@descope/sdk-mixins 0.25.0 → 0.26.0

package/dist/cjs/index.js

@@ -28,6 +28,8 @@ var injectStyleMixin = require('./mixins/injectStyleMixin.js');
 var cspNonceMixin = require('./mixins/cspNonceMixin.js');
 var telemetryMixin = require('./mixins/telemetryMixin/telemetryMixin.js');
 var flowInputMixin = require('./mixins/flowInputMixin/flowInputMixin.js');
+var componentsConditionsMixin = require('./mixins/componentsConditionsMixin/componentsConditionsMixin.js');
+var applier = require('./mixins/componentsConditionsMixin/applier.js');
 
 
 
@@ -60,4 +62,7 @@ exports.injectStyleMixin = injectStyleMixin.injectStyleMixin;
 exports.cspNonceMixin = cspNonceMixin.cspNonceMixin;
 exports.telemetryMixin = telemetryMixin.telemetryMixin;
 exports.flowInputMixin = flowInputMixin.flowInputMixin;
+exports.componentsConditionsMixin = componentsConditionsMixin.componentsConditionsMixin;
+exports.applyComponentsState = applier.applyComponentsState;
+exports.clearComponentsState = applier.clearComponentsState;
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/cjs/mixins/componentsConditionsMixin/applier.js

@@ -0,0 +1,71 @@
+'use strict';
+
+// Applies server-computed component conditions (hide / disable / read-only) to a
+// widget's DOM. Mirrors the flow web-component applier, but targets widget
+// components by their `data-id` (widgets address components that way) and hides
+// via inline style + the `hidden` attribute rather than a `.hidden` class, which
+// widgets do not inject into their shadow DOM.
+const ATTR_SELECTOR_ESCAPE_PATTERN = /(["\\])/g;
+// CSS.escape with a narrow fallback for environments that lack it.
+function escapeSelector(value) {
+    if (typeof CSS !== 'undefined' && typeof CSS.escape === 'function') {
+        return CSS.escape(value);
+    }
+    return value.replace(ATTR_SELECTOR_ESCAPE_PATTERN, '\\$1');
+}
+// IDs can repeat, so match all.
+function findComponents(root, id) {
+    return Array.from(root.querySelectorAll(`[data-id="${escapeSelector(id)}"]`));
+}
+function applyAction(el, action) {
+    var _a;
+    switch (action) {
+        case 'hide':
+            el.setAttribute('hidden', '');
+            (_a = el.style) === null || _a === void 0 ? void 0 : _a.setProperty('display', 'none', 'important');
+            break;
+        case 'disable':
+            el.setAttribute('disabled', 'true');
+            break;
+        case 'read-only':
+            el.setAttribute('readonly', 'true');
+            break;
+        // Unknown action - ignore. A bad action shouldn't make it past the server.
+    }
+}
+function clearAction(el, action) {
+    var _a;
+    switch (action) {
+        case 'hide':
+            el.removeAttribute('hidden');
+            (_a = el.style) === null || _a === void 0 ? void 0 : _a.removeProperty('display');
+            break;
+        case 'disable':
+            el.removeAttribute('disabled');
+            break;
+        case 'read-only':
+            el.removeAttribute('readonly');
+            break;
+        // no-op
+    }
+}
+/** Applies the componentId -> action map to the matching elements under root. */
+function applyComponentsState(root, componentsState) {
+    if (!root || !componentsState)
+        return;
+    Object.entries(componentsState).forEach(([id, action]) => {
+        findComponents(root, id).forEach((el) => applyAction(el, action));
+    });
+}
+/** Reverts a previously-applied componentId -> action map. */
+function clearComponentsState(root, componentsState) {
+    if (!root || !componentsState)
+        return;
+    Object.entries(componentsState).forEach(([id, action]) => {
+        findComponents(root, id).forEach((el) => clearAction(el, action));
+    });
+}
+
+exports.applyComponentsState = applyComponentsState;
+exports.clearComponentsState = clearComponentsState;
+//# sourceMappingURL=applier.js.map

package/dist/cjs/mixins/componentsConditionsMixin/applier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applier.js","sources":["../../../../src/mixins/componentsConditionsMixin/applier.ts"],"sourcesContent":["// Applies server-computed component conditions (hide / disable / read-only) to a\n// widget's DOM. Mirrors the flow web-component applier, but targets widget\n// components by their `data-id` (widgets address components that way) and hides\n// via inline style + the `hidden` attribute rather than a `.hidden` class, which\n// widgets do not inject into their shadow DOM.\n\nconst ATTR_SELECTOR_ESCAPE_PATTERN = /([\"\\\\])/g;\n\n// CSS.escape with a narrow fallback for environments that lack it.\nfunction escapeSelector(value: string): string {\n  if (typeof CSS !== 'undefined' && typeof CSS.escape === 'function') {\n    return CSS.escape(value);\n  }\n  return value.replace(ATTR_SELECTOR_ESCAPE_PATTERN, '\\\\$1');\n}\n\n// IDs can repeat, so match all.\nfunction findComponents(root: ParentNode, id: string): Element[] {\n  return Array.from(root.querySelectorAll(`[data-id=\"${escapeSelector(id)}\"]`));\n}\n\nfunction applyAction(el: Element, action: string): void {\n  switch (action) {\n    case 'hide':\n      el.setAttribute('hidden', '');\n      (el as HTMLElement).style?.setProperty('display', 'none', 'important');\n      break;\n    case 'disable':\n      el.setAttribute('disabled', 'true');\n      break;\n    case 'read-only':\n      el.setAttribute('readonly', 'true');\n      break;\n    default:\n    // Unknown action - ignore. A bad action shouldn't make it past the server.\n  }\n}\n\nfunction clearAction(el: Element, action: string): void {\n  switch (action) {\n    case 'hide':\n      el.removeAttribute('hidden');\n      (el as HTMLElement).style?.removeProperty('display');\n      break;\n    case 'disable':\n      el.removeAttribute('disabled');\n      break;\n    case 'read-only':\n      el.removeAttribute('readonly');\n      break;\n    default:\n    // no-op\n  }\n}\n\n/** Applies the componentId -> action map to the matching elements under root. */\nexport function applyComponentsState(\n  root: ParentNode | null | undefined,\n  componentsState: Record<string, string> | undefined,\n): void {\n  if (!root || !componentsState) return;\n  Object.entries(componentsState).forEach(([id, action]) => {\n    findComponents(root, id).forEach((el) => applyAction(el, action));\n  });\n}\n\n/** Reverts a previously-applied componentId -> action map. */\nexport function clearComponentsState(\n  root: ParentNode | null | undefined,\n  componentsState: Record<string, string> | undefined,\n): void {\n  if (!root || !componentsState) return;\n  Object.entries(componentsState).forEach(([id, action]) => {\n    findComponents(root, id).forEach((el) => clearAction(el, action));\n  });\n}\n"],"names":[],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AAEA,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEhD;AACA,SAAS,cAAc,CAAC,KAAa,EAAA;AACnC,IAAA,IAAI,OAAO,GAAG,KAAK,WAAW,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE;AAClE,QAAA,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KAC1B;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED;AACA,SAAS,cAAc,CAAC,IAAgB,EAAE,EAAU,EAAA;AAClD,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAa,UAAA,EAAA,cAAc,CAAC,EAAE,CAAC,CAAI,EAAA,CAAA,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,EAAW,EAAE,MAAc,EAAA;;IAC9C,QAAQ,MAAM;AACZ,QAAA,KAAK,MAAM;AACT,YAAA,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC9B,YAAA,CAAA,EAAA,GAAC,EAAkB,CAAC,KAAK,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YACvE,MAAM;AACR,QAAA,KAAK,SAAS;AACZ,YAAA,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM;AACR,QAAA,KAAK,WAAW;AACd,YAAA,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM;;KAGT;AACH,CAAC;AAED,SAAS,WAAW,CAAC,EAAW,EAAE,MAAc,EAAA;;IAC9C,QAAQ,MAAM;AACZ,QAAA,KAAK,MAAM;AACT,YAAA,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,EAAA,GAAA,EAAkB,CAAC,KAAK,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAE,cAAc,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM;AACR,QAAA,KAAK,SAAS;AACZ,YAAA,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM;AACR,QAAA,KAAK,WAAW;AACd,YAAA,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM;;KAGT;AACH,CAAC;AAED;AACgB,SAAA,oBAAoB,CAClC,IAAmC,EACnC,eAAmD,EAAA;AAEnD,IAAA,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO;AACtC,IAAA,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,KAAI;QACvD,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,KAAC,CAAC,CAAC;AACL,CAAC;AAED;AACgB,SAAA,oBAAoB,CAClC,IAAmC,EACnC,eAAmD,EAAA;AAEnD,IAAA,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO;AACtC,IAAA,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,KAAI;QACvD,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,KAAC,CAAC,CAAC;AACL;;;;;"}

