@nodii/onboarding 0.1.0-dev.0 → 0.1.0

package/dist/{chunk-SWMIIUXR.js → chunk-IPAKPLIF.js}

@@ -1,8 +1,8 @@
-import { createContactFormState } from './chunk-AFCJLUPK.js';
-import { defaultSpecCache, fetchOnboardingSpec, diffSpecFields } from './chunk-34BQX2KR.js';
-import { createSignupStepper, optionValue } from './chunk-4SWOVHZ2.js';
-import { computePayloadFingerprint, generateIdempotencyKey, submitLead, computeSignupFingerprint, submitSignup } from './chunk-BQCTDU5V.js';
-import { OnboardingBotChallengeError, OnboardingRateLimitError, OnboardingSpecStaleError } from './chunk-AW7W3HAC.js';
+import { createContactFormState } from './chunk-U6AXKGYQ.js';
+import { defaultSpecCache, fetchOnboardingSpec, diffSpecFields } from './chunk-F75ZJERM.js';
+import { createSignupStepper, optionValue } from './chunk-KQTS47FC.js';
+import { computePayloadFingerprint, generateIdempotencyKey, submitLead, computeSignupFingerprint, submitSignup } from './chunk-BMQINH6O.js';
+import { OnboardingBotChallengeError, OnboardingRateLimitError, OnboardingSpecStaleError, OnboardingConsentStaleError, OnboardingConsentIncompleteError } from './chunk-XJTJPBJB.js';
 import { loadRecaptcha, executeRecaptcha } from './chunk-7NS7ENJV.js';
 
 // src/widget/dom-utils.ts
@@ -243,6 +243,193 @@ var DEFAULT_WIDGET_CSS = `
   text-align: center;
   color: var(--_label);
 }
+
+/* \u2500\u2500 D543 ConsentPack step (full-width, generous spacing) \u2500\u2500 */
+
+.nodii-onboarding-consent-stage {
+  /* Full-bleed within the widget host \u2014 consent cards may span the page. */
+  width: 100%;
+  display: flex;
+  flex-direction: column;
+  gap: calc(var(--_spacing) * 2);
+  margin: calc(var(--_spacing) * 1.5) 0;
+}
+
+.nodii-onboarding-consent-intro {
+  font-size: 0.9375rem;
+  color: var(--_label);
+  margin: 0 0 calc(var(--_spacing) * 0.5) 0;
+  line-height: 1.6;
+}
+
+.nodii-onboarding-consent-card {
+  width: 100%;
+  border: 1px solid var(--_border);
+  border-radius: var(--_radius);
+  background: var(--_input-bg);
+  padding: calc(var(--_spacing) * 1.5);
+  display: flex;
+  flex-direction: column;
+  gap: var(--_spacing);
+}
+
+.nodii-onboarding-consent-card.is-stale {
+  border-color: #fcd34d;
+  background: #fffbeb;
+}
+
+.nodii-onboarding-consent-card.has-error {
+  border-color: var(--_error);
+}
+
+.nodii-onboarding-consent-title {
+  font-size: 1.125rem;
+  font-weight: 600;
+  color: var(--_label);
+  margin: 0;
+}
+
+.nodii-onboarding-consent-stale-tag {
+  font-size: 0.8125rem;
+  font-weight: 500;
+  color: #92400e;
+}
+
+.nodii-onboarding-consent-gate {
+  width: 100%;
+}
+
+.nodii-onboarding-consent-scrollbox {
+  width: 100%;
+  height: 360px;
+  overflow-y: auto;
+  border: 1px solid var(--_border);
+  border-radius: var(--_radius);
+  background: #fff;
+  position: relative;
+}
+
+.nodii-onboarding-consent-scrollbox:focus {
+  outline: none;
+  border-color: var(--_primary);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--_primary) 20%, transparent);
+}
+
+/* Inline, same-origin document content (no iframe). Rendered by the default
+   viewer: sanitized HTML/markdown, escaped plain text, or PDF.js canvases. */
+.nodii-onboarding-consent-doc-body {
+  padding: var(--_spacing);
+  font-size: 0.9375rem;
+  line-height: 1.7;
+  color: var(--_label);
+  word-break: break-word;
+}
+
+.nodii-onboarding-consent-doc-body:not(.nodii-consent-pdf) {
+  white-space: pre-wrap;
+}
+
+.nodii-onboarding-consent-doc-loading {
+  padding: var(--_spacing);
+  color: #6b7280;
+  font-size: 0.875rem;
+}
+
+.nodii-consent-pdf {
+  display: flex;
+  flex-direction: column;
+  gap: var(--_spacing);
+  white-space: normal;
+}
+
+.nodii-consent-pdf-page {
+  max-width: 100%;
+  height: auto;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.12);
+}
+
+.nodii-onboarding-consent-note {
+  font-size: 0.8125rem;
+  color: #6b7280;
