@nodii/onboarding 0.1.0-dev.0 → 0.1.0

package/dist/{chunk-34BQX2KR.js → chunk-F75ZJERM.js}

@@ -1,4 +1,5 @@
-import { DEFAULT_REQUEST_TIMEOUT_MS, fetchWithTimeout, OnboardingNetworkError, OnboardingRateLimitError, OnboardingServerError, OnboardingSpecInvalidError } from './chunk-AW7W3HAC.js';
+import { consentPackSchema } from './chunk-U56GQITG.js';
+import { DEFAULT_REQUEST_TIMEOUT_MS, fetchWithTimeout, OnboardingNetworkError, OnboardingRateLimitError, OnboardingServerError, OnboardingSpecInvalidError, OnboardingValidationError } from './chunk-XJTJPBJB.js';
 import { z } from 'zod/v3';
 
 var FIELD_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
@@ -22,10 +23,11 @@ var specStepSchema = z.object({
 var onboardingSpecSchema = z.object({
   specVersion: z.string().min(1),
   onboarderTier: z.enum(["platform", "tenant"]),
+  // D1444: omitted when the onboarder has explicitly disabled bot checking.
   botChallenge: z.object({
     provider: z.literal("recaptcha"),
     siteKey: z.string()
-  }),
+  }).optional(),
   forms: z.object({
     // ADVISORY-ONLY (by design, plan §12.2 / D540): the Contact-Us form is
     // INTENTIONALLY a fixed barebones shape (name/email/phone/message) and is
@@ -35,7 +37,13 @@ var onboardingSpecSchema = z.object({
     // no rendering. Only forms.signup is spec-driven (the dynamic stepper).
     contact: z.object({ fields: z.array(specFieldSchema) }),
     signup: z.object({ steps: z.array(specStepSchema) })
-  })
+  }),
+  // D543 §4 ConsentPack extension. OPTIONAL for backward-compat (D543
+  // "pre-ConsentPack submits still parse"): an onboarder with no required
+  // legal docs serves no block, and the consent stage is omitted from the
+  // flow. When PRESENT it is validated fully (fail-closed) — a malformed
+  // consentPack throws OnboardingSpecInvalidError, never rendered half-parsed.
+  consentPack: consentPackSchema.optional()
 });
 function validateOnboardingSpec(value) {
   return onboardingSpecSchema.safeParse(value);
@@ -159,6 +167,33 @@ async function fetchOnboardingSpec(options) {
   return parsed.data;
 }
 
-export { FIELD_KEY_PATTERN, OnboardingSpecCache, defaultSpecCache, diffSpecFields, fetchOnboardingSpec, onboardingSpecSchema, specFieldSchema, specStepSchema, validateOnboardingSpec };
-//# sourceMappingURL=chunk-34BQX2KR.js.map
-//# sourceMappingURL=chunk-34BQX2KR.js.map
+// src/spec/pin-state.ts
+async function fetchPinState(options) {
+  const pin = options.pin.trim();
+  if (!/^[1-9][0-9]{5}$/.test(pin)) {
+    throw new OnboardingValidationError(
+      "PIN must be a 6-digit Indian PIN code"
+    );
+  }
+  const response = await fetchWithTimeout(
+    `${options.baseUrl.replace(/\/$/, "")}/api/v1/public/onboarding/pin-state?pin=${encodeURIComponent(pin)}`,
+    {
+      method: "GET",
+      fetchImpl: options.fetch ?? globalThis.fetch,
+      timeoutMs: options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS
+    }
+  );
+  if (!response.ok) throw new OnboardingServerError(response.status);
+  const value = await response.json();
+  if (value.pin !== pin || value.state_iso !== null && typeof value.state_iso !== "string") {
+    throw new OnboardingServerError(
+      response.status,
+      "Invalid PIN-state response"
+    );
+  }
+  return { pin, stateIso: value.state_iso };
+}
+
+export { FIELD_KEY_PATTERN, OnboardingSpecCache, defaultSpecCache, diffSpecFields, fetchOnboardingSpec, fetchPinState, onboardingSpecSchema, specFieldSchema, specStepSchema, validateOnboardingSpec };
