@wildo-ai/saas-website 1.1.3 → 1.1.5

package/dist/esm/config/load-website-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-website-config.js","sourceRoot":"","sources":["../../../../src/config/load-website-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAI5E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,yBAAyB,CAAC;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,kBAA0B,EAC1B,MAAmC;IAEnC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEtC,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,KAAK,eAAe,CAAC,cAAc,CACzE,CAAC;IACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,gGAAgG;cAC5F,wFAAwF;cACxF,0EAA0E;cAC1E,+EAA+E;cAC/E,gFAAgF;cAChF,uBAAuB,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,GAAG,mBAAmB,CAAC;IAChE,MAAM,iBAAiB,GAAG,WAAW,CACnC,QAAQ,EACR,cAAc,CAAC,IAAI,EACnB,oCAAoC,CACrC,CAAC;IAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kDAAkD,iBAAiB,mBAAmB;cAClF,gEAAgE;cAChE,IAAI,oCAAoC,qBAAqB;cAC7D,IAAI,cAAc,CAAC,IAAI,yCAAyC;cAChE,uEAAuE;cACvE,2EAA2E;cAC3E,8BAA8B;cAC9B,IAAI,iBAAiB,SAAS;cAC9B,8EAA8E,CACnF,CAAC;IACJ,CAAC;IAED,IAAI,MAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAA8B,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,gFAAgF;cAC5E,GAAG,iBAAiB,qBAAqB;cACzC,uDAAuD;cACvD,6EAA6E;cAC7E,6CAA6C;cAC7C,UAAU,KAAK,EAAE,CACtB,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * @fileoverview Per-service `wildo.website.config.ts` loader.\n *\n * Mirrors the `loadTechnicalDocConfig()` shape used by\n * `platform/factory/wildo-dev-companion/src/technical-doc/services/technical-doc.companion.service.ts`\n * (see `saas-technical-doc.md` Step 7.5). Discovers the unique\n * `frontendType: STATIC_WEBSITE` service in the SaaS config, joins\n * `<saasRoot>/<service.path>/wildo.website.config.ts`, and loads it\n * via the jiti-backed `loadConfig` from `@wildo-ai/platform-config-lib`.\n *\n * The actual Zod validation runs INSIDE `defineWebsiteConfig` (which\n * the per-service config file invokes via\n * `export default defineWebsiteConfig({...})`), so by the time\n * `loadConfig` returns we already hold a parsed\n * `WildoMarketingWebsiteConfig`.\n *\n * @wildo-boundary\n *   This module is **Node-only**. It imports `loadConfig` and\n *   `AppFrontendType` from `@wildo-ai/platform-config-lib`, which\n *   transitively pulls `jiti`, `node:fs`, `node:path`, `node:crypto`,\n *   and other Node-only API surface. It MUST NOT be imported from\n *   any browser-bundled entry of this engine package — specifically\n *   NOT from `index.ts`, `companion-exports.ts`, or `astro-island.ts`.\n *   The dedicated `./config-loader` package subpath exists precisely\n *   to keep this surface OUT of the React-island bundle (enforced by\n *   `__tests__/bundle-isolation.test.ts`).\n *\n *   The Astro build's `astro.config.ts` (a Node-side file by\n *   construction) is the canonical caller. A future companion\n *   subprocess that audits the marketing surface would also call\n *   from here. Browser bundles MUST NOT.\n */\n\nimport { existsSync } from 'node:fs';\nimport { resolve as resolvePath } from 'node:path';\nimport { AppFrontendType, loadConfig } from '@wildo-ai/platform-config-lib';\nimport type { WildoSaasConfig } from '@wildo-ai/platform-config-lib';\nimport type { WildoMarketingWebsiteConfig } from './wildo-website-config.schemas';\n\n/**\n * Conventional file name for the per-service marketing-website\n * configuration (Step 7.5 refactor — `saas-website-slice.md` /\n * `saas-technical-doc.md` Step 7.5 mirror). Authored at the website\n * service root next to `package.json` / `astro.config.ts`.\n *\n * Discovery is \"by convention, not by configuration\":\n *\n *   - The loader locates this file by walking the `services` entry\n *     whose `frontendType === STATIC_WEBSITE` and joining\n *     `<saasRoot>/<service.path>/`. The saas-config schema's\n *     `superRefine` already enforces \"at most one STATIC_WEBSITE\n *     service per app\", so the lookup is deterministic — apps can\n *     name the website service anything (`'website'`, `'marketing'`,\n *     `'site'`).\n *\n *   - File presence is the enable signal — there is NO `enabled`\n *     field on `WildoMarketingWebsiteConfigSchema`. A STATIC_WEBSITE\n *     service without this file is treated as a misconfiguration\n *     and the loader throws (rather than silently shipping an Astro\n *     build with no `i18n` routing / no canonical origin).\n */\nexport const PER_SERVICE_WEBSITE_CONFIG_FILE_NAME = 'wildo.website.config.ts';\n\n/**\n * Memoization slot scoped to the loader module. Keyed by absolute\n * config file path so multiple SaaS configs evaluated in the same\n * process (rare in production — possible in tests) do not collide.\n *\n * Lifetime: the loader is invoked from the Astro build / dev-server\n * pipeline, both of which restart the Node process on every dev-stack\n * reload (the watcher that picks up changes to `wildo.website.config.ts`\n * is the same watcher that reboots the build). A stale entry here\n * therefore cannot outlive a config edit.\n *\n * Tests can pre-populate a known path via {@link primeWebsiteConfigCache}\n * to skip the jiti round-trip when exercising downstream consumers.\n */\nconst WEBSITE_CONFIG_CACHE = new Map<string, WildoMarketingWebsiteConfig>();\n\n/**\n * Test helper — pre-populate the loader's memoization slot for a\n * given absolute config path. Mirrors the\n * `cachedTechnicalDocConfig` pre-population trick used by\n * `technical-doc.publish-openapi.service.test.ts` so the loader's\n * downstream consumers can be exercised in tests without writing a\n * `.ts` file to disk + invoking jiti.\n *\n * Production callers MUST NOT use this helper.\n */\nexport function primeWebsiteConfigCache(\n  absoluteConfigPath: string,\n  config: WildoMarketingWebsiteConfig,\n): void {\n  WEBSITE_CONFIG_CACHE.set(resolvePath(absoluteConfigPath), config);\n}\n\n/**\n * Test helper — clear every cached entry. Use in `beforeEach`/`afterEach`\n * to prevent test cross-contamination.\n */\nexport function clearWebsiteConfigCache(): void {\n  WEBSITE_CONFIG_CACHE.clear();\n}\n\n/**\n * Arguments for {@link loadWebsiteConfig}. Kept as a structured shape\n * (rather than positional `loadWebsiteConfig(saasRoot, saasConfig)`)\n * so that future per-call options (e.g. an explicit `serviceKey`\n * override for multi-website apps the day the singleton invariant\n * relaxes) slot in without breaking callers.\n */\nexport interface LoadWebsiteConfigArgs {\n  /**\n   * Absolute path to the SaaS app root — the directory holding\n   * `wildo.saas.config.ts`. Used to resolve `<saasRoot>/<service.path>/`\n   * for the website service folder.\n   */\n  saasRoot: string;\n  /**\n   * The already-parsed SaaS config (load once via\n   * `loadConfig<WildoSaasConfig>(...)` upstream and pass it down here\n   * — re-parsing per call would invoke jiti twice for one logical\n   * load).\n   */\n  saasConfig: WildoSaasConfig;\n}\n\n/**\n * Discover and load the per-service marketing-website config.\n *\n * Resolution algorithm (mirrors\n * `TechnicalDocCompanionService.loadTechnicalDocConfig`):\n *\n *   1. Find the unique service in `saasConfig.services` whose\n *      `frontendType === STATIC_WEBSITE`. The saas-config\n *      `superRefine` guarantees there is at most one — if there is\n *      none, throw with the misconfiguration message.\n *   2. Resolve `<saasRoot>/<service.path>/wildo.website.config.ts`.\n *   3. If the file does not exist, throw (file presence IS the\n *      enable signal — a STATIC_WEBSITE service without this file\n *      is broken).\n *   4. Check the memoization slot keyed on the absolute path; return\n *      the cached value if present.\n *   5. Call `loadConfig<WildoMarketingWebsiteConfig>(absolutePath)`.\n *      jiti evaluates the file, which invokes `defineWebsiteConfig`,\n *      which invokes `WildoMarketingWebsiteConfigSchema.parse` and\n *      emits any `@unimplemented` warnings. The returned object is\n *      already-validated — we trust the in-file `defineWebsiteConfig`\n *      contract here (mirrors the technical-doc loader pattern in\n *      `TechnicalDocCompanionService.loadTechnicalDocConfig`, which\n *      also does NOT re-parse). A file that hand-rolls the default\n *      export without going through `defineWebsiteConfig` would\n *      surface as a downstream type mismatch — acceptable given the\n *      authoring contract is explicit and grep-discoverable.\n *   6. Memoize and return.\n *\n * @throws Error with a `[wildo-website-config]` prefix if no\n *         STATIC_WEBSITE service is declared, the per-service config\n *         file is missing, or the file's default export does not\n *         pass `WildoMarketingWebsiteConfigSchema`. The loader\n *         intentionally throws plain `Error`s rather than building a\n *         `WildoBackendError` so it stays usable from the Astro\n *         build pipeline (which has no DI container) — the companion\n *         can wrap with `errorBuilder` at the call site if needed\n *         (mirrors how `loadConfig` itself throws plain `Error`).\n */\nexport async function loadWebsiteConfig(\n  args: LoadWebsiteConfigArgs,\n): Promise<WildoMarketingWebsiteConfig> {\n  const { saasRoot, saasConfig } = args;\n\n  const websiteServiceEntry = Object.entries(saasConfig.services).find(\n    ([, service]) => service.frontendType === AppFrontendType.STATIC_WEBSITE,\n  );\n  if (!websiteServiceEntry) {\n    throw new Error(\n      '[wildo-website-config] No frontend service with `frontendType: STATIC_WEBSITE` is declared in '\n        + 'wildo.saas.config.ts. The marketing-website Astro build / loader requires an authored '\n        + 'STATIC_WEBSITE service because that service folder owns the per-service '\n        + '`wildo.website.config.ts` (publicOrigin, appOrigin, defaultLocale, locales). '\n        + 'Add a STATIC_WEBSITE service in wildo.saas.config.ts and ship the per-service '\n        + 'config file under it.',\n    );\n  }\n\n  const [websiteServiceKey, websiteService] = websiteServiceEntry;\n  const websiteConfigPath = resolvePath(\n    saasRoot,\n    websiteService.path,\n    PER_SERVICE_WEBSITE_CONFIG_FILE_NAME,\n  );\n\n  const cached = WEBSITE_CONFIG_CACHE.get(websiteConfigPath);\n  if (cached !== undefined) {\n    return cached;\n  }\n\n  if (!existsSync(websiteConfigPath)) {\n    throw new Error(\n      `[wildo-website-config] STATIC_WEBSITE service '${websiteServiceKey}' is declared in `\n        + `wildo.saas.config.ts but the required per-service config file `\n        + `'${PER_SERVICE_WEBSITE_CONFIG_FILE_NAME}' is missing under `\n        + `'${websiteService.path}/'. File presence IS the enable signal `\n        + '(saas-website-slice.md / saas-technical-doc.md Step 7.5 — the legacy '\n        + '`marketingWebsite` block on wildo.saas.config.ts was dropped in favor of '\n        + 'a per-service file). Create '\n        + `'${websiteConfigPath}' with `\n        + '`export default defineWebsiteConfig({ ... })` from `@wildo-ai/saas-website`.',\n    );\n  }\n\n  let loaded: WildoMarketingWebsiteConfig;\n  try {\n    loaded = await loadConfig<WildoMarketingWebsiteConfig>(websiteConfigPath);\n  } catch (e) {\n    const cause = e instanceof Error ? e.message : String(e);\n    throw new Error(\n      `[wildo-website-config] Failed to load per-service marketing-website config at `\n        + `${websiteConfigPath}. The file MUST do `\n        + '`export default defineWebsiteConfig({...})` and pass '\n        + 'WildoMarketingWebsiteConfigSchema (`z.strictObject` — unknown keys reject; '\n        + '`defaultLocale` must appear in `locales`). '\n        + `Cause: ${cause}`,\n    );\n  }\n\n  WEBSITE_CONFIG_CACHE.set(websiteConfigPath, loaded);\n  return loaded;\n}\n"]}
