@nodii/onboarding 0.1.0-dev.0 → 0.2.0

package/dist/schema-BrtjpXfL.d.ts

@@ -0,0 +1,257 @@
+import { z } from 'zod/v3';
+
+/**
+ * Contact-form Zod schema — mirrors the LOCKED hub REST contract exactly:
+ *   POST /api/v1/public/onboarding/leads
+ *   Schema: PublicOnboardingLeadsRequest (hub id 8686dd33)
+ *
+ * Constraints (per hub JSON Schema):
+ *   name     — string, 1-200 chars, required
+ *   email    — email format, required
+ *   phone    — string, optional (no server-side constraint beyond string)
+ *   message  — string, ≤4000 chars, optional
+ *   botToken — string, required (reCAPTCHA token, D537)
+ *
+ *   additionalProperties: false
+ *
+ * The schema intentionally does NOT include botToken in the public-facing
+ * ContactFormValues type — that field is injected by the submit client right
+ * before the POST (the widget/form never exposes it to the user).
+ */
+
+/**
+ * The user-visible contact form fields. Validated client-side for UX.
+ * Server re-validates authoritatively (D540 §2).
+ */
+declare const contactFormSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    companyName: z.ZodString;
+    contactName: z.ZodString;
+    email: z.ZodString;
+    phone: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+    interestModules: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    sizeBand: z.ZodOptional<z.ZodString>;
+    attribution: z.ZodOptional<z.ZodObject<{
+        campaignTags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        referringSite: z.ZodOptional<z.ZodString>;
+        landingPage: z.ZodOptional<z.ZodString>;
+        button: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    }, {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    }>>;
+    privacyNoticeAcknowledged: z.ZodEffects<z.ZodBoolean, boolean, boolean>;
+    marketingOptIn: z.ZodBoolean;
+    intakeKind: z.ZodEnum<["contact", "enquiry"]>;
+}, "strip", z.ZodTypeAny, {
+    companyName: string;
+    contactName: string;
+    email: string;
+    interestModules: string[];
+    privacyNoticeAcknowledged: boolean;
+    marketingOptIn: boolean;
+    intakeKind: "contact" | "enquiry";
+    name?: string | undefined;
+    phone?: string | undefined;
+    message?: string | undefined;
+    sizeBand?: string | undefined;
+    attribution?: {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    } | undefined;
+}, {
+    companyName: string;
+    contactName: string;
+    email: string;
+    privacyNoticeAcknowledged: boolean;
+    marketingOptIn: boolean;
+    intakeKind: "contact" | "enquiry";
+    name?: string | undefined;
+    phone?: string | undefined;
+    message?: string | undefined;
+    interestModules?: string[] | undefined;
+    sizeBand?: string | undefined;
+    attribution?: {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    } | undefined;
+}>;
+type ContactFormValues = z.infer<typeof contactFormSchema>;
+/**
+ * The full wire payload — contactFormSchema + botToken.
+ *
+ * STRICT mode: unknown keys are REJECTED (not stripped), mirroring the
+ * server's `additionalProperties: false`. `submitLead` runs every outgoing
+ * payload through this schema before the POST — an extra key never reaches
+ * the wire; it fails fast client-side with OnboardingValidationError.
+ */
+declare const leadsWireSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    companyName: z.ZodString;
+    contactName: z.ZodString;
+    email: z.ZodString;
+    phone: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+    interestModules: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    sizeBand: z.ZodOptional<z.ZodString>;
+    attribution: z.ZodOptional<z.ZodObject<{
+        campaignTags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        referringSite: z.ZodOptional<z.ZodString>;
+        landingPage: z.ZodOptional<z.ZodString>;
+        button: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    }, {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    }>>;
+    privacyNoticeAcknowledged: z.ZodEffects<z.ZodBoolean, boolean, boolean>;
+    marketingOptIn: z.ZodBoolean;
+    intakeKind: z.ZodEnum<["contact", "enquiry"]>;
+} & {
+    botToken: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    companyName: string;
+    contactName: string;
+    email: string;
+    interestModules: string[];
+    privacyNoticeAcknowledged: boolean;
+    marketingOptIn: boolean;
+    intakeKind: "contact" | "enquiry";
+    name?: string | undefined;
+    phone?: string | undefined;
+    message?: string | undefined;
+    sizeBand?: string | undefined;
+    attribution?: {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    } | undefined;
+    botToken?: string | undefined;
+}, {
+    companyName: string;
+    contactName: string;
+    email: string;
+    privacyNoticeAcknowledged: boolean;
+    marketingOptIn: boolean;
+    intakeKind: "contact" | "enquiry";
+    name?: string | undefined;
+    phone?: string | undefined;
+    message?: string | undefined;
+    interestModules?: string[] | undefined;
+    sizeBand?: string | undefined;
+    attribution?: {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    } | undefined;
+    botToken?: string | undefined;
+}>;
+type LeadsWirePayload = z.infer<typeof leadsWireSchema>;
+/**
+ * Validate user-visible form values (no botToken required here).
+ * Returns a Zod SafeParseReturnType (inferred).
+ */
+declare function validateContactForm(values: unknown): z.SafeParseReturnType<{
+    companyName: string;
+    contactName: string;
+    email: string;
+    privacyNoticeAcknowledged: boolean;
+    marketingOptIn: boolean;
+    intakeKind: "contact" | "enquiry";
+    name?: string | undefined;
+    phone?: string | undefined;
+    message?: string | undefined;
+    interestModules?: string[] | undefined;
+    sizeBand?: string | undefined;
+    attribution?: {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    } | undefined;
+}, {
+    companyName: string;
+    contactName: string;
+    email: string;
+    interestModules: string[];
+    privacyNoticeAcknowledged: boolean;
+    marketingOptIn: boolean;
+    intakeKind: "contact" | "enquiry";
+    name?: string | undefined;
+    phone?: string | undefined;
+    message?: string | undefined;
+    sizeBand?: string | undefined;
+    attribution?: {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    } | undefined;
+}>;
+/**
+ * Validate the full wire payload (including botToken) before submission.
+ * STRICT: unknown keys are rejected, matching additionalProperties:false.
+ * This is the exact validation `submitLead` applies on the wire path.
+ * Returns a Zod SafeParseReturnType (inferred).
+ */
+declare function validateLeadsPayload(payload: unknown): z.SafeParseReturnType<{
+    companyName: string;
+    contactName: string;
+    email: string;
+    privacyNoticeAcknowledged: boolean;
+    marketingOptIn: boolean;
+    intakeKind: "contact" | "enquiry";
+    name?: string | undefined;
+    phone?: string | undefined;
+    message?: string | undefined;
+    interestModules?: string[] | undefined;
+    sizeBand?: string | undefined;
+    attribution?: {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    } | undefined;
+    botToken?: string | undefined;
+}, {
+    companyName: string;
+    contactName: string;
+    email: string;
+    interestModules: string[];
+    privacyNoticeAcknowledged: boolean;
+    marketingOptIn: boolean;
+    intakeKind: "contact" | "enquiry";
+    name?: string | undefined;
+    phone?: string | undefined;
+    message?: string | undefined;
+    sizeBand?: string | undefined;
+    attribution?: {
+        campaignTags?: Record<string, string> | undefined;
+        referringSite?: string | undefined;
+        landingPage?: string | undefined;
+        button?: string | undefined;
+    } | undefined;
+    botToken?: string | undefined;
+}>;
+
+export { type ContactFormValues as C, type LeadsWirePayload as L, validateLeadsPayload as a, contactFormSchema as c, leadsWireSchema as l, validateContactForm as v };