package/dist/cjs/mixins/componentsConditionsMixin/componentsConditionsMixin.js

@@ -0,0 +1,103 @@
+'use strict';
+
+var tslib = require('tslib');
+var sdkHelpers = require('@descope/sdk-helpers');
+var loggerMixin = require('../loggerMixin/loggerMixin.js');
+var initElementMixin = require('../initElementMixin.js');
+var applier = require('./applier.js');
+
+const COMPONENTS_STATE_PATH = '/v1/mgmt/widget/components-state';
+/**
+ * Shared widget mixin that fetches the server-computed component conditions
+ * verdict for the current user and applies hide/disable/read-only to the widget
+ * DOM. Server-side only - no client-side re-evaluation. Compose it LAST in a
+ * widget's initMixin so its init wraps the widget's render.
+ *
+ * It reuses the widget's existing web-js-sdk httpClient (`this.api.httpClient`),
+ * so `apiMixin` must be composed and `createSdk` must return `httpClient`. A
+ * missing client is a wiring mistake, surfaced loudly (throw) rather than
+ * silently rendering everything; a runtime fetch failure fails open instead.
+ */
+const componentsConditionsMixin = sdkHelpers.createSingletonMixin((superclass) => {
+    var _ComponentsConditionsMixinClass_instances, _ComponentsConditionsMixinClass_statePromise, _ComponentsConditionsMixinClass_appliedState, _ComponentsConditionsMixinClass_requireHttpClient, _ComponentsConditionsMixinClass_fetchComponentsState, _a;
+    // NB: do not compose initLifecycleMixin here - its empty init() has no
+    // super.init() call and would shadow the widget's render init.
+    const BaseClass = sdkHelpers.compose(loggerMixin.loggerMixin, initElementMixin.initElementMixin)(superclass);
+    return _a = class ComponentsConditionsMixinClass extends BaseClass {
+            constructor() {
+                super(...arguments);
+                _ComponentsConditionsMixinClass_instances.add(this);
+                _ComponentsConditionsMixinClass_statePromise.set(this, void 0);
+                _ComponentsConditionsMixinClass_appliedState.set(this, {});
+            }
+            async init() {
+                var _b, _c;
+                if (this.getAttribute('mock') === 'true') {
+                    // Mock mode (demos / e2e) has no backend - skip the fetch, hide nothing.
+                    tslib.__classPrivateFieldSet(this, _ComponentsConditionsMixinClass_statePromise, Promise.resolve({}), "f");
+                    await ((_b = super.init) === null || _b === void 0 ? void 0 : _b.call(this));
+                    return;
+                }
+                // Resolve the client up front so a wiring mistake throws before the
+                // fetch's fail-open path can swallow it.
+                const httpClient = tslib.__classPrivateFieldGet(this, _ComponentsConditionsMixinClass_instances, "m", _ComponentsConditionsMixinClass_requireHttpClient).call(this);
+                // Fire immediately so it overlaps the page/data fetch super.init runs.
+                tslib.__classPrivateFieldSet(this, _ComponentsConditionsMixinClass_statePromise, tslib.__classPrivateFieldGet(this, _ComponentsConditionsMixinClass_instances, "m", _ComponentsConditionsMixinClass_fetchComponentsState).call(this, httpClient), "f");
+                await ((_c = super.init) === null || _c === void 0 ? void 0 : _c.call(this));
+            }
+            async onWidgetRootReady() {
+                var _b, _c;
+                // @ts-expect-error onWidgetRootReady is provided by the widget's initWidgetRootMixin
+                await ((_b = super.onWidgetRootReady) === null || _b === void 0 ? void 0 : _b.call(this));
+                // Apply once the DOM exists and component values are populated, before the
+                // widget dispatches 'ready'. Awaiting here bounds any added latency to
+                // max(0, conditionsFetch - pageFetch).
+                tslib.__classPrivateFieldSet(this, _ComponentsConditionsMixinClass_appliedState, (_c = (await tslib.__classPrivateFieldGet(this, _ComponentsConditionsMixinClass_statePromise, "f"))) !== null && _c !== void 0 ? _c : {}, "f");
+                applier.applyComponentsState(this.contentRootElement, tslib.__classPrivateFieldGet(this, _ComponentsConditionsMixinClass_appliedState, "f"));
+            }
+            /**
+             * Re-fetch and re-apply after the widget mutates data the conditions read
+             * (e.g. a profile save). Public hook for the upcoming re-evaluate-on-mutation
+             * work - no widget wires it to its mutating flows yet.
+             */
+            async reevaluateComponentsState() {
+                const httpClient = tslib.__classPrivateFieldGet(this, _ComponentsConditionsMixinClass_instances, "m", _ComponentsConditionsMixinClass_requireHttpClient).call(this);
+                applier.clearComponentsState(this.contentRootElement, tslib.__classPrivateFieldGet(this, _ComponentsConditionsMixinClass_appliedState, "f"));
+                tslib.__classPrivateFieldSet(this, _ComponentsConditionsMixinClass_appliedState, await tslib.__classPrivateFieldGet(this, _ComponentsConditionsMixinClass_instances, "m", _ComponentsConditionsMixinClass_fetchComponentsState).call(this, httpClient), "f");
+                applier.applyComponentsState(this.contentRootElement, tslib.__classPrivateFieldGet(this, _ComponentsConditionsMixinClass_appliedState, "f"));
+            }
+        },
+        _ComponentsConditionsMixinClass_statePromise = new WeakMap(),
+        _ComponentsConditionsMixinClass_appliedState = new WeakMap(),
+        _ComponentsConditionsMixinClass_instances = new WeakSet(),
+        _ComponentsConditionsMixinClass_requireHttpClient = function _ComponentsConditionsMixinClass_requireHttpClient() {
+            var _b;
+            const httpClient = (_b = this.api) === null || _b === void 0 ? void 0 : _b.httpClient;
+            if (!httpClient) {
+                // Developer misconfiguration (apiMixin not composed, or createSdk does
+                // not expose httpClient) - fail loud so it is caught in development.
+                throw new Error('componentsConditionsMixin: the widget sdk must expose `httpClient`. Compose apiMixin and return `webSdk.httpClient` from createSdk.');
+            }
+            return httpClient;
+        },
+        _ComponentsConditionsMixinClass_fetchComponentsState = async function _ComponentsConditionsMixinClass_fetchComponentsState(httpClient) {
+            var _b;
+            try {
+                const res = await httpClient.get(COMPONENTS_STATE_PATH);
+                if (!(res === null || res === void 0 ? void 0 : res.ok))
+                    return {};
+                const body = await res.json();
+                return (_b = body === null || body === void 0 ? void 0 : body.componentsState) !== null && _b !== void 0 ? _b : {};
+            }
+            catch (e) {
+                // Fail open: render everything. UI hiding is presentation, not access
+                // control - sensitive data stays gated by the widget's data API.
+                this.logger.debug('components-conditions: failed to fetch, showing all components', e === null || e === void 0 ? void 0 : e.message);
+                return {};
+            }
+        },
+        _a;
+});
+
+exports.componentsConditionsMixin = componentsConditionsMixin;
+//# sourceMappingURL=componentsConditionsMixin.js.map