+{"version":3,"file":"load-website-config.js","sourceRoot":"","sources":["../../../../src/config/load-website-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAI5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,yBAAyB,CAAC;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,kBAA0B,EAC1B,MAAmC;IAEnC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEtC,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClE,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,KAAK,eAAe,CAAC,cAAc,CACzE,CAAC;IACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,gGAAgG;cAC5F,wFAAwF;cACxF,0EAA0E;cAC1E,+EAA+E;cAC/E,gFAAgF;cAChF,uBAAuB,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,GAAG,mBAAmB,CAAC;IAChE,MAAM,iBAAiB,GAAG,WAAW,CACnC,QAAQ,EACR,cAAc,CAAC,IAAI,EACnB,oCAAoC,CACrC,CAAC;IAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kDAAkD,iBAAiB,mBAAmB;cAClF,gEAAgE;cAChE,IAAI,oCAAoC,qBAAqB;cAC7D,IAAI,cAAc,CAAC,IAAI,yCAAyC;cAChE,uEAAuE;cACvE,2EAA2E;cAC3E,8BAA8B;cAC9B,IAAI,iBAAiB,SAAS;cAC9B,8EAA8E,CACnF,CAAC;IACJ,CAAC;IAED,IAAI,MAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAA8B,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,gFAAgF;cAC5E,GAAG,iBAAiB,qBAAqB;cACzC,uDAAuD;cACvD,6EAA6E;cAC7E,6CAA6C;cAC7C,UAAU,KAAK,EAAE,CACtB,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * @fileoverview Per-service `wildo.website.config.ts` loader.\n *\n * Mirrors the `loadTechnicalDocConfig()` shape used by\n * `platform/factory/wildo-dev-companion/src/technical-doc/services/technical-doc.companion.service.ts`\n * (see `saas-technical-doc.md` Step 7.5). Discovers the unique\n * `frontendType: STATIC_WEBSITE` service in the SaaS config, joins\n * `<saasRoot>/<service.path>/wildo.website.config.ts`, and loads it\n * via the jiti-backed `loadConfig` from `@wildo-ai/platform-config-lib`.\n *\n * The actual Zod validation runs INSIDE `defineWebsiteConfig` (which\n * the per-service config file invokes via\n * `export default defineWebsiteConfig({...})`), so by the time\n * `loadConfig` returns we already hold a parsed\n * `WildoMarketingWebsiteConfig`.\n *\n * @wildo-boundary\n *   This module is **Node-only**. It imports `loadConfig` and\n *   `AppFrontendType` from `@wildo-ai/platform-config-lib`, which\n *   transitively pulls `jiti`, `node:fs`, `node:path`, `node:crypto`,\n *   and other Node-only API surface. It MUST NOT be imported from\n *   any browser-bundled entry of this engine package — specifically\n *   NOT from `index.ts`, `companion-exports.ts`, or `astro-island.ts`.\n *   The dedicated `./config-loader` package subpath exists precisely\n *   to keep this surface OUT of the React-island bundle (enforced by\n *   `__tests__/bundle-isolation.test.ts`).\n *\n *   The Astro build's `astro.config.ts` (a Node-side file by\n *   construction) is the canonical caller. A future companion\n *   subprocess that audits the marketing surface would also call\n *   from here. Browser bundles MUST NOT.\n */\n\nimport { existsSync } from 'node:fs';\nimport { resolve as resolvePath } from 'node:path';\nimport { AppFrontendType, loadConfig } from '@wildo-ai/platform-config-lib';\nimport type { WildoSaasConfig } from '@wildo-ai/platform-config-lib';\nimport type { WildoMarketingWebsiteConfig } from './wildo-website-config.schemas';\n\nimport { describeThrownValue } from '@wildo-ai/saas-models/public-runtime';\n/**\n * Conventional file name for the per-service marketing-website\n * configuration (Step 7.5 refactor — `saas-website-slice.md` /\n * `saas-technical-doc.md` Step 7.5 mirror). Authored at the website\n * service root next to `package.json` / `astro.config.ts`.\n *\n * Discovery is \"by convention, not by configuration\":\n *\n *   - The loader locates this file by walking the `services` entry\n *     whose `frontendType === STATIC_WEBSITE` and joining\n *     `<saasRoot>/<service.path>/`. The saas-config schema's\n *     `superRefine` already enforces \"at most one STATIC_WEBSITE\n *     service per app\", so the lookup is deterministic — apps can\n *     name the website service anything (`'website'`, `'marketing'`,\n *     `'site'`).\n *\n *   - File presence is the enable signal — there is NO `enabled`\n *     field on `WildoMarketingWebsiteConfigSchema`. A STATIC_WEBSITE\n *     service without this file is treated as a misconfiguration\n *     and the loader throws (rather than silently shipping an Astro\n *     build with no `i18n` routing / no canonical origin).\n */\nexport const PER_SERVICE_WEBSITE_CONFIG_FILE_NAME = 'wildo.website.config.ts';\n\n/**\n * Memoization slot scoped to the loader module. Keyed by absolute\n * config file path so multiple SaaS configs evaluated in the same\n * process (rare in production — possible in tests) do not collide.\n *\n * Lifetime: the loader is invoked from the Astro build / dev-server\n * pipeline, both of which restart the Node process on every dev-stack\n * reload (the watcher that picks up changes to `wildo.website.config.ts`\n * is the same watcher that reboots the build). A stale entry here\n * therefore cannot outlive a config edit.\n *\n * Tests can pre-populate a known path via {@link primeWebsiteConfigCache}\n * to skip the jiti round-trip when exercising downstream consumers.\n */\nconst WEBSITE_CONFIG_CACHE = new Map<string, WildoMarketingWebsiteConfig>();\n\n/**\n * Test helper — pre-populate the loader's memoization slot for a\n * given absolute config path. Mirrors the\n * `cachedTechnicalDocConfig` pre-population trick used by\n * `technical-doc.publish-openapi.service.test.ts` so the loader's\n * downstream consumers can be exercised in tests without writing a\n * `.ts` file to disk + invoking jiti.\n *\n * Production callers MUST NOT use this helper.\n */\nexport function primeWebsiteConfigCache(\n  absoluteConfigPath: string,\n  config: WildoMarketingWebsiteConfig,\n): void {\n  WEBSITE_CONFIG_CACHE.set(resolvePath(absoluteConfigPath), config);\n}\n\n/**\n * Test helper — clear every cached entry. Use in `beforeEach`/`afterEach`\n * to prevent test cross-contamination.\n */\nexport function clearWebsiteConfigCache(): void {\n  WEBSITE_CONFIG_CACHE.clear();\n}\n\n/**\n * Arguments for {@link loadWebsiteConfig}. Kept as a structured shape\n * (rather than positional `loadWebsiteConfig(saasRoot, saasConfig)`)\n * so that future per-call options (e.g. an explicit `serviceKey`\n * override for multi-website apps the day the singleton invariant\n * relaxes) slot in without breaking callers.\n */\nexport interface LoadWebsiteConfigArgs {\n  /**\n   * Absolute path to the SaaS app root — the directory holding\n   * `wildo.saas.config.ts`. Used to resolve `<saasRoot>/<service.path>/`\n   * for the website service folder.\n   */\n  saasRoot: string;\n  /**\n   * The already-parsed SaaS config (load once via\n   * `loadConfig<WildoSaasConfig>(...)` upstream and pass it down here\n   * — re-parsing per call would invoke jiti twice for one logical\n   * load).\n   */\n  saasConfig: WildoSaasConfig;\n}\n\n/**\n * Discover and load the per-service marketing-website config.\n *\n * Resolution algorithm (mirrors\n * `TechnicalDocCompanionService.loadTechnicalDocConfig`):\n *\n *   1. Find the unique service in `saasConfig.services` whose\n *      `frontendType === STATIC_WEBSITE`. The saas-config\n *      `superRefine` guarantees there is at most one — if there is\n *      none, throw with the misconfiguration message.\n *   2. Resolve `<saasRoot>/<service.path>/wildo.website.config.ts`.\n *   3. If the file does not exist, throw (file presence IS the\n *      enable signal — a STATIC_WEBSITE service without this file\n *      is broken).\n *   4. Check the memoization slot keyed on the absolute path; return\n *      the cached value if present.\n *   5. Call `loadConfig<WildoMarketingWebsiteConfig>(absolutePath)`.\n *      jiti evaluates the file, which invokes `defineWebsiteConfig`,\n *      which invokes `WildoMarketingWebsiteConfigSchema.parse` and\n *      emits any `@unimplemented` warnings. The returned object is\n *      already-validated — we trust the in-file `defineWebsiteConfig`\n *      contract here (mirrors the technical-doc loader pattern in\n *      `TechnicalDocCompanionService.loadTechnicalDocConfig`, which\n *      also does NOT re-parse). A file that hand-rolls the default\n *      export without going through `defineWebsiteConfig` would\n *      surface as a downstream type mismatch — acceptable given the\n *      authoring contract is explicit and grep-discoverable.\n *   6. Memoize and return.\n *\n * @throws Error with a `[wildo-website-config]` prefix if no\n *         STATIC_WEBSITE service is declared, the per-service config\n *         file is missing, or the file's default export does not\n *         pass `WildoMarketingWebsiteConfigSchema`. The loader\n *         intentionally throws plain `Error`s rather than building a\n *         `WildoBackendError` so it stays usable from the Astro\n *         build pipeline (which has no DI container) — the companion\n *         can wrap with `errorBuilder` at the call site if needed\n *         (mirrors how `loadConfig` itself throws plain `Error`).\n */\nexport async function loadWebsiteConfig(\n  args: LoadWebsiteConfigArgs,\n): Promise<WildoMarketingWebsiteConfig> {\n  const { saasRoot, saasConfig } = args;\n\n  const websiteServiceEntry = Object.entries(saasConfig.services).find(\n    ([, service]) => service.frontendType === AppFrontendType.STATIC_WEBSITE,\n  );\n  if (!websiteServiceEntry) {\n    throw new Error(\n      '[wildo-website-config] No frontend service with `frontendType: STATIC_WEBSITE` is declared in '\n        + 'wildo.saas.config.ts. The marketing-website Astro build / loader requires an authored '\n        + 'STATIC_WEBSITE service because that service folder owns the per-service '\n        + '`wildo.website.config.ts` (publicOrigin, appOrigin, defaultLocale, locales). '\n        + 'Add a STATIC_WEBSITE service in wildo.saas.config.ts and ship the per-service '\n        + 'config file under it.',\n    );\n  }\n\n  const [websiteServiceKey, websiteService] = websiteServiceEntry;\n  const websiteConfigPath = resolvePath(\n    saasRoot,\n    websiteService.path,\n    PER_SERVICE_WEBSITE_CONFIG_FILE_NAME,\n  );\n\n  const cached = WEBSITE_CONFIG_CACHE.get(websiteConfigPath);\n  if (cached !== undefined) {\n    return cached;\n  }\n\n  if (!existsSync(websiteConfigPath)) {\n    throw new Error(\n      `[wildo-website-config] STATIC_WEBSITE service '${websiteServiceKey}' is declared in `\n        + `wildo.saas.config.ts but the required per-service config file `\n        + `'${PER_SERVICE_WEBSITE_CONFIG_FILE_NAME}' is missing under `\n        + `'${websiteService.path}/'. File presence IS the enable signal `\n        + '(saas-website-slice.md / saas-technical-doc.md Step 7.5 — the legacy '\n        + '`marketingWebsite` block on wildo.saas.config.ts was dropped in favor of '\n        + 'a per-service file). Create '\n        + `'${websiteConfigPath}' with `\n        + '`export default defineWebsiteConfig({ ... })` from `@wildo-ai/saas-website`.',\n    );\n  }\n\n  let loaded: WildoMarketingWebsiteConfig;\n  try {\n    loaded = await loadConfig<WildoMarketingWebsiteConfig>(websiteConfigPath);\n  } catch (e) {\n    const cause = describeThrownValue(e);\n    throw new Error(\n      `[wildo-website-config] Failed to load per-service marketing-website config at `\n        + `${websiteConfigPath}. The file MUST do `\n        + '`export default defineWebsiteConfig({...})` and pass '\n        + 'WildoMarketingWebsiteConfigSchema (`z.strictObject` — unknown keys reject; '\n        + '`defaultLocale` must appear in `locales`). '\n        + `Cause: ${cause}`,\n    );\n  }\n\n  WEBSITE_CONFIG_CACHE.set(websiteConfigPath, loaded);\n  return loaded;\n}\n"]}

