@nodii/onboarding 0.0.1 → 0.1.0

package/dist/chunk-LVJM4CTG.js

@@ -0,0 +1,306 @@
+import { fetchDocumentContent } from './chunk-SEKNVHD3.js';
+import createDOMPurify from 'dompurify';
+import { marked } from 'marked';
+
+var purifier = null;
+function getPurifier() {
+  if (purifier) return purifier;
+  const win = globalThis.window ?? globalThis;
+  purifier = createDOMPurify(win);
+  return purifier;
+}
+var SCROLL_END_EPSILON = 2;
+function clearNode(node) {
+  while (node.firstChild) node.removeChild(node.firstChild);
+}
+function boxHasContent(box) {
+  if ((box.textContent ?? "").trim().length > 0) return true;
+  return box.querySelector("canvas") !== null;
+}
+function makeScrollBox(control, consentKey) {
+  const box = document.createElement("div");
+  box.className = "nodii-onboarding-consent-scrollbox";
+  box.setAttribute("tabindex", "0");
+  box.setAttribute("role", "region");
+  const report = () => {
+    if (!boxHasContent(box)) return;
+    if (box.scrollHeight <= 0) return;
+    const ratio = box.scrollHeight - box.clientHeight <= 0 ? (
+      // Content is present AND genuinely fits without scrolling → "at end".
+      1
+    ) : Math.min(
+      1,
+      (box.scrollTop + box.clientHeight + SCROLL_END_EPSILON) / box.scrollHeight
+    );
+    control.reportScrollProgress(consentKey, ratio);
+  };
+  box.addEventListener("scroll", report);
+  return { box, reportScroll: report };
+}
+function isMarkdown(fetched, doc) {
+  return fetched.contentType.includes("markdown") || /\.mdx?(\?|#|$)/i.test(doc.downloadUrl);
+}
+var DANGEROUS_TAGS = /* @__PURE__ */ new Set([
+  "SCRIPT",
+  "IFRAME",
+  "OBJECT",
+  "EMBED",
+  "FORM",
+  "STYLE",
+  "LINK",
+  "META",
+  "BASE"
+]);
+function normalizeUrlForSchemeCheck(value) {
+  let out = "";
+  for (let i = 0; i < value.length; i++) {
+    const cp = value.charCodeAt(i);
+    if (cp > 32 && cp !== 127) out += value[i];
+  }
+  return out.toLowerCase();
+}
+var DANGEROUS_URL_SCHEMES = ["javascript:", "vbscript:", "data:text/html"];
+function hardenElement(root) {
+  const walker = (node) => {
+    const children = Array.from(node.children);
+    if (DANGEROUS_TAGS.has(node.tagName)) {
+      node.remove();
+      return;
+    }
+    for (const attr of Array.from(node.attributes)) {
+      const name = attr.name.toLowerCase();
+      const value = normalizeUrlForSchemeCheck(attr.value);
+      if (name.startsWith("on")) {
+        node.removeAttribute(attr.name);
+        continue;
+      }
+      if ((name === "href" || name === "src" || name === "xlink:href") && DANGEROUS_URL_SCHEMES.some((s) => value.startsWith(s))) {
+        node.removeAttribute(attr.name);
+      }
+      if (name === "srcdoc") node.removeAttribute(attr.name);
+    }
+    for (const child of children) walker(child);
+  };
+  for (const child of Array.from(root.children)) walker(child);
+}
+function renderSanitizedHtml(container, control, consentKey, html) {
+  clearNode(container);
+  const { box, reportScroll } = makeScrollBox(control, consentKey);
+  const body = document.createElement("div");
+  body.className = "nodii-onboarding-consent-doc-body";
+  body.innerHTML = getPurifier().sanitize(html, {
+    FORBID_TAGS: ["iframe", "object", "embed", "form"],
+    FORBID_ATTR: ["srcdoc"],
+    ADD_ATTR: ["target", "rel"]
+  });
+  hardenElement(body);
+  box.appendChild(body);
+  container.appendChild(box);
+  reportScroll();
+}
+function renderPlainText(container, control, consentKey, text) {
+  clearNode(container);
+  const { box, reportScroll } = makeScrollBox(control, consentKey);
+  const body = document.createElement("div");
+  body.className = "nodii-onboarding-consent-doc-body";
+  body.textContent = text;
+  box.appendChild(body);
+  container.appendChild(box);
+  reportScroll();
+}
+function renderOpenGateAffordance(container, control, consentKey, doc, note) {
+  clearNode(container);
+  const link = document.createElement("a");
+  link.className = "nodii-onboarding-consent-open";
+  link.href = doc.downloadUrl;
+  link.target = "_blank";
+  link.rel = "noopener noreferrer";
+  link.textContent = `Open ${doc.title}`;
+  const markOpened = () => control.markOpened(consentKey);
+  link.addEventListener("click", markOpened);
+  link.addEventListener("keydown", (event) => {
+    if (event.key === "Enter") markOpened();
+  });
+  const row = document.createElement("div");
+  row.className = "nodii-onboarding-consent-open-row";
+  row.appendChild(link);
+  if (note) {
+    const noteEl = document.createElement("p");
+    noteEl.className = "nodii-onboarding-consent-note";
+    noteEl.textContent = note;
+    row.appendChild(noteEl);
+  }
+  container.appendChild(row);
+}
+function renderUnrenderableError(container, doc, onRetry) {
+  clearNode(container);
+  const wrap = document.createElement("div");
+  wrap.className = "nodii-onboarding-consent-unrenderable";
+  wrap.setAttribute("role", "alert");
+  const msg = document.createElement("p");
+  msg.className = "nodii-onboarding-consent-error";
+  msg.textContent = `\u201C${doc.title}\u201D could not be loaded, so it cannot be accepted yet. Please retry; if it keeps failing, contact support.`;
+  wrap.appendChild(msg);
+  const retry = document.createElement("button");
+  retry.type = "button";
+  retry.className = "nodii-onboarding-consent-retry";
+  retry.textContent = "Retry loading document";
+  retry.addEventListener("click", onRetry);
+  wrap.appendChild(retry);
+  const link = document.createElement("a");
+  link.className = "nodii-onboarding-consent-open";
+  link.href = doc.downloadUrl;
+  link.target = "_blank";
+  link.rel = "noopener noreferrer";
+  link.textContent = `Open ${doc.title} in a new tab`;
+  wrap.appendChild(link);
+  container.appendChild(wrap);
+}
+async function renderPdf(container, control, consentKey, doc, blob, onRetry) {
+  const fail = () => handleRenderFailure(container, control, consentKey, doc, onRetry);
+  let pdfjs;
+  try {
+    pdfjs = await import('pdfjs-dist');
+  } catch {
+    return fail();
+  }
+  try {
+    configurePdfWorker(pdfjs);
+    const data = new Uint8Array(await blob.arrayBuffer());
+    const pdf = await pdfjs.getDocument({ data }).promise;
+    const body = document.createElement("div");
+    body.className = "nodii-onboarding-consent-doc-body nodii-consent-pdf";
+    for (let pageNo = 1; pageNo <= pdf.numPages; pageNo++) {
+      const page = await pdf.getPage(pageNo);
+      const viewport = page.getViewport({ scale: 1.2 });
+      const canvas = document.createElement("canvas");
+      canvas.className = "nodii-consent-pdf-page";
+      canvas.width = Math.ceil(viewport.width);
+      canvas.height = Math.ceil(viewport.height);
+      const ctx = canvas.getContext("2d");
+      if (ctx) {
+        await page.render({ canvas, canvasContext: ctx, viewport }).promise;
+      }
+      body.appendChild(canvas);
+    }
+    if (typeof container.isConnected === "boolean" && !container.isConnected) {
+      return { renderedAs: "unrenderable" };
+    }
+    if (body.childElementCount === 0) return fail();
+    clearNode(container);
+    const { box, reportScroll } = makeScrollBox(control, consentKey);
+    box.appendChild(body);
+    container.appendChild(box);
+    reportScroll();
+    return { renderedAs: "pdf" };
+  } catch {
+    return fail();
+  }
+}
+var pdfWorkerConfigured = false;
+function resolvePackagedWorkerUrl() {
+  const WORKER_SPEC = "pdfjs-dist/build/pdf.worker.min.mjs";
+  const meta = import.meta;
+  if (typeof meta.resolve === "function") {
+    try {
+      const resolved = meta.resolve(WORKER_SPEC);
+      if (resolved) return resolved;
+    } catch {
+    }
+  }
+  try {
+    return new URL(WORKER_SPEC, import.meta.url).href;
+  } catch {
+    return null;
+  }
+}
+function configurePdfWorker(pdfjs) {
+  if (pdfWorkerConfigured) return;
+  const opts = pdfjs.GlobalWorkerOptions;
+  if (opts.workerPort || opts.workerSrc) {
+    pdfWorkerConfigured = true;
+    return;
+  }
+  const packagedUrl = resolvePackagedWorkerUrl();
+  if (packagedUrl) {
+    opts.workerSrc = packagedUrl;
+  } else {
+    const version = pdfjs.version ?? "";
+    opts.workerSrc = `https://cdn.jsdelivr.net/npm/pdfjs-dist@${version}/build/pdf.worker.min.mjs`;
+  }
+  pdfWorkerConfigured = true;
+}
+function handleRenderFailure(container, control, consentKey, doc, onRetry) {
+  if (doc.acceptanceLevel === "open_then_accept") {
+    renderOpenGateAffordance(
+      container,
+      control,
+      consentKey,
+      doc,
+      "The inline preview is unavailable. Opening the document in a new tab satisfies this step."
+    );
+    return { renderedAs: "open-affordance" };
+  }
+  renderUnrenderableError(container, doc, onRetry);
+  return { renderedAs: "unrenderable" };
+}
+async function renderConsentDocument(container, doc, control, options) {
+  const { consentKey } = options;
+  const onRetry = () => {
+    void renderConsentDocument(container, doc, control, options);
+  };
+  let fetched;
+  try {
+    fetched = await fetchDocumentContent(doc, {
+      fetch: options.fetch,
+      timeoutMs: options.timeoutMs
+    });
+  } catch {
+    return handleRenderFailure(container, control, consentKey, doc, onRetry);
+  }
+  if (typeof container.isConnected === "boolean" && !container.isConnected) {
+    return { renderedAs: "unrenderable" };
+  }
+  if (doc.acceptanceLevel === "open_then_accept") {
+    renderOpenGateAffordance(
+      container,
+      control,
+      consentKey,
+      doc,
+      "Open the document in a new tab to review it \u2014 that satisfies this step."
