@nodii/onboarding 0.0.1 → 0.1.0-dev.0

package/dist/chunk-34BQX2KR.js

@@ -0,0 +1,164 @@
+import { DEFAULT_REQUEST_TIMEOUT_MS, fetchWithTimeout, OnboardingNetworkError, OnboardingRateLimitError, OnboardingServerError, OnboardingSpecInvalidError } from './chunk-AW7W3HAC.js';
+import { z } from 'zod/v3';
+
+var FIELD_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
+var specFieldSchema = z.object({
+  key: z.string().min(1).regex(
+    FIELD_KEY_PATTERN,
+    "field key must contain only letters, digits, underscore, or hyphen"
+  ),
+  type: z.string().min(1),
+  label: z.string(),
+  required: z.boolean(),
+  validation: z.record(z.unknown()).optional(),
+  options: z.array(z.unknown()).optional(),
+  serviceSelection: z.boolean().optional(),
+  piiClass: z.enum(["none", "context", "always", "reference"]).optional()
+});
+var specStepSchema = z.object({
+  stage: z.enum(["lead", "prospect", "activation"]),
+  fields: z.array(specFieldSchema)
+});
+var onboardingSpecSchema = z.object({
+  specVersion: z.string().min(1),
+  onboarderTier: z.enum(["platform", "tenant"]),
+  botChallenge: z.object({
+    provider: z.literal("recaptcha"),
+    siteKey: z.string()
+  }),
+  forms: z.object({
+    // ADVISORY-ONLY (by design, plan §12.2 / D540): the Contact-Us form is
+    // INTENTIONALLY a fixed barebones shape (name/email/phone/message) and is
+    // NOT onboarder-configurable. `mountContactForm` renders that fixed set
+    // directly and does NOT read forms.contact.fields — the field is modeled
+    // (and validated) so the SDK can round-trip the full spec, but it drives
+    // no rendering. Only forms.signup is spec-driven (the dynamic stepper).
+    contact: z.object({ fields: z.array(specFieldSchema) }),
+    signup: z.object({ steps: z.array(specStepSchema) })
+  })
+});
+function validateOnboardingSpec(value) {
+  return onboardingSpecSchema.safeParse(value);
+}
+
+// src/spec/client.ts
+var SPEC_PATH = "/api/v1/public/onboarding/spec";
+var OnboardingSpecCache = class _OnboardingSpecCache {
+  byVersion = /* @__PURE__ */ new Map();
+  latest = /* @__PURE__ */ new Map();
+  /**
+   * Collision-proof composite key. Uses JSON.stringify of the tuple so an
+   * onboarder or version containing the delimiter can never alias another
+   * entry — and, critically, contains NO control characters (an earlier
+   * NUL-separator made git treat this whole file as binary/undiffable).
+   */
+  static versionKey(onboarder, specVersion) {
+    return JSON.stringify([onboarder, specVersion]);
+  }
+  get(onboarder, specVersion) {
+    return this.byVersion.get(
+      _OnboardingSpecCache.versionKey(onboarder, specVersion)
+    );
+  }
+  getLatest(onboarder) {
+    return this.latest.get(onboarder);
+  }
+  set(onboarder, spec) {
+    this.byVersion.set(
+      _OnboardingSpecCache.versionKey(onboarder, spec.specVersion),
+      spec
+    );
+    this.latest.set(onboarder, spec);
+  }
+  clear() {
+    this.byVersion.clear();
+    this.latest.clear();
+  }
+};
+var defaultSpecCache = new OnboardingSpecCache();
+function signupFieldMap(spec) {
+  const map = /* @__PURE__ */ new Map();
+  for (const step of spec.forms.signup.steps) {
+    for (const field of step.fields) map.set(field.key, field);
+  }
+  return map;
+}
+function diffSpecFields(prev, next) {
+  const prevMap = signupFieldMap(prev);
+  const nextMap = signupFieldMap(next);
+  const added = [];
+  const removed = [];
+  const changed = [];
+  for (const key of nextMap.keys()) {
+    if (!prevMap.has(key)) added.push(key);
+  }
+  for (const [key, prevField] of prevMap) {
+    const nextField = nextMap.get(key);
+    if (!nextField) {
+      removed.push(key);
+      continue;
+    }
+    if (JSON.stringify(prevField) !== JSON.stringify(nextField)) {
+      changed.push(key);
+    }
+  }
+  return {
+    added: added.sort(),
+    removed: removed.sort(),
+    changed: changed.sort()
+  };
+}
+function buildUrl(baseUrl, path) {
+  const base = baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+  return `${base}${path}`;
+}
+async function fetchOnboardingSpec(options) {
+  const cache = options.cache ?? defaultSpecCache;
+  if (options.preferCached) {
+    const cached = cache.getLatest(options.onboarder);
+    if (cached) return cached;
+  }
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const url = buildUrl(options.baseUrl, SPEC_PATH);
+  let response;
+  try {
+    response = await fetchWithTimeout(url, {
+      method: "GET",
+      timeoutMs,
+      fetchImpl
+    });
+  } catch (err) {