package/dist/{signup-client-Bl6eUrxR.d.ts → signup-client-CS95nkVO.d.ts}

@@ -1,6 +1,7 @@
 import { z } from 'zod/v3';
-import { T as TerminalStage } from './model-IEyDI54w.js';
-import { C as ContactFormValues } from './schema-TfyBU6JW.js';
+import { T as TerminalStage } from './model-CEwvHlWA.js';
+import { e as ConsentSubmitDocument } from './controller-BLH3wnxl.js';
+import { C as ContactFormValues } from './schema-BrtjpXfL.js';
 
 /**
  * Submit client for POST /api/v1/public/onboarding/leads.
@@ -42,7 +43,7 @@ interface LeadsSubmitOptions {
      * fresh token (recommended — tokens are single-use; a fixed string on a
      * retried request risks 403 after the first attempt consumed it).
      */
-    botToken: BotTokenSource;
+    botToken?: BotTokenSource;
     /**
      * Stable idempotency key for this submission. Generate ONCE with
      * `generateIdempotencyKey()` and pass the same key for retries.
@@ -116,7 +117,7 @@ declare function submitLead(values: ContactFormValues, options: LeadsSubmitOptio
  * Contract per the LOCKED hub REST interface (PublicOnboardingSubmitRequest):
  *   - Body: { specVersion, answers, selectedServices?, botToken,
  *             consent:{tosAccepted:true, privacyAccepted:true},
- *             credentials:{email, password(12-256)} }
+ *             credentials:{email, displayName?}, organisationName?, subdomain }
  *     additionalProperties: false — validated STRICTLY client-side before
  *     any fetch (unknown keys are rejected, not stripped).
  *   - Idempotency-Key header REQUIRED (same D538 discipline as leads:
@@ -134,61 +135,177 @@ declare function submitLead(values: ContactFormValues, options: LeadsSubmitOptio
  * (/leads tolerates body-less 2xx because its only signal IS the status.)
  */
 