+    );
+    return { renderedAs: "open-affordance" };
+  }
+  if (fetched.kind === "pdf" && fetched.blob) {
+    return renderPdf(
+      container,
+      control,
+      consentKey,
+      doc,
+      fetched.blob,
+      onRetry
+    );
+  }
+  if (fetched.kind === "binary") {
+    return handleRenderFailure(container, control, consentKey, doc, onRetry);
+  }
+  const text = fetched.text ?? "";
+  if (isMarkdown(fetched, doc)) {
+    const html = await marked.parse(text, { async: true });
+    renderSanitizedHtml(container, control, consentKey, html);
+    return { renderedAs: "markdown" };
+  }
+  if (fetched.kind === "html") {
+    renderSanitizedHtml(container, control, consentKey, text);
+    return { renderedAs: "html" };
+  }
+  renderPlainText(container, control, consentKey, text);
+  return { renderedAs: "text" };
+}
+function _resetPdfWorkerState() {
+  pdfWorkerConfigured = false;
+}
+
+export { _resetPdfWorkerState, renderConsentDocument };
+//# sourceMappingURL=chunk-LVJM4CTG.js.map
+//# sourceMappingURL=chunk-LVJM4CTG.js.map

package/dist/chunk-LVJM4CTG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/viewer/render.ts"],"names":[],"mappings":";;;;AAgDA,IAAI,QAAA,GAAsD,IAAA;AAC1D,SAAS,WAAA,GAAkD;AACzD,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,GAAA,GAAO,WAAoC,MAAA,IAAU,UAAA;AAG3D,EAAA,QAAA,GACE,gBAGA,GAAG,CAAA;AACL,EAAA,OAAO,QAAA;AACT;AA+BA,IAAM,kBAAA,GAAqB,CAAA;AAE3B,SAAS,UAAU,IAAA,EAAyB;AAC1C,EAAA,OAAO,IAAA,CAAK,UAAA,EAAY,IAAA,CAAK,WAAA,CAAY,KAAK,UAAU,CAAA;AAC1D;AAaA,SAAS,cAAc,GAAA,EAA2B;AAChD,EAAA,IAAA,CAAK,IAAI,WAAA,IAAe,EAAA,EAAI,MAAK,CAAE,MAAA,GAAS,GAAG,OAAO,IAAA;AAEtD,EAAA,OAAO,GAAA,CAAI,aAAA,CAAc,QAAQ,CAAA,KAAM,IAAA;AACzC;AASA,SAAS,aAAA,CACP,SACA,UAAA,EACmD;AACnD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA;AACxC,EAAA,GAAA,CAAI,SAAA,GAAY,oCAAA;AAChB,EAAA,GAAA,CAAI,YAAA,CAAa,YAAY,GAAG,CAAA;AAChC,EAAA,GAAA,CAAI,YAAA,CAAa,QAAQ,QAAQ,CAAA;AACjC,EAAA,MAAM,SAAS,MAAY;AAIzB,IAAA,IAAI,CAAC,aAAA,CAAc,GAAG,CAAA,EAAG;AAIzB,IAAA,IAAI,GAAA,CAAI,gBAAgB,CAAA,EAAG;AAC3B,IAAA,MAAM,KAAA,GACJ,GAAA,CAAI,YAAA,GAAe,GAAA,CAAI,YAAA,IAAgB,CAAA;AAAA;AAAA,MAEnC;AAAA,QACA,IAAA,CAAK,GAAA;AAAA,MACH,CAAA;AAAA,MAAA,CACC,GAAA,CAAI,SAAA,GAAY,GAAA,CAAI,YAAA,GAAe,sBAClC,GAAA,CAAI;AAAA,KACR;AACN,IAAA,OAAA,CAAQ,oBAAA,CAAqB,YAAY,KAAK,CAAA;AAAA,EAChD,CAAA;AACA,EAAA,GAAA,CAAI,gBAAA,CAAiB,UAAU,MAAM,CAAA;AAIrC,EAAA,OAAO,EAAE,GAAA,EAAK,YAAA,EAAc,MAAA,EAAO;AACrC;AAGA,SAAS,UAAA,CACP,SACA,GAAA,EACS;AACT,EAAA,OACE,OAAA,CAAQ,YAAY,QAAA,CAAS,UAAU,KACvC,iBAAA,CAAkB,IAAA,CAAK,IAAI,WAAW,CAAA;AAE1C;AAGA,IAAM,cAAA,uBAAqB,GAAA,CAAI;AAAA,EAC7B,QAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAoBD,SAAS,2BAA2B,KAAA,EAAuB;AACzD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,EAAA,GAAK,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA;AAC7B,IAAA,IAAI,KAAK,EAAA,IAAQ,EAAA,KAAO,GAAA,EAAM,GAAA,IAAO,MAAM,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,IAAI,WAAA,EAAY;AACzB;AAEA,IAAM,qBAAA,GAAwB,CAAC,aAAA,EAAe,WAAA,EAAa,gBAAgB,CAAA;AAE3E,SAAS,cAAc,IAAA,EAAyB;AAC9C,EAAA,MAAM,MAAA,GAAS,CAAC,IAAA,KAAwB;AAEtC,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA;AACzC,IAAA,IAAI,cAAA,CAAe,GAAA,CAAI,IAAA,CAAK,OAAO,CAAA,EAAG;AACpC,MAAA,IAAA,CAAK,MAAA,EAAO;AACZ,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA,EAAG;AAC9C,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,WAAA,EAAY;AAEnC,MAAA,MAAM,KAAA,GAAQ,0BAAA,CAA2B,IAAA,CAAK,KAAK,CAAA;AACnD,MAAA,IAAI,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA,EAAG;AACzB,QAAA,IAAA,CAAK,eAAA,CAAgB,KAAK,IAAI,CAAA;AAC9B,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CACG,IAAA,KAAS,MAAA,IAAU,IAAA,KAAS,KAAA,IAAS,SAAS,YAAA,KAC/C,qBAAA,CAAsB,IAAA,CAAK,CAAC,CAAA,KAAM,KAAA,CAAM,UAAA,CAAW,CAAC,CAAC,CAAA,EACrD;AACA,QAAA,IAAA,CAAK,eAAA,CAAgB,KAAK,IAAI,CAAA;AAAA,MAChC;AACA,MAAA,IAAI,IAAA,KAAS,QAAA,EAAU,IAAA,CAAK,eAAA,CAAgB,KAAK,IAAI,CAAA;AAAA,IACvD;AACA,IAAA,KAAA,MAAW,KAAA,IAAS,QAAA,EAAU,MAAA,CAAO,KAAK,CAAA;AAAA,EAC5C,CAAA;AACA,EAAA,KAAA,MAAW,SAAS,KAAA,CAAM,IAAA,CAAK,KAAK,QAAQ,CAAA,SAAU,KAAK,CAAA;AAC7D;AAGA,SAAS,mBAAA,CACP,SAAA,EACA,OAAA,EACA,UAAA,EACA,IAAA,EACM;AACN,EAAA,SAAA,CAAU,SAAS,CAAA;AACnB,EAAA,MAAM,EAAE,GAAA,EAAK,YAAA,EAAa,GAAI,aAAA,CAAc,SAAS,UAAU,CAAA;AAC/D,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA;AACzC,EAAA,IAAA,CAAK,SAAA,GAAY,mCAAA;AAGjB,EAAA,IAAA,CAAK,SAAA,GAAY,WAAA,EAAY,CAAE,QAAA,CAAS,IAAA,EAAM;AAAA,IAC5C,WAAA,EAAa,CAAC,QAAA,EAAU,QAAA,EAAU,SAAS,MAAM,CAAA;AAAA,IACjD,WAAA,EAAa,CAAC,QAAQ,CAAA;AAAA,IACtB,QAAA,EAAU,CAAC,QAAA,EAAU,KAAK;AAAA,GAC3B,CAAA;AAGD,EAAA,aAAA,CAAc,IAAI,CAAA;AAClB,EAAA,GAAA,CAAI,YAAY,IAAI,CAAA;AACpB,EAAA,SAAA,CAAU,YAAY,GAAG,CAAA;AAGzB,EAAA,YAAA,EAAa;AACf;AAGA,SAAS,eAAA,CACP,SAAA,EACA,OAAA,EACA,UAAA,EACA,IAAA,EACM;AACN,EAAA,SAAA,CAAU,SAAS,CAAA;AACnB,EAAA,MAAM,EAAE,GAAA,EAAK,YAAA,EAAa,GAAI,aAAA,CAAc,SAAS,UAAU,CAAA;AAC/D,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA;AACzC,EAAA,IAAA,CAAK,SAAA,GAAY,mCAAA;AACjB,EAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,EAAA,GAAA,CAAI,YAAY,IAAI,CAAA;AACpB,EAAA,SAAA,CAAU,YAAY,GAAG,CAAA;AACzB,EAAA,YAAA,EAAa;AACf;AAeA,SAAS,wBAAA,CACP,SAAA,EACA,OAAA,EACA,UAAA,EACA,KACA,IAAA,EACM;AACN,EAAA,SAAA,CAAU,SAAS,CAAA;AACnB,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,aAAA,CAAc,GAAG,CAAA;AACvC,EAAA,IAAA,CAAK,SAAA,GAAY,+BAAA;AACjB,EAAA,IAAA,CAAK,OAAO,GAAA,CAAI,WAAA;AAChB,EAAA,IAAA,CAAK,MAAA,GAAS,QAAA;AACd,EAAA,IAAA,CAAK,GAAA,GAAM,qBAAA;AACX,EAAA,IAAA,CAAK,WAAA,GAAc,CAAA,KAAA,EAAQ,GAAA,CAAI,KAAK,CAAA,CAAA;AAGpC,EAAA,MAAM,UAAA,GAAa,MAAY,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA;AAC5D,EAAA,IAAA,CAAK,gBAAA,CAAiB,SAAS,UAAU,CAAA;AACzC,EAAA,IAAA,CAAK,gBAAA,CAAiB,SAAA,EAAW,CAAC,KAAA,KAAU;AAC1C,IAAA,IAAK,KAAA,CAAwB,GAAA,KAAQ,OAAA,EAAS,UAAA,EAAW;AAAA,EAC3D,CAAC,CAAA;AACD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA;AACxC,EAAA,GAAA,CAAI,SAAA,GAAY,mCAAA;AAChB,EAAA,GAAA,CAAI,YAAY,IAAI,CAAA;AACpB,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,GAAG,CAAA;AACzC,IAAA,MAAA,CAAO,SAAA,GAAY,+BAAA;AACnB,IAAA,MAAA,CAAO,WAAA,GAAc,IAAA;AACrB,IAAA,GAAA,CAAI,YAAY,MAAM,CAAA;AAAA,EACxB;AACA,EAAA,SAAA,CAAU,YAAY,GAAG,CAAA;AAC3B;AAaA,SAAS,uBAAA,CACP,SAAA,EACA,GAAA,EACA,OAAA,EACM;AACN,EAAA,SAAA,CAAU,SAAS,CAAA;AACnB,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA;AACzC,EAAA,IAAA,CAAK,SAAA,GAAY,uCAAA;AACjB,EAAA,IAAA,CAAK,YAAA,CAAa,QAAQ,OAAO,CAAA;AAEjC,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,aAAA,CAAc,GAAG,CAAA;AACtC,EAAA,GAAA,CAAI,SAAA,GAAY,gCAAA;AAChB,EAAA,GAAA,CAAI,WAAA,GAAc,CAAA,MAAA,EAAI,GAAA,CAAI,KAAK,CAAA,6GAAA,CAAA;AAC/B,EAAA,IAAA,CAAK,YAAY,GAAG,CAAA;AAEpB,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC7C,EAAA,KAAA,CAAM,IAAA,GAAO,QAAA;AACb,EAAA,KAAA,CAAM,SAAA,GAAY,gCAAA;AAClB,EAAA,KAAA,CAAM,WAAA,GAAc,wBAAA;AACpB,EAAA,KAAA,CAAM,gBAAA,CAAiB,SAAS,OAAO,CAAA;AACvC,EAAA,IAAA,CAAK,YAAY,KAAK,CAAA;AAGtB,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,aAAA,CAAc,GAAG,CAAA;AACvC,EAAA,IAAA,CAAK,SAAA,GAAY,+BAAA;AACjB,EAAA,IAAA,CAAK,OAAO,GAAA,CAAI,WAAA;AAChB,EAAA,IAAA,CAAK,MAAA,GAAS,QAAA;AACd,EAAA,IAAA,CAAK,GAAA,GAAM,qBAAA;AACX,EAAA,IAAA,CAAK,WAAA,GAAc,CAAA,KAAA,EAAQ,GAAA,CAAI,KAAK,CAAA,aAAA,CAAA;AACpC,EAAA,IAAA,CAAK,YAAY,IAAI,CAAA;AAErB,EAAA,SAAA,CAAU,YAAY,IAAI,CAAA;AAC5B;AAWA,eAAe,UACb,SAAA,EACA,OAAA,EACA,UAAA,EACA,GAAA,EACA,MACA,OAAA,EACsC;AACtC,EAAA,MAAM,OAAO,MACX,mBAAA,CAAoB,WAAW,OAAA,EAAS,UAAA,EAAY,KAAK,OAAO,CAAA;AAElE,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,MAAM,OAAO,YAAY,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA,EAAK;AAAA,EACd;AAEA,EAAA,IAAI;AAKF,IAAA,kBAAA,CAAmB,KAAK,CAAA;AACxB,IAAA,MAAM,OAAO,IAAI,UAAA,CAAW,MAAM,IAAA,CAAK,aAAa,CAAA;AACpD,IAAA,MAAM,MAAM,MAAM,KAAA,CAAM,YAAY,EAAE,IAAA,EAAM,CAAA,CAAE,OAAA;AAM9C,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA;AACzC,IAAA,IAAA,CAAK,SAAA,GAAY,qDAAA;AACjB,IAAA,KAAA,IAAS,MAAA,GAAS,CAAA,EAAG,MAAA,IAAU,GAAA,CAAI,UAAU,MAAA,EAAA,EAAU;AACrD,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAA;AACrC,MAAA,MAAM,WAAW,IAAA,CAAK,WAAA,CAAY,EAAE,KAAA,EAAO,KAAK,CAAA;AAChD,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,MAAA,MAAA,CAAO,SAAA,GAAY,wBAAA;AACnB,MAAA,MAAA,CAAO,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA;AACvC,MAAA,MAAA,CAAO,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA;AACzC,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,UAAA,CAAW,IAAI,CAAA;AAClC,MAAA,IAAI,GAAA,EAAK;AACP,QAAA,MAAM,IAAA,CAAK,OAAO,EAAE,MAAA,EAAQ,eAAe,GAAA,EAAK,QAAA,EAAU,CAAA,CAAE,OAAA;AAAA,MAC9D;AACA,MAAA,IAAA,CAAK,YAAY,MAAM,CAAA;AAAA,IACzB;AAKA,IAAA,IAAI,OAAO,SAAA,CAAU,WAAA,KAAgB,SAAA,IAAa,CAAC,UAAU,WAAA,EAAa;AACxE,MAAA,OAAO,EAAE,YAAY,cAAA,EAAe;AAAA,IACtC;AAGA,IAAA,IAAI,IAAA,CAAK,iBAAA,KAAsB,CAAA,EAAG,OAAO,IAAA,EAAK;AAE9C,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,MAAM,EAAE,GAAA,EAAK,YAAA,EAAa,GAAI,aAAA,CAAc,SAAS,UAAU,CAAA;AAC/D,IAAA,GAAA,CAAI,YAAY,IAAI,CAAA;AACpB,IAAA,SAAA,CAAU,YAAY,GAAG,CAAA;AAEzB,IAAA,YAAA,EAAa;AACb,IAAA,OAAO,EAAE,YAAY,KAAA,EAAM;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA,EAAK;AAAA,EACd;AACF;AAGA,IAAI,mBAAA,GAAsB,KAAA;AAkB1B,SAAS,wBAAA,GAA0C;AACjD,EAAA,MAAM,WAAA,GAAc,qCAAA;AACpB,EAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA;AAGb,EAAA,IAAI,OAAO,IAAA,CAAK,OAAA,KAAY,UAAA,EAAY;AACtC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA;AACzC,MAAA,IAAI,UAAU,OAAO,QAAA;AAAA,IACvB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,WAAA,EAAa,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA,CAAE,IAAA;AAAA,EAC/C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAoBA,SAAS,mBAAmB,KAAA,EAA0C;AACpE,EAAA,IAAI,mBAAA,EAAqB;AACzB,EAAA,MAAM,OAAO,KAAA,CAAM,mBAAA;AAEnB,EAAA,IAAI,IAAA,CAAK,UAAA,IAAc,IAAA,CAAK,SAAA,EAAW;AACrC,IAAA,mBAAA,GAAsB,IAAA;AACtB,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,cAAc,wBAAA,EAAyB;AAC7C,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,WAAA;AAAA,EACnB,CAAA,MAAO;AAGL,IAAA,MAAM,OAAA,GAAW,MAA+B,OAAA,IAAW,EAAA;AAC3D,IAAA,IAAA,CAAK,SAAA,GAAY,2CAA2C,OAAO,CAAA,yBAAA,CAAA;AAAA,EACrE;AACA,EAAA,mBAAA,GAAsB,IAAA;AACxB;AAWA,SAAS,mBAAA,CACP,SAAA,EACA,OAAA,EACA,UAAA,EACA,KACA,OAAA,EAC6B;AAC7B,EAAA,IAAI,GAAA,CAAI,oBAAoB,kBAAA,EAAoB;AAC9C,IAAA,wBAAA;AAAA,MACE,SAAA;AAAA,MACA,OAAA;AAAA,MACA,UAAA;AAAA,MACA,GAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,EAAE,YAAY,iBAAA,EAAkB;AAAA,EACzC;AAGA,EAAA,uBAAA,CAAwB,SAAA,EAAW,KAAK,OAAO,CAAA;AAC/C,EAAA,OAAO,EAAE,YAAY,cAAA,EAAe;AACtC;AAaA,eAAsB,qBAAA,CACpB,SAAA,EACA,GAAA,EACA,OAAA,EACA,OAAA,EACsC;AACtC,EAAA,MAAM,EAAE,YAAW,GAAI,OAAA;AACvB,EAAA,MAAM,UAAU,MAAY;AAC1B,IAAA,KAAK,qBAAA,CAAsB,SAAA,EAAW,GAAA,EAAK,OAAA,EAAS,OAAO,CAAA;AAAA,EAC7D,CAAA;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,qBAAqB,GAAA,EAAK;AAAA,MACxC,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,WAAW,OAAA,CAAQ;AAAA,KACpB,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,mBAAA,CAAoB,SAAA,EAAW,OAAA,EAAS,UAAA,EAAY,KAAK,OAAO,CAAA;AAAA,EACzE;AAKA,EAAA,IAAI,OAAO,SAAA,CAAU,WAAA,KAAgB,SAAA,IAAa,CAAC,UAAU,WAAA,EAAa;AACxE,IAAA,OAAO,EAAE,YAAY,cAAA,EAAe;AAAA,EACtC;AAOA,EAAA,IAAI,GAAA,CAAI,oBAAoB,kBAAA,EAAoB;AAC9C,IAAA,wBAAA;AAAA,MACE,SAAA;AAAA,MACA,OAAA;AAAA,MACA,UAAA;AAAA,MACA,GAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,EAAE,YAAY,iBAAA,EAAkB;AAAA,EACzC;AAEA,EAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,KAAA,IAAS,OAAA,CAAQ,IAAA,EAAM;AAC1C,IAAA,OAAO,SAAA;AAAA,MACL,SAAA;AAAA,MACA,OAAA;AAAA,MACA,UAAA;AAAA,MACA,GAAA;AAAA,MACA,OAAA,CAAQ,IAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAG7B,IAAA,OAAO,mBAAA,CAAoB,SAAA,EAAW,OAAA,EAAS,UAAA,EAAY,KAAK,OAAO,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,IAAQ,EAAA;AAC7B,EAAA,IAAI,UAAA,CAAW,OAAA,EAAS,GAAG,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,KAAA,CAAM,MAAM,EAAE,KAAA,EAAO,MAAM,CAAA;AACrD,IAAA,mBAAA,CAAoB,SAAA,EAAW,OAAA,EAAS,UAAA,EAAY,IAAI,CAAA;AACxD,IAAA,OAAO,EAAE,YAAY,UAAA,EAAW;AAAA,EAClC;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,mBAAA,CAAoB,SAAA,EAAW,OAAA,EAAS,UAAA,EAAY,IAAI,CAAA;AACxD,IAAA,OAAO,EAAE,YAAY,MAAA,EAAO;AAAA,EAC9B;AACA,EAAA,eAAA,CAAgB,SAAA,EAAW,OAAA,EAAS,UAAA,EAAY,IAAI,CAAA;AACpD,EAAA,OAAO,EAAE,YAAY,MAAA,EAAO;AAC9B;AAGO,SAAS,oBAAA,GAA6B;AAC3C,EAAA,mBAAA,GAAsB,KAAA;AACxB","file":"chunk-LVJM4CTG.js","sourcesContent":["/**\n * Default ConsentPack document viewer (D543 §5) — @nodii/onboarding/viewer.\n *\n * A SEPARATE, opt-in module built on STANDARD libraries so the base SDK stays\n * lean: consumers only pay for the viewer if they render our default consent\n * components. The headless controller (@nodii/onboarding/consent) knows nothing\n * about this — it just receives reportScrollProgress / markScrolledToEnd /\n * markOpened from whatever renders the doc.\n *\n * Renderers (per fetched artifact — NO IFRAME anywhere; everything is inline,\n * same-origin, so `scroll_then_accept` scroll tracking is REAL):\n *   - text/html  → sanitize with DOMPurify, inject into a scroll <div>.\n *   - markdown   → marked → DOMPurify → inject into a scroll <div>.\n *   - text/plain → escaped text (textContent) in a scroll <div>.\n *   - application/pdf → PDF.js (pdfjs-dist), rendered to <canvas> + a text\n *     layer, page by page, in a scroll <div>. PDF.js is LAZY-loaded via a\n *     dynamic import() ONLY when a PDF doc is actually present, so it never\n *     bloats the base bundle.\n *\n * The scroll container's scroll-to-end (and the PDF/open fallbacks) drive the\n * consent controller so the gate works for real. A failed fetch/render\n * degrades to an \"open in a new tab\" affordance (marks the doc opened /\n * scrolled) so every doc stays consentable.\n *\n * Bundle discipline: DOMPurify + marked are imported at module top (this is\n * the VIEWER entry, not the base SDK — the base `@nodii/onboarding` never\n * statically imports this file). pdfjs-dist is imported ONLY via dynamic\n * import() inside renderPdf, so even the viewer entry doesn't eagerly load it.\n */\n\nimport createDOMPurify from \"dompurify\";\nimport { marked } from \"marked\";\nimport type { ConsentController } from \"../consent/controller.js\";\nimport type { ConsentDocument } from \"../consent/model.js\";\nimport {\n  fetchDocumentContent,\n  type FetchedConsentDocument,\n} from \"../consent/document.js\";\n\n/**\n * DOMPurify bound to the current window. The default import is BOTH a\n * pre-bound instance AND a factory `(window) => instance`. Binding it\n * explicitly to `globalThis` (which happy-dom / a real browser populate with\n * `window`) guarantees a working DOM even in environments where DOMPurify's\n * implicit global detection misfires (e.g. bun + happy-dom under test), where\n * an unbound instance silently passes HTML through UN-sanitized. Lazily\n * memoized so we only bind once.\n */\nlet purifier: ReturnType<typeof createDOMPurify> | null = null;\nfunction getPurifier(): ReturnType<typeof createDOMPurify> {\n  if (purifier) return purifier;\n  const win = (globalThis as { window?: unknown }).window ?? globalThis;\n  // createDOMPurify is callable as a factory; when the arg is a window-like\n  // object it returns an instance bound to it.\n  purifier = (\n    createDOMPurify as unknown as (\n      w: unknown,\n    ) => ReturnType<typeof createDOMPurify>\n  )(win);\n  return purifier;\n}\n\nexport interface ConsentDocumentViewerOptions {\n  /** Injectable fetch for the presigned artifact GET (defaults to global). */\n  fetch?: typeof globalThis.fetch;\n  /** Per-request timeout in ms (default from fetchDocumentContent). */\n  timeoutMs?: number;\n  /**\n   * The `key` the controller identifies this document by (doc_type |\n   * custom:<key>). The viewer reports scroll/open evidence under this key.\n   */\n  consentKey: string;\n}\n\n/** Result of rendering — lets the caller know how the doc was displayed. */\nexport interface ConsentDocumentViewerResult {\n  /**\n   * How the artifact was rendered.\n   *\n   * - html | markdown | text | pdf → rendered inline (gate is driven by real\n   *   scroll/open).\n   * - open-affordance → an `open_then_accept` doc that opens in a new tab (the\n   *   real-open IS its gate; satisfies ONLY `opened`).\n   * - unrenderable → a GATED doc (scroll_then_accept) that could NOT be\n   *   rendered inline. The gate stays UNSATISFIABLE — accept is disabled and a\n   *   clear error is shown. NO evidence is ever fabricated (COMPLIANCE, D543).\n   */\n  renderedAs:\n    \"html\" | \"markdown\" | \"text\" | \"pdf\" | \"open-affordance\" | \"unrenderable\";\n}\n\nconst SCROLL_END_EPSILON = 2;\n\nfunction clearNode(node: HTMLElement): void {\n  while (node.firstChild) node.removeChild(node.firstChild);\n}\n\n/**\n * Does the box hold ACTUAL readable rendered content? A \"content fits without\n * scrolling\" ratio of 1 is only legitimate when there is genuinely something to\n * have read. Content = non-empty text (HTML/markdown/text render) OR at least\n * one rendered PDF page canvas. A bare wrapper `<div>` with empty text is NOT\n * content — so an empty-artifact doc (e.g. a 0-byte or all-whitespace body, or\n * a not-yet-populated box) can NEVER satisfy the gate. This is the P0a\n * by-construction guarantee: the ratio-1 branch depends on rendered-content\n * presence, not on geometry a headless runtime cannot measure — fabrication is\n * impossible in EVERY runtime.\n */\nfunction boxHasContent(box: HTMLElement): boolean {\n  if ((box.textContent ?? \"\").trim().length > 0) return true;\n  // PDF pages carry no text — a rendered page canvas counts as content.\n  return box.querySelector(\"canvas\") !== null;\n}\n\n/**\n * A scroll <div> that reports scroll progress to the controller. Returns the\n * box AND a `reportScroll` fn the caller MUST invoke ONLY AFTER real content is\n * appended — never at creation. `report` refuses to satisfy the \"fits without\n * scrolling\" case unless the box actually holds content, so an empty or\n * pre-render box can never latch scrolled_to_end (P0a — by construction).\n */\nfunction makeScrollBox(\n  control: ConsentController,\n  consentKey: string,\n): { box: HTMLDivElement; reportScroll: () => void } {\n  const box = document.createElement(\"div\");\n  box.className = \"nodii-onboarding-consent-scrollbox\";\n  box.setAttribute(\"tabindex\", \"0\");\n  box.setAttribute(\"role\", \"region\");\n  const report = (): void => {\n    // COMPLIANCE (P0a): an empty / not-yet-rendered box can NEVER satisfy the\n    // gate — there is nothing to have read. This holds in EVERY runtime,\n    // independent of scroll geometry (which a headless DOM cannot measure).\n    if (!boxHasContent(box)) return;\n    // Unmeasured container (no layout yet / happy-dom) → do NOT report a\n    // fits-without-scroll: scrollHeight 0 is not evidence the user reached the\n    // end. A real scroll event still reports its measured ratio.\n    if (box.scrollHeight <= 0) return;\n    const ratio =\n      box.scrollHeight - box.clientHeight <= 0\n        ? // Content is present AND genuinely fits without scrolling → \"at end\".\n          1\n        : Math.min(\n            1,\n            (box.scrollTop + box.clientHeight + SCROLL_END_EPSILON) /\n              box.scrollHeight,\n          );\n    control.reportScrollProgress(consentKey, ratio);\n  };\n  box.addEventListener(\"scroll\", report);\n  // NOTE: no report is scheduled at creation. The caller invokes reportScroll()\n  // AFTER content is appended (short-doc auto-unlock then only fires with\n  // content present). This is what makes P0a a construction guarantee.\n  return { box, reportScroll: report };\n}\n\n/** Detect markdown by content-type or a .md-looking downloadUrl. */\nfunction isMarkdown(\n  fetched: FetchedConsentDocument,\n  doc: Pick<ConsentDocument, \"downloadUrl\">,\n): boolean {\n  return (\n    fetched.contentType.includes(\"markdown\") ||\n    /\\.mdx?