@nodii/onboarding 0.1.0-dev.0 → 0.2.0

package/dist/index.d.ts

@@ -1,10 +1,16 @@
-export { C as ContactFormValues, L as LeadsWirePayload, c as contactFormSchema, l as leadsWireSchema, v as validateContactForm, a as validateLeadsPayload } from './schema-TfyBU6JW.js';
-export { ContactFormControl, ContactFormState, ContactFormStateListener, FieldError, FormStatus, createContactFormState } from './form/index.js';
-export { F as FIELD_KEY_PATTERN, O as OnboarderTier, a as OnboardingSpec, P as PiiClass, S as SpecField, b as SpecStage, c as SpecStep, T as TerminalStage, o as onboardingSpecSchema, s as specFieldSchema, d as specStepSchema, v as validateOnboardingSpec } from './model-IEyDI54w.js';
-export { OnboardingSpecCache, SpecFetchOptions, SpecFieldDiff, defaultSpecCache, diffSpecFields, fetchOnboardingSpec } from './spec/index.js';
+export { C as ContactFormValues, L as LeadsWirePayload, c as contactFormSchema, l as leadsWireSchema, v as validateContactForm, a as validateLeadsPayload } from './schema-BrtjpXfL.js';
+export { ContactFormControl, ContactFormState, ContactFormStateListener, ContactFormStateOptions, FieldError, FormStatus, createContactFormState } from './form/index.js';
+export { F as FIELD_KEY_PATTERN, O as OnboarderTier, a as OnboardingSpec, P as PiiClass, S as SpecField, b as SpecStage, c as SpecStep, T as TerminalStage, o as onboardingSpecSchema, s as specFieldSchema, d as specStepSchema, v as validateOnboardingSpec } from './model-CEwvHlWA.js';
+export { A as ACCEPTANCE_LEVELS, a as AcceptanceLevel, C as ConsentDocType, b as ConsentDocument, c as ConsentPack, D as DOC_TYPES, d as acceptanceLevelSchema, e as consentDocKey, f as consentDocumentSchema, g as consentPackSchema } from './model-BI_I-D_V.js';
+export { O as OnboardingSpecCache, S as SpecFetchOptions, a as SpecFieldDiff, d as defaultSpecCache, b as diffSpecFields, f as fetchOnboardingSpec } from './client-NvqPpfQP.js';
+export { PinStateResult, fetchPinState } from './spec/index.js';
 export { SignupConsent, SignupCredentials, SignupStepperControl, SignupStepperListener, SignupStepperState, StepperStatus, createSignupStepper, deriveAnswersSchema, deriveFieldSchema, deriveStepSchema, optionValue } from './dynamic/index.js';
-export { B as BotTokenSource, L as LeadsSubmitOptions, a as LeadsSubmitResult, S as SignupSubmitBody, b as SignupSubmitOptions, c as SignupSubmitResult, d as SignupWirePayload, e as computePayloadFingerprint, f as computeSignupFingerprint, g as generateIdempotencyKey, r as resolveBotToken, s as signupWireSchema, h as submitLead, i as submitSignup } from './signup-client-Bl6eUrxR.js';
-export { DEFAULT_REQUEST_TIMEOUT_MS, OnboardingBotChallengeError, OnboardingConflictError, OnboardingError, OnboardingErrorKind, OnboardingNetworkError, OnboardingRateLimitError, OnboardingServerError, OnboardingSpecInvalidError, OnboardingSpecStaleError, OnboardingValidationError, fetchWithTimeout, withTimeout } from './submit/index.js';
+export { C as ConsentController, a as ConsentDocState, b as ConsentEvidence, c as ConsentState, d as ConsentStateListener, e as ConsentSubmitDocument, S as SCROLL_END_THRESHOLD, f as createConsentController, i as initialGateSatisfied } from './controller-BLH3wnxl.js';
+export { ConsentDocumentKind, FetchDocumentContentOptions, FetchedConsentDocument, OnboardingDocumentFetchError, fetchDocumentContent } from './consent/index.js';