+/**
+ * STRICT wire schema for ONE element of the D543 §4 consent.documents array.
+ * `accepted` is const-true (an unaccepted doc is never sent — the consent
+ * controller omits it), and `evidence` carries only the gate-relevant flags.
+ */
+declare const consentSubmitDocumentSchema: z.ZodObject<{
+    legalDocumentId: z.ZodString;
+    versionNo: z.ZodNumber;
+    accepted: z.ZodLiteral<true>;
+    evidence: z.ZodObject<{
+        scrolled_to_end: z.ZodOptional<z.ZodBoolean>;
+        opened: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        opened?: boolean | undefined;
+        scrolled_to_end?: boolean | undefined;
+    }, {
+        opened?: boolean | undefined;
+        scrolled_to_end?: boolean | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    legalDocumentId: string;
+    versionNo: number;
+    accepted: true;
+    evidence: {
+        opened?: boolean | undefined;
+        scrolled_to_end?: boolean | undefined;
+    };
+}, {
+    legalDocumentId: string;
+    versionNo: number;
+    accepted: true;
+    evidence: {
+        opened?: boolean | undefined;
+        scrolled_to_end?: boolean | undefined;
+    };
+}>;
 /**
  * STRICT wire schema — mirrors PublicOnboardingSubmitRequest exactly
- * (additionalProperties: false; consent booleans are const-true; password
- * length 12-256 per the locked schema).
+ * (additionalProperties: false; consent booleans are const-true; passwordless
+ * per D1010, with the workspace subdomain required by D836).
+ *
+ * D543 §4: `consent` extends from booleans to a per-document array. The
+ * `documents` array is AUTHORITATIVE (the server re-validates it); the
+ * `tosAccepted`/`privacyAccepted` booleans are kept as a DERIVED convenience
+ * (D543 "kept as a derived convenience only"). `documents` is OPTIONAL on the
+ * wire for backward-compat — a pre-ConsentPack onboarder serves no consentPack
+ * and submits the booleans alone (D543 "pre-ConsentPack submits still parse").
  */
 declare const signupWireSchema: z.ZodObject<{
     specVersion: z.ZodString;
     answers: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     selectedServices: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    botToken: z.ZodString;
+    botToken: z.ZodOptional<z.ZodString>;
     consent: z.ZodObject<{
         tosAccepted: z.ZodLiteral<true>;
         privacyAccepted: z.ZodLiteral<true>;
+        documents: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            legalDocumentId: z.ZodString;
+            versionNo: z.ZodNumber;
+            accepted: z.ZodLiteral<true>;
+            evidence: z.ZodObject<{
+                scrolled_to_end: z.ZodOptional<z.ZodBoolean>;
+                opened: z.ZodOptional<z.ZodBoolean>;
+            }, "strict", z.ZodTypeAny, {
+                opened?: boolean | undefined;
+                scrolled_to_end?: boolean | undefined;
+            }, {
+                opened?: boolean | undefined;
+                scrolled_to_end?: boolean | undefined;
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            legalDocumentId: string;
+            versionNo: number;
+            accepted: true;
+            evidence: {
+                opened?: boolean | undefined;
+                scrolled_to_end?: boolean | undefined;
+            };
+        }, {
+            legalDocumentId: string;
+            versionNo: number;
+            accepted: true;
+            evidence: {
+                opened?: boolean | undefined;
+                scrolled_to_end?: boolean | undefined;
+            };
+        }>, "many">>;
     }, "strict", z.ZodTypeAny, {
         tosAccepted: true;
         privacyAccepted: true;
+        documents?: {
+            legalDocumentId: string;
+            versionNo: number;
+            accepted: true;
+            evidence: {
+                opened?: boolean | undefined;
+                scrolled_to_end?: boolean | undefined;
+            };
+        }[] | undefined;
     }, {
         tosAccepted: true;
         privacyAccepted: true;
+        documents?: {
+            legalDocumentId: string;
+            versionNo: number;
+            accepted: true;
+            evidence: {
+                opened?: boolean | undefined;
+                scrolled_to_end?: boolean | undefined;
+            };
+        }[] | undefined;
     }>;
     credentials: z.ZodObject<{
         email: z.ZodString;
-        password: z.ZodString;
+        displayName: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         email: string;