package/dist/esm/config/wildo-website-config.schemas.d.ts

@@ -177,11 +177,16 @@ export declare const WildoMarketingWebsiteConfigSchema: z.ZodObject<{
      * Origin of the SaaS application the marketing site links into
      * (signup / login / pricing → checkout).
      *
-     * **Today**: NO runtime consumer. The cross-origin handoff
-     * surface that will read it does not exist yet. Authored
-     * eagerly so the link-surface PR is a single framework-owned move
-     * — until then the field is exercised only by the schema
-     * parser.
+     * Read at runtime since #493: each `.astro` page forwards it to its
+     * bridge island, and the CTA reads it off `WebsiteRuntimeContext`.
+     *
+     * Per environment: a deployment's app lives at a different host in each
+     * environment, and a static site bakes the value in at build time, so the
+     * generated deploy workflow passes the environment's app origin as
+     * `PUBLIC_APP_ORIGIN` — derived from the infra config's `serviceHosts` and
+     * `publicDomain`, not authored a second time. An application's
+     * `wildo.website.config.ts` reads that first and keeps its authored value
+     * as the default for a build that passes none.
      *
      * Distinct from the general `WildoSaasConfig.services.<name>`
      * URL surface because the marketing site is a separate Astro

package/dist/esm/config/wildo-website-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wildo-website-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/wildo-website-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oDAAoD,CAAC;AAEvF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB;;;kBASpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,iCAAiC;IAE1C;;;;;;;;;;OAUG;;IASH;;;;;;;;;;;;;;OAcG;;IAGH;;;;;;;;;;;;;;;;;;;;;;OAsBG;;IAWH;;;;;OAKG;;;;;;;;IAGH;;;;;;;;;OASG;;IAGH;;;;;;;;;OASG;;;;;kBAqDH,CAAC;AACL,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AACjG,wDAAwD"}
+{"version":3,"file":"wildo-website-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/wildo-website-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oDAAoD,CAAC;AAEvF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB;;;kBASpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,iCAAiC;IAE1C;;;;;;;;;;OAUG;;IASH;;;;;;;;;;;;;;;;;;;OAmBG;;IAGH;;;;;;;;;;;;;;;;;;;;;;OAsBG;;IAWH;;;;;OAKG;;;;;;;;IAGH;;;;;;;;;OASG;;IAGH;;;;;;;;;OASG;;;;;kBAqDH,CAAC;AACL,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AACjG,wDAAwD"}

package/dist/esm/config/wildo-website-config.schemas.js

@@ -186,11 +186,16 @@ export const WildoMarketingWebsiteConfigSchema = z
      * Origin of the SaaS application the marketing site links into
      * (signup / login / pricing → checkout).
      *
-     * **Today**: NO runtime consumer. The cross-origin handoff
-     * surface that will read it does not exist yet. Authored
-     * eagerly so the link-surface PR is a single framework-owned move
-     * — until then the field is exercised only by the schema
-     * parser.
+     * Read at runtime since #493: each `.astro` page forwards it to its
+     * bridge island, and the CTA reads it off `WebsiteRuntimeContext`.
+     *
+     * Per environment: a deployment's app lives at a different host in each
+     * environment, and a static site bakes the value in at build time, so the
+     * generated deploy workflow passes the environment's app origin as
+     * `PUBLIC_APP_ORIGIN` — derived from the infra config's `serviceHosts` and
+     * `publicDomain`, not authored a second time. An application's
+     * `wildo.website.config.ts` reads that first and keeps its authored value
+     * as the default for a build that passes none.
      *
      * Distinct from the general `WildoSaasConfig.services.<name>`
      * URL surface because the marketing site is a separate Astro

