@nodii/onboarding 0.1.0-dev.0 → 0.2.0

package/dist/consent/index.d.ts

@@ -0,0 +1,59 @@
+import { b as ConsentDocument } from '../model-BI_I-D_V.js';
+export { A as ACCEPTANCE_LEVELS, a as AcceptanceLevel, C as ConsentDocType, c as ConsentPack, D as DOC_TYPES, d as acceptanceLevelSchema, e as consentDocKey, f as consentDocumentSchema, g as consentPackSchema } from '../model-BI_I-D_V.js';
+export { C as ConsentController, a as ConsentDocState, b as ConsentEvidence, c as ConsentState, d as ConsentStateListener, e as ConsentSubmitDocument, S as SCROLL_END_THRESHOLD, f as createConsentController, i as initialGateSatisfied } from '../controller-BLH3wnxl.js';
+import { d as OnboardingError } from '../errors-vJkye4a0.js';
+import 'zod/v3';
+
+/**
+ * Headless document-content fetch helper (D543 §5).
+ *
+ * The consent controller is DOM-free; document RENDERING is the consumer's
+ * responsibility (TanStack model — you render the row, we own the state). For
+ * `scroll_then_accept` gating to work the doc must be rendered SAME-ORIGIN and
+ * inline (a cross-origin iframe cannot report scroll position), so consumers
+ * fetch the presigned artifact and render its bytes/text themselves.
+ *
+ * This helper does the fetch + classification so a consumer doesn't wrestle
+ * CORS/content-type detection. It returns the artifact's content-type plus the
+ * body as text (for HTML/plain) or a Blob (for PDF/binary). It NEVER renders
+ * or sanitizes — the consumer (or the default component) decides how to display
+ * it (e.g. sanitize+inject HTML, or PDF.js a blob, or degrade to open-in-tab).
+ *
+ * A short-TTL presigned GET may fail (expired URL, CORS, offline); the caller
+ * gets a typed OnboardingDocumentFetchError so a failed preview degrades
+ * gracefully (e.g. fall back to an "open in a new tab" affordance) without
+ * breaking the consent gate.
+ */
+
+/** How the fetched artifact should be treated by a renderer. */
+type ConsentDocumentKind = "html" | "text" | "pdf" | "binary";
+interface FetchedConsentDocument {
+    /** The raw `Content-Type` header (lower-cased, params stripped). */
+    contentType: string;
+    /** Classification for the renderer. */
+    kind: ConsentDocumentKind;
+    /** Present for kind "html" | "text". */
+    text?: string;
+    /** Present for kind "pdf" | "binary". */
+    blob?: Blob;
+}
+interface FetchDocumentContentOptions {
+    fetch?: typeof globalThis.fetch;
+    /** Per-request timeout (default 15s) — a stalled CDN never hangs the UI. */
+    timeoutMs?: number;
+}
+/** A failed presigned artifact fetch (expired URL, CORS, offline, non-2xx). */
+declare class OnboardingDocumentFetchError extends OnboardingError {
+    readonly url: string;
+    constructor(url: string, detail: string);
+}
+/**
+ * Fetch a consent document's presigned artifact and return its content-type +
+ * body (text for HTML/plain, Blob for PDF/binary).
+ *
+ * @throws {OnboardingDocumentFetchError} on network failure, timeout, CORS,
+ *   or a non-2xx response — the caller degrades gracefully (open-in-tab).
+ */
+declare function fetchDocumentContent(doc: Pick<ConsentDocument, "downloadUrl">, options?: FetchDocumentContentOptions): Promise<FetchedConsentDocument>;
+
+export { ConsentDocument, type ConsentDocumentKind, type FetchDocumentContentOptions, type FetchedConsentDocument, OnboardingDocumentFetchError, fetchDocumentContent };

package/dist/consent/index.js

@@ -0,0 +1,7 @@
+import '../chunk-FIRSA7EH.js';
+export { SCROLL_END_THRESHOLD, createConsentController, initialGateSatisfied } from '../chunk-ZR6X3GSM.js';
+export { ACCEPTANCE_LEVELS, DOC_TYPES, acceptanceLevelSchema, consentDocKey, consentDocumentSchema, consentPackSchema } from '../chunk-NDSBIB3N.js';
+export { OnboardingDocumentFetchError, fetchDocumentContent } from '../chunk-SEKNVHD3.js';
+import '../chunk-XJTJPBJB.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/consent/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/controller-BLH3wnxl.d.ts

@@ -0,0 +1,177 @@
+import { b as ConsentDocument, a as AcceptanceLevel, c as ConsentPack } from './model-BI_I-D_V.js';
+
+/**
+ * Headless ConsentPack controller (D543 §2/§5).