+    throw new OnboardingNetworkError(err);
+  }
+  if (response.status === 429) {
+    const retryAfterHeader = response.headers.get("retry-after");
+    const retryAfter = retryAfterHeader ? Number.parseInt(retryAfterHeader, 10) : Number.NaN;
+    throw new OnboardingRateLimitError(
+      Number.isNaN(retryAfter) ? null : retryAfter
+    );
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new OnboardingServerError(
+      response.status,
+      `Spec fetch failed with status ${response.status}`
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new OnboardingSpecInvalidError("response body is not JSON");
+  }
+  const parsed = validateOnboardingSpec(body);
+  if (!parsed.success) {
+    const detail = parsed.error.issues.slice(0, 5).map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+    throw new OnboardingSpecInvalidError(detail);
+  }
+  cache.set(options.onboarder, parsed.data);
+  return parsed.data;
+}
+
+export { FIELD_KEY_PATTERN, OnboardingSpecCache, defaultSpecCache, diffSpecFields, fetchOnboardingSpec, onboardingSpecSchema, specFieldSchema, specStepSchema, validateOnboardingSpec };
+//# sourceMappingURL=chunk-34BQX2KR.js.map
+//# sourceMappingURL=chunk-34BQX2KR.js.map

package/dist/chunk-34BQX2KR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/spec/model.ts","../src/spec/client.ts"],"names":[],"mappings":";;;AAyCO,IAAM,iBAAA,GAAoB;AAE1B,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA,EACtC,KAAK,CAAA,CACF,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,KAAA;AAAA,IACC,iBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACF,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACtB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,OAAA,EAAQ;AAAA,EACpB,YAAY,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EAC3C,SAAS,CAAA,CAAE,KAAA,CAAM,EAAE,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACvC,gBAAA,EAAkB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACvC,QAAA,EAAU,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,WAAW,QAAA,EAAU,WAAW,CAAC,CAAA,CAAE,QAAA;AAC/D,CAAC;AAIM,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EACrC,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,UAAA,EAAY,YAAY,CAAC,CAAA;AAAA,EAChD,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,eAAe;AACjC,CAAC;AAIM,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA,EAC3C,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC7B,eAAe,CAAA,CAAE,IAAA,CAAK,CAAC,UAAA,EAAY,QAAQ,CAAC,CAAA;AAAA,EAC5C,YAAA,EAAc,EAAE,MAAA,CAAO;AAAA,IACrB,QAAA,EAAU,CAAA,CAAE,OAAA,CAAQ,WAAW,CAAA;AAAA,IAC/B,OAAA,EAAS,EAAE,MAAA;AAAO,GACnB,CAAA;AAAA,EACD,KAAA,EAAO,EAAE,MAAA,CAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOd,OAAA,EAAS,EAAE,MAAA,CAAO,EAAE,QAAQ,CAAA,CAAE,KAAA,CAAM,eAAe,CAAA,EAAG,CAAA;AAAA,IACtD,MAAA,EAAQ,EAAE,MAAA,CAAO,EAAE,OAAO,CAAA,CAAE,KAAA,CAAM,cAAc,CAAA,EAAG;AAAA,GACpD;AACH,CAAC;AAQM,SAAS,uBAAuB,KAAA,EAAgB;AACrD,EAAA,OAAO,oBAAA,CAAqB,UAAU,KAAK,CAAA;AAC7C;;;ACjEA,IAAM,SAAA,GAAY,gCAAA;AAQX,IAAM,mBAAA,GAAN,MAAM,oBAAA,CAAoB;AAAA,EACd,SAAA,uBAAgB,GAAA,EAA4B;AAAA,EAC5C,MAAA,uBAAa,GAAA,EAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1D,OAAe,UAAA,CAAW,SAAA,EAAmB,WAAA,EAA6B;AACxE,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,CAAC,SAAA,EAAW,WAAW,CAAC,CAAA;AAAA,EAChD;AAAA,EAEA,GAAA,CAAI,WAAmB,WAAA,EAAiD;AACtE,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA;AAAA,MACpB,oBAAA,CAAoB,UAAA,CAAW,SAAA,EAAW,WAAW;AAAA,KACvD;AAAA,EACF;AAAA,EAEA,UAAU,SAAA,EAA+C;AACvD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,EAClC;AAAA,EAEA,GAAA,CAAI,WAAmB,IAAA,EAA4B;AACjD,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA;AAAA,MACb,oBAAA,CAAoB,UAAA,CAAW,SAAA,EAAW,IAAA,CAAK,WAAW,CAAA;AAAA,MAC1D;AAAA,KACF;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,IAAI,CAAA;AAAA,EACjC;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,UAAU,KAAA,EAAM;AACrB,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACpB;AACF;AAGO,IAAM,gBAAA,GAAmB,IAAI,mBAAA;AAapC,SAAS,eAAe,IAAA,EAA8C;AACpE,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAuB;AACvC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,KAAA,EAAO;AAC1C,IAAA,KAAA,MAAW,SAAS,IAAA,CAAK,MAAA,MAAY,GAAA,CAAI,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,cAAA,CACd,MACA,IAAA,EACe;AACf,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,GAAA,IAAO,OAAA,CAAQ,IAAA,EAAK,EAAG;AAChC,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,EAAG,KAAA,CAAM,KAAK,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,SAAS,CAAA,IAAK,OAAA,EAAS;AACtC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAChB,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAK,SAAA,CAAU,SAAS,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAC3D,MAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAM,IAAA,EAAK;AAAA,IAClB,OAAA,EAAS,QAAQ,IAAA,EAAK;AAAA,IACtB,OAAA,EAAS,QAAQ,IAAA;AAAK,GACxB;AACF;AA2BA,SAAS,QAAA,CAAS,SAAiB,IAAA,EAAsB;AACvD,EAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,CAAS,GAAG,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,OAAA;AAC5D,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA;AACvB;AAUA,eAAsB,oBACpB,OAAA,EACyB;AACzB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,gBAAA;AAE/B,EAAA,IAAI,QAAQ,YAAA,EAAc;AACxB,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAA,CAAU,OAAA,CAAQ,SAAS,CAAA;AAChD,IAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,EACrB;AAEA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,0BAAA;AACvC,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,OAAA,CAAQ,OAAA,EAAS,SAAS,CAAA;AAE/C,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,iBAAiB,GAAA,EAAK;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,SAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,uBAAuB,GAAG,CAAA;AAAA,EACtC;AAEA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAC3D,IAAA,MAAM,aAAa,gBAAA,GACf,MAAA,CAAO,SAAS,gBAAA,EAAkB,EAAE,IACpC,MAAA,CAAO,GAAA;AACX,IAAA,MAAM,IAAI,wBAAA;AAAA,MACR,MAAA,CAAO,KAAA,CAAM,UAAU,CAAA,GAAI,IAAA,GAAO;AAAA,KACpC;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,GAAA,IAAO,QAAA,CAAS,UAAU,GAAA,EAAK;AACnD,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,QAAA,CAAS,MAAA;AAAA,MACT,CAAA,8BAAA,EAAiC,SAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,2BAA2B,2BAA2B,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,MAAA,GAAS,uBAAuB,IAAI,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,MAAA,CACzB,KAAA,CAAM,GAAG,CAAC,CAAA,CACV,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,EAAE,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,IAAK,QAAQ,CAAA,EAAA,EAAK,EAAE,OAAO,CAAA,CAAE,CAAA,CAC1D,IAAA,CAAK,IAAI,CAAA;AACZ,IAAA,MAAM,IAAI,2BAA2B,MAAM,CAAA;AAAA,EAC7C;AAEA,EAAA,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,SAAA,EAAW,MAAA,CAAO,IAAI,CAAA;AACxC,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB","file":"chunk-34BQX2KR.js","sourcesContent":["/**\n * D540 §1 onboarding-spec model — mirrors the LOCKED hub REST contract:\n *   GET /api/v1/public/onboarding/spec (PublicOnboardingSpecResponse)\n *\n * Response shape (hub JSON Schema, both tiers identical):\n *   {\n *     specVersion:   string (monotonic; echo on submit; stale ⇒ 409),\n *     onboarderTier: \"platform\" | \"tenant\",\n *     botChallenge:  { provider: \"recaptcha\", siteKey: string },\n *     forms: {\n *       contact: { fields: SpecField[] },\n *       signup:  { steps: [{ stage: \"lead\"|\"prospect\"|\"activation\",\n *                            fields: SpecField[] }] }\n *     }\n *   }\n *\n * SpecField (required: key, type, label, required):\n *   { key, type, label, required, validation?, options?, serviceSelection?,\n *     piiClass?: \"none\"|\"context\"|\"always\"|\"reference\" }\n *\n * The Zod schema below validates a fetched spec BEFORE the SDK renders\n * anything from it — a malformed spec throws OnboardingSpecInvalidError\n * (a half-parsed spec could silently drop required fields).\n */\n\nimport { z } from \"zod/v3\";\n\nexport type OnboarderTier = \"platform\" | \"tenant\";\nexport type PiiClass = \"none\" | \"context\" | \"always\" | \"reference\";\nexport type SpecStage = \"lead\" | \"prospect\" | \"activation\";\nexport type TerminalStage = \"prospect\" | \"inactive\" | \"active\";\n\n/**\n * Field keys are interpolated into DOM element ids and (historically) CSS\n * selectors by the widget layer. Constrain them to a strict identifier\n * alphabet so a MALICIOUS or compromised onboarder spec cannot smuggle CSS\n * metacharacters or selector-breakout payloads (e.g. `evil], [onclick=…`)\n * through the fetched spec. A spec with an out-of-alphabet key is REJECTED\n * at parse time → OnboardingSpecInvalidError (fail-closed; never rendered).\n * This is layer 1; the widget also CSS.escapes ids as defense-in-depth.