+  margin: calc(var(--_spacing) * 0.5) 0 0 0;
+}
+
+/* A gated doc that could not be rendered inline: the gate stays unsatisfiable
+   (accept disabled); we surface a clear error + Retry. NO click-to-satisfy. */
+.nodii-onboarding-consent-unrenderable {
+  display: flex;
+  flex-direction: column;
+  gap: calc(var(--_spacing) * 0.5);
+  padding: var(--_spacing);
+  border: 1px solid color-mix(in srgb, var(--_error) 30%, transparent);
+  border-radius: var(--_radius);
+  background: color-mix(in srgb, var(--_error) 6%, transparent);
+}
+
+.nodii-onboarding-consent-retry {
+  align-self: flex-start;
+  padding: calc(var(--_spacing) * 0.5) var(--_spacing);
+  background: transparent;
+  color: var(--_primary);
+  border: 1px solid var(--_primary);
+  border-radius: var(--_radius);
+  font-family: var(--_font);
+  font-size: 0.875rem;
+  cursor: pointer;
+}
+
+.nodii-onboarding-consent-open-row,
+.nodii-onboarding-consent-preview-row {
+  display: flex;
+}
+
+.nodii-onboarding-consent-open {
+  display: inline-flex;
+  align-items: center;
+  padding: calc(var(--_spacing) * 0.625) var(--_spacing);
+  border: 1px solid var(--_primary);
+  border-radius: var(--_radius);
+  color: var(--_primary);
+  text-decoration: none;
+  font-size: 0.9375rem;
+  font-weight: 500;
+}
+
+.nodii-onboarding-consent-open:hover {
+  background: color-mix(in srgb, var(--_primary) 8%, transparent);
+}
+
+.nodii-onboarding-consent-preview {
+  font-size: 0.875rem;
+  color: var(--_primary);
+}
+
+.nodii-onboarding-consent-accept-row {
+  display: flex;
+  align-items: flex-start;
+  gap: calc(var(--_spacing) * 0.5);
+}
+
+.nodii-onboarding-consent-accept {
+  margin-top: 3px;
+  width: 1.125rem;
+  height: 1.125rem;
+}
+
+.nodii-onboarding-consent-accept:disabled {
+  cursor: not-allowed;
+  opacity: 0.5;
+}
+
+.nodii-onboarding-consent-accept-label {
+  font-size: 0.9375rem;
+  color: var(--_label);
+  line-height: 1.5;
+}
+
+.nodii-onboarding-consent-required {
+  color: var(--_error);
+}
 `;
 function injectWidgetStyles() {
   if (typeof document === "undefined") return;
@@ -295,13 +482,13 @@ function setFieldError(container, fieldId, message) {
   if (inputEl) inputEl.classList.add("has-error");
 }
 function clearFieldErrors(container) {
-  for (const el3 of container.querySelectorAll(
+  for (const el4 of container.querySelectorAll(
     ".nodii-onboarding-field-error"
   )) {
-    el3.textContent = "";
+    el4.textContent = "";
   }
-  for (const el3 of container.querySelectorAll(".has-error")) {
-    el3.classList.remove("has-error");
+  for (const el4 of container.querySelectorAll(".has-error")) {
+    el4.classList.remove("has-error");
   }
 }
 function applyErrors(container, errors) {
@@ -313,8 +500,10 @@ function applyErrors(container, errors) {
 function mountContactForm(host, options) {
   injectWidgetStyles();
   const formControl = createContactFormState();
-  loadRecaptcha(options.siteKey).catch(() => {
-  });
+  if (options.siteKey) {
+    loadRecaptcha(options.siteKey).catch(() => {
+    });
+  }
   const wrapper = el("div", { class: "nodii-onboarding-widget" });
   const nameInput = el("input", {
     type: "text",
@@ -475,14 +664,18 @@ function mountContactForm(host, options) {
       lastFingerprint = fingerprint;
     }
     let firstToken;
-    try {
-      firstToken = await executeRecaptcha(options.siteKey, "contact_submit", {
-        timeoutMs: options.timeoutMs
-      });
-    } catch (recaptchaErr) {
-      formControl.setError("Could not load bot protection. Please try again.");
-      options.onError?.(recaptchaErr);
-      return;
+    if (options.siteKey) {
+      try {
+        firstToken = await executeRecaptcha(options.siteKey, "contact_submit", {
+          timeoutMs: options.timeoutMs
+        });
+      } catch (recaptchaErr) {
+        formControl.setError(
+          "Could not load bot protection. Please try again."