+//# sourceMappingURL=chunk-F75ZJERM.js.map
+//# sourceMappingURL=chunk-F75ZJERM.js.map

package/dist/chunk-F75ZJERM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/spec/model.ts","../src/spec/client.ts","../src/spec/pin-state.ts"],"names":[],"mappings":";;;;AA0CO,IAAM,iBAAA,GAAoB;AAE1B,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA,EACtC,KAAK,CAAA,CACF,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,KAAA;AAAA,IACC,iBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACF,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACtB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,OAAA,EAAQ;AAAA,EACpB,YAAY,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EAC3C,SAAS,CAAA,CAAE,KAAA,CAAM,EAAE,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACvC,gBAAA,EAAkB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACvC,QAAA,EAAU,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,WAAW,QAAA,EAAU,WAAW,CAAC,CAAA,CAAE,QAAA;AAC/D,CAAC;AAIM,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EACrC,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,UAAA,EAAY,YAAY,CAAC,CAAA;AAAA,EAChD,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,eAAe;AACjC,CAAC;AAIM,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA,EAC3C,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC7B,eAAe,CAAA,CAAE,IAAA,CAAK,CAAC,UAAA,EAAY,QAAQ,CAAC,CAAA;AAAA;AAAA,EAE5C,YAAA,EAAc,EACX,MAAA,CAAO;AAAA,IACN,QAAA,EAAU,CAAA,CAAE,OAAA,CAAQ,WAAW,CAAA;AAAA,IAC/B,OAAA,EAAS,EAAE,MAAA;AAAO,GACnB,EACA,QAAA,EAAS;AAAA,EACZ,KAAA,EAAO,EAAE,MAAA,CAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOd,OAAA,EAAS,EAAE,MAAA,CAAO,EAAE,QAAQ,CAAA,CAAE,KAAA,CAAM,eAAe,CAAA,EAAG,CAAA;AAAA,IACtD,MAAA,EAAQ,EAAE,MAAA,CAAO,EAAE,OAAO,CAAA,CAAE,KAAA,CAAM,cAAc,CAAA,EAAG;AAAA,GACpD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMD,WAAA,EAAa,kBAAkB,QAAA;AACjC,CAAC;AAQM,SAAS,uBAAuB,KAAA,EAAgB;AACrD,EAAA,OAAO,oBAAA,CAAqB,UAAU,KAAK,CAAA;AAC7C;;;AC3EA,IAAM,SAAA,GAAY,gCAAA;AAQX,IAAM,mBAAA,GAAN,MAAM,oBAAA,CAAoB;AAAA,EACd,SAAA,uBAAgB,GAAA,EAA4B;AAAA,EAC5C,MAAA,uBAAa,GAAA,EAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1D,OAAe,UAAA,CAAW,SAAA,EAAmB,WAAA,EAA6B;AACxE,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,CAAC,SAAA,EAAW,WAAW,CAAC,CAAA;AAAA,EAChD;AAAA,EAEA,GAAA,CAAI,WAAmB,WAAA,EAAiD;AACtE,IAAA,OAAO,KAAK,SAAA,CAAU,GAAA;AAAA,MACpB,oBAAA,CAAoB,UAAA,CAAW,SAAA,EAAW,WAAW;AAAA,KACvD;AAAA,EACF;AAAA,EAEA,UAAU,SAAA,EAA+C;AACvD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA;AAAA,EAClC;AAAA,EAEA,GAAA,CAAI,WAAmB,IAAA,EAA4B;AACjD,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA;AAAA,MACb,oBAAA,CAAoB,UAAA,CAAW,SAAA,EAAW,IAAA,CAAK,WAAW,CAAA;AAAA,MAC1D;AAAA,KACF;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,IAAI,CAAA;AAAA,EACjC;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,UAAU,KAAA,EAAM;AACrB,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACpB;AACF;AAGO,IAAM,gBAAA,GAAmB,IAAI,mBAAA;AAapC,SAAS,eAAe,IAAA,EAA8C;AACpE,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAuB;AACvC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,KAAA,EAAO;AAC1C,IAAA,KAAA,MAAW,SAAS,IAAA,CAAK,MAAA,MAAY,GAAA,CAAI,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,cAAA,CACd,MACA,IAAA,EACe;AACf,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,GAAA,IAAO,OAAA,CAAQ,IAAA,EAAK,EAAG;AAChC,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,EAAG,KAAA,