\n */\nexport const FIELD_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;\n\nexport const specFieldSchema = z.object({\n  key: z\n    .string()\n    .min(1)\n    .regex(\n      FIELD_KEY_PATTERN,\n      \"field key must contain only letters, digits, underscore, or hyphen\",\n    ),\n  type: z.string().min(1),\n  label: z.string(),\n  required: z.boolean(),\n  validation: z.record(z.unknown()).optional(),\n  options: z.array(z.unknown()).optional(),\n  serviceSelection: z.boolean().optional(),\n  piiClass: z.enum([\"none\", \"context\", \"always\", \"reference\"]).optional(),\n});\n\nexport type SpecField = z.infer<typeof specFieldSchema>;\n\nexport const specStepSchema = z.object({\n  stage: z.enum([\"lead\", \"prospect\", \"activation\"]),\n  fields: z.array(specFieldSchema),\n});\n\nexport type SpecStep = z.infer<typeof specStepSchema>;\n\nexport const onboardingSpecSchema = z.object({\n  specVersion: z.string().min(1),\n  onboarderTier: z.enum([\"platform\", \"tenant\"]),\n  botChallenge: z.object({\n    provider: z.literal(\"recaptcha\"),\n    siteKey: z.string(),\n  }),\n  forms: z.object({\n    // ADVISORY-ONLY (by design, plan §12.2 / D540): the Contact-Us form is\n    // INTENTIONALLY a fixed barebones shape (name/email/phone/message) and is\n    // NOT onboarder-configurable. `mountContactForm` renders that fixed set\n    // directly and does NOT read forms.contact.fields — the field is modeled\n    // (and validated) so the SDK can round-trip the full spec, but it drives\n    // no rendering. Only forms.signup is spec-driven (the dynamic stepper).\n    contact: z.object({ fields: z.array(specFieldSchema) }),\n    signup: z.object({ steps: z.array(specStepSchema) }),\n  }),\n});\n\nexport type OnboardingSpec = z.infer<typeof onboardingSpecSchema>;\n\n/**\n * Parse an unknown value as an OnboardingSpec.\n * Returns a SafeParseReturnType (inferred).\n */\nexport function validateOnboardingSpec(value: unknown) {\n  return onboardingSpecSchema.safeParse(value);\n}\n","/**\n * Config-fetch client for GET /api/v1/public/onboarding/spec (D540 §1/§3).\n *\n * - The onboarder is derived SERVER-side from the request Host (D536) —\n *   it is NOT sent by the client. The `onboarder` value here is purely the\n *   CLIENT-side cache key (D540 §3: \"cache key (onboarder, specVersion)\").\n * - The spec response is validated against the LOCKED D540 shape before\n *   it is returned; a malformed spec throws OnboardingSpecInvalidError.\n * - Cache semantics: every successful fetch is stored under\n *   (onboarder, specVersion) and as the onboarder's \"latest\". The versioned\n *   entries let the 409 spec_stale flow diff the previously-served version\n *   against the refetched one (see `diffSpecFields` + the signup widget's\n *   handleSpecStale, which reads the cached prior version before refetching).\n */\n\nimport {\n  OnboardingNetworkError,\n  OnboardingRateLimitError,\n  OnboardingServerError,\n  OnboardingSpecInvalidError,\n} from \"../submit/errors.js\";\nimport {\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  fetchWithTimeout,\n} from \"../submit/http.js\";\nimport {\n  validateOnboardingSpec,\n  type OnboardingSpec,\n  type SpecField,\n} from \"./model.js\";\n\nconst SPEC_PATH = \"/api/v1/public/onboarding/spec\";\n\n/**\n * In-memory spec cache keyed by (onboarder, specVersion), with a \"latest\"\n * pointer per onboarder. Purely client-side; no TTL — the reject-stale\n * policy (409 spec_stale on submit) is the authoritative staleness signal,\n * and a refetch overwrites \"latest\".\n */\nexport class OnboardingSpecCache {\n  private readonly byVersion = new Map<string, OnboardingSpec>();\n  private readonly latest = new Map<string, OnboardingSpec>();\n\n  /**\n   * Collision-proof composite key. Uses JSON.stringify of the tuple so an\n   * onboarder or version containing the delimiter can never alias another\n   * entry — and, critically, contains NO control characters (an earlier\n   * NUL-separator made git treat this whole file as binary/undiffable).\n   */\n  private static versionKey(onboarder: string, specVersion: string): string {\n    return JSON.stringify([onboarder, specVersion]);\n  }\n\n  get(onboarder: string, specVersion: string): OnboardingSpec | undefined {\n    return this.byVersion.get(\n      OnboardingSpecCache.versionKey(onboarder, specVersion),\n    );\n  }\n\n  getLatest(onboarder: string): OnboardingSpec | undefined {\n    return this.latest.get(onboarder);\n  }\n\n  set(onboarder: string, spec: OnboardingSpec): void {\n    this.byVersion.set(\n      OnboardingSpecCache.versionKey(onboarder, spec.specVersion),\n      spec,\n    );\n    this.latest.set(onboarder, spec);\n  }\n\n  clear(): void {\n    this.byVersion.clear();\n    this.latest.clear();\n  }\n}\n\n/** Module-level default cache (one per page). Injectable for tests/apps. */\nexport const defaultSpecCache = new OnboardingSpecCache();\n\n/**\n * Diff two spec versions' signup field sets — used by the 409 spec_stale\n * flow to tell the user WHAT changed. Compares by field key across all\n * signup steps.