+export { B as BotTokenSource, L as LeadsSubmitOptions, a as LeadsSubmitResult, S as SignupSubmitBody, b as SignupSubmitOptions, c as SignupSubmitResult, d as SignupWirePayload, e as computePayloadFingerprint, f as computeSignupFingerprint, g as consentSubmitDocumentSchema, h as generateIdempotencyKey, r as resolveBotToken, s as signupWireSchema, i as submitLead, j as submitSignup } from './signup-client-CS95nkVO.js';
+export { DEFAULT_REQUEST_TIMEOUT_MS, fetchWithTimeout, withTimeout } from './submit/index.js';
+export { O as OnboardingBotChallengeError, a as OnboardingConflictError, b as OnboardingConsentIncompleteError, c as OnboardingConsentStaleError, d as OnboardingError, e as OnboardingErrorKind, f as OnboardingNetworkError, g as OnboardingRateLimitError, h as OnboardingServerError, i as OnboardingSpecInvalidError, j as OnboardingSpecStaleError, k as OnboardingSubdomainTakenError, l as OnboardingValidationError, S as StaleConsentDocument } from './errors-vJkye4a0.js';
 export { RecaptchaError, RecaptchaErrorKind, RecaptchaLoadOptions, _resetRecaptchaState, executeRecaptcha, loadRecaptcha } from './recaptcha/index.js';
-export { ContactFormMountOptions, DEFAULT_WIDGET_CSS, MountedWidget, OnboardingWidget, SignupFormMountOptions, WidgetMountOptions, cssEscape, idSelector, injectWidgetStyles, mountContactForm, mountSignupForm } from './widget/index.js';
+export { ConsentStepRenderOptions, ContactFormMountOptions, DEFAULT_WIDGET_CSS, MountedWidget, OnboardingWidget, SignupFormMountOptions, WidgetMountOptions, consentDocElementId, cssEscape, idSelector, injectWidgetStyles, mountContactForm, mountSignupForm, renderConsentStep, updateConsentStep } from './widget/index.js';
 import 'zod/v3';
+import './index-BMSbQGWP.js';

package/dist/index.js

@@ -1,14 +1,19 @@
+export { DEFAULT_WIDGET_CSS, OnboardingWidget, consentDocElementId, cssEscape, idSelector, injectWidgetStyles, mountContactForm, mountSignupForm, renderConsentStep, updateConsentStep } from './chunk-OVULPWNZ.js';
 import './chunk-JFIONONR.js';
-import './chunk-ZDY2I6KY.js';
+export { createContactFormState } from './chunk-DWFZA5T6.js';
+export { FIELD_KEY_PATTERN, OnboardingSpecCache, defaultSpecCache, diffSpecFields, fetchOnboardingSpec, fetchPinState, onboardingSpecSchema, specFieldSchema, specStepSchema, validateOnboardingSpec } from './chunk-KFHVZGX6.js';
+import './chunk-JFDQZ3AC.js';
+export { createSignupStepper, deriveAnswersSchema, deriveFieldSchema, deriveStepSchema, optionValue } from './chunk-A3DE2IAH.js';
+import './chunk-FIRSA7EH.js';
+export { SCROLL_END_THRESHOLD, createConsentController, initialGateSatisfied } from './chunk-ZR6X3GSM.js';
+export { ACCEPTANCE_LEVELS, DOC_TYPES, acceptanceLevelSchema, consentDocKey, consentDocumentSchema, consentPackSchema } from './chunk-NDSBIB3N.js';
+export { OnboardingDocumentFetchError, fetchDocumentContent } from './chunk-SEKNVHD3.js';
 import './chunk-Z4PA6C2Z.js';
+export { computePayloadFingerprint, computeSignupFingerprint, consentSubmitDocumentSchema, generateIdempotencyKey, resolveBotToken, signupWireSchema, submitLead, submitSignup } from './chunk-UHOFGWI7.js';
+export { contactFormSchema, leadsWireSchema, validateContactForm, validateLeadsPayload } from './chunk-WKN4U7QF.js';
+import './chunk-OLWR5COK.js';
+export { DEFAULT_REQUEST_TIMEOUT_MS, OnboardingBotChallengeError, OnboardingConflictError, OnboardingConsentIncompleteError, OnboardingConsentStaleError, OnboardingError, OnboardingNetworkError, OnboardingRateLimitError, OnboardingServerError, OnboardingSpecInvalidError, OnboardingSpecStaleError, OnboardingSubdomainTakenError, OnboardingValidationError, fetchWithTimeout, withTimeout } from './chunk-XJTJPBJB.js';
 import './chunk-VH6FWDWI.js';