+        );
+        options.onError?.(recaptchaErr);
+        return;
+      }
     }
     let usedFirst = false;
     const tokenProvider = async () => {
@@ -497,7 +690,7 @@ function mountContactForm(host, options) {
     try {
       await submitLead(values, {
         baseUrl: options.baseUrl,
-        botToken: tokenProvider,
+        ...options.siteKey ? { botToken: tokenProvider } : {},
         idempotencyKey,
         fetch: options.fetch,
         timeoutMs: options.timeoutMs
@@ -543,13 +736,243 @@ function mountContactForm(host, options) {
   };
 }
 
+// src/widget/consent-step.ts
+var CONSENT_ID_PREFIX = "nodii-consent-doc-";
+function el2(tag, attrs = {}, children = []) {
+  const element = document.createElement(tag);
+  for (const [key, value] of Object.entries(attrs)) {
+    element.setAttribute(key, value);
+  }
+  for (const child of children) {
+    if (typeof child === "string") {
+      element.appendChild(document.createTextNode(child));
+    } else {
+      element.appendChild(child);
+    }
+  }
+  return element;
+}
+function consentDocElementId(key) {
+  return `${CONSENT_ID_PREFIX}${key.replace(/[^A-Za-z0-9_-]/g, "-")}`;
+}
+function buildAcceptRow(control, doc) {
+  const id = consentDocElementId(doc.key);
+  const checkbox = el2("input", {
+    type: "checkbox",
+    id,
+    class: "nodii-onboarding-consent-accept"
+  });
+  checkbox.checked = doc.accepted;
+  checkbox.disabled = !doc.gateSatisfied;
+  checkbox.addEventListener("change", () => {
+    control.setAccepted(doc.key, checkbox.checked);
+    checkbox.checked = control.getState().documents.find((d) => d.key === doc.key)?.accepted ?? false;
+  });
+  const labelText = doc.acceptanceLevel === "checkbox" ? `I accept the ${doc.doc.title}` : `I have reviewed and accept the ${doc.doc.title}`;
+  const label = el2(
+    "label",
+    { for: id, class: "nodii-onboarding-consent-accept-label" },
+    [labelText]
+  );
+  if (doc.required) {
+    label.appendChild(
+      el2("span", { class: "nodii-onboarding-consent-required" }, [" *"])
+    );
+  }
+  const row = el2("div", { class: "nodii-onboarding-consent-accept-row" }, [
+    checkbox,
+    label
+  ]);
+  const errorEl = el2("div", {
+    class: "nodii-onboarding-field-error nodii-onboarding-consent-error",
+    id: `${id}-error`,
+    role: "alert",
+    "aria-live": "polite"
+  });
+  return { row, errorEl };
+}
+function buildOpenAffordance(control, doc) {
+  const id = consentDocElementId(doc.key);
+  const openLink = el2(
+    "a",
+    {
+      class: "nodii-onboarding-consent-open",
+      id: `${id}-open`,
+      href: doc.doc.downloadUrl,
+      target: "_blank",
+      rel: "noopener noreferrer"
+    },
+    [`Open ${doc.doc.title}`]
+  );
+  const markOpened = () => control.markOpened(doc.key);
+  openLink.addEventListener("click", markOpened);
+  openLink.addEventListener("keydown", (event) => {
+    if (event.key === "Enter") markOpened();
+  });
+  return el2("div", { class: "nodii-onboarding-consent-open-row" }, [openLink]);
+}
+function buildGateAffordance(control, doc, opts) {
+  const id = consentDocElementId(doc.key);
+  if (doc.acceptanceLevel === "open_then_accept") {
+    return buildOpenAffordance(control, doc);
+  }
+  if (doc.acceptanceLevel === "checkbox") {
+    return el2("div", { class: "nodii-onboarding-consent-preview-row" }, [
+      el2(
+        "a",
+        {
+          class: "nodii-onboarding-consent-preview",
+          id: `${id}-preview`,
+          href: doc.doc.downloadUrl,
+          target: "_blank",
+          rel: "noopener noreferrer"
+        },
+        [`View ${doc.doc.title}`]
+      )
+    ]);
+  }
+  const container = el2("div", {
+    class: "nodii-onboarding-consent-gate",
+    id: `${id}-gate`
+  });
+  container.appendChild(
+    el2("div", { class: "nodii-onboarding-consent-doc-loading" }, [
+      "Loading document\u2026"
+    ])
+  );
+  const importViewer = opts.importViewer ?? (() => import('./render-DC7P2BGQ.js'));
+  const loadViewer = () => {
+    void (async () => {
+      try {
+        const { renderConsentDocument } = await importViewer();
+        await renderConsentDocument(container, doc.doc, control, {
+          consentKey: doc.key,
+          fetch: opts.fetch,
+          timeoutMs: opts.timeoutMs
+        });
+      } catch {
+        while (container.firstChild) {
+          container.removeChild(container.firstChild);
+        }
+        const wrap = el2("div", {
+          class: "nodii-onboarding-consent-unrenderable",
+          role: "alert"
+        });
+        wrap.appendChild(
+          el2(
+            "p",
+            {
+              // DISTINCT id (NOT `${id}-error`): buildAcceptRow already owns
+              // `${id}-error`, and updateConsentStep's querySelector would match
+              // THIS paragraph first and blank it on the next state change,
+              // silently wiping the compliance message. A unique id keeps this
+              // load-failure error persistent (P1b).