+ *
+ * Framework-agnostic consent state for the signup flow's consent stage.
+ * Exposes, per document: { doc, accepted, gateSatisfied, evidence } and
+ * enforces the per-document ACCEPTANCE-LEVEL GATE (D543 §2):
+ *
+ *   - checkbox           — accept is enable-able immediately (basic clickwrap).
+ *   - scroll_then_accept — accept is DISABLED until the rendered doc is
+ *                          scrolled to the end (evidence.scrolled_to_end).
+ *   - open_then_accept   — accept is DISABLED until the doc is opened/viewed
+ *                          (evidence.opened).
+ *
+ * The gate is a UX guard (D543 §5: "Client evidence is UX-only; the server
+ * re-validates"). But the controller ENFORCES it locally so a UI cannot
+ * present an accept affordance the gate hasn't unlocked, and so a headless
+ * caller cannot assemble a payload that claims an unsatisfied gate.
+ *
+ * COMPLIANCE-CRITICAL (same discipline as the stepper's consent-fabrication
+ * fix): `accept(key)` is REFUSED when the gate is not yet satisfied, and
+ * `buildConsentPayload()` THROWS if ANY required doc is not accepted at its
+ * gate. The controller NEVER fabricates acceptance or evidence — it only
+ * records what the user genuinely did. `isComplete()` is true only when every
+ * REQUIRED doc is accepted with its gate satisfied.
+ *
+ * Same subscribe/mutate contract as the dynamic stepper so the default
+ * component layer renders it and tenants can build their own UI against the
+ * exported control surface (D543 §5 headless flexibility).
+ */
+
+/**
+ * Evidence for a document's gate. Only the field relevant to the doc's
+ * acceptanceLevel is ever set true — a checkbox doc carries no evidence.
+ * Mirrors the D543 §4 submit `evidence:{scrolled_to_end?, opened?}` — these
+ * two keys stay snake_case (the ONLY snake bits in the consent wire shape).
+ */
+interface ConsentEvidence {
+    scrolled_to_end?: boolean;
+    opened?: boolean;
+}
+/**
+ * Per-document view of the consent state — the framework-agnostic "row model"
+ * a consumer binds their own rendering to (TanStack-style). NO DOM here.
+ */
+interface ConsentDocState {
+    /** The document descriptor (from the spec's consentPack). */
+    doc: ConsentDocument;
+    /** Stable client-side key (docType | custom:<customKey>). */
+    key: string;
+    /** The document's acceptance level, surfaced for convenience. */
+    acceptanceLevel: AcceptanceLevel;
+    /** Whether the document is required, surfaced for convenience. */
+    required: boolean;
+    /**
+     * Whether the acceptance-level GATE is satisfied — i.e. accept is
+     * enable-able. checkbox ⇒ always true; scroll ⇒ scrolled-to-end;
+     * open ⇒ opened.
+     */
+    gateSatisfied: boolean;
+    /** Whether the user has genuinely accepted (only possible past the gate). */
+    accepted: boolean;
+    /** The evidence collected so far (drives gateSatisfied for gated levels). */
+    evidence: ConsentEvidence;
+    /**
+     * Scroll progress in [0,1] for a `scroll_then_accept` doc (0 for other
+     * levels). A consumer's scroll handler feeds this via reportScrollProgress;
+     * reaching ~1 flips gateSatisfied. Purely a UX-progress read (e.g. a
+     * progress bar); the gate itself keys on scrolledToEnd evidence.
+     */
+    scrollProgress: number;
+}
+interface ConsentState {
+    /** All documents in spec order. */
+    documents: ConsentDocState[];
+    /** True iff every REQUIRED doc is accepted with its gate satisfied. */
+    complete: boolean;
+}
+type ConsentStateListener = (state: ConsentState) => void;
+/**
+ * One element of the D543 §4 submit `consent.documents` array — CANONICAL
+ * camelCase (legalDocumentId, versionNo, accepted); `evidence` keys stay
+ * snake_case (scrolled_to_end / opened).
