl).origin) in production.\",\n            );\n        }\n\n        const hostWindow = options.hostWindow ?? (typeof window !== \"undefined\" ? window : undefined);\n        if (!hostWindow) {\n            throw new Error(\n                \"CaptelloWebview: no host window available. Pass `hostWindow` when constructing outside a browser.\",\n            );\n        }\n        this.hostWindow = hostWindow;\n\n        this.boundHandler = (event: MessageEvent) => this.handleMessage(event);\n        this.hostWindow.addEventListener(\"message\", this.boundHandler);\n    }\n\n    /** `true` once the webview has reported `form_load_complete`. */\n    get isReady(): boolean {\n        return this.ready;\n    }\n\n    /* -------------------------------------------------------------- *\n     * Receiving (webview → host)\n     * -------------------------------------------------------------- */\n\n    /**\n     * Subscribe to a single outbound message type. Returns an unsubscribe function.\n     *\n     * @example webview.on(OutboundMessageType.FormErrorMessage, (m) => toast(m.data));\n     */\n    on<T extends OutboundMessageType>(type: T, listener: OutboundListener<T>): Unsubscribe {\n        let set = this.listeners.get(type);\n        if (!set) {\n            set = new Set();\n            this.listeners.set(type, set);\n        }\n        set.add(listener as OutboundListener<OutboundMessageType>);\n        return () => {\n            set?.delete(listener as OutboundListener<OutboundMessageType>);\n        };\n    }\n\n    /**\n     * Subscribe once: the listener is removed automatically after it fires the first\n     * time for `type`. Returns an unsubscribe function for cancelling early.\n     */\n    once<T extends OutboundMessageType>(type: T, listener: OutboundListener<T>): Unsubscribe {\n        const off = this.on(type, (message) => {\n            off();\n            listener(message);\n        });\n        return off;\n    }\n\n    /** Subscribe to every outbound message regardless of type. Returns an unsubscribe function. */\n    onAny(listener: AnyOutboundListener): Unsubscribe {\n        this.anyListeners.add(listener);\n        return () => {\n            this.anyListeners.delete(listener);\n        };\n    }\n\n    /* -------------------------------------------------------------- *\n     * Sending (host → webview)\n     * -------------------------------------------------------------- */\n\n    /**\n     * Low-level send: posts any inbound message to the webview as a JSON string.\n     * Prefer the typed helpers below; use this only for forward-compatibility.\n     *\n     * When `queueUntilReady` is enabled (the default) and the form hasn't reported\n     * `form_load_complete` yet, the message is buffered and flushed on load instead of\n     * posted immediately.\n     *\n     * @throws if the iframe's `contentWindow` is not available (not yet loaded /\n     *   detached) and the message can't be queued.\n     */\n    send(message: InboundMessage): void {\n        if (this.destroyed) {\n            throw new Error(\"CaptelloWebview: cannot send after destroy().\");\n        }\n        if (this.queueUntilReady && !this.ready) {\n            this.outbox.push(message);\n            return;\n        }\n        this.postNow(message);\n    }\n\n    /** Posts a message immediately, bypassing the ready-queue. */\n    private postNow(message: InboundMessage): void {\n        const target = this.frame.contentWindow;\n        if (!target) {\n            throw new Error(\n                \"CaptelloWebview: iframe.contentWindow is null. Wait for the iframe to load before sending.\",\n            );\n        }\n        // The webview reads inbound data with JSON.parse(event.data), so it must be a string.\n        target.postMessage(JSON.stringify(message), this.targetOrigin);\n    }\n\n    /** Marks the client ready and flushes any queued messages, in order. */\n    private markReadyAndFlush(): void {\n        if (this.ready) return;\n        this.ready = true;\n        const queued = this.outbox.splice(0);\n        for (const message of queued) {\n            try {\n                this.postNow(message);\n            } catch {\n                /* iframe detached between load and flush — drop silently */\n            }\n        }\n    }\n\n    /** Programmatically submit the form (fire-and-forget). */\n    submit(): void {\n        this.send({ type: InboundMessageType.Submit });\n    }\n\n    /**\n     * Submit the form and await the outcome.