-        password: string;
+        displayName?: string | undefined;
     }, {
         email: string;
-        password: string;
+        displayName?: string | undefined;
     }>;
+    organisationName: z.ZodOptional<z.ZodString>;
+    subdomain: z.ZodEffects<z.ZodString, string, string>;
 }, "strict", z.ZodTypeAny, {
-    botToken: string;
     specVersion: string;
     credentials: {
         email: string;
-        password: string;
+        displayName?: string | undefined;
     };
+    subdomain: string;
     answers: Record<string, unknown>;
     consent: {
         tosAccepted: true;
         privacyAccepted: true;
+        documents?: {
+            legalDocumentId: string;
+            versionNo: number;
+            accepted: true;
+            evidence: {
+                opened?: boolean | undefined;
+                scrolled_to_end?: boolean | undefined;
+            };
+        }[] | undefined;
     };
+    botToken?: string | undefined;
+    organisationName?: string | undefined;
     selectedServices?: string[] | undefined;
 }, {
-    botToken: string;
     specVersion: string;
     credentials: {
         email: string;
-        password: string;
+        displayName?: string | undefined;
     };
+    subdomain: string;
     answers: Record<string, unknown>;
     consent: {
         tosAccepted: true;
         privacyAccepted: true;
+        documents?: {
+            legalDocumentId: string;
+            versionNo: number;
+            accepted: true;
+            evidence: {
+                opened?: boolean | undefined;
+                scrolled_to_end?: boolean | undefined;
+            };
+        }[] | undefined;
     };
+    botToken?: string | undefined;
+    organisationName?: string | undefined;
     selectedServices?: string[] | undefined;
 }>;
 type SignupWirePayload = z.infer<typeof signupWireSchema>;
@@ -197,14 +314,22 @@ interface SignupSubmitBody {
     specVersion: string;
     answers: Record<string, unknown>;
     selectedServices?: string[];
+    /**
+     * D543 §4 consent. `documents` (the per-doc array) is authoritative when
+     * present; the booleans are the derived convenience. `documents` is omitted
+     * for a pre-ConsentPack onboarder (backward-compat).
+     */
     consent: {
         tosAccepted: true;
         privacyAccepted: true;
+        documents?: ConsentSubmitDocument[];
     };
     credentials: {
         email: string;
-        password: string;
+        displayName?: string;
     };
+    organisationName?: string;
+    subdomain: string;
 }
 interface SignupSubmitOptions {
     baseUrl: string;
@@ -214,7 +339,7 @@ interface SignupSubmitOptions {
      * string on a retried request risks 403 after the first attempt consumed
      * it — pass a provider for retry-safe recovery.
      */
-    botToken: BotTokenSource;
+    botToken?: BotTokenSource;
     /** Stable idempotency key — same discipline as submitLead. */
     idempotencyKey: string;
     fetch?: typeof globalThis.fetch;
@@ -247,13 +372,21 @@ declare function computeSignupFingerprint(body: SignupSubmitBody): string;
  *   throws (reCAPTCHA unreachable) on any attempt
  * @throws {OnboardingSpecStaleError} on 409 with code:"spec_stale" (caller
  *   refetches spec); carries the server's currentSpecVersion
- * @throws {OnboardingConflictError} on a 409 that is NOT spec_stale
+ * @throws {OnboardingConsentStaleError} on 409 with code:"consent_stale"
+ *   (D543 §4 — a required legal doc changed; caller refetches spec + requires
+ *   re-acceptance of the changed docs, NEVER auto-accepts); carries
+ *   staleDocuments
+ * @throws {OnboardingConsentIncompleteError} on 400 with
+ *   code:"consent_incomplete" (D543 §4 — server found a required doc missing/
+ *   unaccepted/evidence-insufficient)
+ * @throws {OnboardingConflictError} on a 409 that is NOT spec_stale/consent_stale
  * @throws {OnboardingRateLimitError} on 429
- * @throws {OnboardingValidationError} on 422 (server re-validation)
+ * @throws {OnboardingValidationError} on 422 (server re-validation) or a
+ *   generic 400 that is NOT consent_incomplete
  * @throws {OnboardingServerError} on 5xx after retries, or a 2xx without
  *   the required {accepted:true, terminalStage} body
  * @throws {OnboardingNetworkError} on network failure OR timeout after retries
  */
 declare function submitSignup(body: SignupSubmitBody, options: SignupSubmitOptions): Promise<SignupSubmitResult>;
 