+ */
+interface ConsentSubmitDocument {
+    legalDocumentId: string;
+    versionNo: number;
+    accepted: true;
+    evidence: ConsentEvidence;
+}
+interface ConsentController {
+    getState(): ConsentState;
+    /** True iff there are no documents to consent to (stage is skippable). */
+    isEmpty(): boolean;
+    /** True iff every required doc is accepted with its gate satisfied. */
+    isComplete(): boolean;
+    /**
+     * Alias of isComplete() — TanStack-style ergonomic read: "can the consumer
+     * submit the consent step?" (all required docs accepted at their gate).
+     */
+    canSubmit(): boolean;
+    /**
+     * Whether the given document's gate is satisfied (accept is enable-able).
+     * Unknown key ⇒ false.
+     */
+    isGateSatisfied(key: string): boolean;
+    /**
+     * Report scroll progress in [0,1] for a `scroll_then_accept` doc — the
+     * consumer's OWN scroll handler feeds this (e.g. on its same-origin scroll
+     * container). Ratio ≥ SCROLL_END_THRESHOLD marks scrolled-to-end (opens the
+     * gate); otherwise it just updates scrollProgress for UX. Clamped to [0,1].
+     * No-op for other levels and unknown keys.
+     */
+    reportScrollProgress(key: string, ratio: number): void;
+    /**
+     * Mark a `scroll_then_accept` doc as scrolled to the end (evidence). No-op
+     * for other levels (their gate isn't scroll-driven) and unknown keys.
+     * Equivalent to reportScrollProgress(key, 1).
+     */
+    markScrolledToEnd(key: string): void;
+    /**
+     * Mark an `open_then_accept` doc as opened/viewed (evidence). No-op for
+     * other levels and unknown keys.
+     */
+    markOpened(key: string): void;
+    /**
+     * Set a document's accepted flag. Accepting is REFUSED (accepted stays
+     * false) when the gate is not satisfied — a UI cannot record acceptance a
+     * user could not legitimately give. Unaccepting is always allowed.
+     */
+    setAccepted(key: string, accepted: boolean): void;
+    /**
+     * Build the D543 §4 submit array from the ACTUAL consent state.
+     *
+     * @throws {Error} if any REQUIRED doc is not accepted with its gate
+     *   satisfied — never fabricates acceptance/evidence (compliance-critical).
+     *   Optional docs that were accepted ARE included; optional docs left
+     *   unaccepted are omitted.
+     */
+    buildConsentPayload(): ConsentSubmitDocument[];
+    /**
+     * Swap in a refetched consentPack after 409 consent_stale. For every doc
+     * whose (versionNo, contentHash) CHANGED, acceptance + evidence are
+     * RESET (re-acceptance required — NEVER auto-accept a changed doc, D543 §4
+     * / task §4). Unchanged docs keep their state. Returns the keys whose
+     * consent was reset so the UI can highlight what changed.
+     */
+    applyNewPack(pack: ConsentPack | undefined): string[];
+    subscribe(listener: ConsentStateListener): () => void;
+}
+/**
+ * Scroll ratio at/above which a `scroll_then_accept` doc counts as
+ * scrolled-to-end. Slightly below 1 so sub-pixel rounding on the consumer's
+ * scroll math (scrollTop+clientHeight vs scrollHeight) still opens the gate.
+ */
+declare const SCROLL_END_THRESHOLD = 0.99;
+/** checkbox docs have no gate; gated levels start unsatisfied. */
+declare function initialGateSatisfied(level: AcceptanceLevel): boolean;
+/**
+ * Create a headless consent controller for a spec's consentPack.
+ *
+ * @param pack the spec's `consentPack` (or undefined ⇒ an empty controller;
+ *   the stage is skipped and `isComplete()` / `isEmpty()` are true).