CAAM,KAAK,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,SAAS,CAAA,IAAK,OAAA,EAAS;AACtC,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACjC,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAChB,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAK,SAAA,CAAU,SAAS,MAAM,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAC3D,MAAA,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAM,IAAA,EAAK;AAAA,IAClB,OAAA,EAAS,QAAQ,IAAA,EAAK;AAAA,IACtB,OAAA,EAAS,QAAQ,IAAA;AAAK,GACxB;AACF;AA2BA,SAAS,QAAA,CAAS,SAAiB,IAAA,EAAsB;AACvD,EAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,CAAS,GAAG,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,OAAA;AAC5D,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,EAAG,IAAI,CAAA,CAAA;AACvB;AAUA,eAAsB,oBACpB,OAAA,EACyB;AACzB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,gBAAA;AAE/B,EAAA,IAAI,QAAQ,YAAA,EAAc;AACxB,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAA,CAAU,OAAA,CAAQ,SAAS,CAAA;AAChD,IAAA,IAAI,QAAQ,OAAO,MAAA;AAAA,EACrB;AAEA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,0BAAA;AACvC,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,OAAA,CAAQ,OAAA,EAAS,SAAS,CAAA;AAE/C,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,iBAAiB,GAAA,EAAK;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,SAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,uBAAuB,GAAG,CAAA;AAAA,EACtC;AAEA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,IAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAC3D,IAAA,MAAM,aAAa,gBAAA,GACf,MAAA,CAAO,SAAS,gBAAA,EAAkB,EAAE,IACpC,MAAA,CAAO,GAAA;AACX,IAAA,MAAM,IAAI,wBAAA;AAAA,MACR,MAAA,CAAO,KAAA,CAAM,UAAU,CAAA,GAAI,IAAA,GAAO;AAAA,KACpC;AAAA,EACF;AACA,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,GAAA,IAAO,QAAA,CAAS,UAAU,GAAA,EAAK;AACnD,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,QAAA,CAAS,MAAA;AAAA,MACT,CAAA,8BAAA,EAAiC,SAAS,MAAM,CAAA;AAAA,KAClD;AAAA,EACF;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,2BAA2B,2BAA2B,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,MAAA,GAAS,uBAAuB,IAAI,CAAA;AAC1C,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,MAAA,CACzB,KAAA,CAAM,GAAG,CAAC,CAAA,CACV,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,EAAE,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,IAAK,QAAQ,CAAA,EAAA,EAAK,EAAE,OAAO,CAAA,CAAE,CAAA,CAC1D,IAAA,CAAK,IAAI,CAAA;AACZ,IAAA,MAAM,IAAI,2BAA2B,MAAM,CAAA;AAAA,EAC7C;AAEA,EAAA,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,SAAA,EAAW,MAAA,CAAO,IAAI,CAAA;AACxC,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;;;ACnNA,eAAsB,cAAc,OAAA,EAKR;AAC1B,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,IAAI,CAAC,iBAAA,CAAkB,IAAA,CAAK,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,yBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,MAAM,gBAAA;AAAA,IACrB,CAAA,EAAG,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,wCAAA,EAA2C,kBAAA,CAAmB,GAAG,CAAC,CAAA,CAAA;AAAA,IACvG;AAAA,MACE,MAAA,EAAQ,KAAA;AAAA,MACR,SAAA,EAAW,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAAA,MACvC,SAAA,EAAW,QAAQ,SAAA,IAAa;AAAA;AAClC,GACF;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,EAAA,QAAU,IAAI,qBAAA,CAAsB,SAAS,MAAM,CAAA;AACjE,EAAA,MAAM,KAAA,GAAS,MAAM,QAAA,CAAS,IAAA,EAAK;AAInC,EAAA,IACE,KAAA,CAAM,QAAQ,GAAA,IACb,KAAA,CAAM,cAAc,IAAA,IAAQ,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,EACxD;AACA,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,QAAA,CAAS,MAAA;AAAA,MACT;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,GAAA,EAAK,QAAA,EAAU,KAAA,CAAM,SAAA,EAAU;AAC1C","file":"chunk-F75ZJERM.js","sourcesContent":["/**\n * D540 §1 onboarding-spec model — mirrors the LOCKED hub REST contract:\n *   GET /api/v1/public/onboarding/spec (PublicOnboardingSpecResponse)\n *\n * Response shape (hub JSON Schema, both tiers identical):\n *   {\n *     specVersion:   string (monotonic; echo on submit; stale ⇒ 409),\n *     onboarderTier: \"platform\" | \"tenant\",\n *     botChallenge:  { provider: \"recaptcha\", siteKey: string },\n *     forms: {\n *       contact: { fields: SpecField[] },\n *       signup:  { steps: [{ stage: \"lead\"|\"prospect\"|\"activation\",\n *                            fields: SpecField[] }] }\n *     }\n *   }\n *\n * SpecField (required: key, type, label, required):\n *   { key, type, label, required, validation?, options?, serviceSelection?,\n *     piiClass?: \"none\"|\"context\"|\"always\"|\"reference\" }\n *\n * The Zod schema below validates a fetched spec BEFORE the SDK renders\n * anything from it — a malformed spec throws OnboardingSpecInvalidError\n * (a half-parsed spec could silently drop required fields).\n */\n\nimport { z } from \"zod/v3\";\nimport { consentPackSchema } from \"../consent/model.js\";\n\nexport type OnboarderTier = \"platform\" | \"tenant\";\nexport type PiiClass = \"none\" | \"context\" | \"always\" | \"reference\";\nexport type SpecStage = \"lead\" | \"prospect\" | \"activation\";\nexport type TerminalStage = \"prospect\" | \"inactive\" | \"active\";\n\n/**\n * Field keys are interpolated into DOM element ids and (historically) CSS\n * selectors by the widget layer. Constrain them to a strict identifier\n * alphabet so a MALICIOUS or compromised onboarder spec cannot smuggle CSS\n * metacharacters or selector-breakout payloads (e.g. `evil], [onclick=…`)\n * through the fetched spec. A spec with an out-of-alphabet key is REJECTED\n * at parse time → OnboardingSpecInvalidError (fail-closed; never rendered).\n * This is layer 1; the widget also CSS.escapes ids as defense-in-depth.\n */\nexport const FIELD_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;\n\nexport const specFieldSchema = z.object({\n  key: z\n    .string()\n    .min(1)\n    .regex(\n      FIELD_KEY_PATTERN,\n      \"field key must contain only letters, digits, underscore, or hyphen\",\n    ),\n  type: z.string().min(1),\n  label: z.string(),\n  required: z.boolean(),\n  validation: z.record(z.unknown()).optional(),\n  options: z.array(z.unknown()).optional(),\n  serviceSelection: z.boolean().optional(),\n  piiClass: z.enum([\"none\", \"context\", \"always\", \"reference\"]).optional(),\n});\n\nexport type SpecField = z.infer<typeof specFieldSchema>;\n\nexport const specStepSchema = z.object({\n  stage: z.enum([\"lead\", \"prospect\", \"activation\"]),\n  fields: z.array(specFieldSchema),\n});\n\nexport type SpecStep = z.infer<typeof specStepSchema>;\n\nexport const onboardingSpecSchema = z.object({\n  specVersion: z.string().min(1),\n  onboarderTier: z.enum([\"platform\", \"tenant\"]),\n  // D1444: omitted when the onboarder has explicitly disabled bot checking.