+              class: "nodii-onboarding-field-error nodii-onboarding-consent-error",
+              id: `${id}-load-error`
+            },
+            [
+              `\u201C${doc.doc.title}\u201D could not be loaded, so it cannot be accepted yet. Please retry.`
+            ]
+          )
+        );
+        const retry = el2(
+          "button",
+          { type: "button", class: "nodii-onboarding-consent-retry" },
+          ["Retry loading document"]
+        );
+        retry.addEventListener("click", loadViewer);
+        wrap.appendChild(retry);
+        wrap.appendChild(
+          el2(
+            "a",
+            {
+              class: "nodii-onboarding-consent-open",
+              href: doc.doc.downloadUrl,
+              target: "_blank",
+              rel: "noopener noreferrer"
+            },
+            [`Open ${doc.doc.title} in a new tab`]
+          )
+        );
+        container.appendChild(wrap);
+      }
+    })();
+  };
+  loadViewer();
+  return container;
+}
+function buildConsentCard(control, doc, stale, opts) {
+  const card = el2("div", {
+    class: `nodii-onboarding-consent-card${stale ? " is-stale" : ""}`,
+    "data-consent-key": doc.key
+  });
+  card.appendChild(
+    el2("h4", { class: "nodii-onboarding-consent-title" }, [doc.doc.title])
+  );
+  if (stale) {
+    card.appendChild(
+      el2(
+        "div",
+        { class: "nodii-onboarding-consent-stale-tag", role: "status" },
+        ["Updated \u2014 please review and re-accept."]
+      )
+    );
+  }
+  card.appendChild(buildGateAffordance(control, doc, opts));
+  const { row, errorEl } = buildAcceptRow(control, doc);
+  card.appendChild(row);
+  card.appendChild(errorEl);
+  return card;
+}
+function renderConsentStep(host, control, state, staleKeys = [], opts = {}) {
+  while (host.firstChild) host.removeChild(host.firstChild);
+  const staleSet = new Set(staleKeys);
+  host.appendChild(
+    el2("h3", { class: "nodii-onboarding-stage-title" }, [
+      "Review & accept documents"
+    ])
+  );
+  host.appendChild(
+    el2("p", { class: "nodii-onboarding-consent-intro" }, [
+      "Please review each document below and accept to continue."
+    ])
+  );
+  for (const doc of state.documents) {
+    host.appendChild(
+      buildConsentCard(control, doc, staleSet.has(doc.key), opts)
+    );
+  }
+}
+function updateConsentStep(host, state, consentErrors) {
+  const errorByKey = new Map(consentErrors.map((e) => [e.path, e.message]));
+  for (const doc of state.documents) {
+    const id = consentDocElementId(doc.key);
+    const checkbox = host.querySelector(
+      idSelector(id)
+    );
+    if (checkbox) {
+      checkbox.disabled = !doc.gateSatisfied;
+      checkbox.checked = doc.accepted;
+    }
+    const errorNode = host.querySelector(idSelector(`${id}-error`));
+    if (errorNode) errorNode.textContent = errorByKey.get(doc.key) ?? "";
+    const card = host.querySelector(
+      `[data-consent-key="${cssEscape(doc.key)}"]`
+    );
+    if (card) {
+      if (errorByKey.has(doc.key)) card.classList.add("has-error");
+      else card.classList.remove("has-error");
+    }
+  }
+}
+
 // src/widget/signup-form.ts
 var STAGE_TITLES = {
   lead: "About you",
   prospect: "Your business",
   activation: "Choose your services"
 };
-function el2(tag, attrs = {}, children = []) {
+function el3(tag, attrs = {}, children = []) {
   const element = document.createElement(tag);
   for (const [key, value] of Object.entries(attrs)) {
     element.setAttribute(key, value);
@@ -574,7 +997,7 @@ function buildFieldInput(field, currentValue, onChange) {
   const id = `nodii-f-${field.key}`;
   switch (field.type) {
     case "textarea": {
-      const input = el2("textarea", {
+      const input = el3("textarea", {
         id,
         class: "nodii-onboarding-textarea",
         rows: "4"
@@ -585,7 +1008,7 @@ function buildFieldInput(field, currentValue, onChange) {
     }
     case "checkbox":
     case "boolean": {
-      const input = el2("input", {
+      const input = el3("input", {
         type: "checkbox",
         id
       });
@@ -595,14 +1018,14 @@ function buildFieldInput(field, currentValue, onChange) {
     }
     case "select":
     case "radio": {
-      const select = el2("select", {
+      const select = el3("select", {
         id,
         class: "nodii-onboarding-input"
       });
-      select.appendChild(el2("option", { value: "" }, ["\u2014 select \u2014"]));
+      select.appendChild(el3("option", { value: "" }, ["\u2014 select \u2014"]));