\n */\nexport interface SpecFieldDiff {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nfunction signupFieldMap(spec: OnboardingSpec): Map<string, SpecField> {\n  const map = new Map<string, SpecField>();\n  for (const step of spec.forms.signup.steps) {\n    for (const field of step.fields) map.set(field.key, field);\n  }\n  return map;\n}\n\nexport function diffSpecFields(\n  prev: OnboardingSpec,\n  next: OnboardingSpec,\n): SpecFieldDiff {\n  const prevMap = signupFieldMap(prev);\n  const nextMap = signupFieldMap(next);\n  const added: string[] = [];\n  const removed: string[] = [];\n  const changed: string[] = [];\n  for (const key of nextMap.keys()) {\n    if (!prevMap.has(key)) added.push(key);\n  }\n  for (const [key, prevField] of prevMap) {\n    const nextField = nextMap.get(key);\n    if (!nextField) {\n      removed.push(key);\n      continue;\n    }\n    if (JSON.stringify(prevField) !== JSON.stringify(nextField)) {\n      changed.push(key);\n    }\n  }\n  return {\n    added: added.sort(),\n    removed: removed.sort(),\n    changed: changed.sort(),\n  };\n}\n\nexport interface SpecFetchOptions {\n  baseUrl: string;\n  /**\n   * Client-side cache key ONLY (never transmitted; trust is host-derived\n   * per D536). Use the onboarder slug/id your embed is configured with.\n   */\n  onboarder: string;\n  /** Custom fetch implementation (defaults to globalThis.fetch). */\n  fetch?: typeof globalThis.fetch;\n  /** Cache to read/write (defaults to the module-level cache). */\n  cache?: OnboardingSpecCache;\n  /**\n   * Request timeout in ms (default 15s). A stalled intake aborts with\n   * OnboardingNetworkError so the boot doesn't hang on \"Loading signup form…\".\n   */\n  timeoutMs?: number;\n  /**\n   * When true, return the cached \"latest\" for this onboarder if present\n   * WITHOUT a network round-trip. Default false (spec fetches are cheap\n   * and the server bumps specVersion on any change). The signup widget's\n   * boot passes preferCached:true so a remount reuses the loaded spec.\n   */\n  preferCached?: boolean;\n}\n\nfunction buildUrl(baseUrl: string, path: string): string {\n  const base = baseUrl.endsWith(\"/\") ? baseUrl.slice(0, -1) : baseUrl;\n  return `${base}${path}`;\n}\n\n/**\n * Fetch (and validate, and cache) the onboarding spec.\n *\n * @throws {OnboardingSpecInvalidError} response does not match D540 §1\n * @throws {OnboardingRateLimitError} on 429\n * @throws {OnboardingServerError} on any other non-2xx status\n * @throws {OnboardingNetworkError} on network failure OR timeout\n */\nexport async function fetchOnboardingSpec(\n  options: SpecFetchOptions,\n): Promise<OnboardingSpec> {\n  const cache = options.cache ?? defaultSpecCache;\n\n  if (options.preferCached) {\n    const cached = cache.getLatest(options.onboarder);\n    if (cached) return cached;\n  }\n\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n  const url = buildUrl(options.baseUrl, SPEC_PATH);\n\n  let response: Response;\n  try {\n    response = await fetchWithTimeout(url, {\n      method: \"GET\",\n      timeoutMs,\n      fetchImpl,\n    });\n  } catch (err) {\n    throw new OnboardingNetworkError(err);\n  }\n\n  if (response.status === 429) {\n    const retryAfterHeader = response.headers.get(\"retry-after\");\n    const retryAfter = retryAfterHeader\n      ? Number.parseInt(retryAfterHeader, 10)\n      : Number.NaN;\n    throw new OnboardingRateLimitError(\n      Number.isNaN(retryAfter) ? null : retryAfter,\n    );\n  }\n  if (response.status < 200 || response.status >= 300) {\n    throw new OnboardingServerError(\n      response.status,\n      `Spec fetch failed with status ${response.status}`,\n    );\n  }\n\n  let body: unknown;\n  try {\n    body = await response.json();\n  } catch {\n    throw new OnboardingSpecInvalidError(\"response body is not JSON\");\n  }\n\n  const parsed = validateOnboardingSpec(body);\n  if (!parsed.success) {\n    const detail = parsed.error.issues\n      .slice(0, 5)\n      .map((i) => `${i.path.join(\".\") || \"(root)\"}: ${i.message}`)\n      .join(\"; \");\n    throw new OnboardingSpecInvalidError(detail);\n  }\n\n  cache.set(options.onboarder, parsed.data);\n  return parsed.data;\n}\n"]}

package/dist/chunk-4SWOVHZ2.js

@@ -0,0 +1,434 @@
+import { z } from 'zod/v3';
+
+// src/dynamic/derive.ts
+function optionValue(option) {