\n  botChallenge: z\n    .object({\n      provider: z.literal(\"recaptcha\"),\n      siteKey: z.string(),\n    })\n    .optional(),\n  forms: z.object({\n    // ADVISORY-ONLY (by design, plan §12.2 / D540): the Contact-Us form is\n    // INTENTIONALLY a fixed barebones shape (name/email/phone/message) and is\n    // NOT onboarder-configurable. `mountContactForm` renders that fixed set\n    // directly and does NOT read forms.contact.fields — the field is modeled\n    // (and validated) so the SDK can round-trip the full spec, but it drives\n    // no rendering. Only forms.signup is spec-driven (the dynamic stepper).\n    contact: z.object({ fields: z.array(specFieldSchema) }),\n    signup: z.object({ steps: z.array(specStepSchema) }),\n  }),\n  // D543 §4 ConsentPack extension. OPTIONAL for backward-compat (D543\n  // \"pre-ConsentPack submits still parse\"): an onboarder with no required\n  // legal docs serves no block, and the consent stage is omitted from the\n  // flow. When PRESENT it is validated fully (fail-closed) — a malformed\n  // consentPack throws OnboardingSpecInvalidError, never rendered half-parsed.\n  consentPack: consentPackSchema.optional(),\n});\n\nexport type OnboardingSpec = z.infer<typeof onboardingSpecSchema>;\n\n/**\n * Parse an unknown value as an OnboardingSpec.\n * Returns a SafeParseReturnType (inferred).\n */\nexport function validateOnboardingSpec(value: unknown) {\n  return onboardingSpecSchema.safeParse(value);\n}\n","/**\n * Config-fetch client for GET /api/v1/public/onboarding/spec (D540 §1/§3).\n *\n * - The onboarder is derived SERVER-side from the request Host (D536) —\n *   it is NOT sent by the client. The `onboarder` value here is purely the\n *   CLIENT-side cache key (D540 §3: \"cache key (onboarder, specVersion)\").\n * - The spec response is validated against the LOCKED D540 shape before\n *   it is returned; a malformed spec throws OnboardingSpecInvalidError.\n * - Cache semantics: every successful fetch is stored under\n *   (onboarder, specVersion) and as the onboarder's \"latest\". The versioned\n *   entries let the 409 spec_stale flow diff the previously-served version\n *   against the refetched one (see `diffSpecFields` + the signup widget's\n *   handleSpecStale, which reads the cached prior version before refetching).\n */\n\nimport {\n  OnboardingNetworkError,\n  OnboardingRateLimitError,\n  OnboardingServerError,\n  OnboardingSpecInvalidError,\n} from \"../submit/errors.js\";\nimport {\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  fetchWithTimeout,\n} from \"../submit/http.js\";\nimport {\n  validateOnboardingSpec,\n  type OnboardingSpec,\n  type SpecField,\n} from \"./model.js\";\n\nconst SPEC_PATH = \"/api/v1/public/onboarding/spec\";\n\n/**\n * In-memory spec cache keyed by (onboarder, specVersion), with a \"latest\"\n * pointer per onboarder. Purely client-side; no TTL — the reject-stale\n * policy (409 spec_stale on submit) is the authoritative staleness signal,\n * and a refetch overwrites \"latest\".\n */\nexport class OnboardingSpecCache {\n  private readonly byVersion = new Map<string, OnboardingSpec>();\n  private readonly latest = new Map<string, OnboardingSpec>();\n\n  /**\n   * Collision-proof composite key. Uses JSON.stringify of the tuple so an\n   * onboarder or version containing the delimiter can never alias another\n   * entry — and, critically, contains NO control characters (an earlier\n   * NUL-separator made git treat this whole file as binary/undiffable).