package/dist/cjs/mixins/componentsConditionsMixin/componentsConditionsMixin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentsConditionsMixin.js","sources":["../../../../src/mixins/componentsConditionsMixin/componentsConditionsMixin.ts"],"sourcesContent":["import { compose, createSingletonMixin } from '@descope/sdk-helpers';\nimport { loggerMixin } from '../loggerMixin';\nimport { initElementMixin } from '../initElementMixin';\nimport { applyComponentsState, clearComponentsState } from './applier';\n\ntype ComponentsState = Record<string, string>;\n\nconst COMPONENTS_STATE_PATH = '/v1/mgmt/widget/components-state';\n\n// The widget's sdk (built by apiMixin) is expected to expose the client here.\ninterface ComponentsConditionsHost {\n  api?: { httpClient?: ConditionsHttpClient };\n}\n\n// Minimal client contract the mixin needs. Widgets expose their existing\n// web-js-sdk httpClient (the same instance used for every other API call),\n// narrowed to this so no web-js-sdk/core-js-sdk type leaks into the widget's\n// public sdk surface. Declared last (with the mixin) to satisfy import/exports-last.\nexport interface ConditionsHttpClient {\n  get: (path: string) => Promise<Response>;\n}\n\n/**\n * Shared widget mixin that fetches the server-computed component conditions\n * verdict for the current user and applies hide/disable/read-only to the widget\n * DOM. Server-side only - no client-side re-evaluation. Compose it LAST in a\n * widget's initMixin so its init wraps the widget's render.\n *\n * It reuses the widget's existing web-js-sdk httpClient (`this.api.httpClient`),\n * so `apiMixin` must be composed and `createSdk` must return `httpClient`. A\n * missing client is a wiring mistake, surfaced loudly (throw) rather than\n * silently rendering everything; a runtime fetch failure fails open instead.\n */\nexport const componentsConditionsMixin = createSingletonMixin(\n  <T extends CustomElementConstructor>(superclass: T) => {\n    // NB: do not compose initLifecycleMixin here - its empty init() has no\n    // super.init() call and would shadow the widget's render init.\n    const BaseClass = compose(loggerMixin, initElementMixin)(superclass);\n\n    return class ComponentsConditionsMixinClass extends BaseClass {\n      #statePromise?: Promise<ComponentsState>;\n\n      #appliedState: ComponentsState = {};\n\n      #requireHttpClient(): ConditionsHttpClient {\n        const httpClient = (this as unknown as ComponentsConditionsHost).api\n          ?.httpClient;\n        if (!httpClient) {\n          // Developer misconfiguration (apiMixin not composed, or createSdk does\n          // not expose httpClient) - fail loud so it is caught in development.\n          throw new Error(\n            'componentsConditionsMixin: the widget sdk must expose `httpClient`. Compose apiMixin and return `webSdk.httpClient` from createSdk.',\n          );\n        }\n        return httpClient;\n      }\n\n      async #fetchComponentsState(\n        httpClient: ConditionsHttpClient,\n      ): Promise<ComponentsState> {\n        try {\n          const res = await httpClient.get(COMPONENTS_STATE_PATH);\n          if (!res?.ok) return {};\n          const body = await res.json();\n          return body?.componentsState ?? {};\n        } catch (e) {\n          // Fail open: render everything. UI hiding is presentation, not access\n          // control - sensitive data stays gated by the widget's data API.\n          this.logger.debug(\n            'components-conditions: failed to fetch, showing all components',\n            (e as Error)?.message,\n          );\n          return {};\n        }\n      }\n\n      async init() {\n        if (this.getAttribute('mock') === 'true') {\n          // Mock mode (demos / e2e) has no backend - skip the fetch, hide nothing.\n          this.#statePromise = Promise.resolve({});\n          await super.init?.();\n          return;\n        }\n        // Resolve the client up front so a wiring mistake throws before the\n        // fetch's fail-open path can swallow it.\n        const httpClient = this.#requireHttpClient();\n        // Fire immediately so it overlaps the page/data fetch super.init runs.\n        this.#statePromise = this.#fetchComponentsState(httpClient);\n        await super.init?.