+ *
+ * @example
+ * ```ts
+ * const consent = createConsentController(spec.consentPack);
+ * consent.subscribe(render);
+ * consent.markScrolledToEnd("tos");   // scroll_then_accept gate
+ * consent.setAccepted("tos", true);   // now allowed
+ * const docs = consent.buildConsentPayload(); // throws if any required unmet
+ * ```
+ */
+declare function createConsentController(pack: ConsentPack | undefined): ConsentController;
+
+export { type ConsentController as C, SCROLL_END_THRESHOLD as S, type ConsentDocState as a, type ConsentEvidence as b, type ConsentState as c, type ConsentStateListener as d, type ConsentSubmitDocument as e, createConsentController as f, initialGateSatisfied as i };

package/dist/dynamic/index.d.ts

@@ -1,7 +1,10 @@
 import { z } from 'zod/v3';
-import { c as SpecStep, S as SpecField, T as TerminalStage, a as OnboardingSpec } from '../model-IEyDI54w.js';
+import { c as SpecStep, S as SpecField, T as TerminalStage, a as OnboardingSpec } from '../model-CEwvHlWA.js';
+import { c as ConsentState, C as ConsentController, e as ConsentSubmitDocument } from '../controller-BLH3wnxl.js';
+export { a as ConsentDocState, b as ConsentEvidence, d as ConsentStateListener, S as SCROLL_END_THRESHOLD, f as createConsentController, i as initialGateSatisfied } from '../controller-BLH3wnxl.js';
 import { FieldError } from '../form/index.js';
-import '../schema-TfyBU6JW.js';
+import '../model-BI_I-D_V.js';
+import '../schema-BrtjpXfL.js';
 
 /**
  * Spec → Zod validator derivation (D540 §3).
@@ -88,7 +91,9 @@ interface SignupConsent {
 }
 interface SignupCredentials {
     email: string;
-    password: string;
+    displayName: string;
+    organisationName: string;
+    subdomain: string;
 }
 interface SignupStepperState {
     /** Zero-based index of the current step. */
@@ -113,6 +118,22 @@ interface SignupStepperState {
     specVersion: string;
     /** Set on success from the submit response. */
     terminalStage: TerminalStage | null;
+    /**
+     * D543 ConsentPack state (per-document acceptance + gates). Empty
+     * (documents:[]) when the spec serves no consentPack — the consent stage is
+     * then skipped and does not gate the submit.
+     */
+    consentState: ConsentState;
+    /**
+     * True after a 409 consent_stale swap until the user re-accepts the changed
+     * docs. Distinct from specStale — a doc-version bump does not necessarily
+     * change the form fields, and the banner copy differs.
+     */
+    consentStale: boolean;
+    /** Keys of the consent docs whose acceptance was reset by the last swap. */
+    staleConsentKeys: string[];
+    /** Consent-stage errors (submit-time; e.g. a required doc not accepted). */
+    consentErrors: FieldError[];
 }
 type SignupStepperListener = (state: SignupStepperState) => void;
 interface SignupStepperControl {
@@ -120,6 +141,14 @@ interface SignupStepperControl {
     setAnswer(key: string, value: unknown): void;
     setConsent(consent: Partial<SignupConsent>): void;
     setCredentials(credentials: Partial<SignupCredentials>): void;
+    /**
+     * The headless ConsentPack controller (D543 §5). Exposed so the default
+     * component layer AND fully custom tenant UIs drive the SAME state: mark
+     * scroll/open evidence, set acceptance, read per-doc gate status. The
+     * stepper subscribes to it internally so consent mutations re-emit stepper
+     * state (consentState/consentStale) to the widget.
+     */
+    readonly consent: ConsentController;
     /** Validate ONLY the current step. Returns true when clean. */
     validateStep(): boolean;
     /** Validate current step; advance when clean. Returns true if advanced. */
@@ -135,6 +164,11 @@ interface SignupStepperControl {
     /**
      * The submit payload body (minus botToken, which the transport attaches).
      * Call ONLY after validateAll() returns true.
+     *
+     * D543 §4: `consent.documents` is the per-doc consent array built from the
+     * ACTUAL consent state (omitted when the spec serves no consentPack). The
+     * booleans stay as the derived convenience. THROWS if any required consent
+     * doc is not accepted at its gate (never fabricates acceptance).
      */
     buildSubmitPayload(): {
         specVersion: string;
@@ -143,20 +177,45 @@ interface SignupStepperControl {
         consent: {
             tosAccepted: true;
             privacyAccepted: true;
+            documents?: ConsentSubmitDocument[];
         };
-        credentials: SignupCredentials;
+        credentials: {
+            email: string;
+            displayName?: string;
+        };
+        organisationName?: string;
+        subdomain: string;
     };
     /**
      * Swap in a refetched spec after 409 spec_stale. Drops answers for
      * removed fields, re-validates the rest, marks specStale, repositions
-     * to the first step with errors. NEVER auto-resubmits.
+     * to the first step with errors. ALSO swaps the consentPack (a spec bump
+     * may carry new doc versions) — changed docs require re-acceptance. NEVER
+     * auto-resubmits.