\n     *\n     * Sends `submit_form`, then resolves with the {@link SubmissionBody} when the\n     * webview emits `submission_body`, or rejects with a {@link SubmissionError}\n     * (carrying the translated message) when it emits `form_error_message`. Rejects\n     * with a {@link SubmissionTimeoutError} if neither arrives within `timeoutMs`.\n     *\n     * This is the typed, leak-free version of the common \"click submit, wait for the\n     * result\" flow — listeners are always cleaned up, including on timeout.\n     *\n     * @param timeoutMs how long to wait before giving up. Defaults to 60_000.\n     * @example\n     * try {\n     *   const body = await webview.submitAndWait();\n     *   await persist(body);\n     * } catch (err) {\n     *   if (err instanceof SubmissionError) showToast(err.message);\n     * }\n     */\n    submitAndWait(timeoutMs = 60_000): Promise<SubmissionBody> {\n        return new Promise<SubmissionBody>((resolve, reject) => {\n            let settled = false;\n            let timer: ReturnType<typeof setTimeout> | undefined;\n\n            const cleanup = () => {\n                settled = true;\n                offSuccess();\n                offError();\n                if (timer !== undefined) clearTimeout(timer);\n            };\n\n            const offSuccess = this.on(OutboundMessageType.SubmissionBody, (message) => {\n                if (settled) return;\n                cleanup();\n                resolve(message.data);\n            });\n            const offError = this.on(OutboundMessageType.FormErrorMessage, (message) => {\n                if (settled) return;\n                cleanup();\n                reject(new SubmissionError(message.data));\n            });\n\n            if (timeoutMs > 0 && timeoutMs !== Infinity) {\n                timer = setTimeout(() => {\n                    if (settled) return;\n                    cleanup();\n                    reject(new SubmissionTimeoutError(timeoutMs));\n                }, timeoutMs);\n            }\n\n            try {\n                this.send({ type: InboundMessageType.Submit });\n            } catch (err) {\n                if (!settled) {\n                    cleanup();\n                    reject(err);\n                }\n            }\n        });\n    }\n\n    /** Reset the form, clearing all entered values. */\n    reset(): void {\n        this.send({ type: InboundMessageType.Reset });\n    }\n\n    /** Switch the current submission into draft-update mode. */\n    updateDraft(): void {\n        this.send({ type: InboundMessageType.UpdateDraft });\n    }\n\n    /** Run validation against a target field, or `\"all\"` for the whole form. */\n    triggerValidation(target: ValidationTarget): void {\n        this.send({ type: InboundMessageType.TriggerValidation, target });\n    }\n\n    /** Pre-fill the form from a submission body (a received body or a partial). */\n    prefillSubmission(submission: SubmissionPrefill): void {\n        this.send({\n            type: InboundMessageType.FormPrefill,\n            data_type: PrefillDataType.UlcSubmission,\n            data: submission,\n        });\n    }\n\n    /** Pre-fill the form from a list of transcription field/value items. */\n    prefillInfo(info: PrefillInfoItem[]): void {\n        this.send({\n            type: InboundMessageType.FormPrefill,\n            data_type: PrefillDataType.Info,\n            data: info,\n        });\n    }\n\n    /** Pre-fill the form from a submission plus transcription items. */\n    prefillSubmissionAndInfo(data: { submission?: SubmissionPrefill; info?: PrefillInfoItem[] }): void {\n        this.send({\n            type: InboundMessageType.FormPrefill,\n            data_type: PrefillDataType.UlcSubmissionAndInfo,\n            data,\n        });\n    }\n\n    /* -------------------------------------------------------------- *\n     * Lifecycle\n     * -------------------------------------------------------------- */\n\n    /** Remove the `message` listener and drop all subscriptions. Idempotent. */\n    destroy(): void {\n        if (this.destroyed) return;\n        this.destroyed = true;\n        this.hostWindow.removeEventListener(\"message\", this.boundHandler);\n        this.listeners.clear();\n        this.anyListeners.clear();\n        this.outbox.length = 0;\n    }\n\n    /* -------------------------------------------------------------- *\n     * Internals\n     * -------------------------------------------------------------- */\n\n    private handleMessage(event: MessageEvent): void {\n        if (this.destroyed) return;\n\n        // Origin check: skip when targetOrigin is the wildcard. Warn (dev only) if a\n        // message that *looks* like ours is dropped on origin — a common \"why isn't my\n        // listener firing?