();\n      }\n\n      async onWidgetRootReady() {\n        // @ts-expect-error onWidgetRootReady is provided by the widget's initWidgetRootMixin\n        await super.onWidgetRootReady?.();\n        // Apply once the DOM exists and component values are populated, before the\n        // widget dispatches 'ready'. Awaiting here bounds any added latency to\n        // max(0, conditionsFetch - pageFetch).\n        this.#appliedState = (await this.#statePromise) ?? {};\n        applyComponentsState(this.contentRootElement, this.#appliedState);\n      }\n\n      /**\n       * Re-fetch and re-apply after the widget mutates data the conditions read\n       * (e.g. a profile save). Public hook for the upcoming re-evaluate-on-mutation\n       * work - no widget wires it to its mutating flows yet.\n       */\n      async reevaluateComponentsState() {\n        const httpClient = this.#requireHttpClient();\n        clearComponentsState(this.contentRootElement, this.#appliedState);\n        this.#appliedState = await this.#fetchComponentsState(httpClient);\n        applyComponentsState(this.contentRootElement, this.#appliedState);\n      }\n    };\n  },\n);\n"],"names":["createSingletonMixin","compose","loggerMixin","initElementMixin","__classPrivateFieldSet","__classPrivateFieldGet","applyComponentsState","clearComponentsState"],"mappings":";;;;;;;;AAOA,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AAejE;;;;;;;;;;AAUG;MACU,yBAAyB,GAAGA,+BAAoB,CAC3D,CAAqC,UAAa,KAAI;;;;IAGpD,MAAM,SAAS,GAAGC,kBAAO,CAACC,uBAAW,EAAEC,iCAAgB,CAAC,CAAC,UAAU,CAAC,CAAC;IAErE,OAAO,EAAA,GAAA,MAAM,8BAA+B,SAAQ,SAAS,CAAA;AAAtD,YAAA,WAAA,GAAA;;;gBACL,4CAAyC,CAAA,GAAA,CAAA,IAAA,EAAA,KAAA,CAAA,CAAA,CAAA;AAEzC,gBAAA,4CAAA,CAAA,GAAA,CAAA,IAAA,EAAiC,EAAE,CAAC,CAAA;aAsErC;AApCC,YAAA,MAAM,IAAI,GAAA;;gBACR,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE;;oBAExCC,4BAAA,CAAA,IAAI,gDAAiB,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA,GAAA,CAAA,CAAC;AACzC,oBAAA,OAAM,CAAA,EAAA,GAAA,KAAK,CAAC,IAAI,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,IAAA,CAAA,IAAA,CAAI,CAAA,CAAC;oBACrB,OAAO;iBACR;;;gBAGD,MAAM,UAAU,GAAGC,4BAAA,CAAA,IAAI,oGAAmB,CAAvB,IAAA,CAAA,IAAI,CAAqB,CAAC;;gBAE7CD,4BAAA,CAAA,IAAI,EAAiB,4CAAA,EAAAC,4BAAA,CAAA,IAAI,EAAA,yCAAA,EAAA,GAAA,EAAA,oDAAA,CAAsB,CAA1B,IAAA,CAAA,IAAI,EAAuB,UAAU,CAAC,EAAA,GAAA,CAAA,CAAC;AAC5D,gBAAA,OAAM,CAAA,EAAA,GAAA,KAAK,CAAC,IAAI,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,IAAA,CAAA,IAAA,CAAI,CAAA,CAAC;aACtB;AAED,YAAA,MAAM,iBAAiB,GAAA;;;AAErB,gBAAA,OAAM,CAAA,EAAA,GAAA,KAAK,CAAC,iBAAiB,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,IAAA,CAAA,IAAA,CAAI,CAAA,CAAC;;;;AAIlC,gBAAAD,4BAAA,CAAA,IAAI,EAAA,4CAAA,EAAiB,CAAA,EAAA,IAAC,MAAMC,4BAAA,CAAA,IAAI,EAAA,4CAAA,EAAA,GAAA,CAAc,CAAC,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,EAAA,GAAI,EAAE,EAAA,GAAA,CAAA,CAAC;gBACtDC,4BAAoB,CAAC,IAAI,CAAC,kBAAkB,EAAED,4BAAA,CAAA,IAAI,EAAc,4CAAA,EAAA,GAAA,CAAA,CAAC,CAAC;aACnE;AAED;;;;AAIG;AACH,YAAA,MAAM,yBAAyB,GAAA;gBAC7B,MAAM,UAAU,GAAGA,4BAAA,CAAA,IAAI,oGAAmB,CAAvB,IAAA,CAAA,IAAI,CAAqB,CAAC;gBAC7CE,4BAAoB,CAAC,IAAI,CAAC,kBAAkB,EAAEF,4BAAA,CAAA,IAAI,EAAc,4CAAA,EAAA,GAAA,CAAA,CAAC,CAAC;AAClE,gBAAAD,4BAAA,CAAA,IAAI,EAAA,4CAAA,EAAiB,MAAMC,4BAAA,CAAA,IAAI,EAAA,yCAAA,EAAA,GAAA,EAAA,oDAAA,CAAsB,CAA1B,IAAA,CAAA,IAAI,EAAuB,UAAU,CAAC,EAAA,GAAA,CAAA,CAAC;gBAClEC,4BAAoB,CAAC,IAAI,CAAC,kBAAkB,EAAED,4BAAA,CAAA,IAAI,EAAc,4CAAA,EAAA,GAAA,CAAA,CAAC,CAAC;aACnE;AACF,SAAA;;;;;;YAnEG,MAAM,UAAU,GAAG,CAAC,EAAA,GAAA,IAA4C,CAAC,GAAG,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAChE,UAAU,CAAC;YACf,IAAI,CAAC,UAAU,EAAE;;;AAGf,gBAAA,MAAM,IAAI,KAAK,CACb,qIAAqI,CACtI,CAAC;aACH;AACD,YAAA,OAAO,UAAU,CAAC;SACnB;AAED,QAAA,oDAAA,GAAA,oEACE,UAAgC,EAAA;;AAEhC,YAAA,IAAI;gBACF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBACxD,IAAI,EAAC,GAAG,KAAA,IAAA,IAAH,GAAG,KAAH,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,GAAG,CAAE,EAAE,CAAA;AAAE,oBAAA,OAAO,EAAE,CAAC;AACxB,gBAAA,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,OAAO,CAAA,EAAA,GAAA,IAAI,KAAA,IAAA,IAAJ,IAAI,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAJ,IAAI,CAAE,eAAe,MAAI,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,EAAA,GAAA,EAAE,CAAC;aACpC;YAAC,OAAO,CAAC,EAAE;;;AAGV,gBAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gEAAgE,EAC/D,CAAW,KAAA,IAAA,IAAX,CAAC,KAAD,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,CAAC,CAAY,OAAO,CACtB,CAAC;AACF,gBAAA,OAAO,EAAE,CAAC;aACX;SACF;AAsCD,QAAA,EAAA,CAAA;AACJ,CAAC;;;;"}