+  if (option !== null && typeof option === "object") {
+    const o = option;
+    if ("value" in o) return String(o["value"]);
+    if ("key" in o) return String(o["key"]);
+  }
+  return String(option);
+}
+function knownValidation(field) {
+  const v = field.validation ?? {};
+  const out = {};
+  if (typeof v["minLength"] === "number") out.minLength = v["minLength"];
+  if (typeof v["maxLength"] === "number") out.maxLength = v["maxLength"];
+  if (typeof v["min"] === "number") out.min = v["min"];
+  if (typeof v["max"] === "number") out.max = v["max"];
+  if (typeof v["pattern"] === "string") out.pattern = v["pattern"];
+  if (typeof v["format"] === "string") out.format = v["format"];
+  return out;
+}
+function stringSchema(field) {
+  const v = knownValidation(field);
+  let s = z.string();
+  if (field.type === "email" || v.format === "email") {
+    s = s.email(`${field.label} must be a valid email`);
+  }
+  if (v.minLength !== void 0) {
+    s = s.min(
+      v.minLength,
+      `${field.label} must be at least ${v.minLength} characters`
+    );
+  }
+  if (v.maxLength !== void 0) {
+    s = s.max(
+      v.maxLength,
+      `${field.label} must be at most ${v.maxLength} characters`
+    );
+  }
+  if (v.pattern !== void 0) {
+    try {
+      s = s.regex(
+        new RegExp(v.pattern),
+        `${field.label} has an invalid format`
+      );
+    } catch {
+    }
+  }
+  return s;
+}
+function numberSchema(field) {
+  const v = knownValidation(field);
+  let s = z.coerce.number({
+    invalid_type_error: `${field.label} must be a number`
+  });
+  if (v.min !== void 0) {
+    s = s.min(v.min, `${field.label} must be at least ${v.min}`);
+  }
+  if (v.max !== void 0) {
+    s = s.max(v.max, `${field.label} must be at most ${v.max}`);
+  }
+  return s;
+}
+function enumSchema(field) {
+  const allowed = (field.options ?? []).map(optionValue);
+  if (allowed.length === 0) return z.string();
+  return z.string().refine((val) => allowed.includes(val), {
+    message: `${field.label} must be one of the offered options`
+  });
+}
+function multiEnumSchema(field) {
+  const allowed = (field.options ?? []).map(optionValue);
+  const item = allowed.length === 0 ? z.string() : z.string().refine((val) => allowed.includes(val), {
+    message: `${field.label} contains a value outside the offered options`
+  });
+  return z.array(item);
+}
+function dateSchema(field) {
+  return z.string().refine((val) => !Number.isNaN(Date.parse(val)), {
+    message: `${field.label} must be a valid date`
+  });
+}
+function baseSchema(field) {
+  switch (field.type) {
+    case "email":
+      return stringSchema(field);
+    case "number":
+      return numberSchema(field);
+    case "checkbox":
+    case "boolean":
+      return z.boolean();
+    case "select":
+    case "radio":
+      return enumSchema(field);
+    case "multiselect":
+      return multiEnumSchema(field);
+    case "date":
+      return dateSchema(field);
+    default:
+      return stringSchema(field);
+  }
+}
+function deriveFieldSchema(field) {
+  const base = baseSchema(field);
+  if (field.required) {
+    if (field.type !== "checkbox" && field.type !== "boolean" && field.type !== "number" && field.type !== "multiselect") {
+      return z.string({ required_error: `${field.label} is required` }).min(1, `${field.label} is required`).pipe(base);
+    }
+    if (field.type === "number") {
+      return z.any().refine(
+        (val) => val !== "" && val !== void 0 && val !== null,
+        `${field.label} is required`
+      ).pipe(base);
+    }
+    if (field.type === "multiselect") {
+      return base.refine(
+        (val) => Array.isArray(val) && val.length > 0,
+        `${field.label} requires at least one selection`
+      );
+    }
+    return base;
+  }
+  return z.preprocess(
+    (val) => val === "" || val === void 0 || val === null ? void 0 : val,
+    base.optional()
+  );
+}
+function deriveStepSchema(step) {
+  const shape = {};
+  for (const field of step.fields) {
+    shape[field.key] = deriveFieldSchema(field);
+  }
+  return z.object(shape).strict();
+}
+function deriveAnswersSchema(steps) {
+  const shape = {};
+  for (const step of steps) {
+    for (const field of step.fields) {
+      shape[field.key] = deriveFieldSchema(field);
+    }
+  }
+  return z.object(shape).strict();
+}
+var credentialsSchema = z.object({
+  email: z.string().email("A valid account email is required"),
+  password: z.string().min(12, "Password must be at least 12 characters").max(256, "Password must be at most 256 characters")