      */
     applyNewSpec(spec: OnboardingSpec): void;
     /** Clear the specStale flag once the user has re-confirmed. */
     acknowledgeSpecStale(): void;
+    /**
+     * Swap in the refetched spec's consentPack after 409 consent_stale (D543
+     * §4). Resets acceptance for docs whose version/hash changed (re-acceptance
+     * required — NEVER auto-accept a changed doc), marks consentStale, records
+     * which keys were reset. NEVER auto-resubmits.
+     */
+    applyNewConsentPack(spec: OnboardingSpec): void;
+    /** Clear the consentStale flag once the user has re-accepted. */
+    acknowledgeConsentStale(): void;
     setSubmitting(): void;
     setSuccess(terminalStage: TerminalStage): void;
     setError(message: string): void;
+    /**
+     * Put a server's refusal on the one account field it is about (409
+     * subdomain_taken → `subdomain`), so the user is told which input to change.
+     * Returns the form to "editing" with no form-level error: the field carries
+     * the message. Replaces any error already on that field. Editing the field
+     * clears it; the next validateAll() recomputes account errors as usual.
+     */
+    setAccountError(path: keyof SignupCredentials, message: string): void;
     /**
      * Reset to the pristine initial state against the CURRENT spec: step 0,
      * status "editing", answers/credentials/consent/errors cleared. This is
@@ -181,4 +240,4 @@ interface SignupStepperControl {
  */
 declare function createSignupStepper(spec: OnboardingSpec): SignupStepperControl;
 
-export { type SignupConsent, type SignupCredentials, type SignupStepperControl, type SignupStepperListener, type SignupStepperState, type StepperStatus, createSignupStepper, deriveAnswersSchema, deriveFieldSchema, deriveStepSchema, optionValue };
+export { ConsentController, ConsentState, ConsentSubmitDocument, type SignupConsent, type SignupCredentials, type SignupStepperControl, type SignupStepperListener, type SignupStepperState, type StepperStatus, createSignupStepper, deriveAnswersSchema, deriveFieldSchema, deriveStepSchema, optionValue };

package/dist/dynamic/index.js

@@ -1,4 +1,7 @@
-import '../chunk-ZDY2I6KY.js';
-export { createSignupStepper, deriveAnswersSchema, deriveFieldSchema, deriveStepSchema, optionValue } from '../chunk-4SWOVHZ2.js';
+import '../chunk-JFDQZ3AC.js';
+export { createSignupStepper, deriveAnswersSchema, deriveFieldSchema, deriveStepSchema, optionValue } from '../chunk-A3DE2IAH.js';
+export { SCROLL_END_THRESHOLD, createConsentController, initialGateSatisfied } from '../chunk-ZR6X3GSM.js';
+import '../chunk-NDSBIB3N.js';
+import '../chunk-OLWR5COK.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/errors-vJkye4a0.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Error taxonomy for the onboarding submit client.
+ *
+ * Maps HTTP status codes and server error bodies to typed errors:
+ *   403 bot_challenge_failed  → OnboardingBotChallengeError
+ *   409 spec_stale (SUBMIT)   → OnboardingSpecStaleError  (submit endpoint only,
+ *                               body { error:true, code:"spec_stale",
+ *                               currentSpecVersion })
+ *   409 (other / LEADS)       → OnboardingConflictError    (generic conflict)
+ *   429                       → OnboardingRateLimitError
+ *   5xx                       → OnboardingServerError (retryable)
+ *   network / timeout         → OnboardingNetworkError
+ */
+type OnboardingErrorKind = "bot_challenge_failed" | "spec_stale" | "spec_invalid" | "consent_stale" | "consent_incomplete" | "subdomain_taken" | "conflict" | "rate_limited" | "server_error" | "network_error" | "validation_error";
+declare class OnboardingError extends Error {
+    readonly kind: OnboardingErrorKind;
+    readonly statusCode: number | null;
+    constructor(kind: OnboardingErrorKind, message: string, statusCode?: number | null);
+}
+declare class OnboardingBotChallengeError extends OnboardingError {
+    constructor(message?: string);
+}
+/**
+ * A 409 that is NOT spec_stale. On the /leads path there is no spec_stale
+ * concept (the payload carries no specVersion); on /submit, a 409 that
+ * lacks `code:"spec_stale"` also lands here. Distinct from
+ * OnboardingSpecStaleError so headless consumers switching on `kind` get the
+ * correct diagnosis (a generic conflict, e.g. a D538 same-key concurrent
+ * race) rather than a "form has been updated, refresh" recovery message.