package/dist/esm/index.js

@@ -26,4 +26,6 @@ export { injectStyleMixin } from './mixins/injectStyleMixin.js';
 export { cspNonceMixin } from './mixins/cspNonceMixin.js';
 export { telemetryMixin } from './mixins/telemetryMixin/telemetryMixin.js';
 export { flowInputMixin } from './mixins/flowInputMixin/flowInputMixin.js';
+export { componentsConditionsMixin } from './mixins/componentsConditionsMixin/componentsConditionsMixin.js';
+export { applyComponentsState, clearComponentsState } from './mixins/componentsConditionsMixin/applier.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/esm/mixins/componentsConditionsMixin/applier.js

@@ -0,0 +1,68 @@
+// Applies server-computed component conditions (hide / disable / read-only) to a
+// widget's DOM. Mirrors the flow web-component applier, but targets widget
+// components by their `data-id` (widgets address components that way) and hides
+// via inline style + the `hidden` attribute rather than a `.hidden` class, which
+// widgets do not inject into their shadow DOM.
+const ATTR_SELECTOR_ESCAPE_PATTERN = /(["\\])/g;
+// CSS.escape with a narrow fallback for environments that lack it.
+function escapeSelector(value) {
+    if (typeof CSS !== 'undefined' && typeof CSS.escape === 'function') {
+        return CSS.escape(value);
+    }
+    return value.replace(ATTR_SELECTOR_ESCAPE_PATTERN, '\\$1');
+}
+// IDs can repeat, so match all.
+function findComponents(root, id) {
+    return Array.from(root.querySelectorAll(`[data-id="${escapeSelector(id)}"]`));
+}
+function applyAction(el, action) {
+    var _a;
+    switch (action) {
+        case 'hide':
+            el.setAttribute('hidden', '');
+            (_a = el.style) === null || _a === void 0 ? void 0 : _a.setProperty('display', 'none', 'important');
+            break;
+        case 'disable':
+            el.setAttribute('disabled', 'true');
+            break;
+        case 'read-only':
+            el.setAttribute('readonly', 'true');
+            break;
+        // Unknown action - ignore. A bad action shouldn't make it past the server.
+    }
+}
+function clearAction(el, action) {
+    var _a;
+    switch (action) {
+        case 'hide':
+            el.removeAttribute('hidden');
+            (_a = el.style) === null || _a === void 0 ? void 0 : _a.removeProperty('display');
+            break;
+        case 'disable':
+            el.removeAttribute('disabled');
+            break;
+        case 'read-only':
+            el.removeAttribute('readonly');
+            break;
+        // no-op
+    }
+}
+/** Applies the componentId -> action map to the matching elements under root. */
+function applyComponentsState(root, componentsState) {
+    if (!root || !componentsState)
+        return;
+    Object.entries(componentsState).forEach(([id, action]) => {
+        findComponents(root, id).forEach((el) => applyAction(el, action));
+    });
+}
+/** Reverts a previously-applied componentId -> action map. */
+function clearComponentsState(root, componentsState) {
+    if (!root || !componentsState)
+        return;
+    Object.entries(componentsState).forEach(([id, action]) => {
+        findComponents(root, id).forEach((el) => clearAction(el, action));
+    });
+}
+
+export { applyComponentsState, clearComponentsState };
+//# sourceMappingURL=applier.js.map

package/dist/esm/mixins/componentsConditionsMixin/applier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applier.js","sources":["../../../../src/mixins/componentsConditionsMixin/applier.ts"],"sourcesContent":["// Applies server-computed component conditions (hide / disable / read-only) to a\n// widget's DOM. Mirrors the flow web-component applier, but targets widget\n// components by their `data-id` (widgets address components that way) and hides\n// via inline style + the `hidden` attribute rather than a `.hidden` class, which\n// widgets do not inject into their shadow DOM.\n\nconst ATTR_SELECTOR_ESCAPE_PATTERN = /([\"\\\\])/g;\n\n// CSS.escape with a narrow fallback for environments that lack it.\nfunction escapeSelector(value: string): string {\n  if (typeof CSS !== 'undefined' && typeof CSS.escape === 'function') {\n    return CSS.escape(value);\n  }\n  return value.replace(ATTR_SELECTOR_ESCAPE_PATTERN, '\\\\$1');\n}\n\n// IDs can repeat, so match all.\nfunction findComponents(root: ParentNode, id: string): Element[] {\n  return Array.from(root.querySelectorAll(`[data-id=\"${escapeSelector(id)}\"]`));\n}\n\nfunction applyAction(el: Element, action: string): void {\n  switch (action) {\n    case 'hide':\n      el.setAttribute('hidden', '');\n      (el as HTMLElement).style?.setProperty('display', 'none', 'important');\n      break;\n    case 'disable':\n      el.setAttribute('disabled', 'true');\n      break;\n    case 'read-only':\n      el.setAttribute('readonly', 'true');\n      break;\n    default:\n    // Unknown action - ignore. A bad action shouldn't make it past the server.\n  }\n}\n\nfunction clearAction(el: Element, action: string): void {\n  switch (action) {\n    case 'hide':\n      el.removeAttribute('hidden');\n      (el as HTMLElement).style?.removeProperty('display');\n      break;\n    case 'disable':\n      el.removeAttribute('disabled');\n      break;\n    case 'read-only':\n      el.removeAttribute('readonly');\n      break;\n    default:\n    // no-op\n  }\n}\n\n/** Applies the componentId -> action map to the matching elements under root. */\nexport function applyComponentsState(\n  root: ParentNode | null | undefined,\n  componentsState: Record<string, string> | undefined,\n): void {\n  if (!root || !componentsState) return;\n  Object.entries(componentsState).forEach(([id, action]) => {\n    findComponents(root, id).forEach((el) => applyAction(el, action));\n  });\n}\n\n/** Reverts a previously-applied componentId -> action map. */\nexport function clearComponentsState(\n  root: ParentNode | null | undefined,\n  componentsState: Record<string, string> | undefined,\n): void {\n  if (!root || !componentsState) return;\n  Object.entries(componentsState).forEach(([id, action]) => {\n    findComponents(root, id).forEach((el) => clearAction(el, action));\n  });\n}\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AAEA,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEhD;AACA,SAAS,cAAc,CAAC,KAAa,EAAA;AACnC,IAAA,IAAI,OAAO,GAAG,KAAK,WAAW,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE;AAClE,QAAA,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KAC1B;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED;AACA,SAAS,cAAc,CAAC,IAAgB,EAAE,EAAU,EAAA;AAClD,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAa,UAAA,EAAA,cAAc,CAAC,EAAE,CAAC,CAAI,EAAA,CAAA,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,EAAW,EAAE,MAAc,EAAA;;IAC9C,QAAQ,MAAM;AACZ,QAAA,KAAK,MAAM;AACT,YAAA,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC9B,YAAA,CAAA,EAAA,GAAC,EAAkB,CAAC,KAAK,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YACvE,MAAM;AACR,QAAA,KAAK,SAAS;AACZ,YAAA,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM;AACR,QAAA,KAAK,WAAW;AACd,YAAA,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM;;KAGT;AACH,CAAC;AAED,SAAS,WAAW,CAAC,EAAW,EAAE,MAAc,EAAA;;IAC9C,QAAQ,MAAM;AACZ,QAAA,KAAK,MAAM;AACT,YAAA,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,EAAA,GAAA,EAAkB,CAAC,KAAK,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAE,cAAc,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM;AACR,QAAA,KAAK,SAAS;AACZ,YAAA,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM;AACR,QAAA,KAAK,WAAW;AACd,YAAA,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM;;KAGT;AACH,CAAC;AAED;AACgB,SAAA,oBAAoB,CAClC,IAAmC,EACnC,eAAmD,EAAA;AAEnD,IAAA,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO;AACtC,IAAA,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,KAAI;QACvD,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,KAAC,CAAC,CAAC;AACL,CAAC;AAED;AACgB,SAAA,oBAAoB,CAClC,IAAmC,EACnC,eAAmD,EAAA;AAEnD,IAAA,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO;AACtC,IAAA,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,KAAI;QACvD,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,KAAC,CAAC,CAAC;AACL;;;;"}