(\\?|#|$)/i.test(doc.downloadUrl)\n  );\n}\n\n/** Tags that must never survive into the rendered consent document. */\nconst DANGEROUS_TAGS = new Set([\n  \"SCRIPT\",\n  \"IFRAME\",\n  \"OBJECT\",\n  \"EMBED\",\n  \"FORM\",\n  \"STYLE\",\n  \"LINK\",\n  \"META\",\n  \"BASE\",\n]);\n\n/**\n * Defense-in-depth pass AFTER DOMPurify: walk the parsed DOM and remove any\n * dangerous element, every on* event-handler attribute, and javascript:/data:\n * URLs. DOMPurify is the primary, audited sanitizer, but this deterministic\n * DOM walk (a) hardens against any DOMPurify config gap and (b) is provably\n * correct in EVERY runtime — including ones where DOMPurify's own DOM-based\n * pass is a no-op (e.g. certain SSR/test DOMs). Belt-and-suspenders, not a\n * hand-rolled replacement for DOMPurify.\n */\n/**\n * Normalize a URL for scheme inspection the way a browser does BEFORE\n * resolving it: strip ALL ASCII whitespace and control characters (code\n * points <= 0x20, plus DEL 0x7F) anywhere in the string, not just the ends.\n * Browsers ignore these inside a URL, so a scheme split by an embedded tab/\n * newline/NUL (e.g. jav<TAB>ascript:) still executes; a mere .trim() leaves\n * the embedded ones and the startsWith('javascript:') check is bypassed.\n * Char-code filtering avoids embedding literal control bytes in a regex.\n */\nfunction normalizeUrlForSchemeCheck(value: string): string {\n  let out = \"\";\n  for (let i = 0; i < value.length; i++) {\n    const cp = value.charCodeAt(i);\n    if (cp > 0x20 && cp !== 0x7f) out += value[i];\n  }\n  return out.toLowerCase();\n}\n\nconst DANGEROUS_URL_SCHEMES = [\"javascript:\", \"vbscript:\", \"data:text/html\"];\n\nfunction hardenElement(root: HTMLElement): void {\n  const walker = (node: Element): void => {\n    // Copy children first — removal mutates the live list.\n    const children = Array.from(node.children);\n    if (DANGEROUS_TAGS.has(node.tagName)) {\n      node.remove();\n      return;\n    }\n    for (const attr of Array.from(node.attributes)) {\n      const name = attr.name.toLowerCase();\n      // Whitespace/control-stripped, lower-cased value for scheme inspection.\n      const value = normalizeUrlForSchemeCheck(attr.value);\n      if (name.startsWith(\"on\")) {\n        node.removeAttribute(attr.name);\n        continue;\n      }\n      if (\n        (name === \"href\" || name === \"src\" || name === \"xlink:href\") &&\n        DANGEROUS_URL_SCHEMES.some((s) => value.startsWith(s))\n      ) {\n        node.removeAttribute(attr.name);\n      }\n      if (name === \"srcdoc\") node.removeAttribute(attr.name);\n    }\n    for (const child of children) walker(child);\n  };\n  for (const child of Array.from(root.children)) walker(child);\n}\n\n/** Render sanitized HTML inline into a scroll box. */\nfunction renderSanitizedHtml(\n  container: HTMLElement,\n  control: ConsentController,\n  consentKey: string,\n  html: string,\n): void {\n  clearNode(container);\n  const { box, reportScroll } = makeScrollBox(control, consentKey);\n  const body = document.createElement(\"div\");\n  body.className = \"nodii-onboarding-consent-doc-body\";\n  // Primary: DOMPurify (the standard, audited Cure53 sanitizer). FORBID_TAGS\n  // on <iframe>/<object>/<embed>/<form> so a doc can't smuggle a frame in.\n  body.innerHTML = getPurifier().sanitize(html, {\n    FORBID_TAGS: [\"iframe\", \"object\", \"embed\", \"form\"],\n    FORBID_ATTR: [\"srcdoc\"],\n    ADD_ATTR: [\"target\", \"rel\"],\n  });\n  // Defense-in-depth: a deterministic DOM walk that removes any residual\n  // dangerous node/attr, correct in every runtime (see hardenElement).\n  hardenElement(body);\n  box.appendChild(body);\n  container.appendChild(box);\n  // Content is now IN the box → the short-doc auto-unlock may fire (P0a: report\n  // ONLY after content is present, never at box creation).\n  reportScroll();\n}\n\n/** Render escaped plain text inline into a scroll box. */\nfunction renderPlainText(\n  container: HTMLElement,\n  control: ConsentController,\n  consentKey: string,\n  text: string,\n): void {\n  clearNode(container);\n  const { box, reportScroll } = makeScrollBox(control, consentKey);\n  const body = document.createElement(\"div\");\n  body.className = \"nodii-onboarding-consent-doc-body\";\n  body.textContent = text; // safe-by-construction (no markup interpretation)\n  box.appendChild(body);\n  container.appendChild(box);\n  reportScroll(); // only after content is present (P0a)\n}\n\n/**\n * The LEGITIMATE gate affordance for an `open_then_accept` doc: an open-in-new\n * tab link. Opening the doc in a new tab IS the gate for this level, so a REAL\n * navigation satisfies ONLY `opened` (never `scrolled_to_end`). A native\n * <a target=\"_blank\"> navigates on click AND on Enter (keyboard activation of\n * an anchor) — we mark `opened` on those, which correspond to a real open. We\n * do NOT bind Space (Space does not activate an anchor → no navigation → no\n * open → must not mark opened; binding it would fabricate evidence).\n *\n * This is used both as the primary affordance for open_then_accept and as the\n * failure fallback for open_then_accept when inline preview is unavailable —\n * either way the gate is genuinely the real open.\n */\nfunction renderOpenGateAffordance(\n  container: HTMLElement,\n  control: ConsentController,\n  consentKey: string,\n  doc: Pick<ConsentDocument, \"downloadUrl\" | \"title\">,\n  note?: string,\n): void {\n  clearNode(container);\n  const link = document.createElement(\"a\");\n  link.className = \"nodii-onboarding-consent-open\";\n  link.href = doc.downloadUrl;\n  link.target = \"_blank\";\n  link.rel = \"noopener noreferrer\";\n  link.textContent = `Open ${doc.title}`;\n  // Mark opened ONLY on real activation of the anchor (click / Enter). No\n  // Space handler — Space does not navigate an <a>, so it is not a real open.\n  const markOpened = (): void => control.markOpened(consentKey);\n  link.addEventListener(\"click\", markOpened);\n  link.addEventListener(\"keydown\", (event) => {\n    if ((event as KeyboardEvent).key === \"Enter\") markOpened();\n  });\n  const row = document.createElement(\"div\");\n  row.className = \"nodii-onboarding-consent-open-row\";\n  row.appendChild(link);\n  if (note) {\n    const noteEl = document.createElement(\"p\");\n    noteEl.className = \"nodii-onboarding-consent-note\";\n    noteEl.textContent = note;\n    row.appendChild(noteEl);\n  }\n  container.appendChild(row);\n}\n\n/**\n * COMPLIANCE-CRITICAL (P0, D543): a GATED doc whose acceptance requires SEEING\n * the content inline (scroll_then_accept) could NOT be rendered inline (fetch\n * failure, expired presigned URL, CORS, octet-stream, PDF.js failure, viewer\n * unavailable). The gate MUST stay UNSATISFIABLE — the SDK NEVER fabricates\n * `scrolled_to_end` on a mere click. Render a clear error + a Retry, and an\n * \"Open in a new tab\" link that is INFORMATIONAL ONLY (it does NOT satisfy the\n * scroll gate — reading in a new tab is not evidence the user scrolled the\n * rendered doc to the end for this level). Accept stays disabled; the operator\n * must fix the artifact/URL for this doc to become acceptable.\n */\nfunction renderUnrenderableError(\n  container: HTMLElement,\n  doc: Pick<ConsentDocument, \"downloadUrl\" | \"title\">,\n  onRetry: () => void,\n): void {\n  clearNode(container);\n  const wrap = document.createElement(\"div\");\n  wrap.className = \"nodii-onboarding-consent-unrenderable\";\n  wrap.setAttribute(\"role\", \"alert\");\n\n  const msg = document.createElement(\"p\");\n  msg.className = \"nodii-onboarding-consent-error\";\n  msg.textContent = `“${doc.title}” could not be loaded, so it cannot be accepted yet. Please retry; if it keeps failing, contact support.`;\n  wrap.appendChild(msg);\n\n  const retry = document.createElement(\"button\");\n  retry.type = \"button\";\n  retry.className = \"nodii-onboarding-consent-retry\";\n  retry.textContent = \"Retry loading document\";\n  retry.addEventListener(\"click\", onRetry);\n  wrap.appendChild(retry);\n\n  // Informational only — opening in a new tab does NOT satisfy the scroll gate.\n  const link = document.createElement(\"a\");\n  link.className = \"nodii-onboarding-consent-open\";\n  link.href = doc.downloadUrl;\n  link.target = \"_blank\";\n  link.rel = \"noopener noreferrer\";\n  link.textContent = `Open ${doc.title} in a new tab`;\n  wrap.appendChild(link);\n\n  container.appendChild(wrap);\n}\n\n/**\n * Render a PDF via PDF.js into a scroll box (canvas per page). pdfjs-dist is\n * LAZY-loaded here (dynamic import) so it never enters the base bundle. On any\n * failure (import/worker/CSP/parse/zero-page), route through handleRenderFailure\n * — for a scroll_then_accept doc that is UNRENDERABLE (gate stays unsatisfiable,\n * never fabricated); for open_then_accept it is the real-open affordance (P0).\n * The scroll box is only attached (and progress only reported) AFTER pages are\n * rendered, so an empty/pre-render box can never satisfy the gate (P0a).\n */\nasync function renderPdf(\n  container: HTMLElement,\n  control: ConsentController,\n  consentKey: string,\n  doc: ConsentDocument,\n  blob: Blob,\n  onRetry: () => void,\n): Promise<ConsentDocumentViewerResult> {\n  const fail = (): ConsentDocumentViewerResult =>\n    handleRenderFailure(container, control, consentKey, doc, onRetry);\n\n  let pdfjs: typeof import(\"pdfjs-dist\");\n  try {\n    pdfjs = await import(\"pdfjs-dist\");\n  } catch {\n    return fail();\n  }\n\n  try {\n    // Configure the worker so getDocument does not reject on\n    // \"No GlobalWorkerOptions.workerSrc specified\" (pdfjs-dist v6). Resolve the\n    // packaged worker via a bundler-friendly URL; if that fails, fall back to\n    // the CDN for the exact installed version (never leaves the worker unset).