\" cause.\n        if (this.targetOrigin !== \"*\" && event.origin !== this.targetOrigin) {\n            if (parseOutboundMessage(event.data)) {\n                devWarn(\n                    `[captello-sdk] Ignored a Captello message from origin \"${event.origin}\" ` +\n                        `(expected \"${this.targetOrigin}\"). Check the targetOrigin you passed.`,\n                );\n            }\n            return;\n        }\n\n        // Source check: only accept messages from the bound iframe's window.\n        if (this.matchSource) {\n            const expected = this.frame.contentWindow;\n            if (expected && event.source !== expected) {\n                if (parseOutboundMessage(event.data)) {\n                    devWarn(\n                        \"[captello-sdk] Ignored a Captello message from an unexpected source window \" +\n                            \"(not the bound iframe). If the webview relays through another window, set matchSource: false.\",\n                    );\n                }\n                return;\n            }\n        }\n\n        const message = parseOutboundMessage(event.data);\n        if (!message) return;\n\n        // Flip to ready (and flush queued sends) the moment the form loads, before\n        // dispatching to listeners — so a listener can send and have it post immediately.\n        if (message.type === OutboundMessageType.FormLoadComplete) {\n            this.markReadyAndFlush();\n        }\n\n        const set = this.listeners.get(message.type);\n        if (set) {\n            // Copy to a snapshot so a listener that unsubscribes mid-dispatch is safe.\n            for (const listener of [...set]) listener(message);\n        }\n        if (this.anyListeners.size) {\n            for (const listener of [...this.anyListeners]) listener(message);\n        }\n    }\n}\n"]}

package/dist/{client-3IBxKbIE.d.cts → client-BvE73qNT.d.ts}

@@ -1,18 +1,25 @@
 /**
- * Typed access to a submission's **visible** data — the list a host renders as
- * key/value pairs (one row per filled, visible form element).
+ * Types for a submission's **visible** data — the list a host renders as key/value
+ * pairs (one row per filled, visible form element).
  *
  * The webview emits this as `visible_submissions_data` inside the `submission_body`
- * payload: an array of items discriminated by `element_type`, where `element_value`'s
- * shape depends on the type. This module mirrors that contract and provides:
+ * payload: an array of {@link VisibleSubmissionDataItem}, discriminated by
+ * `element_type`, where `element_value`'s shape depends on the type. Narrow on
+ * `element_type` to get a precisely-typed `element_value` and render it however you
+ * like:
  *
- * - {@link parseVisibleSubmissionsData} — narrow `unknown` to typed items, dropping
- *   anything that doesn't match the contract.
- * - {@link toDisplayValue} / {@link toDisplayPairs} — flatten each item to a string
- *   (and `{ id, label, value }` rows) for direct rendering.
- *
- * For custom rendering, narrow on `element_type` and read the precisely-typed
- * `element_value` yourself.
+ * @example
+ * for (const item of submission.visible_submissions_data ?? []) {
+ *   switch (item.element_type) {
+ *     case FormElementType.email:
+ *       row(item.element_title, item.element_value); // element_value: string
+ *       break;
+ *     case FormElementType.checkbox:
+ *       // element_value: string[] | OrderCheckboxSubmissionData
+ *       break;
+ *     // …
+ *   }
+ * }
  */
 /**
  * Every form element type, mirroring the webview's `FormElementType`. The string
@@ -144,55 +151,6 @@ type VisibleSubmissionDataItem = {
         element_value: VisibleSubmissionElementValueMap[T];
     };
 }[VisibleSubmissionElementType];
-/**
- * Narrows `unknown` to a typed `VisibleSubmissionDataItem[]`, ready for rendering.