package/dist/esm/mixins/componentsConditionsMixin/componentsConditionsMixin.js

@@ -0,0 +1,101 @@
+import { __classPrivateFieldSet, __classPrivateFieldGet } from 'tslib';
+import { createSingletonMixin, compose } from '@descope/sdk-helpers';
+import { loggerMixin } from '../loggerMixin/loggerMixin.js';
+import { initElementMixin } from '../initElementMixin.js';
+import { applyComponentsState, clearComponentsState } from './applier.js';
+
+const COMPONENTS_STATE_PATH = '/v1/mgmt/widget/components-state';
+/**
+ * Shared widget mixin that fetches the server-computed component conditions
+ * verdict for the current user and applies hide/disable/read-only to the widget
+ * DOM. Server-side only - no client-side re-evaluation. Compose it LAST in a
+ * widget's initMixin so its init wraps the widget's render.
+ *
+ * It reuses the widget's existing web-js-sdk httpClient (`this.api.httpClient`),
+ * so `apiMixin` must be composed and `createSdk` must return `httpClient`. A
+ * missing client is a wiring mistake, surfaced loudly (throw) rather than
+ * silently rendering everything; a runtime fetch failure fails open instead.
+ */
+const componentsConditionsMixin = createSingletonMixin((superclass) => {
+    var _ComponentsConditionsMixinClass_instances, _ComponentsConditionsMixinClass_statePromise, _ComponentsConditionsMixinClass_appliedState, _ComponentsConditionsMixinClass_requireHttpClient, _ComponentsConditionsMixinClass_fetchComponentsState, _a;
+    // NB: do not compose initLifecycleMixin here - its empty init() has no
+    // super.init() call and would shadow the widget's render init.
+    const BaseClass = compose(loggerMixin, initElementMixin)(superclass);
+    return _a = class ComponentsConditionsMixinClass extends BaseClass {
+            constructor() {
+                super(...arguments);
+                _ComponentsConditionsMixinClass_instances.add(this);
+                _ComponentsConditionsMixinClass_statePromise.set(this, void 0);
+                _ComponentsConditionsMixinClass_appliedState.set(this, {});
+            }
+            async init() {
+                var _b, _c;
+                if (this.getAttribute('mock') === 'true') {
+                    // Mock mode (demos / e2e) has no backend - skip the fetch, hide nothing.
+                    __classPrivateFieldSet(this, _ComponentsConditionsMixinClass_statePromise, Promise.resolve({}), "f");
+                    await ((_b = super.init) === null || _b === void 0 ? void 0 : _b.call(this));
+                    return;
+                }
+                // Resolve the client up front so a wiring mistake throws before the
+                // fetch's fail-open path can swallow it.
+                const httpClient = __classPrivateFieldGet(this, _ComponentsConditionsMixinClass_instances, "m", _ComponentsConditionsMixinClass_requireHttpClient).call(this);
+                // Fire immediately so it overlaps the page/data fetch super.init runs.
+                __classPrivateFieldSet(this, _ComponentsConditionsMixinClass_statePromise, __classPrivateFieldGet(this, _ComponentsConditionsMixinClass_instances, "m", _ComponentsConditionsMixinClass_fetchComponentsState).call(this, httpClient), "f");
+                await ((_c = super.init) === null || _c === void 0 ? void 0 : _c.call(this));
+            }
+            async onWidgetRootReady() {
+                var _b, _c;
+                // @ts-expect-error onWidgetRootReady is provided by the widget's initWidgetRootMixin
+                await ((_b = super.onWidgetRootReady) === null || _b === void 0 ? void 0 : _b.call(this));
+                // Apply once the DOM exists and component values are populated, before the
+                // widget dispatches 'ready'. Awaiting here bounds any added latency to
+                // max(0, conditionsFetch - pageFetch).
+                __classPrivateFieldSet(this, _ComponentsConditionsMixinClass_appliedState, (_c = (await __classPrivateFieldGet(this, _ComponentsConditionsMixinClass_statePromise, "f"))) !== null && _c !== void 0 ? _c : {}, "f");
+                applyComponentsState(this.contentRootElement, __classPrivateFieldGet(this, _ComponentsConditionsMixinClass_appliedState, "f"));
+            }
+            /**
+             * Re-fetch and re-apply after the widget mutates data the conditions read
+             * (e.g. a profile save). Public hook for the upcoming re-evaluate-on-mutation
+             * work - no widget wires it to its mutating flows yet.
+             */
+            async reevaluateComponentsState() {
+                const httpClient = __classPrivateFieldGet(this, _ComponentsConditionsMixinClass_instances, "m", _ComponentsConditionsMixinClass_requireHttpClient).call(this);
+                clearComponentsState(this.contentRootElement, __classPrivateFieldGet(this, _ComponentsConditionsMixinClass_appliedState, "f"));
+                __classPrivateFieldSet(this, _ComponentsConditionsMixinClass_appliedState, await __classPrivateFieldGet(this, _ComponentsConditionsMixinClass_instances, "m", _ComponentsConditionsMixinClass_fetchComponentsState).call(this, httpClient), "f");
+                applyComponentsState(this.contentRootElement, __classPrivateFieldGet(this, _ComponentsConditionsMixinClass_appliedState, "f"));
+            }
+        },
+        _ComponentsConditionsMixinClass_statePromise = new WeakMap(),
+        _ComponentsConditionsMixinClass_appliedState = new WeakMap(),
+        _ComponentsConditionsMixinClass_instances = new WeakSet(),
+        _ComponentsConditionsMixinClass_requireHttpClient = function _ComponentsConditionsMixinClass_requireHttpClient() {
+            var _b;
+            const httpClient = (_b = this.api) === null || _b === void 0 ? void 0 : _b.httpClient;
+            if (!httpClient) {
+                // Developer misconfiguration (apiMixin not composed, or createSdk does
+                // not expose httpClient) - fail loud so it is caught in development.
+                throw new Error('componentsConditionsMixin: the widget sdk must expose `httpClient`. Compose apiMixin and return `webSdk.httpClient` from createSdk.');
+            }
+            return httpClient;
+        },
+        _ComponentsConditionsMixinClass_fetchComponentsState = async function _ComponentsConditionsMixinClass_fetchComponentsState(httpClient) {
+            var _b;
+            try {
+                const res = await httpClient.get(COMPONENTS_STATE_PATH);
+                if (!(res === null || res === void 0 ? void 0 : res.ok))
+                    return {};
+                const body = await res.json();
+                return (_b = body === null || body === void 0 ? void 0 : body.componentsState) !== null && _b !== void 0 ? _b : {};
+            }
+            catch (e) {
+                // Fail open: render everything. UI hiding is presentation, not access
+                // control - sensitive data stays gated by the widget's data API.
+                this.logger.debug('components-conditions: failed to fetch, showing all components', e === null || e === void 0 ? void 0 : e.message);
+                return {};
+            }
+        },
+        _a;
+});
+
+export { componentsConditionsMixin };
+//# sourceMappingURL=componentsConditionsMixin.js.map