package/dist/esm/config/wildo-website-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"wildo-website-config.schemas.js","sourceRoot":"","sources":["../../../../src/config/wildo-website-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oDAAoD,CAAC;AAEvF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CACJ,cAAc,EACd,iFAAiF,CAClF;CACJ,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,YAAY,CAAC;IACZ;;;;;;;;;;OAUG;IACH,YAAY,EAAE,CAAC;SACZ,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACvC,KAAK,EACH,2EAA2E;YAC3E,iFAAiF;KACpF,CAAC;IAEJ;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;IAElB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,SAAS,EAAE,CAAC;SACT,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACvC,KAAK,EACH,6EAA6E;YAC7E,8EAA8E;YAC9E,kBAAkB;KACrB,CAAC;SACD,QAAQ,EAAE;IAEb;;;;;OAKG;IACH,GAAG,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAEpC;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAExC;;;;;;;;;OASG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,kBAAkB,MAAM,CAAC,aAAa,iCAAiC;gBACvE,eAAe,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;gBACvE,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EACL,gBAAgB,KAAK,CAAC,IAAI,0BAA0B,QAAQ,QAAQ;oBACpE,IAAI,KAAK,CAAC,MAAM,qDAAqD;aACxE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,6DAA6D;IAC7D,kEAAkE;IAClE,cAAc;IACd,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EACL,WAAW,KAAK,CAAC,MAAM,+BAA+B,YAAY,IAAI;oBACtE,QAAQ,KAAK,CAAC,IAAI,2CAA2C;aAChE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,wDAAwD","sourcesContent":["/**\n * @wildo_source:part:start engine.saas-website.config facet:layer:engine facet:family:marketing-website\n *\n * Per-service marketing-website configuration block, authored in\n * the website service folder as `wildo.website.config.ts`.\n *\n * # What this file's loaded value is used for TODAY\n *\n * This schema is the single source of truth for the marketing-site routing\n * and origin surface. Every consumer reads here:\n *\n *   - `defaultLocale` + `locales` — read by `buildAstroI18nConfig(...)`,\n *     `assertLabelPacksValid(...)`, `loadWebsitePageRuntime(...)` and\n *     `renderWebsitePageHeadHtml(...)` via the shared `WebsiteSiteContext`.\n *   - `publicOrigin` — read by the head renderer to compose absolute\n *     `<link rel=\"canonical\">`, `og:url`, hreflang `href` URLs and\n *     the structured-data `mainEntityOfPage`. The previous\n *     `WebsiteRootConfig.seo.siteOrigin` was deleted.\n *   - `appOrigin` — the marketing → app handoff target, read at runtime\n *     since #493. A `wildo.website.config.ts` is Node-loaded and so\n *     invisible to a client island, which is why this value reaches the\n *     browser the way `apiOrigin` does: the `.astro` page forwards it to\n *     its bridge island, which puts it on `WebsiteRuntimeContext.appOrigin`\n *     for the CTA to read.\n *\n *     It previously had NO runtime consumer, and a site resolved the app\n *     origin a SECOND time from a public build-time environment variable —\n *     one host authored twice with no mechanical link, and a silent\n *     fallback to localhost when the variable was unset. That is how a\n *     marketing site comes to point at the wrong environment.\n *   - `csp?` — read by the website-local `sync-nginx-csp` build step,\n *     which merges the app-static posture with `infra.csp?.<serviceKey>`,\n *     emits the generated artifact consumed by Astro pages, and rewrites\n *     the checked-in nginx marker file used by the website Docker image.\n *\n * Future companion subprocesses that introspect the marketing\n * surface (locale-coverage audits, label-pack validation against\n * authored locales, SEO-link sanity checks) will also read here —\n * none exist today.\n *\n * # Why this is per-service website configuration\n *\n * Co-locating the schema with the engine package that owns its semantics\n * keeps three concerns separate from application-root service declarations:\n *\n *   1. **Right reuse axis.** Marketing-site content (locales, SEO origins,\n *      future label-pack overrides, marketing-only CTAs) is conceptually\n *      different from saas-app-level service declarations (`path`,\n *      `serviceName`, `frontendType`, `sessionStorage`). The marketing\n *      config travels with the website service folder, NOT with the\n *      SaaS app root. Two unrelated lifecycles, two different review\n *      audiences.\n *   2. **Engine boundary.** `platform-config-lib` no longer needs to\n *      depend on `@wildo-ai/presets-components-models` (the home of\n *      `AvailableLanguage`) just to type the marketing-site locale\n *      enum. Adding a new website primitive (a new SEO field, a new\n *      locale-pack id) belongs with the website package and its public\n *      configuration contract.\n *   3. **Disambiguator hazard.** The previous root-level\n *      `marketingWebsite?` block silently assumed \"one STATIC_WEBSITE\n *      service per SaaS app\" — but nothing in the schema enforced it.\n *      Two STATIC_WEBSITE services would have silently shared one\n *      config block with no obvious \"which one wins?\" answer. The\n *      application configuration rejects more than one STATIC_WEBSITE (and\n *      TECH_DOC) service, so the per-service config-file lookup is\n *      deterministic by construction.\n *\n * # Schema decisions encoded here\n *\n * - `z.strictObject` so authoring an unknown key surfaces as a parse\n *   error at `defineWebsiteConfig` time instead of being silently\n *   dropped (same posture as `WildoSaasConfigSchema` and\n *   `WildoTechnicalDocConfigSchema`).\n *\n * - **No `enabled` field.** The gate is \"is there a `wildo.website.config.ts`\n *   in a `frontendType: STATIC_WEBSITE` service folder?\" — file\n *   presence under a STATIC_WEBSITE service IS the enable signal.\n *   The Astro build / dev companion / future audit CLI requires the\n *   file when it walks a STATIC_WEBSITE service folder, so a\n *   half-authored config simply cannot exist (the loader fails\n *   closed). Removing the boolean closes a foot-gun: an authored\n *   `enabled: false` block was previously a silent way to keep the\n *   config \"warm\" without shipping anything, and consumers had to\n *   remember to read the flag in addition to the file presence — a\n *   future read-the-config / forget-the-flag bug waiting to happen.\n *   A separate `services.<key>.enabled` pattern (orthogonal to\n *   marketing-website) is the right place for any \"temporarily\n *   disable this service\" story (deferred — see DASHBOARD).\n *\n * - URL fields are `z.url()` (Zod 4 native validator) so we get\n *   protocol + host parsing for free, matching the rest of the\n *   codebase.\n *\n * - `csp?` is typed against `WildoCspConfigSchema` from\n *   `@wildo-ai/platform-config-lib`, mirroring the docs service's\n *   `wildo.tech-doc.config.ts` contract. The parsed value is consumed by\n *   the shared `resolveCspPolicy()` / `emitCspArtifacts()` generator flow.\n *\n * - `defaultLocale ∈ locales` cross-check via `.superRefine` —\n *   keeping `defaultLocale` as a top-level field is product-explicit\n *   (\"which locale URL is the canonical one\") and decouples it from\n *   list ordering. Locale-path uniqueness AND locale-value\n *   uniqueness are also enforced — duplicate paths would silently\n *   overwrite each other in the Astro build and corrupt the sitemap;\n *   duplicate locales would produce duplicate hreflang entries.\n *\n * - Locale primitive is `AvailableLanguage`. The schema imports it\n *   from `@wildo-ai/presets-components-models/public-runtime` (the\n *   side-effect-free public-runtime seam), but **consumers authoring\n *   `wildo.website.config.ts` must import it from\n *   `@wildo-ai/saas-models/public-runtime`**. Both paths produce identical\n *   values; saas-models simply re-exports the presets atom. Picking\n *   one path consistently across consumer files prevents drift in\n *   docs / examples / search results. Values authored in\n *   `wildo.website.config.ts` are the lowercase BCP-47 strings\n *   (`'en'`, `'fr'`), NOT the UPPERCASE TS enum member names\n *   (`EN`, `FR`). `z.enum(AvailableLanguage)` parses against the\n *   enum VALUES, which is what we want.\n */\n\nimport { WildoCspConfigSchema } from '@wildo-ai/platform-config-lib';\nimport { z } from 'zod';\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models/public-runtime';\n\n/**\n * Per-locale configuration. Each authored locale gets one entry.\n *\n * `path` is the locale URL prefix segment (e.g. `'en'`, `'fr'`) — the\n * Astro builder maps `/en/...` and `/fr/...` paths via this value. We\n * do NOT auto-derive `path` from the locale string because some\n * deployments may want a flat root for the default locale (`/...`\n * instead of `/en/...`); keeping it explicit per locale leaves that\n * door open without a config-shape change.\n */\nexport const WebsiteLocaleConfigSchema = z.strictObject({\n  locale: z.enum(AvailableLanguage),\n  path: z\n    .string()\n    .min(1)\n    .regex(\n      /^[a-z0-9-]+$/,\n      'locale path must be lowercase alphanumeric with hyphens (becomes a URL segment)',\n    ),\n});\nexport type WebsiteLocaleConfig = z.infer<typeof WebsiteLocaleConfigSchema>;\n\n/**\n * Per-service marketing-website configuration block.\n *\n * Authored as `export default defineWebsiteConfig({...})` in\n * `<website-service-root>/wildo.website.config.ts`. The Astro\n * build loads this file once at bootstrap via jiti and composes\n * a `WebsiteSiteContext`; helpers consume that composed context rather than\n * this raw value.\n *\n * @example\n * ```ts\n * import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';\n * import { defineWebsiteConfig } from '@wildo-ai/saas-website';\n *\n * export default defineWebsiteConfig({\n *   publicOrigin: 'https://example.com',\n *   appOrigin: 'https://app.example.com',\n *   defaultLocale: AvailableLanguage.EN,\n *   locales: [\n *     { locale: AvailableLanguage.EN, path: 'en' },\n *     { locale: AvailableLanguage.FR, path: 'fr' },\n *   ],\n *   csp: { enabled: true, reportOnly: true },\n * });\n * ```\n */\nexport const WildoMarketingWebsiteConfigSchema = z\n  .strictObject({\n    /**\n     * Public origin of the marketing site (apex / www) — canonical\n     * input the Astro head renderer emits as absolute URLs\n     * (`<link rel=\"canonical\">`, `og:url`, hreflang `href`,\n     * sitemap base, structured-data `mainEntityOfPage`).\n     *\n     * MUST NOT end with `/` — the head renderer composes\n     * `${publicOrigin}${routePath}` and a trailing slash would emit\n     * `https://example.com//`. Surface the constraint loudly here\n     * rather than silently corrupting URLs at build time.\n     */\n    publicOrigin: z\n      .url()\n      .refine((value) => !value.endsWith('/'), {\n        error:\n          'WildoMarketingWebsiteConfig.publicOrigin must NOT end with \"/\" (the head ' +\n          'renderer concatenates publicOrigin + routePath; trailing slash would emit \"//\")',\n      }),\n\n    /**\n     * Origin of the SaaS application the marketing site links into\n     * (signup / login / pricing → checkout).\n     *\n     * **Today**: NO runtime consumer. The cross-origin handoff\n     * surface that will read it does not exist yet. Authored\n     * eagerly so the link-surface PR is a single framework-owned move\n     * — until then the field is exercised only by the schema\n     * parser.