\n    configurePdfWorker(pdfjs);\n    const data = new Uint8Array(await blob.arrayBuffer());\n    const pdf = await pdfjs.getDocument({ data }).promise;\n\n    // Render EVERY page into a DETACHED body FIRST — the scroll box is not put\n    // into the container (and reportScroll is not called) until real content is\n    // present (P0a: an empty/pre-render box can never satisfy the gate, even in\n    // a real browser where an empty 360px box measures scrollHeight==clientH).\n    const body = document.createElement(\"div\");\n    body.className = \"nodii-onboarding-consent-doc-body nodii-consent-pdf\";\n    for (let pageNo = 1; pageNo <= pdf.numPages; pageNo++) {\n      const page = await pdf.getPage(pageNo);\n      const viewport = page.getViewport({ scale: 1.2 });\n      const canvas = document.createElement(\"canvas\");\n      canvas.className = \"nodii-consent-pdf-page\";\n      canvas.width = Math.ceil(viewport.width);\n      canvas.height = Math.ceil(viewport.height);\n      const ctx = canvas.getContext(\"2d\");\n      if (ctx) {\n        await page.render({ canvas, canvasContext: ctx, viewport }).promise;\n      }\n      body.appendChild(canvas);\n    }\n\n    // Lifecycle guard: if the container was detached while we awaited the PDF\n    // (stage re-render / unmount / a Retry started a fresh render), abandon —\n    // don't mutate an orphaned tree or fight a concurrent render (P2 lifecycle).\n    if (typeof container.isConnected === \"boolean\" && !container.isConnected) {\n      return { renderedAs: \"unrenderable\" };\n    }\n    // A zero-page or all-empty PDF has no readable content → treat as a render\n    // failure (never satisfy a gate on an empty box).\n    if (body.childElementCount === 0) return fail();\n\n    clearNode(container);\n    const { box, reportScroll } = makeScrollBox(control, consentKey);\n    box.appendChild(body);\n    container.appendChild(box);\n    // Content is now present → the short-PDF auto-unlock may fire (P0a).\n    reportScroll();\n    return { renderedAs: \"pdf\" };\n  } catch {\n    return fail();\n  }\n}\n\n/** Whether pdfjs already has a worker configured this session. */\nlet pdfWorkerConfigured = false;\n\ninterface WorkerGlobalOptions {\n  workerSrc?: string;\n  workerPort?: unknown;\n}\n\n/**\n * Resolve the packaged pdf worker module to a LOADABLE URL, robust across\n * runtimes:\n *  1. `import.meta.resolve(...)` — real module resolution (Node/bun ESM);\n *     resolves through node_modules to the actual file (the plain\n *     `new URL(spec, import.meta.url)` does NOT — it's relative to THIS file,\n *     which 404s, the exact P2 dead-fallback bug).\n *  2. `new URL(\"pdfjs-dist/build/pdf.worker.min.mjs\", import.meta.url)` — a\n *     bundler (Vite/webpack/tsup) rewrites this to the emitted asset URL.\n * Returns null if neither yields a URL (→ caller falls back to the CDN).\n */\nfunction resolvePackagedWorkerUrl(): string | null {\n  const WORKER_SPEC = \"pdfjs-dist/build/pdf.worker.min.mjs\";\n  const meta = import.meta as ImportMeta & {\n    resolve?: (spec: string) => string;\n  };\n  if (typeof meta.resolve === \"function\") {\n    try {\n      const resolved = meta.resolve(WORKER_SPEC);\n      if (resolved) return resolved;\n    } catch {\n      // fall through to the bundler-rewrite form\n    }\n  }\n  try {\n    return new URL(WORKER_SPEC, import.meta.url).href;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Ensure pdfjs has a LOADABLE worker before getDocument (P2). Real pdfjs-dist\n * v6 rejects getDocument without one, and merely SETTING `workerSrc` is not the\n * same as the worker LOADING: the naive `new URL('pdfjs-dist/build/...',\n * import.meta.url)` resolves RELATIVE TO THIS MODULE (not through\n * node_modules), so it points at a path that 404s at load — the dead-fallback\n * bug P2 flags. We resolve the worker to a genuinely-loadable URL instead\n * (`import.meta.resolve` → real module resolution; else the bundler-rewrite\n * `new URL` form; else the version-pinned CDN).\n *\n * We set `workerSrc` (not `workerPort`): a resolved file/asset/CDN URL loads in\n * BOTH a real browser (bundler-served or CDN) AND Node/bun (resolved file\n * path) — proven by the [P2] real-pdfjs test which renders a real PDF with the\n * worker configured here and NO pre-set workerSrc. If the worker still can't\n * load (offline + unresolvable), getDocument rejects and the caller degrades\n * to `unrenderable` — a gated PDF that can't render stays unacceptable, NEVER\n * fabricated (P0). Idempotent per session.\n */\nfunction configurePdfWorker(pdfjs: typeof import(\"pdfjs-dist\")): void {\n  if (pdfWorkerConfigured) return;\n  const opts = pdfjs.GlobalWorkerOptions as WorkerGlobalOptions;\n  // A consumer (or a prior call) already wired a worker → respect it.\n  if (opts.workerPort || opts.workerSrc) {\n    pdfWorkerConfigured = true;\n    return;\n  }\n\n  const packagedUrl = resolvePackagedWorkerUrl();\n  if (packagedUrl) {\n    opts.workerSrc = packagedUrl;\n  } else {\n    // Last resort: version-pinned CDN so a build that can't resolve the asset\n    // still gets a real worker rather than silently failing every PDF.\n    const version = (pdfjs as { version?: string }).version ?? \"\";\n    opts.workerSrc = `https://cdn.jsdelivr.net/npm/pdfjs-dist@${version}/build/pdf.worker.min.mjs`;\n  }\n  pdfWorkerConfigured = true;\n}\n\n/**\n * COMPLIANCE-CRITICAL failure router (P0): a doc could not be rendered inline.\n * - open_then_accept → the real-open affordance (opening IS its gate; satisfies\n *   ONLY `opened`). This is legitimate, not a fabrication.\n * - scroll_then_accept → UNRENDERABLE: the gate stays unsatisfiable, a clear\n *   error + Retry is shown, accept is disabled. NEVER fabricate scrolled_to_end.\n * - checkbox → no gate (already satisfiable): show the error + a plain open link\n *   for reference; accept remains enabled (the checkbox gate needs no evidence).\n */\nfunction handleRenderFailure(\n  container: HTMLElement,\n  control: ConsentController,\n  consentKey: string,\n  doc: ConsentDocument,\n  onRetry: () => void,\n): ConsentDocumentViewerResult {\n  if (doc.acceptanceLevel === \"open_then_accept\") {\n    renderOpenGateAffordance(\n      container,\n      control,\n      consentKey,\n      doc,\n      \"The inline preview is unavailable. Opening the document in a new tab satisfies this step.\",\n    );\n    return { renderedAs: \"open-affordance\" };\n  }\n  // scroll_then_accept (and checkbox — harmless there): show the error. For a\n  // scroll gate this leaves it UNSATISFIABLE (accept stays disabled).\n  renderUnrenderableError(container, doc, onRetry);\n  return { renderedAs: \"unrenderable\" };\n}\n\n/**\n * Fetch + render a consent document INLINE into `container`, wiring its scroll\n * container (or the legitimate open-affordance) to the consent controller so\n * `scroll_then_accept` / `open_then_accept` gates work for real. NO iframe.\n *\n * On ANY inline-render failure for a `scroll_then_accept` doc the gate stays\n * UNSATISFIABLE (never fabricates scrolled_to_end, D543 §5 COMPLIANCE) — the\n * caller's Retry re-invokes this.\n *\n * @returns how the doc was rendered (for the caller's telemetry/UX).\n */\nexport async function renderConsentDocument(\n  container: HTMLElement,\n  doc: ConsentDocument,\n  control: ConsentController,\n  options: ConsentDocumentViewerOptions,\n): Promise<ConsentDocumentViewerResult> {\n  const { consentKey } = options;\n  const onRetry = (): void => {\n    void renderConsentDocument(container, doc, control, options);\n  };\n\n  let fetched: FetchedConsentDocument;\n  try {\n    fetched = await fetchDocumentContent(doc, {\n      fetch: options.fetch,\n      timeoutMs: options.timeoutMs,\n    });\n  } catch {\n    return handleRenderFailure(container, control, consentKey, doc, onRetry);\n  }\n\n  // If the container was detached while we awaited the fetch (the consent stage\n  // re-rendered, or the widget unmounted), skip DOM work — a stale render must\n  // not mutate an orphaned node or leak an unhandled error.\n  if (typeof container.isConnected === \"boolean\" && !container.isConnected) {\n    return { renderedAs: \"unrenderable\" };\n  }\n\n  // open_then_accept: opening the doc in a new tab IS the gate — scrolling an\n  // inline render does NOT satisfy it (reportScrollProgress no-ops for this\n  // level). So on a SUCCESSFUL fetch we ALSO present the open affordance (which\n  // marks `opened` on a real open) so the gate is satisfiable through the\n  // default viewer (P1). We do not attempt an inline scroll gate here.\n  if (doc.acceptanceLevel === \"open_then_accept\") {\n    renderOpenGateAffordance(\n      container,\n      control,\n      consentKey,\n      doc,\n      \"Open the document in a new tab to review it — that satisfies this step.\",\n    );\n    return { renderedAs: \"open-affordance\" };\n  }\n\n  if (fetched.kind === \"pdf\" && fetched.blob) {\n    return renderPdf(\n      container,\n      control,\n      consentKey,\n      doc,\n      fetched.blob,\n      onRetry,\n    );\n  }\n  if (fetched.kind === \"binary\") {\n    // A binary/octet-stream artifact cannot be previewed inline → same\n    // compliance rule: gated docs stay unsatisfiable, never click-to-satisfy.\n    return handleRenderFailure(container, control, consentKey, doc, onRetry);\n  }\n  // text or html\n  const text = fetched.text ?? \"\";\n  if (isMarkdown(fetched, doc)) {\n    const html = await marked.parse(text, { async: true });\n    renderSanitizedHtml(container, control, consentKey, html);\n    return { renderedAs: \"markdown\" };\n  }\n  if (fetched.kind === \"html\") {\n    renderSanitizedHtml(container, control, consentKey, text);\n    return { renderedAs: \"html\" };\n  }\n  renderPlainText(container, control, consentKey, text);\n  return { renderedAs: \"text\" };\n}\n\n/** Reset the module-level pdf-worker latch (tests). */\nexport function _resetPdfWorkerState(): void {\n  pdfWorkerConfigured = false;\n}\n"]}