package/dist/esm/mixins/componentsConditionsMixin/componentsConditionsMixin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentsConditionsMixin.js","sources":["../../../../src/mixins/componentsConditionsMixin/componentsConditionsMixin.ts"],"sourcesContent":["import { compose, createSingletonMixin } from '@descope/sdk-helpers';\nimport { loggerMixin } from '../loggerMixin';\nimport { initElementMixin } from '../initElementMixin';\nimport { applyComponentsState, clearComponentsState } from './applier';\n\ntype ComponentsState = Record<string, string>;\n\nconst COMPONENTS_STATE_PATH = '/v1/mgmt/widget/components-state';\n\n// The widget's sdk (built by apiMixin) is expected to expose the client here.\ninterface ComponentsConditionsHost {\n  api?: { httpClient?: ConditionsHttpClient };\n}\n\n// Minimal client contract the mixin needs. Widgets expose their existing\n// web-js-sdk httpClient (the same instance used for every other API call),\n// narrowed to this so no web-js-sdk/core-js-sdk type leaks into the widget's\n// public sdk surface. Declared last (with the mixin) to satisfy import/exports-last.\nexport interface ConditionsHttpClient {\n  get: (path: string) => Promise<Response>;\n}\n\n/**\n * Shared widget mixin that fetches the server-computed component conditions\n * verdict for the current user and applies hide/disable/read-only to the widget\n * DOM. Server-side only - no client-side re-evaluation. Compose it LAST in a\n * widget's initMixin so its init wraps the widget's render.\n *\n * It reuses the widget's existing web-js-sdk httpClient (`this.api.httpClient`),\n * so `apiMixin` must be composed and `createSdk` must return `httpClient`. A\n * missing client is a wiring mistake, surfaced loudly (throw) rather than\n * silently rendering everything; a runtime fetch failure fails open instead.\n */\nexport const componentsConditionsMixin = createSingletonMixin(\n  <T extends CustomElementConstructor>(superclass: T) => {\n    // NB: do not compose initLifecycleMixin here - its empty init() has no\n    // super.init() call and would shadow the widget's render init.\n    const BaseClass = compose(loggerMixin, initElementMixin)(superclass);\n\n    return class ComponentsConditionsMixinClass extends BaseClass {\n      #statePromise?: Promise<ComponentsState>;\n\n      #appliedState: ComponentsState = {};\n\n      #requireHttpClient(): ConditionsHttpClient {\n        const httpClient = (this as unknown as ComponentsConditionsHost).api\n          ?.httpClient;\n        if (!httpClient) {\n          // Developer misconfiguration (apiMixin not composed, or createSdk does\n          // not expose httpClient) - fail loud so it is caught in development.\n          throw new Error(\n            'componentsConditionsMixin: the widget sdk must expose `httpClient`. Compose apiMixin and return `webSdk.httpClient` from createSdk.',\n          );\n        }\n        return httpClient;\n      }\n\n      async #fetchComponentsState(\n        httpClient: ConditionsHttpClient,\n      ): Promise<ComponentsState> {\n        try {\n          const res = await httpClient.get(COMPONENTS_STATE_PATH);\n          if (!res?.ok) return {};\n          const body = await res.json();\n          return body?.componentsState ?? {};\n        } catch (e) {\n          // Fail open: render everything. UI hiding is presentation, not access\n          // control - sensitive data stays gated by the widget's data API.\n          this.logger.debug(\n            'components-conditions: failed to fetch, showing all components',\n            (e as Error)?.message,\n          );\n          return {};\n        }\n      }\n\n      async init() {\n        if (this.getAttribute('mock') === 'true') {\n          // Mock mode (demos / e2e) has no backend - skip the fetch, hide nothing.\n          this.#statePromise = Promise.resolve({});\n          await super.init?.();\n          return;\n        }\n        // Resolve the client up front so a wiring mistake throws before the\n        // fetch's fail-open path can swallow it.\n        const httpClient = this.#requireHttpClient();\n        // Fire immediately so it overlaps the page/data fetch super.init runs.\n        this.#statePromise = this.#fetchComponentsState(httpClient);\n        await super.init?.