- *
- * Accepts, in order of convenience:
- * - the `visible_submissions_data` array itself,
- * - a `submission_body` payload object (the `data` of a `SubmissionBody` message) —
- *   its `visible_submissions_data` is extracted,
- * - anything else → `[]`.
- *
- * Items that don't match the contract (missing fields, structural/unknown
- * `element_type`) are dropped, so the result is always safe to map over.
- *
- * @example
- * webview.on(OutboundMessageType.SubmissionBody, (msg) => {
- *   const rows = toDisplayPairs(msg.data); // [{ elementId, label, value }, ...]
- *   render(rows);
- * });
- */
-declare function parseVisibleSubmissionsData(data: unknown): VisibleSubmissionDataItem[];
-/** Options for {@link toDisplayValue} / {@link toDisplayPairs}. */
-interface DisplayValueOptions {
-    /** Separator for list-like values (checkbox, image, …). Default `", "`. */
-    listSeparator?: string;
-    /** Labels for boolean values. Default `{ true: "Yes", false: "No" }`. */
-    booleanLabels?: {
-        true: string;
-        false: string;
-    };
-    /** Text used when a value is empty/blank. Default `""`. */
-    emptyText?: string;
-}
-/**
- * Flattens a single visible item's `element_value` to a human-readable string for
- * rendering — composites are joined, list/order values are summarized, booleans use
- * the configured labels. For full control, read `element_value` directly instead.
- */
-declare function toDisplayValue(item: VisibleSubmissionDataItem, options?: DisplayValueOptions): string;
-/** A render-ready key/value row. */
-interface SubmissionDisplayPair {
-    elementId: string;
-    label: string;
-    value: string;
-}
-/**
- * One-shot helper: parse `unknown` and map each visible item to a
- * `{ elementId, label, value }` row, where `value` is {@link toDisplayValue}'s output.
- * Ideal for rendering a submission as a key/value list.
- */
-declare function toDisplayPairs(data: unknown, options?: DisplayValueOptions): SubmissionDisplayPair[];
 
 /**
  * The message protocol exchanged between the Captello capture webview (the iframe)
@@ -222,7 +180,7 @@ declare enum OutboundMessageType {
      * submission body for the host to persist/forward.
      */
     SubmissionBody = "submission_body",
-    /** The form was submitted successfully (used in kiosk / quick-capture flows). */
+    /** The form was submitted successfully. `action` indicates whether it was a new submission or an update. */
     FormSubmitSuccess = "form_submit_success",
     /** Connexions: the host should perform the profile redirect (embed mode). */
     ConnexionsProfileRedirect = "connexions_profile_redirect",
@@ -252,8 +210,9 @@ interface SubmissionBody {
     data: Record<string, unknown>;
     /**
      * Visible, filled elements ready to render as key/value rows — one item per
-     * element, discriminated by `element_type`. Use {@link parseVisibleSubmissionsData}
-     * or {@link toDisplayPairs} to consume it. May be absent on older webview builds.
+     * element, discriminated by `element_type` (narrow on it for a precisely-typed
+     * `element_value`). See {@link VisibleSubmissionDataItem}. May be absent on older
+     * webview builds.
      */
     visible_submissions_data?: VisibleSubmissionDataItem[];
     submission_date: string;
@@ -280,6 +239,7 @@ interface FormLoadCompleteMessage {
 }
 interface FormSubmitSuccessMessage {
     type: OutboundMessageType.FormSubmitSuccess;
+    action: "create" | "update";
 }
 interface FormErrorMessageMessage {
     type: OutboundMessageType.FormErrorMessage;
@@ -407,8 +367,7 @@ interface CaptelloWebviewOptions {
     /**
      * Origin to validate incoming messages against and to target outgoing messages.