\n     *\n     * Distinct from the general `WildoSaasConfig.services.<name>`\n     * URL surface because the marketing site is a separate Astro\n     * project that does not load the full SaaS app graph at build\n     * time.\n     */\n    appOrigin: z.url(),\n\n    /**\n     * Backend API origin the marketing site POSTs to for anonymous\n     * captures (lead / draft-note forms) — e.g.\n     * `https://api.example.com`. Threaded through\n     * `WebsiteRuntimeContext.apiOrigin` into the React island that\n     * constructs the `WebsiteAnonymousSessionClient`.\n     *\n     * OPTIONAL because a pure brochure site with no capture forms never\n     * talks to an API — only sites that host an anonymous-capture\n     * section need it. When such a section renders without a resolved\n     * `apiOrigin`, the section surfaces a loud misconfiguration rather\n     * than silently POSTing nowhere.\n     *\n     * MUST NOT end with `/` — the anon client composes\n     * `${apiOrigin}${MAIN_API_BASE_PATH}${path}` and a trailing slash\n     * would emit a doubled `//` in the request URL. (The client also\n     * defensively strips trailing slashes, but the refine surfaces the\n     * mistake at authoring time.)\n     *\n     * Distinct from `appOrigin` (the human-facing app the marketing CTAs\n     * link into) and `publicOrigin` (the marketing site's own canonical\n     * origin): this is the machine-to-machine API host.\n     */\n    apiOrigin: z\n      .url()\n      .refine((value) => !value.endsWith('/'), {\n        error:\n          'WildoMarketingWebsiteConfig.apiOrigin must NOT end with \"/\" (the anonymous ' +\n          'client concatenates apiOrigin + MAIN_API_BASE_PATH + path; a trailing slash ' +\n          'would emit \"//\")',\n      })\n      .optional(),\n\n    /**\n     * Optional Content-Security-Policy override for the marketing site.\n     * Consumed by the website-local `sync-nginx-csp` step, which emits\n     * the generated artifact for Astro page injection and rewrites the\n     * website nginx marker file from the same resolved output.\n     */\n    csp: WildoCspConfigSchema.optional(),\n\n    /**\n     * Default locale the marketing site serves for unmatched URLs\n     * and as the canonical hreflang signal. Must appear in\n     * `locales` below (cross-check enforced by the schema-level\n     * `.superRefine`).\n     *\n     * Read by `buildAstroI18nConfig(...)` (drives Astro's own\n     * `i18n.defaultLocale`) and by the head renderer (drives\n     * `<html lang=\"...\">`, `og:locale`, hreflang `x-default`).\n     */\n    defaultLocale: z.enum(AvailableLanguage),\n\n    /**\n     * Ordered list of locales the marketing site builds. Order is\n     * preserved (used by the language switcher rendering and by\n     * the sitemap emitter — when the sitemap surface lands).\n     *\n     * Read by `buildAstroI18nConfig(...)` (Astro `i18n.locales`),\n     * by `assertLabelPacksValid(...)` (one label pack per locale),\n     * by `loadWebsitePageRuntime(...)` (per-page locale resolution),\n     * and by the head renderer (hreflang alternates).\n     */\n    locales: z.array(WebsiteLocaleConfigSchema).min(1),\n  })\n  .superRefine((config, ctx) => {\n    const declaredLocales = new Set(config.locales.map((entry) => entry.locale));\n    if (!declaredLocales.has(config.defaultLocale)) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['defaultLocale'],\n        message:\n          `defaultLocale '${config.defaultLocale}' is not declared in 'locales' ` +\n          `(declared: [${[...declaredLocales].join(', ')}]). The default locale ` +\n          `must be one of the locales the site actually builds.`,\n      });\n    }\n\n    // Locale-path uniqueness: two entries collapsing to the same URL\n    // segment would silently overwrite each other in the Astro build\n    // and corrupt the sitemap. Fail closed at parse time.\n    const pathOwners = new Map<string, AvailableLanguage>();\n    for (const entry of config.locales) {\n      const previous = pathOwners.get(entry.path);\n      if (previous !== undefined) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['locales'],\n          message:\n            `Locale path '${entry.path}' is declared by both '${previous}' and ` +\n            `'${entry.locale}'. Each locale must have a unique URL path segment.`,\n        });\n        continue;\n      }\n      pathOwners.set(entry.path, entry.locale);\n    }\n\n    // Locale-value uniqueness: same locale appearing twice would\n    // produce duplicate hreflang entries and ambiguous default-locale\n    // resolution.\n    const localeOwners = new Map<AvailableLanguage, string>();\n    for (const entry of config.locales) {\n      const previousPath = localeOwners.get(entry.locale);\n      if (previousPath !== undefined) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['locales'],\n          message:\n            `Locale '${entry.locale}' is declared twice (paths '${previousPath}' ` +\n            `and '${entry.path}'). Each locale must appear at most once.`,\n        });\n        continue;\n      }\n      localeOwners.set(entry.locale, entry.path);\n    }\n  });\nexport type WildoMarketingWebsiteConfig = z.infer<typeof WildoMarketingWebsiteConfigSchema>;\nexport type WildoMarketingWebsiteConfigInput = z.input<typeof WildoMarketingWebsiteConfigSchema>;\n/** @wildo_source:part:end engine.saas-website.config */\n"]}
+{"version":3,"file":"wildo-website-config.schemas.js","sourceRoot":"","sources":["../../../../src/config/wildo-website-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oDAAoD,CAAC;AAEvF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CACJ,cAAc,EACd,iFAAiF,CAClF;CACJ,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,YAAY,CAAC;IACZ;;;;;;;;;;OAUG;IACH,YAAY,EAAE,CAAC;SACZ,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACvC,KAAK,EACH,2EAA2E;YAC3E,iFAAiF;KACpF,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;IAElB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,SAAS,EAAE,CAAC;SACT,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACvC,KAAK,EACH,6EAA6E;YAC7E,8EAA8E;YAC9E,kBAAkB;KACrB,CAAC;SACD,QAAQ,EAAE;IAEb;;;;;OAKG;IACH,GAAG,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAEpC;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAExC;;;;;;;;;OASG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,kBAAkB,MAAM,CAAC,aAAa,iCAAiC;gBACvE,eAAe,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;gBACvE,sDAAsD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EACL,gBAAgB,KAAK,CAAC,IAAI,0BAA0B,QAAQ,QAAQ;oBACpE,IAAI,KAAK,CAAC,MAAM,qDAAqD;aACxE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,6DAA6D;IAC7D,kEAAkE;IAClE,cAAc;IACd,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EACL,WAAW,KAAK,CAAC,MAAM,+BAA+B,YAAY,IAAI;oBACtE,QAAQ,KAAK,CAAC,IAAI,2CAA2C;aAChE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,wDAAwD","sourcesContent":["/**\n * @wildo_source:part:start engine.saas-website.config facet:layer:engine facet:family:marketing-website\n *\n * Per-service marketing-website configuration block, authored in\n * the website service folder as `wildo.website.config.ts`.\n *\n * # What this file's loaded value is used for TODAY\n *\n * This schema is the single source of truth for the marketing-site routing\n * and origin surface. Every consumer reads here:\n *\n *   - `defaultLocale` + `locales` — read by `buildAstroI18nConfig(...)`,\n *     `assertLabelPacksValid(...)`, `loadWebsitePageRuntime(...)` and\n *     `renderWebsitePageHeadHtml(...)` via the shared `WebsiteSiteContext`.\n *   - `publicOrigin` — read by the head renderer to compose absolute\n *     `<link rel=\"canonical\">`, `og:url`, hreflang `href` URLs and\n *     the structured-data `mainEntityOfPage`. The previous\n *     `WebsiteRootConfig.seo.siteOrigin` was deleted.\n *   - `appOrigin` — the marketing → app handoff target, read at runtime\n *     since #493. A `wildo.website.config.ts` is Node-loaded and so\n *     invisible to a client island, which is why this value reaches the\n *     browser the way `apiOrigin` does: the `.astro` page forwards it to\n *     its bridge island, which puts it on `WebsiteRuntimeContext.appOrigin`\n *     for the CTA to read.\n *\n *     It previously had NO runtime consumer, and a site resolved the app\n *     origin a SECOND time from a public build-time environment variable —\n *     one host authored twice with no mechanical link, and a silent\n *     fallback to localhost when the variable was unset. That is how a\n *     marketing site comes to point at the wrong environment.\n *   - `csp?` — read by the website-local `sync-nginx-csp` build step,\n *     which merges the app-static posture with `infra.csp?.<serviceKey>`,\n *     emits the generated artifact consumed by Astro pages, and rewrites\n *     the checked-in nginx marker file used by the website Docker image.\n *\n * Future companion subprocesses that introspect the marketing\n * surface (locale-coverage audits, label-pack validation against\n * authored locales, SEO-link sanity checks) will also read here —\n * none exist today.\n *\n * # Why this is per-service website configuration\n *\n * Co-locating the schema with the engine package that owns its semantics\n * keeps three concerns separate from application-root service declarations:\n *\n *   1. **Right reuse axis.** Marketing-site content (locales, SEO origins,\n *      future label-pack overrides, marketing-only CTAs) is conceptually\n *      different from saas-app-level service declarations (`path`,\n *      `serviceName`, `frontendType`, `sessionStorage`). The marketing\n *      config travels with the website service folder, NOT with the\n *      SaaS app root. Two unrelated lifecycles, two different review\n *      audiences.\n *   2. **Engine boundary.** `platform-config-lib` no longer needs to\n *      depend on `@wildo-ai/presets-components-models` (the home of\n *      `AvailableLanguage`) just to type the marketing-site locale\n *      enum. Adding a new website primitive (a new SEO field, a new\n *      locale-pack id) belongs with the website package and its public\n *      configuration contract.\n *   3. **Disambiguator hazard.** The previous root-level\n *      `marketingWebsite?` block silently assumed \"one STATIC_WEBSITE\n *      service per SaaS app\" — but nothing in the schema enforced it.\n *      Two STATIC_WEBSITE services would have silently shared one\n *      config block with no obvious \"which one wins?\" answer. The\n *      application configuration rejects more than one STATIC_WEBSITE (and\n *      TECH_DOC) service, so the per-service config-file lookup is\n *      deterministic by construction.\n *\n * # Schema decisions encoded here\n *\n * - `z.strictObject` so authoring an unknown key surfaces as a parse\n *   error at `defineWebsiteConfig` time instead of being silently\n *   dropped (same posture as `WildoSaasConfigSchema` and\n *   `WildoTechnicalDocConfigSchema`).\n *\n * - **No `enabled` field.** The gate is \"is there a `wildo.website.config.ts`\n *   in a `frontendType: STATIC_WEBSITE` service folder?\" — file\n *   presence under a STATIC_WEBSITE service IS the enable signal.