-export { DEFAULT_WIDGET_CSS, OnboardingWidget, cssEscape, idSelector, injectWidgetStyles, mountContactForm, mountSignupForm } from './chunk-SWMIIUXR.js';
-export { createContactFormState } from './chunk-AFCJLUPK.js';
-export { FIELD_KEY_PATTERN, OnboardingSpecCache, defaultSpecCache, diffSpecFields, fetchOnboardingSpec, onboardingSpecSchema, specFieldSchema, specStepSchema, validateOnboardingSpec } from './chunk-34BQX2KR.js';
-export { createSignupStepper, deriveAnswersSchema, deriveFieldSchema, deriveStepSchema, optionValue } from './chunk-4SWOVHZ2.js';
-export { computePayloadFingerprint, computeSignupFingerprint, generateIdempotencyKey, resolveBotToken, signupWireSchema, submitLead, submitSignup } from './chunk-BQCTDU5V.js';
-export { contactFormSchema, leadsWireSchema, validateContactForm, validateLeadsPayload } from './chunk-BIFANV7M.js';
-export { DEFAULT_REQUEST_TIMEOUT_MS, OnboardingBotChallengeError, OnboardingConflictError, OnboardingError, OnboardingNetworkError, OnboardingRateLimitError, OnboardingServerError, OnboardingSpecInvalidError, OnboardingSpecStaleError, OnboardingValidationError, fetchWithTimeout, withTimeout } from './chunk-AW7W3HAC.js';
 export { RecaptchaError, _resetRecaptchaState, executeRecaptcha, loadRecaptcha } from './chunk-7NS7ENJV.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/model-BI_I-D_V.d.ts

@@ -0,0 +1,267 @@
+import { z } from 'zod/v3';
+
+/**
+ * D543 §4 ConsentPack spec model — the `consentPack` block that GET
+ * /api/v1/public/onboarding/spec grows on top of the D540 shape:
+ *
+ *   consentPack: {
+ *     documents: [
+ *       { doc_type, custom_key?, title, version_no, content_hash,
+ *         download_url, acceptance_level, required }
+ *     ]
+ *   }
+ *
+ * The intake projects ONLY `live` versions into this block (D543 §4);
+ * `download_url` is a short-TTL presigned GET the SDK renders/opens.
+ *
+ * `acceptance_level` (D543 §2) is a per-document GATE:
+ *   - "checkbox"            — a single accept checkbox (basic clickwrap).
+ *   - "scroll_then_accept"  — accept disabled until the doc is scrolled to
+ *                             the end (client asserts evidence.scrolled_to_end).
+ *   - "open_then_accept"    — accept disabled until the doc is opened/viewed
+ *                             (client asserts evidence.opened).
+ * (E-signature is a deferred future level, D543 §2 — NOT modeled here.)
+ *
+ * FAIL-CLOSED (R1 + D543 §5 / D540 §1): a malformed consentPack throws
+ * OnboardingSpecInvalidError at parse time — never rendered half-parsed
+ * (a dropped `required` doc would let a user submit without consent, and a
+ * missing `content_hash`/`version_no` would break the server's re-validation
+ * match). The SDK refuses to render a consent step it cannot trust.
+ *
+ * DOM-ID HARDENING: a document's DOM-id token is derived from `doc_type`
+ * (a fixed enum — safe) or, for custom docs, from `custom_key` (free-form
+ * from the served spec). Custom keys are interpolated into element ids and
+ * (historically) selectors by the widget layer, so they are constrained to
+ * the SAME strict identifier alphabet as field keys (CUSTOM_KEY_PATTERN,
+ * identical to the spec model's FIELD_KEY_PATTERN) and REJECTED at parse time
+ * if they carry CSS/selector metacharacters. This is layer 1; the widget also
+ * CSS.escapes every id token as defense-in-depth.
+ *
+ * SUBMIT PIN (P4): the submit array carries {legalDocumentId, versionNo,
+ * accepted, evidence} — the server matches on legalDocumentId + versionNo
+ * (contentHash is spec-side integrity metadata, NOT echoed on submit; a
+ * content change publishes a new versionNo, so versionNo is a complete pin).