+});
+function zodIssuesToFieldErrors(issues) {
+  return issues.map((issue) => ({
+    path: issue.path.join("."),
+    message: issue.message
+  }));
+}
+function serviceIdsOf(key, value) {
+  if (typeof value === "string" && value !== "") return [value];
+  if (Array.isArray(value)) return value.map((v) => String(v));
+  if (value === true) return [key];
+  return [];
+}
+function createSignupStepper(spec) {
+  let steps = spec.forms.signup.steps;
+  let specVersion = spec.specVersion;
+  let state = {
+    stepIndex: 0,
+    stepCount: steps.length,
+    currentStep: steps[0] ?? null,
+    answers: {},
+    selectedServices: [],
+    errors: [],
+    accountErrors: [],
+    consent: { tosAccepted: false, privacyAccepted: false },
+    credentials: { email: "", password: "" },
+    status: "editing",
+    serverError: null,
+    specStale: false,
+    specVersion,
+    terminalStage: null
+  };
+  let validatedSteps = /* @__PURE__ */ new Set();
+  const listeners = /* @__PURE__ */ new Set();
+  function emit() {
+    for (const listener of listeners) {
+      listener(structuredClone(state));
+    }
+  }
+  function knownFieldKeys() {
+    const keys = /* @__PURE__ */ new Set();
+    for (const step of steps) {
+      for (const field of step.fields) keys.add(field.key);
+    }
+    return keys;
+  }
+  function stepAnswers(step) {
+    const out = {};
+    for (const field of step.fields) {
+      if (field.key in state.answers) out[field.key] = state.answers[field.key];
+    }
+    return out;
+  }
+  function deriveSelectedServices() {
+    const services = [];
+    for (const step of steps) {
+      for (const field of step.fields) {
+        if (field.serviceSelection === true) {
+          services.push(...serviceIdsOf(field.key, state.answers[field.key]));
+        }
+      }
+    }
+    return [...new Set(services)];
+  }
+  function runStepValidation(step) {
+    const result = deriveStepSchema(step).safeParse(stepAnswers(step));
+    return result.success ? [] : zodIssuesToFieldErrors(result.error.issues);
+  }
+  function firstStepWithErrors() {
+    for (let i = 0; i < steps.length; i++) {
+      const step = steps[i];
+      if (step && runStepValidation(step).length > 0) return i;
+    }
+    return 0;
+  }
+  return {
+    getState() {
+      return structuredClone(state);
+    },
+    setAnswer(key, value) {
+      state = {
+        ...state,
+        answers: { ...state.answers, [key]: value }
+      };
+      state.selectedServices = deriveSelectedServices();
+      if (validatedSteps.has(state.stepIndex) && state.currentStep) {
+        state = { ...state, errors: runStepValidation(state.currentStep) };
+      }
+      emit();
+    },
+    setConsent(consent) {
+      state = { ...state, consent: { ...state.consent, ...consent } };
+      emit();
+    },
+    setCredentials(credentials) {
+      state = {
+        ...state,
+        credentials: { ...state.credentials, ...credentials }
+      };
+      emit();
+    },
+    validateStep() {
+      if (!state.currentStep) return true;
+      validatedSteps.add(state.stepIndex);
+      const errors = runStepValidation(state.currentStep);
+      state = { ...state, errors };
+      emit();
+      return errors.length === 0;
+    },
+    next() {
+      if (!state.currentStep) return false;
+      validatedSteps.add(state.stepIndex);
+      const errors = runStepValidation(state.currentStep);
+      if (errors.length > 0) {
+        state = { ...state, errors };
+        emit();
+        return false;
+      }
+      if (state.stepIndex >= steps.length - 1) return false;
+      const stepIndex = state.stepIndex + 1;
+      state = {
+        ...state,
+        stepIndex,
+        currentStep: steps[stepIndex] ?? null,
+        errors: []
+      };
+      emit();
+      return true;
+    },
+    back() {
+      if (state.stepIndex === 0) return;
+      const stepIndex = state.stepIndex - 1;
+      state = {
+        ...state,
+        stepIndex,
+        currentStep: steps[stepIndex] ?? null,
+        errors: []
+      };
+      emit();
+    },
+    isFirstStep() {
+      return state.stepIndex === 0;
+    },
+    isLastStep() {
+      return state.stepIndex >= steps.length - 1;
+    },
+    validateAll() {
+      for (let i = 0; i < steps.length; i++) validatedSteps.add(i);
+      const answersResult = deriveAnswersSchema(steps).safeParse(state.answers);
+      const errors = answersResult.success ? [] : zodIssuesToFieldErrors(answersResult.error.issues);
+      const accountErrors = [];