-export { type BotTokenSource as B, type LeadsSubmitOptions as L, type SignupSubmitBody as S, type LeadsSubmitResult as a, type SignupSubmitOptions as b, type SignupSubmitResult as c, type SignupWirePayload as d, computePayloadFingerprint as e, computeSignupFingerprint as f, generateIdempotencyKey as g, submitLead as h, submitSignup as i, resolveBotToken as r, signupWireSchema as s };
+export { type BotTokenSource as B, type LeadsSubmitOptions as L, type SignupSubmitBody as S, type LeadsSubmitResult as a, type SignupSubmitOptions as b, type SignupSubmitResult as c, type SignupWirePayload as d, computePayloadFingerprint as e, computeSignupFingerprint as f, consentSubmitDocumentSchema as g, generateIdempotencyKey as h, submitLead as i, submitSignup as j, resolveBotToken as r, signupWireSchema as s };

package/dist/spec/index.d.ts

@@ -1,88 +1,17 @@
-import { a as OnboardingSpec } from '../model-IEyDI54w.js';
-export { F as FIELD_KEY_PATTERN, O as OnboarderTier, P as PiiClass, S as SpecField, b as SpecStage, c as SpecStep, T as TerminalStage, o as onboardingSpecSchema, s as specFieldSchema, d as specStepSchema, v as validateOnboardingSpec } from '../model-IEyDI54w.js';
+export { F as FIELD_KEY_PATTERN, O as OnboarderTier, a as OnboardingSpec, P as PiiClass, S as SpecField, b as SpecStage, c as SpecStep, T as TerminalStage, o as onboardingSpecSchema, s as specFieldSchema, d as specStepSchema, v as validateOnboardingSpec } from '../model-CEwvHlWA.js';
+export { A as ACCEPTANCE_LEVELS, a as AcceptanceLevel, C as ConsentDocType, b as ConsentDocument, c as ConsentPack, D as DOC_TYPES, d as acceptanceLevelSchema, e as consentDocKey, f as consentDocumentSchema, g as consentPackSchema } from '../model-BI_I-D_V.js';
+export { O as OnboardingSpecCache, S as SpecFetchOptions, a as SpecFieldDiff, d as defaultSpecCache, b as diffSpecFields, f as fetchOnboardingSpec } from '../client-NvqPpfQP.js';
 import 'zod/v3';
 