       for (const opt of field.options ?? []) {
         const value = optionValue(opt);
-        const optionEl = el2("option", { value }, [optionLabel(opt)]);
+        const optionEl = el3("option", { value }, [optionLabel(opt)]);
         select.appendChild(optionEl);
       }
       if (typeof currentValue === "string") select.value = currentValue;
@@ -610,7 +1033,7 @@ function buildFieldInput(field, currentValue, onChange) {
       return select;
     }
     case "multiselect": {
-      const select = el2("select", {
+      const select = el3("select", {
         id,
         class: "nodii-onboarding-input",
         multiple: "multiple"
@@ -618,7 +1041,7 @@ function buildFieldInput(field, currentValue, onChange) {
       const current = Array.isArray(currentValue) ? currentValue.map(String) : [];
       for (const opt of field.options ?? []) {
         const value = optionValue(opt);
-        const optionEl = el2("option", { value }, [
+        const optionEl = el3("option", { value }, [
           optionLabel(opt)
         ]);
         if (current.includes(value)) optionEl.selected = true;
@@ -635,7 +1058,7 @@ function buildFieldInput(field, currentValue, onChange) {
     }
     default: {
       const typeAttr = field.type === "email" || field.type === "tel" || field.type === "number" || field.type === "date" ? field.type : "text";
-      const input = el2("input", {
+      const input = el3("input", {
         type: typeAttr,
         id,
         class: "nodii-onboarding-input"
@@ -649,7 +1072,7 @@ function buildFieldInput(field, currentValue, onChange) {
 }
 function fieldRow(field, input, idOverride) {
   const id = idOverride ?? `nodii-f-${field.key}`;
-  const labelEl = el2(
+  const labelEl = el3(
     "label",
     {
       for: id,
@@ -657,13 +1080,13 @@ function fieldRow(field, input, idOverride) {
     },
     [field.label]
   );
-  const errorEl = el2("div", {
+  const errorEl = el3("div", {
     class: "nodii-onboarding-field-error",
     id: `${id}-error`,
     role: "alert",
     "aria-live": "polite"
   });
-  return el2("div", { class: "nodii-onboarding-field" }, [
+  return el3("div", { class: "nodii-onboarding-field" }, [
     labelEl,
     input,
     errorEl
@@ -671,8 +1094,8 @@ function fieldRow(field, input, idOverride) {
 }
 function mountSignupForm(host, options) {
   injectWidgetStyles();
-  const wrapper = el2("div", { class: "nodii-onboarding-widget" });
-  const loadingEl = el2("div", { class: "nodii-onboarding-loading" }, [
+  const wrapper = el3("div", { class: "nodii-onboarding-widget" });
+  const loadingEl = el3("div", { class: "nodii-onboarding-loading" }, [
     "Loading signup form\u2026"
   ]);
   wrapper.appendChild(loadingEl);
@@ -686,27 +1109,28 @@ function mountSignupForm(host, options) {
   let lastFingerprint = null;
   let renderedStepIndex = -1;
   let renderedStale = false;
+  let renderedConsentStale = false;
   let currentSpecVersion = null;
   let staleDiffSummary = "";
-  const stepArea = el2("div", {});
-  const staleBanner = el2("div", {
+  const stepArea = el3("div", {});
+  const staleBanner = el3("div", {
     class: "nodii-onboarding-stale-banner",
     role: "alert",
     style: "display:none"
   });
-  const serverErrorEl = el2("div", {
+  const serverErrorEl = el3("div", {
     class: "nodii-onboarding-server-error",
     role: "alert",
     "aria-live": "assertive",
     style: "display:none"
   });
-  const successEl = el2("div", {
+  const successEl = el3("div", {
     class: "nodii-onboarding-success",
     role: "status",
     style: "display:none"
   });
-  const stepsIndicator = el2("div", { class: "nodii-onboarding-steps" });
-  const form = el2("form", { novalidate: "true", "aria-label": "Sign up" });
+  const stepsIndicator = el3("div", { class: "nodii-onboarding-steps" });
+  const form = el3("form", { novalidate: "true", "aria-label": "Sign up" });
   function setFieldErrorsInPlace(container, errors, idPrefix) {
     for (const errEl of container.querySelectorAll(
       ".nodii-onboarding-field-error"
@@ -726,7 +1150,7 @@ function mountSignupForm(host, options) {
   }
   function accountIdOf(path) {
     if (path === "email") return "nodii-account-email";
-    if (path === "password") return "nodii-account-password";
+    if (path === "displayName") return "nodii-account-display-name";
     if (path === "tosAccepted") return "nodii-consent-tos";
     if (path === "privacyAccepted") return "nodii-consent-privacy";
     return `nodii-account-${path}`;
@@ -737,15 +1161,15 @@ function mountSignupForm(host, options) {