      * Strongly recommended — set it to the webview's origin (e.g.
-     * `"https://capture.captello.com"`). Use {@link targetOriginFromUrl} to derive it
-     * from the embed URL.
+     * `"https://capture.captello.com"`), e.g. `new URL(embedUrl).origin`.
      *
      * Defaults to `"*"`, which accepts messages from any origin and posts without an
      * origin check. Only acceptable for trusted/local development.
@@ -558,4 +517,4 @@ declare class CaptelloWebview {
     private handleMessage;
 }
 
-export { type AnyOutboundListener as A, type BusinessCardValue as B, type CaptelloWebviewOptions as C, type DisplayValueOptions as D, FormElementType as F, type InboundMessage as I, OutboundMessageType as O, type PrefillInfoItem as P, type SubmissionBody as S, type Unsubscribe as U, type ValidationTarget as V, type OutboundMessageMap as a, SubmissionError as b, SubmissionTimeoutError as c, type OutboundMessage as d, CaptelloWebview as e, type SubmissionPrefill as f, type AttachmentValue as g, type CompositeSubmissionValue as h, InboundMessageType as i, type OrderCheckboxSubmissionData as j, type OrderRadioSubmissionData as k, type OutboundListener as l, PrefillDataType as m, type SubmissionDisplayPair as n, type SubmissionQuestionData as o, type VisibleSubmissionDataItem as p, type VisibleSubmissionElementType as q, type VisibleSubmissionElementValueMap as r, parseOutboundMessage as s, parseVisibleSubmissionsData as t, toDisplayPairs as u, toDisplayValue as v };
+export { type AnyOutboundListener as A, type BusinessCardValue as B, type CaptelloWebviewOptions as C, FormElementType as F, type InboundMessage as I, OutboundMessageType as O, type PrefillInfoItem as P, type SubmissionBody as S, type Unsubscribe as U, type ValidationTarget as V, type OutboundMessageMap as a, SubmissionError as b, SubmissionTimeoutError as c, type OutboundMessage as d, CaptelloWebview as e, type SubmissionPrefill as f, type AttachmentValue as g, type CompositeSubmissionValue as h, InboundMessageType as i, type OrderCheckboxSubmissionData as j, type OrderRadioSubmissionData as k, type OutboundListener as l, PrefillDataType as m, type SubmissionQuestionData as n, type VisibleSubmissionDataItem as o, type VisibleSubmissionElementType as p, type VisibleSubmissionElementValueMap as q, parseOutboundMessage as r };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AnyOutboundListener, g as AttachmentValue, B as BusinessCardValue, e as CaptelloWebview, C as CaptelloWebviewOptions, h as CompositeSubmissionValue, D as DisplayValueOptions, F as FormElementType, I as InboundMessage, i as InboundMessageType, j as OrderCheckboxSubmissionData, k as OrderRadioSubmissionData, l as OutboundListener, d as OutboundMessage, a as OutboundMessageMap, O as OutboundMessageType, m as PrefillDataType, P as PrefillInfoItem, S as SubmissionBody, n as SubmissionDisplayPair, b as SubmissionError, f as SubmissionPrefill, o as SubmissionQuestionData, c as SubmissionTimeoutError, U as Unsubscribe, V as ValidationTarget, p as VisibleSubmissionDataItem, q as VisibleSubmissionElementType, r as VisibleSubmissionElementValueMap, s as parseOutboundMessage, t as parseVisibleSubmissionsData, u as toDisplayPairs, v as toDisplayValue } from './client-3IBxKbIE.js';
+export { A as AnyOutboundListener, g as AttachmentValue, B as BusinessCardValue, e as CaptelloWebview, C as CaptelloWebviewOptions, h as CompositeSubmissionValue, F as FormElementType, I as InboundMessage, i as InboundMessageType, j as OrderCheckboxSubmissionData, k as OrderRadioSubmissionData, l as OutboundListener, d as OutboundMessage, a as OutboundMessageMap, O as OutboundMessageType, m as PrefillDataType, P as PrefillInfoItem, S as SubmissionBody, b as SubmissionError, f as SubmissionPrefill, n as SubmissionQuestionData, c as SubmissionTimeoutError, U as Unsubscribe, V as ValidationTarget, o as VisibleSubmissionDataItem, p as VisibleSubmissionElementType, q as VisibleSubmissionElementValueMap, r as parseOutboundMessage } from './client-BvE73qNT.js';
 
 /**
  * Builder for the Captello capture webview embed URL.