-/**
- * Config-fetch client for GET /api/v1/public/onboarding/spec (D540 §1/§3).
- *
- * - The onboarder is derived SERVER-side from the request Host (D536) —
- *   it is NOT sent by the client. The `onboarder` value here is purely the
- *   CLIENT-side cache key (D540 §3: "cache key (onboarder, specVersion)").
- * - The spec response is validated against the LOCKED D540 shape before
- *   it is returned; a malformed spec throws OnboardingSpecInvalidError.
- * - Cache semantics: every successful fetch is stored under
- *   (onboarder, specVersion) and as the onboarder's "latest". The versioned
- *   entries let the 409 spec_stale flow diff the previously-served version
- *   against the refetched one (see `diffSpecFields` + the signup widget's
- *   handleSpecStale, which reads the cached prior version before refetching).
- */
-
-/**
- * In-memory spec cache keyed by (onboarder, specVersion), with a "latest"
- * pointer per onboarder. Purely client-side; no TTL — the reject-stale
- * policy (409 spec_stale on submit) is the authoritative staleness signal,
- * and a refetch overwrites "latest".
- */
-declare class OnboardingSpecCache {
-    private readonly byVersion;
-    private readonly latest;
-    /**
-     * Collision-proof composite key. Uses JSON.stringify of the tuple so an
-     * onboarder or version containing the delimiter can never alias another
-     * entry — and, critically, contains NO control characters (an earlier
-     * NUL-separator made git treat this whole file as binary/undiffable).
-     */
-    private static versionKey;
-    get(onboarder: string, specVersion: string): OnboardingSpec | undefined;
-    getLatest(onboarder: string): OnboardingSpec | undefined;
-    set(onboarder: string, spec: OnboardingSpec): void;
-    clear(): void;
-}
-/** Module-level default cache (one per page). Injectable for tests/apps. */
-declare const defaultSpecCache: OnboardingSpecCache;
-/**
- * Diff two spec versions' signup field sets — used by the 409 spec_stale
- * flow to tell the user WHAT changed. Compares by field key across all
- * signup steps.
- */
-interface SpecFieldDiff {
-    added: string[];
-    removed: string[];
-    changed: string[];
+interface PinStateResult {
+    pin: string;
+    stateIso: string | null;
 }
-declare function diffSpecFields(prev: OnboardingSpec, next: OnboardingSpec): SpecFieldDiff;
-interface SpecFetchOptions {
+declare function fetchPinState(options: {
     baseUrl: string;
-    /**
-     * Client-side cache key ONLY (never transmitted; trust is host-derived
-     * per D536). Use the onboarder slug/id your embed is configured with.
-     */
-    onboarder: string;
-    /** Custom fetch implementation (defaults to globalThis.fetch). */
+    pin: string;
     fetch?: typeof globalThis.fetch;
-    /** Cache to read/write (defaults to the module-level cache). */
-    cache?: OnboardingSpecCache;
-    /**
-     * Request timeout in ms (default 15s). A stalled intake aborts with
-     * OnboardingNetworkError so the boot doesn't hang on "Loading signup form…".
-     */
     timeoutMs?: number;
-    /**
-     * When true, return the cached "latest" for this onboarder if present
-     * WITHOUT a network round-trip. Default false (spec fetches are cheap
-     * and the server bumps specVersion on any change). The signup widget's
-     * boot passes preferCached:true so a remount reuses the loaded spec.
-     */
-    preferCached?: boolean;
-}
-/**
- * Fetch (and validate, and cache) the onboarding spec.
- *
- * @throws {OnboardingSpecInvalidError} response does not match D540 §1
- * @throws {OnboardingRateLimitError} on 429
- * @throws {OnboardingServerError} on any other non-2xx status
- * @throws {OnboardingNetworkError} on network failure OR timeout
- */
-declare function fetchOnboardingSpec(options: SpecFetchOptions): Promise<OnboardingSpec>;
+}): Promise<PinStateResult>;
 
-export { OnboardingSpec, OnboardingSpecCache, type SpecFetchOptions, type SpecFieldDiff, defaultSpecCache, diffSpecFields, fetchOnboardingSpec };
+export { type PinStateResult, fetchPinState };

package/dist/spec/index.js

@@ -1,4 +1,5 @@
-export { FIELD_KEY_PATTERN, OnboardingSpecCache, defaultSpecCache, diffSpecFields, fetchOnboardingSpec, onboardingSpecSchema, specFieldSchema, specStepSchema, validateOnboardingSpec } from '../chunk-34BQX2KR.js';
-import '../chunk-AW7W3HAC.js';
+export { FIELD_KEY_PATTERN, OnboardingSpecCache, defaultSpecCache, diffSpecFields, fetchOnboardingSpec, fetchPinState, onboardingSpecSchema, specFieldSchema, specStepSchema, validateOnboardingSpec } from '../chunk-KFHVZGX6.js';
+export { ACCEPTANCE_LEVELS, DOC_TYPES, acceptanceLevelSchema, consentDocKey, consentDocumentSchema, consentPackSchema } from '../chunk-NDSBIB3N.js';
+import '../chunk-XJTJPBJB.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map