+ *
+ * DRIFT 5e3df7a3 (2026-07-14, consumer-visible) — RESOLVED by the canonical
+ * shape: D543 §4 as literally written omitted `legal_document_id` from the
+ * spec block, yet the submit array is KEYED on it (the server matches
+ * legalDocumentId + versionNo against the live version). The
+ * canonical alignment (both tiers, camelCase) INCLUDES `legalDocumentId` in
+ * the spec `consentPack.documents[]`, exactly as the drift proposed. This
+ * model REQUIRES it (fail-closed OnboardingSpecInvalidError if missing).
+ */
+
+/** D543 §2 acceptance-level enum. Extensible (adding a level is additive). */
+declare const ACCEPTANCE_LEVELS: readonly ["checkbox", "scroll_then_accept", "open_then_accept"];
+type AcceptanceLevel = (typeof ACCEPTANCE_LEVELS)[number];
+declare const acceptanceLevelSchema: z.ZodEnum<["checkbox", "scroll_then_accept", "open_then_accept"]>;
+/** D543 §3 docType enum. */
+declare const DOC_TYPES: readonly ["tos", "privacy", "dpa", "custom"];
+type ConsentDocType = (typeof DOC_TYPES)[number];
+/**
+ * One live legal document projected into the consent step. Mirrors the D543
+ * §4 `consentPack.documents[]` element — CANONICAL camelCase wire shape (both
+ * tenant + platform tiers aligned to this): { legalDocumentId, docType,
+ * customKey (nullable), title, versionNo, contentHash, downloadUrl,
+ * acceptanceLevel, required }. The `acceptanceLevel` enum VALUES stay snake
+ * (checkbox | scroll_then_accept | open_then_accept).
+ *
+ * Cross-field invariant (D543 §3): `customKey` is a non-null identifier when
+ * `docType === "custom"` and MUST be null otherwise (a canonical tos/privacy/
+ * dpa doc is keyed by docType; only custom docs carry a key). The custom-key
+ * alphabet is DOM-id safe.
+ */
+declare const consentDocumentSchema: z.ZodEffects<z.ZodObject<{
+    legalDocumentId: z.ZodString;
+    docType: z.ZodEnum<["tos", "privacy", "dpa", "custom"]>;
+    customKey: z.ZodNullable<z.ZodString>;
+    title: z.ZodString;
+    versionNo: z.ZodNumber;
+    contentHash: z.ZodString;
+    downloadUrl: z.ZodEffects<z.ZodString, string, string>;
+    contentType: z.ZodOptional<z.ZodString>;
+    acceptanceLevel: z.ZodEnum<["checkbox", "scroll_then_accept", "open_then_accept"]>;
+    required: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    legalDocumentId: string;
+    docType: "custom" | "tos" | "privacy" | "dpa";
+    customKey: string | null;
+    title: string;
+    versionNo: number;
+    contentHash: string;
+    downloadUrl: string;
+    acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+    required: boolean;
+    contentType?: string | undefined;
+}, {
+    legalDocumentId: string;
+    docType: "custom" | "tos" | "privacy" | "dpa";
+    customKey: string | null;
+    title: string;
+    versionNo: number;
+    contentHash: string;
+    downloadUrl: string;
+    acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+    required: boolean;
+    contentType?: string | undefined;
+}>, {
+    legalDocumentId: string;
+    docType: "custom" | "tos" | "privacy" | "dpa";
+    customKey: string | null;
+    title: string;
+    versionNo: number;
+    contentHash: string;
+    downloadUrl: string;
+    acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+    required: boolean;
+    contentType?: string | undefined;
+}, {
+    legalDocumentId: string;
+    docType: "custom" | "tos" | "privacy" | "dpa";
+    customKey: string | null;
+    title: string;
+    versionNo: number;
+    contentHash: string;
+    downloadUrl: string;
+    acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+    required: boolean;
+    contentType?: string | undefined;
+}>;
+type ConsentDocument = z.infer<typeof consentDocumentSchema>;
+/**
+ * The `consentPack` block. `documents` may be empty (an onboarder with no
+ * required legal docs) — the consent stage is then omitted from the flow.
+ *
+ * Uniqueness: no two documents may share the same STABLE key (docType, or
+ * custom:<customKey> for custom docs). A duplicate would collide their DOM
+ * ids AND their consent records — fail-closed at parse (the server keys the
+ * registry on (scope, docType) / (scope, customKey) per D543 §3, so a
+ * duplicate here is a projection bug, not a renderable spec).