@@ -58,6 +58,20 @@ declare enum ActionButtonPosition {
     Bottom = "1",
     Hidden = "2"
 }
+/** Supported webview languages. The wire value is the two-letter code. */
+declare enum Language {
+    Arabic = "ar",
+    German = "de",
+    English = "en",
+    Spanish = "es",
+    French = "fr",
+    Italian = "it",
+    Japanese = "ja",
+    Korean = "ko",
+    Dutch = "nl",
+    Portuguese = "pt",
+    Chinese = "zh"
+}
 /** Context for filtering form-fill actions, sent as the `useIn` param. */
 type UseInContext = "outbound" | "inbound" | "notes";
 /**
@@ -72,8 +86,7 @@ interface EmbedUrlOptions {
     mode?: FormMode;
     eventWebAccessToken?: string;
     activationId?: string | number;
-    /** Two-letter language code, e.g. `"en"`, `"de"`. */
-    language?: string;
+    language?: Language;
     actionButtonPosition?: ActionButtonPosition;
     formType?: FormType;
     launcher?: LauncherType;
@@ -94,28 +107,21 @@ interface EmbedUrlOptions {
     extraParams?: Record<string, string | number | boolean | undefined | null>;
 }
 /**
- * Builds an absolute embed URL from a base capture URL and typed options.
+ * Builds an absolute embed URL from a capture base URL and typed options.
  *
- * Existing query params on `baseUrl` are preserved; options override params with
- * the same key. The base may be any capture origin/path, e.g.
- * `"https://capture.captello.com/"`.
+ * You only need to pass the **capture origin** — the SDK appends the capture path for
+ * you. Passing the origin, the origin with a trailing slash, or the full
+ * `…/capture/submission` URL all produce the same correct result, so there's nothing to
+ * get wrong. Existing query params on `baseUrl` are preserved; options override params
+ * with the same key.
  *
  * @example
- * buildEmbedUrl("https://capture.captello.com/", {
- *   formId: 1234,
- *   mode: FormMode.Submit,
- *   launcher: LauncherType.EventGenWeb,
- *   language: "en",
- * });
- * // → "https://capture.captello.com/?f=1234&m=submit&launcher=event_gen_web&l=en"
+ * // All three are equivalent:
+ * buildEmbedUrl("https://capture.captello.com", { formId: 1234, mode: FormMode.Submit });
+ * buildEmbedUrl("https://capture.captello.com/", { formId: 1234, mode: FormMode.Submit });
+ * buildEmbedUrl("https://capture.captello.com/capture/submission", { formId: 1234, mode: FormMode.Submit });
+ * // → "https://capture.captello.com/capture/submission?f=1234&m=submit"
  */
 declare function buildEmbedUrl(baseUrl: string, options?: EmbedUrlOptions): string;
-/**
- * Extracts the origin of an embed URL — convenient for passing as the client's
- * `targetOrigin` so messages are scoped to the webview's origin.
- *
- * @example targetOriginFromUrl("https://capture.captello.com/?f=1") // "https://capture.captello.com"
- */
-declare function targetOriginFromUrl(embedUrl: string): string;
 
-export { ActionButtonPosition, EmbedParam, type EmbedUrlOptions, FormMode, type FormType, LauncherType, type SubmissionType, type UseInContext, buildEmbedUrl, targetOriginFromUrl };
+export { ActionButtonPosition, EmbedParam, type EmbedUrlOptions, FormMode, type FormType, Language, LauncherType, type SubmissionType, type UseInContext, buildEmbedUrl };