     }
     for (let i = 0; i < state.stepCount; i++) {
       stepsIndicator.appendChild(
-        el2("div", {
+        el3("div", {
           class: `nodii-onboarding-step-dot${i <= state.stepIndex ? " active" : ""}`
         })
       );
     }
   }
   function renderAccountSection(control, state) {
-    const section = el2("div", { class: "nodii-onboarding-account-section" });
-    const emailInput = el2("input", {
+    const section = el3("div", { class: "nodii-onboarding-account-section" });
+    const emailInput = el3("input", {
       type: "email",
       id: "nodii-account-email",
       class: "nodii-onboarding-input",
@@ -768,32 +1192,54 @@ function mountSignupForm(host, options) {
         // label for + error id match the real input id
       )
     );
-    const passwordInput = el2("input", {
-      type: "password",
-      id: "nodii-account-password",
+    const displayNameInput = el3("input", {
+      type: "text",
+      id: "nodii-account-display-name",
       class: "nodii-onboarding-input",
-      autocomplete: "new-password",
-      minlength: "12",
-      maxlength: "256"
+      autocomplete: "name",
+      maxlength: "200"
     });
-    passwordInput.value = state.credentials.password;
-    passwordInput.addEventListener(
+    displayNameInput.value = state.credentials.displayName;
+    displayNameInput.addEventListener(
       "input",
-      () => control.setCredentials({ password: passwordInput.value })
+      () => control.setCredentials({ displayName: displayNameInput.value })
     );
     section.appendChild(
       fieldRow(
         {
-          key: "account-password",
-          label: "Password (12+ characters)",
+          key: "account-display-name",
+          label: "Your name",
           required: true
         },
-        passwordInput,
-        "nodii-account-password"
-        // label for + error id match the real input id
+        displayNameInput,
+        "nodii-account-display-name"
       )
     );
-    const tosCheckbox = el2("input", {
+    for (const [key, label, autocomplete] of [
+      ["organisationName", "Organisation name", "organization"],
+      ["subdomain", "Workspace subdomain", "off"]
+    ]) {
+      const input = el3("input", {
+        type: "text",
+        id: `nodii-account-${key}`,
+        class: "nodii-onboarding-input",
+        autocomplete,
+        maxlength: key === "subdomain" ? "63" : "200"
+      });
+      input.value = state.credentials[key];
+      input.addEventListener(
+        "input",
+        () => control.setCredentials({ [key]: input.value })
+      );
+      section.appendChild(
+        fieldRow(
+          { key: `account-${key}`, label, required: true },
+          input,
+          `nodii-account-${key}`
+        )
+      );
+    }
+    const tosCheckbox = el3("input", {
       type: "checkbox",
       id: "nodii-consent-tos"
     });
@@ -805,7 +1251,7 @@ function mountSignupForm(host, options) {
     const tosLabelChildren = ["I accept the "];
     if (options.tosUrl) {
       tosLabelChildren.push(
-        el2(
+        el3(
           "a",
           {
             href: options.tosUrl,
@@ -819,19 +1265,19 @@ function mountSignupForm(host, options) {
       tosLabelChildren.push("Terms of Service");
     }
     section.appendChild(
-      el2("div", { class: "nodii-onboarding-consent-row" }, [
+      el3("div", { class: "nodii-onboarding-consent-row" }, [
         tosCheckbox,
-        el2("label", { for: "nodii-consent-tos" }, tosLabelChildren)
+        el3("label", { for: "nodii-consent-tos" }, tosLabelChildren)
       ])
     );
     section.appendChild(
-      el2("div", {
+      el3("div", {
         class: "nodii-onboarding-field-error",
         id: "nodii-consent-tos-error",
         role: "alert"
       })
     );
-    const privacyCheckbox = el2("input", {
+    const privacyCheckbox = el3("input", {
       type: "checkbox",
       id: "nodii-consent-privacy"
     });
@@ -843,7 +1289,7 @@ function mountSignupForm(host, options) {
     const privacyLabelChildren = ["I accept the "];
     if (options.privacyUrl) {
       privacyLabelChildren.push(
-        el2(
+        el3(
           "a",
           {
             href: options.privacyUrl,
@@ -857,13 +1303,13 @@ function mountSignupForm(host, options) {
       privacyLabelChildren.push("Privacy Policy");
     }
     section.appendChild(
-      el2("div", { class: "nodii-onboarding-consent-row" }, [
+      el3("div", { class: "nodii-onboarding-consent-row" }, [
         privacyCheckbox,