+ */
+declare const consentPackSchema: z.ZodEffects<z.ZodObject<{
+    documents: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        legalDocumentId: z.ZodString;
+        docType: z.ZodEnum<["tos", "privacy", "dpa", "custom"]>;
+        customKey: z.ZodNullable<z.ZodString>;
+        title: z.ZodString;
+        versionNo: z.ZodNumber;
+        contentHash: z.ZodString;
+        downloadUrl: z.ZodEffects<z.ZodString, string, string>;
+        contentType: z.ZodOptional<z.ZodString>;
+        acceptanceLevel: z.ZodEnum<["checkbox", "scroll_then_accept", "open_then_accept"]>;
+        required: z.ZodBoolean;
+    }, "strict", z.ZodTypeAny, {
+        legalDocumentId: string;
+        docType: "custom" | "tos" | "privacy" | "dpa";
+        customKey: string | null;
+        title: string;
+        versionNo: number;
+        contentHash: string;
+        downloadUrl: string;
+        acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+        required: boolean;
+        contentType?: string | undefined;
+    }, {
+        legalDocumentId: string;
+        docType: "custom" | "tos" | "privacy" | "dpa";
+        customKey: string | null;
+        title: string;
+        versionNo: number;
+        contentHash: string;
+        downloadUrl: string;
+        acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+        required: boolean;
+        contentType?: string | undefined;
+    }>, {
+        legalDocumentId: string;
+        docType: "custom" | "tos" | "privacy" | "dpa";
+        customKey: string | null;
+        title: string;
+        versionNo: number;
+        contentHash: string;
+        downloadUrl: string;
+        acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+        required: boolean;
+        contentType?: string | undefined;
+    }, {
+        legalDocumentId: string;
+        docType: "custom" | "tos" | "privacy" | "dpa";
+        customKey: string | null;
+        title: string;
+        versionNo: number;
+        contentHash: string;
+        downloadUrl: string;
+        acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+        required: boolean;
+        contentType?: string | undefined;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    documents: {
+        legalDocumentId: string;
+        docType: "custom" | "tos" | "privacy" | "dpa";
+        customKey: string | null;
+        title: string;
+        versionNo: number;
+        contentHash: string;
+        downloadUrl: string;
+        acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+        required: boolean;
+        contentType?: string | undefined;
+    }[];
+}, {
+    documents: {
+        legalDocumentId: string;
+        docType: "custom" | "tos" | "privacy" | "dpa";
+        customKey: string | null;
+        title: string;
+        versionNo: number;
+        contentHash: string;
+        downloadUrl: string;
+        acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+        required: boolean;
+        contentType?: string | undefined;
+    }[];
+}>, {
+    documents: {
+        legalDocumentId: string;
+        docType: "custom" | "tos" | "privacy" | "dpa";
+        customKey: string | null;
+        title: string;
+        versionNo: number;
+        contentHash: string;
+        downloadUrl: string;
+        acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+        required: boolean;
+        contentType?: string | undefined;
+    }[];
+}, {
+    documents: {
+        legalDocumentId: string;
+        docType: "custom" | "tos" | "privacy" | "dpa";
+        customKey: string | null;
+        title: string;
+        versionNo: number;
+        contentHash: string;
+        downloadUrl: string;
+        acceptanceLevel: "checkbox" | "scroll_then_accept" | "open_then_accept";
+        required: boolean;
+        contentType?: string | undefined;
+    }[];
+}>;
+type ConsentPack = z.infer<typeof consentPackSchema>;
+/**
+ * Stable, collision-proof identity for a consent document, used as the map
+ * key in the controller and the DOM-id token in the widget. `docType` is a
+ * fixed enum; `custom:` is prefixed for custom docs so a customKey of
+ * "tos" can never alias the canonical tos doc.
+ *
+ * Note: this is NOT the submit key — the submit array keys on the server's
+ * opaque `legalDocumentId` (D543 §4), which the SDK does not synthesize.
+ * This is a purely CLIENT-side identity for state + DOM.
+ */
+declare function consentDocKey(doc: {
+    docType: ConsentDocType;
+    customKey?: string | null | undefined;
+}): string;
+
+export { ACCEPTANCE_LEVELS as A, type ConsentDocType as C, DOC_TYPES as D, type AcceptanceLevel as a, type ConsentDocument as b, type ConsentPack as c, acceptanceLevelSchema as d, consentDocKey as e, consentDocumentSchema as f, consentPackSchema as g };