\n *   The Astro build / dev companion / future audit CLI requires the\n *   file when it walks a STATIC_WEBSITE service folder, so a\n *   half-authored config simply cannot exist (the loader fails\n *   closed). Removing the boolean closes a foot-gun: an authored\n *   `enabled: false` block was previously a silent way to keep the\n *   config \"warm\" without shipping anything, and consumers had to\n *   remember to read the flag in addition to the file presence — a\n *   future read-the-config / forget-the-flag bug waiting to happen.\n *   A separate `services.<key>.enabled` pattern (orthogonal to\n *   marketing-website) is the right place for any \"temporarily\n *   disable this service\" story (deferred — see DASHBOARD).\n *\n * - URL fields are `z.url()` (Zod 4 native validator) so we get\n *   protocol + host parsing for free, matching the rest of the\n *   codebase.\n *\n * - `csp?` is typed against `WildoCspConfigSchema` from\n *   `@wildo-ai/platform-config-lib`, mirroring the docs service's\n *   `wildo.tech-doc.config.ts` contract. The parsed value is consumed by\n *   the shared `resolveCspPolicy()` / `emitCspArtifacts()` generator flow.\n *\n * - `defaultLocale ∈ locales` cross-check via `.superRefine` —\n *   keeping `defaultLocale` as a top-level field is product-explicit\n *   (\"which locale URL is the canonical one\") and decouples it from\n *   list ordering. Locale-path uniqueness AND locale-value\n *   uniqueness are also enforced — duplicate paths would silently\n *   overwrite each other in the Astro build and corrupt the sitemap;\n *   duplicate locales would produce duplicate hreflang entries.\n *\n * - Locale primitive is `AvailableLanguage`. The schema imports it\n *   from `@wildo-ai/presets-components-models/public-runtime` (the\n *   side-effect-free public-runtime seam), but **consumers authoring\n *   `wildo.website.config.ts` must import it from\n *   `@wildo-ai/saas-models/public-runtime`**. Both paths produce identical\n *   values; saas-models simply re-exports the presets atom. Picking\n *   one path consistently across consumer files prevents drift in\n *   docs / examples / search results. Values authored in\n *   `wildo.website.config.ts` are the lowercase BCP-47 strings\n *   (`'en'`, `'fr'`), NOT the UPPERCASE TS enum member names\n *   (`EN`, `FR`). `z.enum(AvailableLanguage)` parses against the\n *   enum VALUES, which is what we want.\n */\n\nimport { WildoCspConfigSchema } from '@wildo-ai/platform-config-lib';\nimport { z } from 'zod';\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models/public-runtime';\n\n/**\n * Per-locale configuration. Each authored locale gets one entry.\n *\n * `path` is the locale URL prefix segment (e.g. `'en'`, `'fr'`) — the\n * Astro builder maps `/en/...` and `/fr/...` paths via this value. We\n * do NOT auto-derive `path` from the locale string because some\n * deployments may want a flat root for the default locale (`/...`\n * instead of `/en/...`); keeping it explicit per locale leaves that\n * door open without a config-shape change.\n */\nexport const WebsiteLocaleConfigSchema = z.strictObject({\n  locale: z.enum(AvailableLanguage),\n  path: z\n    .string()\n    .min(1)\n    .regex(\n      /^[a-z0-9-]+$/,\n      'locale path must be lowercase alphanumeric with hyphens (becomes a URL segment)',\n    ),\n});\nexport type WebsiteLocaleConfig = z.infer<typeof WebsiteLocaleConfigSchema>;\n\n/**\n * Per-service marketing-website configuration block.\n *\n * Authored as `export default defineWebsiteConfig({...})` in\n * `<website-service-root>/wildo.website.config.ts`. The Astro\n * build loads this file once at bootstrap via jiti and composes\n * a `WebsiteSiteContext`; helpers consume that composed context rather than\n * this raw value.\n *\n * @example\n * ```ts\n * import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';\n * import { defineWebsiteConfig } from '@wildo-ai/saas-website';\n *\n * export default defineWebsiteConfig({\n *   publicOrigin: 'https://example.com',\n *   appOrigin: 'https://app.example.com',\n *   defaultLocale: AvailableLanguage.EN,\n *   locales: [\n *     { locale: AvailableLanguage.EN, path: 'en' },\n *     { locale: AvailableLanguage.FR, path: 'fr' },\n *   ],\n *   csp: { enabled: true, reportOnly: true },\n * });\n * ```\n */\nexport const WildoMarketingWebsiteConfigSchema = z\n  .strictObject({\n    /**\n     * Public origin of the marketing site (apex / www) — canonical\n     * input the Astro head renderer emits as absolute URLs\n     * (`<link rel=\"canonical\">`, `og:url`, hreflang `href`,\n     * sitemap base, structured-data `mainEntityOfPage`).\n     *\n     * MUST NOT end with `/` — the head renderer composes\n     * `${publicOrigin}${routePath}` and a trailing slash would emit\n     * `https://example.com//`. Surface the constraint loudly here\n     * rather than silently corrupting URLs at build time.\n     */\n    publicOrigin: z\n      .url()\n      .refine((value) => !value.endsWith('/'), {\n        error:\n          'WildoMarketingWebsiteConfig.publicOrigin must NOT end with \"/\" (the head ' +\n          'renderer concatenates publicOrigin + routePath; trailing slash would emit \"//\")',\n      }),\n\n    /**\n     * Origin of the SaaS application the marketing site links into\n     * (signup / login / pricing → checkout).\n     *\n     * Read at runtime since #493: each `.astro` page forwards it to its\n     * bridge island, and the CTA reads it off `WebsiteRuntimeContext`.\n     *\n     * Per environment: a deployment's app lives at a different host in each\n     * environment, and a static site bakes the value in at build time, so the\n     * generated deploy workflow passes the environment's app origin as\n     * `PUBLIC_APP_ORIGIN` — derived from the infra config's `serviceHosts` and\n     * `publicDomain`, not authored a second time. An application's\n     * `wildo.website.config.ts` reads that first and keeps its authored value\n     * as the default for a build that passes none.\n     *\n     * Distinct from the general `WildoSaasConfig.services.<name>`\n     * URL surface because the marketing site is a separate Astro\n     * project that does not load the full SaaS app graph at build\n     * time.\n     */\n    appOrigin: z.url(),\n\n    /**\n     * Backend API origin the marketing site POSTs to for anonymous\n     * captures (lead / draft-note forms) — e.g.\n     * `https://api.example.com`. Threaded through\n     * `WebsiteRuntimeContext.apiOrigin` into the React island that\n     * constructs the `WebsiteAnonymousSessionClient`.\n     *\n     * OPTIONAL because a pure brochure site with no capture forms never\n     * talks to an API — only sites that host an anonymous-capture\n     * section need it. When such a section renders without a resolved\n     * `apiOrigin`, the section surfaces a loud misconfiguration rather\n     * than silently POSTing nowhere.\n     *\n     * MUST NOT end with `/` — the anon client composes\n     * `${apiOrigin}${MAIN_API_BASE_PATH}${path}` and a trailing slash\n     * would emit a doubled `//` in the request URL. (The client also\n     * defensively strips trailing slashes, but the refine surfaces the\n     * mistake at authoring time.)\n     *\n     * Distinct from `appOrigin` (the human-facing app the marketing CTAs\n     * link into) and `publicOrigin` (the marketing site's own canonical\n     * origin): this is the machine-to-machine API host.\n     */\n    apiOrigin: z\n      .url()\n      .refine((value) => !value.endsWith('/'), {\n        error:\n          'WildoMarketingWebsiteConfig.apiOrigin must NOT end with \"/\" (the anonymous ' +\n          'client concatenates apiOrigin + MAIN_API_BASE_PATH + path; a trailing slash ' +\n          'would emit \"//\")',\n      })\n      .optional(),\n\n    /**\n     * Optional Content-Security-Policy override for the marketing site.\n     * Consumed by the website-local `sync-nginx-csp` step, which emits\n     * the generated artifact for Astro page injection and rewrites the\n     * website nginx marker file from the same resolved output.\n     */\n    csp: WildoCspConfigSchema.optional(),\n\n    /**\n     * Default locale the marketing site serves for unmatched URLs\n     * and as the canonical hreflang signal. Must appear in\n     * `locales` below (cross-check enforced by the schema-level\n     * `.superRefine`).\n     *\n     * Read by `buildAstroI18nConfig(...)` (drives Astro's own\n     * `i18n.defaultLocale`) and by the head renderer (drives\n     * `<html lang=\"...\">`, `og:locale`, hreflang `x-default`).\n     */\n    defaultLocale: z.enum(AvailableLanguage),\n\n    /**\n     * Ordered list of locales the marketing site builds. Order is\n     * preserved (used by the language switcher rendering and by\n     * the sitemap emitter — when the sitemap surface lands).\n     *\n     * Read by `buildAstroI18nConfig(...)` (Astro `i18n.locales`),\n     * by `assertLabelPacksValid(...)` (one label pack per locale),\n     * by `loadWebsitePageRuntime(...)` (per-page locale resolution),\n     * and by the head renderer (hreflang alternates).\n     */\n    locales: z.array(WebsiteLocaleConfigSchema).min(1),\n  })\n  .superRefine((config, ctx) => {\n    const declaredLocales = new Set(config.locales.map((entry) => entry.locale));\n    if (!declaredLocales.has(config.defaultLocale)) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['defaultLocale'],\n        message:\n          `defaultLocale '${config.defaultLocale}' is not declared in 'locales' ` +\n          `(declared: [${[...declaredLocales].join(', ')}]). The default locale ` +\n          `must be one of the locales the site actually builds.`,\n      });\n    }\n\n    // Locale-path uniqueness: two entries collapsing to the same URL\n    // segment would silently overwrite each other in the Astro build\n    // and corrupt the sitemap. Fail closed at parse time.\n    const pathOwners = new Map<string, AvailableLanguage>();\n    for (const entry of config.locales) {\n      const previous = pathOwners.get(entry.path);\n      if (previous !== undefined) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['locales'],\n          message:\n            `Locale path '${entry.path}' is declared by both '${previous}' and ` +\n            `'${entry.locale}'. Each locale must have a unique URL path segment.`,\n        });\n        continue;\n      }\n      pathOwners.set(entry.path, entry.locale);\n    }\n\n    // Locale-value uniqueness: same locale appearing twice would\n    // produce duplicate hreflang entries and ambiguous default-locale\n    // resolution.\n    const localeOwners = new Map<AvailableLanguage, string>();\n    for (const entry of config.locales) {\n      const previousPath = localeOwners.get(entry.locale);\n      if (previousPath !== undefined) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['locales'],\n          message:\n            `Locale '${entry.locale}' is declared twice (paths '${previousPath}' ` +\n            `and '${entry.path}'). Each locale must appear at most once.`,\n        });\n        continue;\n      }\n      localeOwners.set(entry.locale, entry.path);\n    }\n  });\nexport type WildoMarketingWebsiteConfig = z.infer<typeof WildoMarketingWebsiteConfigSchema>;\nexport type WildoMarketingWebsiteConfigInput = z.input<typeof WildoMarketingWebsiteConfigSchema>;\n/** @wildo_source:part:end engine.saas-website.config */\n"]}