();\n      }\n\n      async onWidgetRootReady() {\n        // @ts-expect-error onWidgetRootReady is provided by the widget's initWidgetRootMixin\n        await super.onWidgetRootReady?.();\n        // Apply once the DOM exists and component values are populated, before the\n        // widget dispatches 'ready'. Awaiting here bounds any added latency to\n        // max(0, conditionsFetch - pageFetch).\n        this.#appliedState = (await this.#statePromise) ?? {};\n        applyComponentsState(this.contentRootElement, this.#appliedState);\n      }\n\n      /**\n       * Re-fetch and re-apply after the widget mutates data the conditions read\n       * (e.g. a profile save). Public hook for the upcoming re-evaluate-on-mutation\n       * work - no widget wires it to its mutating flows yet.\n       */\n      async reevaluateComponentsState() {\n        const httpClient = this.#requireHttpClient();\n        clearComponentsState(this.contentRootElement, this.#appliedState);\n        this.#appliedState = await this.#fetchComponentsState(httpClient);\n        applyComponentsState(this.contentRootElement, this.#appliedState);\n      }\n    };\n  },\n);\n"],"names":[],"mappings":";;;;;;AAOA,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AAejE;;;;;;;;;;AAUG;MACU,yBAAyB,GAAG,oBAAoB,CAC3D,CAAqC,UAAa,KAAI;;;;IAGpD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,UAAU,CAAC,CAAC;IAErE,OAAO,EAAA,GAAA,MAAM,8BAA+B,SAAQ,SAAS,CAAA;AAAtD,YAAA,WAAA,GAAA;;;gBACL,4CAAyC,CAAA,GAAA,CAAA,IAAA,EAAA,KAAA,CAAA,CAAA,CAAA;AAEzC,gBAAA,4CAAA,CAAA,GAAA,CAAA,IAAA,EAAiC,EAAE,CAAC,CAAA;aAsErC;AApCC,YAAA,MAAM,IAAI,GAAA;;gBACR,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE;;oBAExC,sBAAA,CAAA,IAAI,gDAAiB,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA,GAAA,CAAA,CAAC;AACzC,oBAAA,OAAM,CAAA,EAAA,GAAA,KAAK,CAAC,IAAI,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,IAAA,CAAA,IAAA,CAAI,CAAA,CAAC;oBACrB,OAAO;iBACR;;;gBAGD,MAAM,UAAU,GAAG,sBAAA,CAAA,IAAI,oGAAmB,CAAvB,IAAA,CAAA,IAAI,CAAqB,CAAC;;gBAE7C,sBAAA,CAAA,IAAI,EAAiB,4CAAA,EAAA,sBAAA,CAAA,IAAI,EAAA,yCAAA,EAAA,GAAA,EAAA,oDAAA,CAAsB,CAA1B,IAAA,CAAA,IAAI,EAAuB,UAAU,CAAC,EAAA,GAAA,CAAA,CAAC;AAC5D,gBAAA,OAAM,CAAA,EAAA,GAAA,KAAK,CAAC,IAAI,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,IAAA,CAAA,IAAA,CAAI,CAAA,CAAC;aACtB;AAED,YAAA,MAAM,iBAAiB,GAAA;;;AAErB,gBAAA,OAAM,CAAA,EAAA,GAAA,KAAK,CAAC,iBAAiB,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,IAAA,CAAA,IAAA,CAAI,CAAA,CAAC;;;;AAIlC,gBAAA,sBAAA,CAAA,IAAI,EAAA,4CAAA,EAAiB,CAAA,EAAA,IAAC,MAAM,sBAAA,CAAA,IAAI,EAAA,4CAAA,EAAA,GAAA,CAAc,CAAC,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,EAAA,GAAI,EAAE,EAAA,GAAA,CAAA,CAAC;gBACtD,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,EAAE,sBAAA,CAAA,IAAI,EAAc,4CAAA,EAAA,GAAA,CAAA,CAAC,CAAC;aACnE;AAED;;;;AAIG;AACH,YAAA,MAAM,yBAAyB,GAAA;gBAC7B,MAAM,UAAU,GAAG,sBAAA,CAAA,IAAI,oGAAmB,CAAvB,IAAA,CAAA,IAAI,CAAqB,CAAC;gBAC7C,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,EAAE,sBAAA,CAAA,IAAI,EAAc,4CAAA,EAAA,GAAA,CAAA,CAAC,CAAC;AAClE,gBAAA,sBAAA,CAAA,IAAI,EAAA,4CAAA,EAAiB,MAAM,sBAAA,CAAA,IAAI,EAAA,yCAAA,EAAA,GAAA,EAAA,oDAAA,CAAsB,CAA1B,IAAA,CAAA,IAAI,EAAuB,UAAU,CAAC,EAAA,GAAA,CAAA,CAAC;gBAClE,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,EAAE,sBAAA,CAAA,IAAI,EAAc,4CAAA,EAAA,GAAA,CAAA,CAAC,CAAC;aACnE;AACF,SAAA;;;;;;YAnEG,MAAM,UAAU,GAAG,CAAC,EAAA,GAAA,IAA4C,CAAC,GAAG,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAChE,UAAU,CAAC;YACf,IAAI,CAAC,UAAU,EAAE;;;AAGf,gBAAA,MAAM,IAAI,KAAK,CACb,qIAAqI,CACtI,CAAC;aACH;AACD,YAAA,OAAO,UAAU,CAAC;SACnB;AAED,QAAA,oDAAA,GAAA,oEACE,UAAgC,EAAA;;AAEhC,YAAA,IAAI;gBACF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBACxD,IAAI,EAAC,GAAG,KAAA,IAAA,IAAH,GAAG,KAAH,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,GAAG,CAAE,EAAE,CAAA;AAAE,oBAAA,OAAO,EAAE,CAAC;AACxB,gBAAA,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,OAAO,CAAA,EAAA,GAAA,IAAI,KAAA,IAAA,IAAJ,IAAI,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAJ,IAAI,CAAE,eAAe,MAAI,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,EAAA,GAAA,EAAE,CAAC;aACpC;YAAC,OAAO,CAAC,EAAE;;;AAGV,gBAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gEAAgE,EAC/D,CAAW,KAAA,IAAA,IAAX,CAAC,KAAD,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,CAAC,CAAY,OAAO,CACtB,CAAC;AACF,gBAAA,OAAO,EAAE,CAAC;aACX;SACF;AAsCD,QAAA,EAAA,CAAA;AACJ,CAAC;;;;"}