package/dist/chunk-SEKNVHD3.js

@@ -0,0 +1,59 @@
+import { OnboardingError, DEFAULT_REQUEST_TIMEOUT_MS, fetchWithTimeout } from './chunk-XJTJPBJB.js';
+
+// src/consent/document.ts
+var OnboardingDocumentFetchError = class extends OnboardingError {
+  url;
+  constructor(url, detail) {
+    super(
+      "network_error",
+      `Failed to fetch consent document from "${url}": ${detail}`,
+      null
+    );
+    this.name = "OnboardingDocumentFetchError";
+    this.url = url;
+  }
+};
+function classify(contentType) {
+  if (contentType.includes("application/pdf")) return "pdf";
+  if (contentType.includes("text/html")) return "html";
+  if (contentType.startsWith("text/")) return "text";
+  return "binary";
+}
+async function fetchDocumentContent(doc, options = {}) {
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const url = doc.downloadUrl;
+  let response;
+  try {
+    response = await fetchWithTimeout(url, {
+      method: "GET",
+      timeoutMs,
+      fetchImpl
+    });
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new OnboardingDocumentFetchError(url, detail);
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new OnboardingDocumentFetchError(
+      url,
+      `unexpected status ${response.status}`
+    );
+  }
+  const rawType = response.headers.get("content-type") ?? "";
+  const contentType = rawType.split(";")[0]?.trim().toLowerCase() ?? "";
+  const kind = classify(contentType);
+  try {
+    if (kind === "html" || kind === "text") {
+      return { contentType, kind, text: await response.text() };
+    }
+    return { contentType, kind, blob: await response.blob() };
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new OnboardingDocumentFetchError(url, `body read failed: ${detail}`);
+  }
+}
+
+export { OnboardingDocumentFetchError, fetchDocumentContent };
+//# sourceMappingURL=chunk-SEKNVHD3.js.map
+//# sourceMappingURL=chunk-SEKNVHD3.js.map

package/dist/chunk-SEKNVHD3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/consent/document.ts"],"names":[],"mappings":";;;AAiDO,IAAM,4BAAA,GAAN,cAA2C,eAAA,CAAgB;AAAA,EAChD,GAAA;AAAA,EAEhB,WAAA,CAAY,KAAa,MAAA,EAAgB;AACvC,IAAA,KAAA;AAAA,MACE,eAAA;AAAA,MACA,CAAA,uCAAA,EAA0C,GAAG,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA;AAAA,MACzD;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,8BAAA;AACZ,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AAAA,EACb;AACF;AAEA,SAAS,SAAS,WAAA,EAA0C;AAC1D,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,iBAAiB,CAAA,EAAG,OAAO,KAAA;AACpD,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,WAAW,CAAA,EAAG,OAAO,MAAA;AAC9C,EAAA,IAAI,WAAA,CAAY,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,MAAA;AAC5C,EAAA,OAAO,QAAA;AACT;AASA,eAAsB,oBAAA,CACpB,GAAA,EACA,OAAA,GAAuC,EAAC,EACP;AACjC,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,0BAAA;AACvC,EAAA,MAAM,MAAM,GAAA,CAAI,WAAA;AAEhB,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,iBAAiB,GAAA,EAAK;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,SAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,IAAA,MAAM,IAAI,4BAAA,CAA6B,GAAA,EAAK,MAAM,CAAA;AAAA,EACpD;AAEA,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,GAAA,IAAO,QAAA,CAAS,UAAU,GAAA,EAAK;AACnD,IAAA,MAAM,IAAI,4BAAA;AAAA,MACR,GAAA;AAAA,MACA,CAAA,kBAAA,EAAqB,SAAS,MAAM,CAAA;AAAA,KACtC;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AACxD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,CAAE,WAAA,EAAY,IAAK,EAAA;AACnE,EAAA,MAAM,IAAA,GAAO,SAAS,WAAW,CAAA;AAEjC,EAAA,IAAI;AACF,IAAA,IAAI,IAAA,KAAS,MAAA,IAAU,IAAA,KAAS,MAAA,EAAQ;AACtC,MAAA,OAAO,EAAE,WAAA,EAAa,IAAA,EAAM,MAAM,MAAM,QAAA,CAAS,MAAK,EAAE;AAAA,IAC1D;AACA,IAAA,OAAO,EAAE,WAAA,EAAa,IAAA,EAAM,MAAM,MAAM,QAAA,CAAS,MAAK,EAAE;AAAA,EAC1D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,IAAA,MAAM,IAAI,4BAAA,CAA6B,GAAA,EAAK,CAAA,kBAAA,EAAqB,MAAM,CAAA,CAAE,CAAA;AAAA,EAC3E;AACF","file":"chunk-SEKNVHD3.js","sourcesContent":["/**\n * Headless document-content fetch helper (D543 §5).\n *\n * The consent controller is DOM-free; document RENDERING is the consumer's\n * responsibility (TanStack model — you render the row, we own the state). For\n * `scroll_then_accept` gating to work the doc must be rendered SAME-ORIGIN and\n * inline (a cross-origin iframe cannot report scroll position), so consumers\n * fetch the presigned artifact and render its bytes/text themselves.\n *\n * This helper does the fetch + classification so a consumer doesn't wrestle\n * CORS/content-type detection. It returns the artifact's content-type plus the\n * body as text (for HTML/plain) or a Blob (for PDF/binary). It NEVER renders\n * or sanitizes — the consumer (or the default component) decides how to display\n * it (e.g. sanitize+inject HTML, or PDF.js a blob, or degrade to open-in-tab).\n *\n * A short-TTL presigned GET may fail (expired URL, CORS, offline); the caller\n * gets a typed OnboardingDocumentFetchError so a failed preview degrades\n * gracefully (e.g. fall back to an \"open in a new tab\" affordance) without\n * breaking the consent gate.\n */\n\nimport type { ConsentDocument } from \"./model.js\";\nimport {\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  fetchWithTimeout,\n} from \"../submit/http.js\";\nimport { OnboardingError } from \"../submit/errors.js\";\n\n/** How the fetched artifact should be treated by a renderer. */\nexport type ConsentDocumentKind = \"html\" | \"text\" | \"pdf\" | \"binary\";\n\nexport interface FetchedConsentDocument {\n  /** The raw `Content-Type` header (lower-cased, params stripped). */\n  contentType: string;\n  /** Classification for the renderer. */\n  kind: ConsentDocumentKind;\n  /** Present for kind \"html\" | \"text\". */\n  text?: string;\n  /** Present for kind \"pdf\" | \"binary\". */\n  blob?: Blob;\n}\n\nexport interface FetchDocumentContentOptions {\n  fetch?: typeof globalThis.fetch;\n  /** Per-request timeout (default 15s) — a stalled CDN never hangs the UI. */\n  timeoutMs?: number;\n}\n\n/** A failed presigned artifact fetch (expired URL, CORS, offline, non-2xx). */\nexport class OnboardingDocumentFetchError extends OnboardingError {\n  public readonly url: string;\n\n  constructor(url: string, detail: string) {\n    super(\n      \"network_error\",\n      `Failed to fetch consent document from \"${url}\": ${detail}`,\n      null,\n    );\n    this.name = \"OnboardingDocumentFetchError\";\n    this.url = url;\n  }\n}\n\nfunction classify(contentType: string): ConsentDocumentKind {\n  if (contentType.includes(\"application/pdf\")) return \"pdf\";\n  if (contentType.includes(\"text/html\")) return \"html\";\n  if (contentType.startsWith(\"text/\")) return \"text\";\n  return \"binary\";\n}\n\n/**\n * Fetch a consent document's presigned artifact and return its content-type +\n * body (text for HTML/plain, Blob for PDF/binary).\n *\n * @throws {OnboardingDocumentFetchError} on network failure, timeout, CORS,\n *   or a non-2xx response — the caller degrades gracefully (open-in-tab).\n */\nexport async function fetchDocumentContent(\n  doc: Pick<ConsentDocument, \"downloadUrl\">,\n  options: FetchDocumentContentOptions = {},\n): Promise<FetchedConsentDocument> {\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n  const url = doc.downloadUrl;\n\n  let response: Response;\n  try {\n    response = await fetchWithTimeout(url, {\n      method: \"GET\",\n      timeoutMs,\n      fetchImpl,\n    });\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new OnboardingDocumentFetchError(url, detail);\n  }\n\n  if (response.status < 200 || response.status >= 300) {\n    throw new OnboardingDocumentFetchError(\n      url,\n      `unexpected status ${response.status}`,\n    );\n  }\n\n  const rawType = response.headers.get(\"content-type\") ?? \"\";\n  const contentType = rawType.split(\";\")[0]?.trim().toLowerCase() ?? \"\";\n  const kind = classify(contentType);\n\n  try {\n    if (kind === \"html\" || kind === \"text\") {\n      return { contentType, kind, text: await response.text() };\n    }\n    return { contentType, kind, blob: await response.blob() };\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new OnboardingDocumentFetchError(url, `body read failed: ${detail}`);\n  }\n}\n"]}

package/dist/chunk-SIMLMQPT.js

@@ -0,0 +1,37 @@
+import { z } from 'zod/v3';
+
+// src/form/schema.ts
+var contactFormSchema = z.object({
+  name: z.string().max(200).optional(),
+  companyName: z.string().min(1, "Company name is required").max(200, "Company name must be 200 characters or fewer"),
+  contactName: z.string().min(1, "Contact name is required").max(200, "Contact name must be 200 characters or fewer"),
+  email: z.string().email("A valid email address is required"),
+  phone: z.string().optional(),
+  message: z.string().max(4e3, "Message must be 4000 characters or fewer").optional(),
+  interestModules: z.array(z.string().min(1)).max(32).default([]),
+  sizeBand: z.string().max(80).optional(),
+  attribution: z.object({
+    campaignTags: z.record(z.string()).optional(),
+    referringSite: z.string().max(2048).optional(),
+    landingPage: z.string().max(2048).optional(),
+    button: z.string().max(120).optional()
+  }).strict().optional(),
+  privacyNoticeAcknowledged: z.boolean().refine((value) => value, "Privacy notice acknowledgement is required"),
+  marketingOptIn: z.boolean(),
+  intakeKind: z.enum(["contact", "enquiry"]),
+  // Q46 default: a visually-hidden field. Humans leave it empty.