\n   */\n  private static versionKey(onboarder: string, specVersion: string): string {\n    return JSON.stringify([onboarder, specVersion]);\n  }\n\n  get(onboarder: string, specVersion: string): OnboardingSpec | undefined {\n    return this.byVersion.get(\n      OnboardingSpecCache.versionKey(onboarder, specVersion),\n    );\n  }\n\n  getLatest(onboarder: string): OnboardingSpec | undefined {\n    return this.latest.get(onboarder);\n  }\n\n  set(onboarder: string, spec: OnboardingSpec): void {\n    this.byVersion.set(\n      OnboardingSpecCache.versionKey(onboarder, spec.specVersion),\n      spec,\n    );\n    this.latest.set(onboarder, spec);\n  }\n\n  clear(): void {\n    this.byVersion.clear();\n    this.latest.clear();\n  }\n}\n\n/** Module-level default cache (one per page). Injectable for tests/apps. */\nexport const defaultSpecCache = new OnboardingSpecCache();\n\n/**\n * Diff two spec versions' signup field sets — used by the 409 spec_stale\n * flow to tell the user WHAT changed. Compares by field key across all\n * signup steps.\n */\nexport interface SpecFieldDiff {\n  added: string[];\n  removed: string[];\n  changed: string[];\n}\n\nfunction signupFieldMap(spec: OnboardingSpec): Map<string, SpecField> {\n  const map = new Map<string, SpecField>();\n  for (const step of spec.forms.signup.steps) {\n    for (const field of step.fields) map.set(field.key, field);\n  }\n  return map;\n}\n\nexport function diffSpecFields(\n  prev: OnboardingSpec,\n  next: OnboardingSpec,\n): SpecFieldDiff {\n  const prevMap = signupFieldMap(prev);\n  const nextMap = signupFieldMap(next);\n  const added: string[] = [];\n  const removed: string[] = [];\n  const changed: string[] = [];\n  for (const key of nextMap.keys()) {\n    if (!prevMap.has(key)) added.push(key);\n  }\n  for (const [key, prevField] of prevMap) {\n    const nextField = nextMap.get(key);\n    if (!nextField) {\n      removed.push(key);\n      continue;\n    }\n    if (JSON.stringify(prevField) !== JSON.stringify(nextField)) {\n      changed.push(key);\n    }\n  }\n  return {\n    added: added.sort(),\n    removed: removed.sort(),\n    changed: changed.sort(),\n  };\n}\n\nexport interface SpecFetchOptions {\n  baseUrl: string;\n  /**\n   * Client-side cache key ONLY (never transmitted; trust is host-derived\n   * per D536). Use the onboarder slug/id your embed is configured with.\n   */\n  onboarder: string;\n  /** Custom fetch implementation (defaults to globalThis.fetch). */\n  fetch?: typeof globalThis.fetch;\n  /** Cache to read/write (defaults to the module-level cache). */\n  cache?: OnboardingSpecCache;\n  /**\n   * Request timeout in ms (default 15s). A stalled intake aborts with\n   * OnboardingNetworkError so the boot doesn't hang on \"Loading signup form…\".\n   */\n  timeoutMs?: number;\n  /**\n   * When true, return the cached \"latest\" for this onboarder if present\n   * WITHOUT a network round-trip. Default false (spec fetches are cheap\n   * and the server bumps specVersion on any change). The signup widget's\n   * boot passes preferCached:true so a remount reuses the loaded spec.\n   */\n  preferCached?: boolean;\n}\n\nfunction buildUrl(baseUrl: string, path: string): string {\n  const base = baseUrl.endsWith(\"/\") ? baseUrl.slice(0, -1) : baseUrl;\n  return `${base}${path}`;\n}\n\n/**\n * Fetch (and validate, and cache) the onboarding spec.