package/dist/esm/core/anonymous-session/inbound-contact-form.schema.d.ts

@@ -11,8 +11,8 @@
  *
  * Mirrors the non-excluded, non-backend-only CREATE inputs of `InboundContact`
  * (`email` required; `firstName` / `lastName` / `phone` optional), plus ONE privacy
- * signal: an OPTIONAL marketing opt-in (mapped to the `privacy.dataProcessingConsent`
- * tier). There is no second, required agreement field: a governed notice, contract or
+ * signal: an OPTIONAL marketing opt-in (mapped to the `privacy.consentedPurposes` set).
+ * There is no second, required agreement field: a governed notice, contract or
  * consent interaction must use the separate exact-release receipt contract, because this
  * DTO cannot manufacture legal evidence from a checkbox and a client timestamp.
  * `relatedUserId` is intentionally absent — it is `.excludeFromCreate()` on the
@@ -34,7 +34,7 @@ export declare const InboundContactFormSchema: z.ZodObject<{
 export type InboundContactFormValues = z.infer<typeof InboundContactFormSchema>;
 /**
  * Build the exact JSON body the backend CREATE expects from validated form values.
- * Keeps the `privacy` nesting + the consent enum mapping in ONE place so the form
+ * Keeps the `privacy` nesting + the consent purpose mapping in ONE place so the form
  * component stays declarative.
  */
 export declare function buildInboundContactCreateBody(values: InboundContactFormValues): Record<string, unknown>;

package/dist/esm/core/anonymous-session/inbound-contact-form.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contact-form.schema.d.ts","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/inbound-contact-form.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAanC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYvG"}
+{"version":3,"file":"inbound-contact-form.schema.d.ts","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/inbound-contact-form.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAcnC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcvG"}

package/dist/esm/core/anonymous-session/inbound-contact-form.schema.js

@@ -11,14 +11,15 @@
  *
  * Mirrors the non-excluded, non-backend-only CREATE inputs of `InboundContact`
  * (`email` required; `firstName` / `lastName` / `phone` optional), plus ONE privacy
- * signal: an OPTIONAL marketing opt-in (mapped to the `privacy.dataProcessingConsent`
- * tier). There is no second, required agreement field: a governed notice, contract or
+ * signal: an OPTIONAL marketing opt-in (mapped to the `privacy.consentedPurposes` set).
+ * There is no second, required agreement field: a governed notice, contract or
  * consent interaction must use the separate exact-release receipt contract, because this
  * DTO cannot manufacture legal evidence from a checkbox and a client timestamp.
  * `relatedUserId` is intentionally absent — it is `.excludeFromCreate()` on the
  * resource (sales/admin-only, never client-authored).
  */
 import { z } from "zod";
+import { ConsentPurpose } from "@wildo-ai/saas-models/public-runtime";
 /**
  * The wire payload POSTed to `/api/v1/inbound-contacts`. `privacy` matches the
  * resource's `InboundContactPrivacySchema` shape (a nested consent object) so the
@@ -32,15 +33,16 @@ export const InboundContactFormSchema = z.object({
     lastName: z.string().trim().max(200).optional(),
     phone: z.string().trim().max(64).optional(),
     /**
-     * OPTIONAL marketing opt-in — maps into the resource's `privacy.dataProcessingConsent`
-     * tier ('marketing' vs the BASIC default). It is the only privacy field on this form,
-     * and it gates nothing: an unchecked box still submits, at the BASIC tier.
+     * OPTIONAL marketing opt-in — maps into the resource's `privacy.consentedPurposes` set.
+     * It is the only privacy field on this form, and it gates nothing: sending the form is the
+     * essential act and never depends on optional consent, so an unchecked box still submits,
+     * granting nothing.
      */
     marketingConsent: z.boolean().default(false),
 });
 /**
  * Build the exact JSON body the backend CREATE expects from validated form values.
- * Keeps the `privacy` nesting + the consent enum mapping in ONE place so the form
+ * Keeps the `privacy` nesting + the consent purpose mapping in ONE place so the form
  * component stays declarative.
  */
 export function buildInboundContactCreateBody(values) {
@@ -50,9 +52,11 @@ export function buildInboundContactCreateBody(values) {
         ...(values.lastName ? { lastName: values.lastName } : {}),
         ...(values.phone ? { phone: values.phone } : {}),
         privacy: {
-            // OPTIONAL marketing tier: 'marketing' when the visitor opted in, else the
-            // resource's BASIC default.
-            dataProcessingConsent: values.marketingConsent ? "marketing" : "basic",
+            // The visitor SAW the opt-in and submitted, so this is a decision either way (#534): the set
+            // they granted — MARKETING or nothing — plus a CLAIM that they decided now. The backend's
+            // CREATE prefix replaces the instant with its own clock; a browser clock is never recorded.
+            consentedPurposes: values.marketingConsent ? [ConsentPurpose.MARKETING] : [],
+            consentDecidedAt: new Date().toISOString(),
         },
     };
 }