+  website: z.string().max(0).optional()
+});
+var leadsWireSchema = contactFormSchema.extend({
+  botToken: z.string().min(1, "botToken is required").optional()
+}).strict();
+function validateContactForm(values) {
+  return contactFormSchema.safeParse(values);
+}
+function validateLeadsPayload(payload) {
+  return leadsWireSchema.safeParse(payload);
+}
+
+export { contactFormSchema, leadsWireSchema, validateContactForm, validateLeadsPayload };
+//# sourceMappingURL=chunk-SIMLMQPT.js.map
+//# sourceMappingURL=chunk-SIMLMQPT.js.map

package/dist/chunk-SIMLMQPT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/form/schema.ts"],"names":[],"mappings":";;;AAyBO,IAAM,iBAAA,GAAoB,EAAE,MAAA,CAAO;AAAA,EACxC,MAAM,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,EACnC,WAAA,EAAa,CAAA,CACV,MAAA,EAAO,CACP,GAAA,CAAI,GAAG,0BAA0B,CAAA,CACjC,GAAA,CAAI,GAAA,EAAK,8CAA8C,CAAA;AAAA,EAC1D,WAAA,EAAa,CAAA,CACV,MAAA,EAAO,CACP,GAAA,CAAI,GAAG,0BAA0B,CAAA,CACjC,GAAA,CAAI,GAAA,EAAK,8CAA8C,CAAA;AAAA,EAC1D,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,MAAM,mCAAmC,CAAA;AAAA,EAC3D,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,OAAA,EAAS,EACN,MAAA,EAAO,CACP,IAAI,GAAA,EAAM,0CAA0C,EACpD,QAAA,EAAS;AAAA,EACZ,eAAA,EAAiB,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,QAAO,CAAE,GAAA,CAAI,CAAC,CAAC,EAAE,GAAA,CAAI,EAAE,CAAA,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC9D,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,EAAE,EAAE,QAAA,EAAS;AAAA,EACtC,WAAA,EAAa,EACV,MAAA,CAAO;AAAA,IACN,cAAc,CAAA,CAAE,MAAA,CAAO,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IAC5C,eAAe,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,IAAI,EAAE,QAAA,EAAS;AAAA,IAC7C,aAAa,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,IAAI,EAAE,QAAA,EAAS;AAAA,IAC3C,QAAQ,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA;AAAS,GACtC,CAAA,CACA,MAAA,EAAO,CACP,QAAA,EAAS;AAAA,EACZ,yBAAA,EAA2B,EACxB,OAAA,EAAQ,CACR,OAAO,CAAC,KAAA,KAAU,OAAO,4CAA4C,CAAA;AAAA,EACxE,cAAA,EAAgB,EAAE,OAAA,EAAQ;AAAA,EAC1B,YAAY,CAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC,CAAA;AAAA;AAAA,EAEzC,SAAS,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA;AAC7B,CAAC;AAYM,IAAM,eAAA,GAAkB,kBAC5B,MAAA,CAAO;AAAA,EACN,QAAA,EAAU,EAAE,MAAA,EAAO,CAAE,IAAI,CAAA,EAAG,sBAAsB,EAAE,QAAA;AACtD,CAAC,EACA,MAAA;AAQI,SAAS,oBAAoB,MAAA,EAAiB;AACnD,EAAA,OAAO,iBAAA,CAAkB,UAAU,MAAM,CAAA;AAC3C;AAQO,SAAS,qBAAqB,OAAA,EAAkB;AACrD,EAAA,OAAO,eAAA,CAAgB,UAAU,OAAO,CAAA;AAC1C","file":"chunk-SIMLMQPT.js","sourcesContent":["/**\n * Contact-form Zod schema — mirrors the LOCKED hub REST contract exactly:\n *   POST /api/v1/public/onboarding/leads\n *   Schema: PublicOnboardingLeadsRequest (hub id 8686dd33)\n *\n * Constraints (per hub JSON Schema):\n *   name     — string, 1-200 chars, required\n *   email    — email format, required\n *   phone    — string, optional (no server-side constraint beyond string)\n *   message  — string, ≤4000 chars, optional\n *   botToken — string, required (reCAPTCHA token, D537)\n *\n *   additionalProperties: false\n *\n * The schema intentionally does NOT include botToken in the public-facing\n * ContactFormValues type — that field is injected by the submit client right\n * before the POST (the widget/form never exposes it to the user).\n */\n\nimport { z } from \"zod/v3\";\n\n/**\n * The user-visible contact form fields. Validated client-side for UX.\n * Server re-validates authoritatively (D540 §2).\n */\nexport const contactFormSchema = z.object({\n  name: z.string().max(200).optional(),\n  companyName: z\n    .string()\n    .min(1, \"Company name is required\")\n    .max(200, \"Company name must be 200 characters or fewer\"),\n  contactName: z\n    .string()\n    .min(1, \"Contact name is required\")\n    .max(200, \"Contact name must be 200 characters or fewer\"),\n  email: z.string().email(\"A valid email address is required\"),\n  phone: z.string().optional(),\n  message: z\n    .string()\n    .max(4000, \"Message must be 4000 characters or fewer\")\n    .optional(),\n  interestModules: z.array(z.string().min(1)).max(32).default([]),\n  sizeBand: z.string().max(80).optional(),\n  attribution: z\n    .object({\n      campaignTags: z.record(z.string()).optional(),\n      referringSite: z.string().max(2048).optional(),\n      landingPage: z.string().max(2048).optional(),\n      button: z.string().max(120).optional(),\n    })\n    .strict()\n    .optional(),\n  privacyNoticeAcknowledged: z\n    .boolean()\n    .refine((value) => value, \"Privacy notice acknowledgement is required\"),\n  marketingOptIn: z.boolean(),\n  intakeKind: z.enum([\"contact\", \"enquiry\"]),\n  // Q46 default: a visually-hidden field. Humans leave it empty.\n  website: z.string().max(0).optional(),\n});\n\nexport type ContactFormValues = z.infer<typeof contactFormSchema>;\n\n/**\n * The full wire payload — contactFormSchema + botToken.\n *\n * STRICT mode: unknown keys are REJECTED (not stripped), mirroring the\n * server's `additionalProperties: false`. `submitLead` runs every outgoing\n * payload through this schema before the POST — an extra key never reaches\n * the wire; it fails fast client-side with OnboardingValidationError.\n */\nexport const leadsWireSchema = contactFormSchema\n  .extend({\n    botToken: z.string().min(1, \"botToken is required\").optional(),\n  })\n  .strict();\n\nexport type LeadsWirePayload = z.infer<typeof leadsWireSchema>;\n\n/**\n * Validate user-visible form values (no botToken required here).\n * Returns a Zod SafeParseReturnType (inferred).\n */\nexport function validateContactForm(values: unknown) {\n  return contactFormSchema.safeParse(values);\n}\n\n/**\n * Validate the full wire payload (including botToken) before submission.\n * STRICT: unknown keys are rejected, matching additionalProperties:false.\n * This is the exact validation `submitLead` applies on the wire path.\n * Returns a Zod SafeParseReturnType (inferred).\n */\nexport function validateLeadsPayload(payload: unknown) {\n  return leadsWireSchema.safeParse(payload);\n}\n"]}

package/dist/chunk-U56GQITG.js

@@ -0,0 +1,79 @@
+import { z } from 'zod/v3';
+
+// src/consent/model.ts
+var CUSTOM_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
+var ACCEPTANCE_LEVELS = [
+  "checkbox",
+  "scroll_then_accept",
+  "open_then_accept"
+];
+var acceptanceLevelSchema = z.enum(ACCEPTANCE_LEVELS);
+var DOC_TYPES = ["tos", "privacy", "dpa", "custom"];
+var consentDocumentSchema = z.object({
+  // Server-side opaque registry id (D543 §3 legal_documents.id). Echoed
+  // verbatim on submit as consent.documents[].legalDocumentId (D543 §4);
+  // the SDK never synthesizes it. See DRIFT 5e3df7a3 (module doc).
+  legalDocumentId: z.string().min(1),
+  docType: z.enum(DOC_TYPES),
+  // Nullable (NOT omitted): non-custom docs send customKey:null.
+  customKey: z.string().min(1).regex(
+    CUSTOM_KEY_PATTERN,
+    "customKey must contain only letters, digits, underscore, or hyphen"
+  ).nullable(),
+  title: z.string().min(1),
+  // Monotonic version of the live document. This is the SUBMIT PIN: it is
+  // echoed on submit (consent.documents[].versionNo) and the server matches
+  // it against the current live version (mismatch ⇒ 409 consent_stale). Any
+  // content change publishes a NEW version, so versionNo is a complete pin.
+  versionNo: z.number().int().nonnegative(),
+  // sha256 of the live artifact — spec-side integrity metadata (P4). NOT
+  // echoed on submit: versionNo is the pin (a content change = new version),
+  // so the submit array carries versionNo only, per the canonical wire shape.
+  // The SDK exposes contentHash so a consumer can display/verify integrity;
+  // the server does NOT require it on the submit array.
+  contentHash: z.string().min(1),
+  // Short-TTL presigned GET for the artifact bytes (D543 §4 / 04-pii).