+ */
+declare class OnboardingConflictError extends OnboardingError {
+    constructor(statusCode?: number, message?: string);
+}
+declare class OnboardingSubdomainTakenError extends OnboardingError {
+    constructor();
+}
+declare class OnboardingRateLimitError extends OnboardingError {
+    readonly retryAfterSeconds: number | null;
+    constructor(retryAfterSeconds?: number | null);
+}
+/**
+ * A /submit 409 whose body carries `code:"spec_stale"` (D540 reject-stale).
+ * The PINNED body shape (confirmed against the crm intake) is exactly:
+ *   { error: true, code: "spec_stale", currentSpecVersion: string }
+ * The version is read ONLY from `currentSpecVersion` — no field hedging.
+ * Submit-endpoint only; /leads 409s are OnboardingConflictError.
+ */
+declare class OnboardingSpecStaleError extends OnboardingError {
+    readonly currentSpecVersion: string;
+    constructor(currentSpecVersion: string);
+}
+/**
+ * A /submit 409 whose body carries `code:"consent_stale"` (D543 §4 —
+ * SIBLING to spec_stale). Raised when a required legal document's live
+ * version/content_hash changed between spec-fetch and submit, so the echoed
+ * consent no longer matches the live version.
+ *
+ * PINNED body shape (D543 §4, mirroring spec_stale):
+ *   { error: true, code: "consent_stale", staleDocuments?: [...] }
+ * where each staleDocuments entry identifies a changed doc so the caller can
+ * tell the user WHICH docs changed. The caller refetches the spec and
+ * REQUIRES re-acceptance of the changed docs — the SDK NEVER auto-accepts a
+ * changed doc (D543 §4). Submit-endpoint only.
+ */
+interface StaleConsentDocument {
+    /** The server registry id of the changed doc (D543 §3 legal_documents.id). */
+    legalDocumentId?: string;
+    /** doc_type of the changed doc, when the server includes it. */
+    docType?: string;
+    /** The new live version_no, when the server includes it. */
+    currentVersionNo?: number;
+}
+declare class OnboardingConsentStaleError extends OnboardingError {
+    /**
+     * The documents the server reports as changed (may be empty when the
+     * server does not enumerate them — the caller then refetches + diffs).
+     */
+    readonly staleDocuments: StaleConsentDocument[];
+    constructor(staleDocuments?: StaleConsentDocument[]);
+}
+/**
+ * A /submit 400 whose body carries `code:"consent_incomplete"` (D543 §4).
+ * The server's authoritative re-validation found a required live document
+ * that was missing, not accepted, or whose evidence did not satisfy its
+ * acceptance_level gate. Distinct from a generic 422 so headless consumers
+ * switching on `kind` route the user back to the consent step specifically.
+ */
+declare class OnboardingConsentIncompleteError extends OnboardingError {
+    constructor(message?: string);
+}
+declare class OnboardingServerError extends OnboardingError {
+    constructor(statusCode: number, message?: string);
+}
+declare class OnboardingNetworkError extends OnboardingError {
+    constructor(cause?: unknown);
+}
+declare class OnboardingValidationError extends OnboardingError {
+    constructor(message: string);
+}
+/**
+ * The spec endpoint returned a body that does not conform to the LOCKED
+ * D540 §1 response shape. This is a server-side contract violation — the
+ * SDK refuses to render a form from a malformed spec (a half-parsed spec
+ * could silently drop required fields).