\n *\n * @throws {OnboardingSpecInvalidError} response does not match D540 §1\n * @throws {OnboardingRateLimitError} on 429\n * @throws {OnboardingServerError} on any other non-2xx status\n * @throws {OnboardingNetworkError} on network failure OR timeout\n */\nexport async function fetchOnboardingSpec(\n  options: SpecFetchOptions,\n): Promise<OnboardingSpec> {\n  const cache = options.cache ?? defaultSpecCache;\n\n  if (options.preferCached) {\n    const cached = cache.getLatest(options.onboarder);\n    if (cached) return cached;\n  }\n\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n  const timeoutMs = options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n  const url = buildUrl(options.baseUrl, SPEC_PATH);\n\n  let response: Response;\n  try {\n    response = await fetchWithTimeout(url, {\n      method: \"GET\",\n      timeoutMs,\n      fetchImpl,\n    });\n  } catch (err) {\n    throw new OnboardingNetworkError(err);\n  }\n\n  if (response.status === 429) {\n    const retryAfterHeader = response.headers.get(\"retry-after\");\n    const retryAfter = retryAfterHeader\n      ? Number.parseInt(retryAfterHeader, 10)\n      : Number.NaN;\n    throw new OnboardingRateLimitError(\n      Number.isNaN(retryAfter) ? null : retryAfter,\n    );\n  }\n  if (response.status < 200 || response.status >= 300) {\n    throw new OnboardingServerError(\n      response.status,\n      `Spec fetch failed with status ${response.status}`,\n    );\n  }\n\n  let body: unknown;\n  try {\n    body = await response.json();\n  } catch {\n    throw new OnboardingSpecInvalidError(\"response body is not JSON\");\n  }\n\n  const parsed = validateOnboardingSpec(body);\n  if (!parsed.success) {\n    const detail = parsed.error.issues\n      .slice(0, 5)\n      .map((i) => `${i.path.join(\".\") || \"(root)\"}: ${i.message}`)\n      .join(\"; \");\n    throw new OnboardingSpecInvalidError(detail);\n  }\n\n  cache.set(options.onboarder, parsed.data);\n  return parsed.data;\n}\n","import {\n  OnboardingServerError,\n  OnboardingValidationError,\n} from \"../submit/errors.js\";\nimport {\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  fetchWithTimeout,\n} from \"../submit/http.js\";\n\nexport interface PinStateResult {\n  pin: string;\n  stateIso: string | null;\n}\n\nexport async function fetchPinState(options: {\n  baseUrl: string;\n  pin: string;\n  fetch?: typeof globalThis.fetch;\n  timeoutMs?: number;\n}): Promise<PinStateResult> {\n  const pin = options.pin.trim();\n  if (!/^[1-9][0-9]{5}$/.test(pin)) {\n    throw new OnboardingValidationError(\n      \"PIN must be a 6-digit Indian PIN code\",\n    );\n  }\n  const response = await fetchWithTimeout(\n    `${options.baseUrl.replace(/\\/$/, \"\")}/api/v1/public/onboarding/pin-state?pin=${encodeURIComponent(pin)}`,\n    {\n      method: \"GET\",\n      fetchImpl: options.fetch ?? globalThis.fetch,\n      timeoutMs: options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,\n    },\n  );\n  if (!response.ok) throw new OnboardingServerError(response.status);\n  const value = (await response.json()) as {\n    pin?: unknown;\n    state_iso?: unknown;\n  };\n  if (\n    value.pin !== pin ||\n    (value.state_iso !== null && typeof value.state_iso !== \"string\")\n  ) {\n    throw new OnboardingServerError(\n      response.status,\n      \"Invalid PIN-state response\",\n    );\n  }\n  return { pin, stateIso: value.state_iso };\n}\n"]}

package/dist/chunk-FIRSA7EH.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-FIRSA7EH.js.map
+//# sourceMappingURL=chunk-FIRSA7EH.js.map

package/dist/{chunk-ZDY2I6KY.js.map → chunk-FIRSA7EH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-ZDY2I6KY.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-FIRSA7EH.js"}