+  downloadUrl: z.string().min(1),
+  acceptanceLevel: acceptanceLevelSchema,
+  required: z.boolean()
+}).strict().superRefine((doc, ctx) => {
+  if (doc.docType === "custom" && doc.customKey === null) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["customKey"],
+      message: "customKey is required (non-null) when docType is 'custom'"
+    });
+  }
+  if (doc.docType !== "custom" && doc.customKey !== null) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["customKey"],
+      message: "customKey must be null when docType is not 'custom'"
+    });
+  }
+});
+var consentPackSchema = z.object({
+  documents: z.array(consentDocumentSchema)
+}).strict().superRefine((pack, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < pack.documents.length; i++) {
+    const doc = pack.documents[i];
+    if (!doc) continue;
+    const key = consentDocKey(doc);
+    if (seen.has(key)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["documents", i],
+        message: `duplicate consent document key "${key}"`
+      });
+    }
+    seen.add(key);
+  }
+});
+function consentDocKey(doc) {
+  return doc.docType === "custom" ? `custom:${doc.customKey ?? ""}` : doc.docType;
+}
+
+export { ACCEPTANCE_LEVELS, DOC_TYPES, acceptanceLevelSchema, consentDocKey, consentDocumentSchema, consentPackSchema };
+//# sourceMappingURL=chunk-U56GQITG.js.map
+//# sourceMappingURL=chunk-U56GQITG.js.map

package/dist/chunk-U56GQITG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/consent/model.ts"],"names":[],"mappings":";;;AA2DA,IAAM,kBAAA,GAAqB,kBAAA;AAGpB,IAAM,iBAAA,GAAoB;AAAA,EAC/B,UAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF;AAIO,IAAM,qBAAA,GAAwB,CAAA,CAAE,IAAA,CAAK,iBAAiB;AAGtD,IAAM,SAAA,GAAY,CAAC,KAAA,EAAO,SAAA,EAAW,OAAO,QAAQ;AAgBpD,IAAM,qBAAA,GAAwB,EAClC,MAAA,CAAO;AAAA;AAAA;AAAA;AAAA,EAIN,eAAA,EAAiB,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACjC,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,SAAS,CAAA;AAAA;AAAA,EAEzB,WAAW,CAAA,CACR,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,KAAA;AAAA,IACC,kBAAA;AAAA,IACA;AAAA,IAED,QAAA,EAAS;AAAA,EACZ,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB,WAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,WAAA,EAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxC,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA;AAAA,EAE7B,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC7B,eAAA,EAAiB,qBAAA;AAAA,EACjB,QAAA,EAAU,EAAE,OAAA;AACd,CAAC,EACA,MAAA,EAAO,CACP,WAAA,CAAY,CAAC,KAAK,GAAA,KAAQ;AACzB,EAAA,IAAI,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,GAAA,CAAI,cAAc,IAAA,EAAM;AACtD,IAAA,GAAA,CAAI,QAAA,CAAS;AAAA,MACX,IAAA,EAAM,EAAE,YAAA,CAAa,MAAA;AAAA,MACrB,IAAA,EAAM,CAAC,WAAW,CAAA;AAAA,MAClB,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,EACH;AACA,EAAA,IAAI,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,GAAA,CAAI,cAAc,IAAA,EAAM;AACtD,IAAA,GAAA,CAAI,QAAA,CAAS;AAAA,MACX,IAAA,EAAM,EAAE,YAAA,CAAa,MAAA;AAAA,MACrB,IAAA,EAAM,CAAC,WAAW,CAAA;AAAA,MAClB,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,EACH;AACF,CAAC;AAcI,IAAM,iBAAA,GAAoB,EAC9B,MAAA,CAAO;AAAA,EACN,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,qBAAqB;AAC1C,CAAC,EACA,MAAA,EAAO,CACP,WAAA,CAAY,CAAC,MAAM,GAAA,KAAQ;AAC1B,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA,EAAA,EAAK;AAC9C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,SAAA,CAAU,CAAC,CAAA;AAC5B,IAAA,IAAI,CAAC,GAAA,EAAK;AACV,IAAA,MAAM,GAAA,GAAM,cAAc,GAAG,CAAA;AAC7B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACjB,MAAA,GAAA,CAAI,QAAA,CAAS;AAAA,QACX,IAAA,EAAM,EAAE,YAAA,CAAa,MAAA;AAAA,QACrB,IAAA,EAAM,CAAC,WAAA,EAAa,CAAC,CAAA;AAAA,QACrB,OAAA,EAAS,mCAAmC,GAAG,CAAA,CAAA;AAAA,OAChD,CAAA;AAAA,IACH;AACA,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AAAA,EACd;AACF,CAAC;AAcI,SAAS,cAAc,GAAA,EAGnB;AACT,EAAA,OAAO,GAAA,CAAI,YAAY,QAAA,GACnB,CAAA,OAAA,EAAU,IAAI,SAAA,IAAa,EAAE,KAC7B,GAAA,CAAI,OAAA;AACV","file":"chunk-U56GQITG.js","sourcesContent":["/**\n * D543 §4 ConsentPack spec model — the `consentPack` block that GET\n * /api/v1/public/onboarding/spec grows on top of the D540 shape:\n *\n *   consentPack: {\n *     documents: [\n *       { doc_type, custom_key?, title, version_no, content_hash,\n *         download_url, acceptance_level, required }\n *     ]\n *   }\n *\n * The intake projects ONLY `live` versions into this block (D543 §4);\n * `download_url` is a short-TTL presigned GET the SDK renders/opens.\n *\n * `acceptance_level` (D543 §2) is a per-document GATE:\n *   - \"checkbox\"            — a single accept checkbox (basic clickwrap).\n *   - \"scroll_then_accept\"  — accept disabled until the doc is scrolled to\n *                             the end (client asserts evidence.scrolled_to_end).\n *   - \"open_then_accept\"    — accept disabled until the doc is opened/viewed\n *                             (client asserts evidence.opened).\n * (E-signature is a deferred future level, D543 §2 — NOT modeled here.)\n *\n * FAIL-CLOSED (R1 + D543 §5 / D540 §1): a malformed consentPack throws\n * OnboardingSpecInvalidError at parse time — never rendered half-parsed\n * (a dropped `required` doc would let a user submit without consent, and a\n * missing `content_hash`/`version_no` would break the server's re-validation\n * match). The SDK refuses to render a consent step it cannot trust.\n *\n * DOM-ID HARDENING: a document's DOM-id token is derived from `doc_type`\n * (a fixed enum — safe) or, for custom docs, from `custom_key` (free-form\n * from the served spec). Custom keys are interpolated into element ids and\n * (historically) selectors by the widget layer, so they are constrained to\n * the SAME strict identifier alphabet as field keys (CUSTOM_KEY_PATTERN,\n * identical to the spec model's FIELD_KEY_PATTERN) and REJECTED at parse time\n * if they carry CSS/selector metacharacters. This is layer 1; the widget also\n * CSS.escapes every id token as defense-in-depth.\n *\n * SUBMIT PIN (P4): the submit array carries {legalDocumentId, versionNo,\n * accepted, evidence} — the server matches on legalDocumentId + versionNo\n * (contentHash is spec-side integrity metadata, NOT echoed on submit; a\n * content change publishes a new versionNo, so versionNo is a complete pin).\n *\n * DRIFT 5e3df7a3 (2026-07-14, consumer-visible) — RESOLVED by the canonical\n * shape: D543 §4 as literally written omitted `legal_document_id` from the\n * spec block, yet the submit array is KEYED on it (the server matches\n * legalDocumentId + versionNo against the live version). The\n * canonical alignment (both tiers, camelCase) INCLUDES `legalDocumentId` in\n * the spec `consentPack.documents[]`, exactly as the drift proposed. This\n * model REQUIRES it (fail-closed OnboardingSpecInvalidError if missing).\n */\n\nimport { z } from \"zod/v3\";\n\n/**\n * DOM-id-safe custom-key alphabet. INTENTIONALLY identical to the spec\n * model's FIELD_KEY_PATTERN (`/^[A-Za-z0-9_-]+$/`), duplicated here rather\n * than imported to avoid a spec↔consent import cycle (spec/model.ts imports\n * consentPackSchema from this file). Any change to one must mirror the other.\n */\nconst CUSTOM_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;\n\n/** D543 §2 acceptance-level enum. Extensible (adding a level is additive). */\nexport const ACCEPTANCE_LEVELS = [\n  \"checkbox\",\n  \"scroll_then_accept\",\n  \"open_then_accept\",\n] as const;\n\nexport type AcceptanceLevel = (typeof ACCEPTANCE_LEVELS)[number];\n\nexport const acceptanceLevelSchema = z.enum(ACCEPTANCE_LEVELS);\n\n/** D543 §3 docType enum. */\nexport const DOC_TYPES = [\"tos\", \"privacy\", \"dpa\", \"custom\"] as const;\nexport type ConsentDocType = (typeof DOC_TYPES)[number];\n\n/**\n * One live legal document projected into the consent step. Mirrors the D543\n * §4 `consentPack.documents[]` element — CANONICAL camelCase wire shape (both\n * tenant + platform tiers aligned to this): { legalDocumentId, docType,\n * customKey (nullable), title, versionNo, contentHash, downloadUrl,\n * acceptanceLevel, required }. The `acceptanceLevel` enum VALUES stay snake\n * (checkbox | scroll_then_accept | open_then_accept).\n *\n * Cross-field invariant (D543 §3): `customKey` is a non-null identifier when\n * `docType === \"custom\"` and MUST be null otherwise (a canonical tos/privacy/\n * dpa doc is keyed by docType; only custom docs carry a key). The custom-key\n * alphabet is DOM-id safe.\n */\nexport const consentDocumentSchema = z\n  .object({\n    // Server-side opaque registry id (D543 §3 legal_documents.id). Echoed\n    // verbatim on submit as consent.documents[].legalDocumentId (D543 §4);\n    // the SDK never synthesizes it. See DRIFT 5e3df7a3 (module doc).\n    legalDocumentId: z.string().min(1),\n    docType: z.enum(DOC_TYPES),\n    // Nullable (NOT omitted): non-custom docs send customKey:null.\n    customKey: z\n      .string()\n      .min(1)\n      .regex(\n        CUSTOM_KEY_PATTERN,\n        \"customKey must contain only letters, digits, underscore, or hyphen\",\n      )\n      .nullable(),\n    title: z.string().min(1),\n    // Monotonic version of the live document. This is the SUBMIT PIN: it is\n    // echoed on submit (consent.documents[].versionNo) and the server matches\n    // it against the current live version (mismatch ⇒ 409 consent_stale). Any\n    // content change publishes a NEW version, so versionNo is a complete pin.\n    versionNo: z.number().int().nonnegative(),\n    // sha256 of the live artifact — spec-side integrity metadata (P4). NOT\n    // echoed on submit: versionNo is the pin (a content change = new version),\n    // so the submit array carries versionNo only, per the canonical wire shape.\n    // The SDK exposes contentHash so a consumer can display/verify integrity;\n    // the server does NOT require it on the submit array.\n    contentHash: z.string().min(1),\n    // Short-TTL presigned GET for the artifact bytes (D543 §4 / 04-pii).\n    downloadUrl: z.string().min(1),\n    acceptanceLevel: acceptanceLevelSchema,\n    required: z.boolean(),\n  })\n  .strict()\n  .superRefine((doc, ctx) => {\n    if (doc.docType === \"custom\" && doc.customKey === null) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: [\"customKey\"],\n        message: \"customKey is required (non-null) when docType is 'custom'\",\n      });\n    }\n    if (doc.docType !== \"custom\" && doc.customKey !== null) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: [\"customKey\"],\n        message: \"customKey must be null when docType is not 'custom'\",\n      });\n    }\n  });\n\nexport type ConsentDocument = z.infer<typeof consentDocumentSchema>;\n\n/**\n * The `consentPack` block. `documents` may be empty (an onboarder with no\n * required legal docs) — the consent stage is then omitted from the flow.\n *\n * Uniqueness: no two documents may share the same STABLE key (docType, or\n * custom:<customKey> for custom docs). A duplicate would collide their DOM\n * ids AND their consent records — fail-closed at parse (the server keys the\n * registry on (scope, docType) / (scope, customKey) per D543 §3, so a\n * duplicate here is a projection bug, not a renderable spec).\n */\nexport const consentPackSchema = z\n  .object({\n    documents: z.array(consentDocumentSchema),\n  })\n  .strict()\n  .superRefine((pack, ctx) => {\n    const seen = new Set<string>();\n    for (let i = 0; i < pack.documents.length; i++) {\n      const doc = pack.documents[i];\n      if (!doc) continue;\n      const key = consentDocKey(doc);\n      if (seen.has(key)) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: [\"documents\", i],\n          message: `duplicate consent document key \"${key}\"`,\n        });\n      }\n      seen.add(key);\n    }\n  });\n\nexport type ConsentPack = z.infer<typeof consentPackSchema>;\n\n/**\n * Stable, collision-proof identity for a consent document, used as the map\n * key in the controller and the DOM-id token in the widget. `docType` is a\n * fixed enum; `custom:` is prefixed for custom docs so a customKey of\n * \"tos\" can never alias the canonical tos doc.\n *\n * Note: this is NOT the submit key — the submit array keys on the server's\n * opaque `legalDocumentId` (D543 §4), which the SDK does not synthesize.\n * This is a purely CLIENT-side identity for state + DOM.\n */\nexport function consentDocKey(doc: {\n  docType: ConsentDocType;\n  customKey?: string | null | undefined;\n}): string {\n  return doc.docType === \"custom\"\n    ? `custom:${doc.customKey ?? \"\"}`\n    : doc.docType;\n}\n"]}