+      const credResult = credentialsSchema.safeParse(state.credentials);
+      if (!credResult.success) {
+        accountErrors.push(...zodIssuesToFieldErrors(credResult.error.issues));
+      }
+      if (state.consent.tosAccepted !== true) {
+        accountErrors.push({
+          path: "tosAccepted",
+          message: "You must accept the Terms of Service"
+        });
+      }
+      if (state.consent.privacyAccepted !== true) {
+        accountErrors.push({
+          path: "privacyAccepted",
+          message: "You must accept the Privacy Policy"
+        });
+      }
+      state = { ...state, errors, accountErrors };
+      emit();
+      return errors.length === 0 && accountErrors.length === 0;
+    },
+    buildSubmitPayload() {
+      if (state.consent.tosAccepted !== true || state.consent.privacyAccepted !== true) {
+        throw new Error(
+          "buildSubmitPayload: cannot build a submit payload without genuine user consent (tosAccepted && privacyAccepted must both be true). Call validateAll() and surface the consent errors to the user first."
+        );
+      }
+      const parsed = deriveAnswersSchema(steps).safeParse(state.answers);
+      if (!parsed.success) {
+        const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "(answers)"}: ${i.message}`).join("; ");
+        throw new Error(
+          `buildSubmitPayload: answers failed validation \u2014 call validateAll() first (${detail}).`
+        );
+      }
+      const known = knownFieldKeys();
+      const answers = {};
+      for (const [key, value] of Object.entries(parsed.data)) {
+        if (known.has(key) && value !== void 0 && value !== "") {
+          answers[key] = value;
+        }
+      }
+      const selectedServices = deriveSelectedServices();
+      return {
+        specVersion,
+        answers,
+        ...selectedServices.length > 0 ? { selectedServices } : {},
+        consent: {
+          tosAccepted: state.consent.tosAccepted,
+          privacyAccepted: state.consent.privacyAccepted
+        },
+        credentials: { ...state.credentials }
+      };
+    },
+    applyNewSpec(newSpec) {
+      steps = newSpec.forms.signup.steps;
+      specVersion = newSpec.specVersion;
+      const known = /* @__PURE__ */ new Set();
+      for (const step of steps) {
+        for (const field of step.fields) known.add(field.key);
+      }
+      const answers = {};
+      for (const [key, value] of Object.entries(state.answers)) {
+        if (known.has(key)) answers[key] = value;
+      }
+      state = {
+        ...state,
+        answers,
+        stepCount: steps.length,
+        specVersion,
+        specStale: true,
+        status: "editing",
+        serverError: null
+      };
+      state.selectedServices = deriveSelectedServices();
+      const stepIndex = Math.min(firstStepWithErrors(), steps.length - 1);
+      const currentStep = steps[Math.max(stepIndex, 0)] ?? null;
+      validatedSteps = /* @__PURE__ */ new Set([Math.max(stepIndex, 0)]);
+      state = {
+        ...state,
+        stepIndex: Math.max(stepIndex, 0),
+        currentStep,
+        errors: currentStep ? runStepValidation(currentStep) : []
+      };
+      emit();
+    },
+    acknowledgeSpecStale() {
+      state = { ...state, specStale: false };
+      emit();
+    },
+    setSubmitting() {
+      state = {
+        ...state,
+        status: "submitting",
+        serverError: null
+      };
+      emit();
+    },
+    setSuccess(terminalStage) {
+      state = { ...state, status: "success", terminalStage, serverError: null };
+      emit();
+    },
+    setError(message) {
+      state = { ...state, status: "error", serverError: message };
+      emit();
+    },
+    reset() {
+      validatedSteps = /* @__PURE__ */ new Set();
+      state = {
+        stepIndex: 0,
+        stepCount: steps.length,
+        currentStep: steps[0] ?? null,
+        answers: {},
+        selectedServices: [],
+        errors: [],
+        accountErrors: [],
+        consent: { tosAccepted: false, privacyAccepted: false },
+        credentials: { email: "", password: "" },
+        status: "editing",
+        serverError: null,
+        specStale: false,
+        specVersion,
+        terminalStage: null
+      };
+      emit();
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    }
+  };
+}
+
+export { createSignupStepper, deriveAnswersSchema, deriveFieldSchema, deriveStepSchema, optionValue };
+//# sourceMappingURL=chunk-4SWOVHZ2.js.map
+//# sourceMappingURL=chunk-4SWOVHZ2.js.map