-        el2("label", { for: "nodii-consent-privacy" }, privacyLabelChildren)
+        el3("label", { for: "nodii-consent-privacy" }, privacyLabelChildren)
       ])
     );
     section.appendChild(
-      el2("div", {
+      el3("div", {
         class: "nodii-onboarding-field-error",
         id: "nodii-consent-privacy-error",
         role: "alert"
@@ -876,7 +1322,7 @@ function mountSignupForm(host, options) {
     const step = state.currentStep;
     if (step) {
       stepArea.appendChild(
-        el2("h3", { class: "nodii-onboarding-stage-title" }, [
+        el3("h3", { class: "nodii-onboarding-stage-title" }, [
           STAGE_TITLES[step.stage] ?? step.stage
         ])
       );
@@ -891,11 +1337,24 @@ function mountSignupForm(host, options) {
     }
     const isLast = control.isLastStep();
     if (isLast) {
+      if (!control.consent.isEmpty()) {
+        const consentStage = el3("div", {
+          class: "nodii-onboarding-consent-stage"
+        });
+        renderConsentStep(
+          consentStage,
+          control.consent,
+          state.consentState,
+          state.staleConsentKeys,
+          { fetch: options.fetch, timeoutMs: options.timeoutMs }
+        );
+        stepArea.appendChild(consentStage);
+      }
       stepArea.appendChild(renderAccountSection(control, state));
     }
-    const nav = el2("div", { class: "nodii-onboarding-nav" });
+    const nav = el3("div", { class: "nodii-onboarding-nav" });
     if (!control.isFirstStep()) {
-      const backBtn = el2(
+      const backBtn = el3(
         "button",
         { type: "button", class: "nodii-onboarding-back-btn" },
         ["Back"]
@@ -903,7 +1362,7 @@ function mountSignupForm(host, options) {
       backBtn.addEventListener("click", () => control.back());
       nav.appendChild(backBtn);
     }
-    const forwardBtn = el2(
+    const forwardBtn = el3(
       "button",
       {
         type: isLast ? "submit" : "button",
@@ -940,12 +1399,27 @@ function mountSignupForm(host, options) {
     } else {
       staleDiffSummary = "";
     }
-    siteKey = options.siteKey ?? fresh.botChallenge.siteKey;
+    siteKey = options.siteKey ?? fresh.botChallenge?.siteKey ?? "";
     currentSpecVersion = fresh.specVersion;
     control.applyNewSpec(fresh);
     idempotencyKey = null;
     lastFingerprint = null;
   }
+  async function handleConsentStale(control) {
+    const fresh = await fetchOnboardingSpec({
+      baseUrl: options.baseUrl,
+      onboarder: options.onboarder,
+      fetch: options.fetch,
+      timeoutMs: options.timeoutMs,
+      cache
+    });
+    if (unmounted) return;
+    siteKey = options.siteKey ?? fresh.botChallenge?.siteKey ?? "";
+    currentSpecVersion = fresh.specVersion;
+    control.applyNewConsentPack(fresh);
+    idempotencyKey = null;
+    lastFingerprint = null;
+  }
   async function handleSubmit(control) {
     if (!control.validateAll()) return;
     control.acknowledgeSpecStale();
@@ -957,14 +1431,16 @@ function mountSignupForm(host, options) {
       lastFingerprint = fingerprint;
     }
     let firstToken;
-    try {
-      firstToken = await executeRecaptcha(siteKey, "signup_submit", {
-        timeoutMs: options.timeoutMs
-      });
-    } catch (recaptchaErr) {
-      control.setError("Could not load bot protection. Please try again.");
-      options.onError?.(recaptchaErr);
-      return;
+    if (siteKey) {
+      try {
+        firstToken = await executeRecaptcha(siteKey, "signup_submit", {
+          timeoutMs: options.timeoutMs
+        });
+      } catch (recaptchaErr) {
+        control.setError("Could not load bot protection. Please try again.");
+        options.onError?.(recaptchaErr);
+        return;
+      }
     }
     let usedFirst = false;
     const tokenProvider = async () => {
@@ -979,7 +1455,7 @@ function mountSignupForm(host, options) {
     try {
       const result = await submitSignup(body, {
         baseUrl: options.baseUrl,
-        botToken: tokenProvider,
+        ...siteKey ? { botToken: tokenProvider } : {},
         idempotencyKey,
         fetch: options.fetch,
         timeoutMs: options.timeoutMs
@@ -1000,6 +1476,21 @@ function mountSignupForm(host, options) {
           return;
         }
         options.onError?.(err);
+      } else if (err instanceof OnboardingConsentStaleError) {
+        try {
+          await handleConsentStale(control);
+        } catch (refetchErr) {
+          control.setError(
+            "The legal documents changed and could not be reloaded. Please refresh the page."