+ */
+declare class OnboardingSpecInvalidError extends OnboardingError {
+    constructor(detail: string);
+}
+
+export { OnboardingBotChallengeError as O, type StaleConsentDocument as S, OnboardingConflictError as a, OnboardingConsentIncompleteError as b, OnboardingConsentStaleError as c, OnboardingError as d, type OnboardingErrorKind as e, OnboardingNetworkError as f, OnboardingRateLimitError as g, OnboardingServerError as h, OnboardingSpecInvalidError as i, OnboardingSpecStaleError as j, OnboardingSubdomainTakenError as k, OnboardingValidationError as l };

package/dist/form/index.d.ts

@@ -1,5 +1,5 @@
-import { C as ContactFormValues } from '../schema-TfyBU6JW.js';
-export { L as LeadsWirePayload, c as contactFormSchema, l as leadsWireSchema, v as validateContactForm, a as validateLeadsPayload } from '../schema-TfyBU6JW.js';
+import { C as ContactFormValues } from '../schema-BrtjpXfL.js';
+export { L as LeadsWirePayload, c as contactFormSchema, l as leadsWireSchema, v as validateContactForm, a as validateLeadsPayload } from '../schema-BrtjpXfL.js';
 import 'zod/v3';
 
 /**
@@ -26,6 +26,14 @@ interface ContactFormState {
     dirty: boolean;
 }
 type ContactFormStateListener = (state: ContactFormState) => void;
+interface ContactFormStateOptions {
+    /**
+     * The onboarder publishes the interest question as required (its spec's
+     * `forms.contact` field `interestModules`), so an empty choice is a field
+     * error rather than a lead that says nothing about what was asked.
+     */
+    requireInterest?: boolean;
+}
 interface ContactFormControl {
     /** Current snapshot of form state. */
     getState(): ContactFormState;
@@ -59,6 +67,6 @@ interface ContactFormControl {
  * if (valid) await submitContact(form.getState().values, botToken);
  * ```
  */
-declare function createContactFormState(): ContactFormControl;
+declare function createContactFormState(options?: ContactFormStateOptions): ContactFormControl;
 
-export { type ContactFormControl, type ContactFormState, type ContactFormStateListener, ContactFormValues, type FieldError, type FormStatus, createContactFormState };
+export { type ContactFormControl, type ContactFormState, type ContactFormStateListener, type ContactFormStateOptions, ContactFormValues, type FieldError, type FormStatus, createContactFormState };

package/dist/form/index.js

@@ -1,5 +1,5 @@
 import '../chunk-JFIONONR.js';
-export { createContactFormState } from '../chunk-AFCJLUPK.js';
-export { contactFormSchema, leadsWireSchema, validateContactForm, validateLeadsPayload } from '../chunk-BIFANV7M.js';
+export { createContactFormState } from '../chunk-DWFZA5T6.js';
+export { contactFormSchema, leadsWireSchema, validateContactForm, validateLeadsPayload } from '../chunk-WKN4U7QF.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index-BMSbQGWP.d.ts

@@ -0,0 +1,103 @@
+import { C as ConsentController } from './controller-BLH3wnxl.js';
+import { b as ConsentDocument } from './model-BI_I-D_V.js';
+
+/**
+ * Default ConsentPack document viewer (D543 §5) — @nodii/onboarding/viewer.
+ *
+ * A SEPARATE, opt-in module built on STANDARD libraries so the base SDK stays
+ * lean: consumers only pay for the viewer if they render our default consent
+ * components. The headless controller (@nodii/onboarding/consent) knows nothing
+ * about this — it just receives reportScrollProgress / markScrolledToEnd /
+ * markOpened from whatever renders the doc.
+ *
+ * Renderers (per fetched artifact — NO IFRAME anywhere; everything is inline,
+ * same-origin, so `scroll_then_accept` scroll tracking is REAL):
+ *   - text/html  → sanitize with DOMPurify, inject into a scroll <div>.
+ *   - markdown   → marked → DOMPurify → inject into a scroll <div>.
+ *   - text/plain → escaped text (textContent) in a scroll <div>.
+ *   - application/pdf → PDF.js (pdfjs-dist), rendered to <canvas> + a text
+ *     layer, page by page, in a scroll <div>. PDF.js is LAZY-loaded via a
+ *     dynamic import() ONLY when a PDF doc is actually present, so it never
+ *     bloats the base bundle.
+ *
+ * The scroll container's scroll-to-end (and the PDF/open fallbacks) drive the
+ * consent controller so the gate works for real. A failed fetch/render
+ * degrades to an "open in a new tab" affordance (marks the doc opened /
+ * scrolled) so every doc stays consentable.
+ *
+ * Bundle discipline: DOMPurify + marked are imported at module top (this is
+ * the VIEWER entry, not the base SDK — the base `@nodii/onboarding` never
+ * statically imports this file). pdfjs-dist is imported ONLY via dynamic
+ * import() inside renderPdf, so even the viewer entry doesn't eagerly load it.
+ */
+
+interface ConsentDocumentViewerOptions {
+    /** Injectable fetch for the presigned artifact GET (defaults to global). */
+    fetch?: typeof globalThis.fetch;
+    /** Per-request timeout in ms (default from fetchDocumentContent). */
+    timeoutMs?: number;
+    /**
+     * The `key` the controller identifies this document by (doc_type |
+     * custom:<key>). The viewer reports scroll/open evidence under this key.
+     */
+    consentKey: string;
+}
+/** Result of rendering — lets the caller know how the doc was displayed. */
+interface ConsentDocumentViewerResult {
+    /**
+     * How the artifact was rendered.
+     *
+     * - html | markdown | text | pdf → rendered inline (gate is driven by real
+     *   scroll/open).
+     * - open-affordance → an `open_then_accept` doc that opens in a new tab (the
+     *   real-open IS its gate; satisfies ONLY `opened`).
+     * - unrenderable → a GATED doc (scroll_then_accept) that could NOT be
+     *   rendered inline. The gate stays UNSATISFIABLE — accept is disabled and a
+     *   clear error is shown. NO evidence is ever fabricated (COMPLIANCE, D543).
+     */
+    renderedAs: "html" | "markdown" | "text" | "pdf" | "open-affordance" | "unrenderable";
+}
+/**
+ * The worker URL to use: the packaged candidate when it really serves a
+ * script, else the CDN build of the exact API version that is loaded (so the
+ * API and the worker can never disagree on version).
+ *
+ * An http(s) candidate is fetched and judged the way the browser will judge a
+ * module worker: a 2xx with a JavaScript MIME type. A host's HTML fallback page
+ * or a 404 fails, so a bundled page no longer ends up with a worker that cannot
+ * load and every scroll-to-accept PDF unrenderable. A file: or blob: candidate
+ * comes from the runtime's own module resolution and is used as is.
+ *
+ * The probe is bounded like every other request the SDK makes: its answer is
+ * kept for the session and awaited before every PDF, so a host that accepts
+ * the connection and then stalls must cost one timeout, not every PDF on the
+ * page. A probe that times out counts as "not a script".
+ *
+ * Exported for tests only.
+ */
+declare function _pickPdfWorkerSrc(packagedUrl: string | null, apiVersion: string, fetchImpl?: typeof globalThis.fetch, timeoutMs?: number): Promise<string>;
+/**
+ * Fetch + render a consent document INLINE into `container`, wiring its scroll
+ * container (or the legitimate open-affordance) to the consent controller so
+ * `scroll_then_accept` / `open_then_accept` gates work for real. NO iframe.
+ *
+ * On ANY inline-render failure for a `scroll_then_accept` doc the gate stays
+ * UNSATISFIABLE (never fabricates scrolled_to_end, D543 §5 COMPLIANCE) — the
+ * caller's Retry re-invokes this.
+ *
+ * @returns how the doc was rendered (for the caller's telemetry/UX).
+ */
+declare function renderConsentDocument(container: HTMLElement, doc: ConsentDocument, control: ConsentController, options: ConsentDocumentViewerOptions): Promise<ConsentDocumentViewerResult>;
+/** Reset the module-level pdf-worker latch (tests). */
+declare function _resetPdfWorkerState(): void;
+
+type ___viewer_render_js_ConsentDocumentViewerOptions = ConsentDocumentViewerOptions;
+type ___viewer_render_js_ConsentDocumentViewerResult = ConsentDocumentViewerResult;
+declare const ___viewer_render_js__pickPdfWorkerSrc: typeof _pickPdfWorkerSrc;
+declare const ___viewer_render_js__resetPdfWorkerState: typeof _resetPdfWorkerState;
+declare const ___viewer_render_js_renderConsentDocument: typeof renderConsentDocument;
+declare namespace ___viewer_render_js {
+  export { type ___viewer_render_js_ConsentDocumentViewerOptions as ConsentDocumentViewerOptions, type ___viewer_render_js_ConsentDocumentViewerResult as ConsentDocumentViewerResult, ___viewer_render_js__pickPdfWorkerSrc as _pickPdfWorkerSrc, ___viewer_render_js__resetPdfWorkerState as _resetPdfWorkerState, ___viewer_render_js_renderConsentDocument as renderConsentDocument };
+}
+
+export { type ConsentDocumentViewerOptions as C, ___viewer_render_js as _, type ConsentDocumentViewerResult as a, _resetPdfWorkerState as b, renderConsentDocument as r };