+          );
+          options.onError?.(refetchErr);
+          return;
+        }
+        options.onError?.(err);
+      } else if (err instanceof OnboardingConsentIncompleteError) {
+        control.validateAll();
+        control.setError("Please accept all required documents to continue.");
+        options.onError?.(err);
       } else if (err instanceof OnboardingBotChallengeError) {
         control.setError(
           "Bot protection check failed. Please refresh the page and try again."
@@ -1017,14 +1508,15 @@ function mountSignupForm(host, options) {
     }
   }
   function onStateChange(control, state) {
-    if (state.stepIndex !== renderedStepIndex || state.specStale !== renderedStale) {
+    if (state.stepIndex !== renderedStepIndex || state.specStale !== renderedStale || state.consentStale !== renderedConsentStale) {
       renderedStepIndex = state.stepIndex;
       renderedStale = state.specStale;
+      renderedConsentStale = state.consentStale;
       renderStep(control, state);
       renderStepsIndicator(state);
     }
-    staleBanner.style.display = state.specStale ? "" : "none";
-    staleBanner.textContent = state.specStale ? `This form was just updated by the provider${staleDiffSummary}. Please review your answers below and submit again.` : "";
+    staleBanner.style.display = state.specStale || state.consentStale ? "" : "none";
+    staleBanner.textContent = state.specStale ? `This form was just updated by the provider${staleDiffSummary}. Please review your answers below and submit again.` : state.consentStale ? "One or more legal documents were updated. Please review and re-accept the updated documents below, then submit again." : "";
     setFieldErrorsInPlace(
       stepArea,
       state.errors,
@@ -1037,6 +1529,12 @@ function mountSignupForm(host, options) {
       const inputNode = stepArea.querySelector(idSelector(id));
       if (inputNode) inputNode.classList.add("has-error");
     }
+    const consentStage = stepArea.querySelector(
+      ".nodii-onboarding-consent-stage"
+    );
+    if (consentStage) {
+      updateConsentStep(consentStage, state.consentState, state.consentErrors);
+    }
     if (state.serverError) {
       serverErrorEl.textContent = state.serverError;
       serverErrorEl.style.display = "";
@@ -1080,7 +1578,7 @@ function mountSignupForm(host, options) {
       return;
     }
     if (unmounted) return;
-    siteKey = options.siteKey ?? spec.botChallenge.siteKey;
+    siteKey = options.siteKey ?? spec.botChallenge?.siteKey ?? "";
     currentSpecVersion = spec.specVersion;
     const control = createSignupStepper(spec);
     stepper = control;
@@ -1144,12 +1642,12 @@ var OnboardingWidget = {
    * });
    * ```
    */
-  mount(el3, options) {
+  mount(el4, options) {
     if (options.form === "contact") {
-      return mountContactForm(el3, options);
+      return mountContactForm(el4, options);
     }
     if (options.form === "signup") {
-      return mountSignupForm(el3, options);
+      return mountSignupForm(el4, options);
     }
     throw new Error(
       `OnboardingWidget.mount: unknown form "${options.form}". Supported: "contact", "signup".`
@@ -1157,6 +1655,6 @@ var OnboardingWidget = {
   }
 };
 
-export { DEFAULT_WIDGET_CSS, OnboardingWidget, cssEscape, idSelector, injectWidgetStyles, mountContactForm, mountSignupForm };
-//# sourceMappingURL=chunk-SWMIIUXR.js.map
-//# sourceMappingURL=chunk-SWMIIUXR.js.map
+export { DEFAULT_WIDGET_CSS, OnboardingWidget, consentDocElementId, cssEscape, idSelector, injectWidgetStyles, mountContactForm, mountSignupForm, renderConsentStep, updateConsentStep };
+//# sourceMappingURL=chunk-IPAKPLIF.js.map
+//# sourceMappingURL=chunk-IPAKPLIF.js.map