package/dist/esm/core/anonymous-session/inbound-contact-form.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contact-form.schema.js","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/inbound-contact-form.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,mFAAmF;IACnF,+EAA+E;IAC/E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC7C,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAgC;IAC5E,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACxC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE;YACP,2EAA2E;YAC3E,4BAA4B;YAC5B,qBAAqB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;SACvE;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Inbound-contact form input schema (website-local, bundle-safe).\n *\n * Deliberately a SEPARATE plain-Zod schema, NOT `InboundContactSchema` from\n * `@wildo-ai/saas-models`: that schema is decorator-bound (`.isPrimaryKey()`,\n * `.excludeFromCreate()`, `.isBackendOnly()`, …), so importing it would boot the\n * decorator framework into the browser bundle — forbidden by bundle discipline. The\n * website only needs to validate the handful of client-authored CREATE fields; the\n * backend is the authority on the full contract (it re-validates + injects the\n * server-set fields: `_id`, `anonymousUserId`, `userId`, `emailUserMatch`, timestamps).\n *\n * Mirrors the non-excluded, non-backend-only CREATE inputs of `InboundContact`\n * (`email` required; `firstName` / `lastName` / `phone` optional), plus ONE privacy\n * signal: an OPTIONAL marketing opt-in (mapped to the `privacy.dataProcessingConsent`\n * tier). There is no second, required agreement field: a governed notice, contract or\n * consent interaction must use the separate exact-release receipt contract, because this\n * DTO cannot manufacture legal evidence from a checkbox and a client timestamp.\n * `relatedUserId` is intentionally absent — it is `.excludeFromCreate()` on the\n * resource (sales/admin-only, never client-authored).\n */\n\nimport { z } from \"zod\";\n\n/**\n * The wire payload POSTed to `/api/v1/inbound-contacts`. `privacy` matches the\n * resource's `InboundContactPrivacySchema` shape (a nested consent object) so the\n * backend accepts it verbatim.\n */\nexport const InboundContactFormSchema = z.object({\n  // Zod 4: top-level `z.email()` (not the deprecated `z.string().email()`), matching\n  // the resource schema. An empty string fails it, so it also covers \"required\".\n  email: z.email(\"Enter a valid email address\"),\n  firstName: z.string().trim().max(200).optional(),\n  lastName: z.string().trim().max(200).optional(),\n  phone: z.string().trim().max(64).optional(),\n  /**\n   * OPTIONAL marketing opt-in — maps into the resource's `privacy.dataProcessingConsent`\n   * tier ('marketing' vs the BASIC default). It is the only privacy field on this form,\n   * and it gates nothing: an unchecked box still submits, at the BASIC tier.\n   */\n  marketingConsent: z.boolean().default(false),\n});\n\nexport type InboundContactFormValues = z.infer<typeof InboundContactFormSchema>;\n\n/**\n * Build the exact JSON body the backend CREATE expects from validated form values.\n * Keeps the `privacy` nesting + the consent enum mapping in ONE place so the form\n * component stays declarative.\n */\nexport function buildInboundContactCreateBody(values: InboundContactFormValues): Record<string, unknown> {\n  return {\n    email: values.email.trim().toLowerCase(),\n    ...(values.firstName ? { firstName: values.firstName } : {}),\n    ...(values.lastName ? { lastName: values.lastName } : {}),\n    ...(values.phone ? { phone: values.phone } : {}),\n    privacy: {\n      // OPTIONAL marketing tier: 'marketing' when the visitor opted in, else the\n      // resource's BASIC default.\n      dataProcessingConsent: values.marketingConsent ? \"marketing\" : \"basic\",\n    },\n  };\n}\n"]}
+{"version":3,"file":"inbound-contact-form.schema.js","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/inbound-contact-form.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,mFAAmF;IACnF,+EAA+E;IAC/E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC7C,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAgC;IAC5E,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACxC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE;YACP,6FAA6F;YAC7F,0FAA0F;YAC1F,4FAA4F;YAC5F,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5E,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC3C;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Inbound-contact form input schema (website-local, bundle-safe).\n *\n * Deliberately a SEPARATE plain-Zod schema, NOT `InboundContactSchema` from\n * `@wildo-ai/saas-models`: that schema is decorator-bound (`.isPrimaryKey()`,\n * `.excludeFromCreate()`, `.isBackendOnly()`, …), so importing it would boot the\n * decorator framework into the browser bundle — forbidden by bundle discipline. The\n * website only needs to validate the handful of client-authored CREATE fields; the\n * backend is the authority on the full contract (it re-validates + injects the\n * server-set fields: `_id`, `anonymousUserId`, `userId`, `emailUserMatch`, timestamps).\n *\n * Mirrors the non-excluded, non-backend-only CREATE inputs of `InboundContact`\n * (`email` required; `firstName` / `lastName` / `phone` optional), plus ONE privacy\n * signal: an OPTIONAL marketing opt-in (mapped to the `privacy.consentedPurposes` set).\n * There is no second, required agreement field: a governed notice, contract or\n * consent interaction must use the separate exact-release receipt contract, because this\n * DTO cannot manufacture legal evidence from a checkbox and a client timestamp.\n * `relatedUserId` is intentionally absent — it is `.excludeFromCreate()` on the\n * resource (sales/admin-only, never client-authored).\n */\n\nimport { z } from \"zod\";\n\nimport { ConsentPurpose } from \"@wildo-ai/saas-models/public-runtime\";\n\n/**\n * The wire payload POSTed to `/api/v1/inbound-contacts`. `privacy` matches the\n * resource's `InboundContactPrivacySchema` shape (a nested consent object) so the\n * backend accepts it verbatim.\n */\nexport const InboundContactFormSchema = z.object({\n  // Zod 4: top-level `z.email()` (not the deprecated `z.string().email()`), matching\n  // the resource schema. An empty string fails it, so it also covers \"required\".\n  email: z.email(\"Enter a valid email address\"),\n  firstName: z.string().trim().max(200).optional(),\n  lastName: z.string().trim().max(200).optional(),\n  phone: z.string().trim().max(64).optional(),\n  /**\n   * OPTIONAL marketing opt-in — maps into the resource's `privacy.consentedPurposes` set.\n   * It is the only privacy field on this form, and it gates nothing: sending the form is the\n   * essential act and never depends on optional consent, so an unchecked box still submits,\n   * granting nothing.\n   */\n  marketingConsent: z.boolean().default(false),\n});\n\nexport type InboundContactFormValues = z.infer<typeof InboundContactFormSchema>;\n\n/**\n * Build the exact JSON body the backend CREATE expects from validated form values.\n * Keeps the `privacy` nesting + the consent purpose mapping in ONE place so the form\n * component stays declarative.\n */\nexport function buildInboundContactCreateBody(values: InboundContactFormValues): Record<string, unknown> {\n  return {\n    email: values.email.trim().toLowerCase(),\n    ...(values.firstName ? { firstName: values.firstName } : {}),\n    ...(values.lastName ? { lastName: values.lastName } : {}),\n    ...(values.phone ? { phone: values.phone } : {}),\n    privacy: {\n      // The visitor SAW the opt-in and submitted, so this is a decision either way (#534): the set\n      // they granted — MARKETING or nothing — plus a CLAIM that they decided now. The backend's\n      // CREATE prefix replaces the instant with its own clock; a browser clock is never recorded.\n      consentedPurposes: values.marketingConsent ? [ConsentPurpose.MARKETING] : [],\n      consentDecidedAt: new Date().toISOString(),\n    },\n  };\n}\n"]}

package/dist/esm/core/anonymous-session/website-anonymous-session-client.d.ts

@@ -72,6 +72,17 @@ export declare class WebsiteAnonymousSessionClient {
      * JSON response. Throws `WebsiteAnonymousRequestError` on a non-2xx status.
      */
     postAnonymous<TResponse = unknown>(path: string, body: unknown): Promise<TResponse>;
+    /**
+     * Send `body` to an anonymous endpoint with an explicit METHOD.
+     *
+     * `postAnonymous` above is the POST case and delegates here. This exists because not every anonymous
+     * door is a POST and the method is not guessable from the path: the visitor consent door declares
+     * `resourceOperationLike: UPDATE_MANY`, which the engine maps to PUT, so a POST to it answers 404 —
+     * and this client's one silent caller swallowed exactly that. A caller reads the door's method from
+     * the same place it reads the path (`ANONYMOUS_CONSENT_RECORD_METHOD` beside
+     * `ANONYMOUS_CONSENT_RECORD_PATH`) rather than inferring it from a method name.
+     */
+    requestAnonymous<TResponse = unknown>(method: string, path: string, body: unknown): Promise<TResponse>;
     private ensureSessionStarted;
     private buildHeaders;
     private captureSessionToken;

package/dist/esm/core/anonymous-session/website-anonymous-session-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"website-anonymous-session-client.d.ts","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/website-anonymous-session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAeH,MAAM,WAAW,oCAAoC;IACnD,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,iEAAiE;AACjE,qBAAa,4BAA6B,SAAQ,KAAK;aAEnC,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,MAAM;gBADhB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;CAKnC;AAED,qBAAa,6BAA6B;IACxC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAEjC,OAAO,EAAE,oCAAoC;IAMzD,8FAA8F;IAC9F,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;IACH,yBAAyB,IAAI,MAAM;IAMnC,6EAA6E;IAC7E,eAAe,IAAI,OAAO;IAI1B;;;;;;OAMG;IACG,aAAa,CAAC,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBzF,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,YAAY;IAcpB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,OAAO;CAYhB"}
+{"version":3,"file":"website-anonymous-session-client.d.ts","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/website-anonymous-session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAeH,MAAM,WAAW,oCAAoC;IACnD,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,iEAAiE;AACjE,qBAAa,4BAA6B,SAAQ,KAAK;aAEnC,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,MAAM;gBADhB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;CAKnC;AAED,qBAAa,6BAA6B;IACxC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAEjC,OAAO,EAAE,oCAAoC;IAMzD,8FAA8F;IAC9F,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;IACH,yBAAyB,IAAI,MAAM;IAMnC,6EAA6E;IAC7E,eAAe,IAAI,OAAO;IAI1B;;;;;;OAMG;IACG,aAAa,CAAC,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAIzF;;;;;;;;;OASG;IACG,gBAAgB,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAoB5G,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,YAAY;IAcpB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,OAAO;CAYhB"}

package/dist/esm/core/anonymous-session/website-anonymous-session-client.js

@@ -94,9 +94,22 @@ export class WebsiteAnonymousSessionClient {
      * JSON response. Throws `WebsiteAnonymousRequestError` on a non-2xx status.
      */
     async postAnonymous(path, body) {
+        return this.requestAnonymous('POST', path, body);
+    }
+    /**
+     * Send `body` to an anonymous endpoint with an explicit METHOD.
+     *
+     * `postAnonymous` above is the POST case and delegates here. This exists because not every anonymous
+     * door is a POST and the method is not guessable from the path: the visitor consent door declares
+     * `resourceOperationLike: UPDATE_MANY`, which the engine maps to PUT, so a POST to it answers 404 —
+     * and this client's one silent caller swallowed exactly that. A caller reads the door's method from
+     * the same place it reads the path (`ANONYMOUS_CONSENT_RECORD_METHOD` beside
+     * `ANONYMOUS_CONSENT_RECORD_PATH`) rather than inferring it from a method name.
+     */
+    async requestAnonymous(method, path, body) {
         this.ensureSessionStarted();
         const response = await fetch(`${this.apiBaseUrl}${path}`, {
-            method: 'POST',
+            method,
             headers: this.buildHeaders(),
             body: JSON.stringify(body),
             // Carry the parent-domain `__wildo_anon_session` cookie to the API so the

package/dist/esm/core/anonymous-session/website-anonymous-session-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"website-anonymous-session-client.js","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/website-anonymous-session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,YAAY,GAAG;IACnB,eAAe,EAAE,iBAAiB;IAClC,qBAAqB,EAAE,uBAAuB;CACtC,CAAC;AASX,iEAAiE;AACjE,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAEnC;IACA;IAFlB,YACkB,MAAc,EACd,QAAgB;QAEhC,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;QAHxC,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,6BAA6B;IAChC,eAAe,GAAkB,IAAI,CAAC;IACtC,YAAY,GAAkB,IAAI,CAAC;IAC1B,UAAU,CAAS;IACnB,mBAAmB,CAAS;IAE7C,YAAY,OAA6C;QACvD,IAAI,CAAC,UAAU,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAClF,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,8FAA8F;IAC9F,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,yBAAyB;QACvB,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,iEAAiE;QACjE,OAAO,IAAI,CAAC,eAAyB,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,eAAe;QACb,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAsB,IAAY,EAAE,IAAa;QAClE,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,0EAA0E;YAC1E,yDAAyD;YACzD,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAc,CAAC;IAC9C,CAAC;IAEO,oBAAoB;QAC1B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,mBAAmB;SAClE,CAAC;QACF,iFAAiF;QACjF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACjE,CAAC;aAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,OAAO,CAAC,eAAe,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,mBAAmB,CAAC,QAAkB;QAC5C,mFAAmF;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC;QAC5E,IAAI,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACvE,IAAI,MAAM;gBAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;YAC1C,IAAI,KAAK;gBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,qCAAqC;QACvC,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * WebsiteAnonymousSessionClient\n *\n * A self-contained, browser-only anonymous-session HTTP client for the marketing\n * website. It MIRRORS the SaaS app's `AnonymousSessionContext` protocol WITHOUT\n * importing `@wildo-ai/saas-frontend-lib` — the website ships into a browser bundle\n * that must not pull the decorator framework / heavy frontend graph (bundle\n * discipline). It uses ONLY browser globals (`fetch` / `crypto` / `localStorage`) and\n * the bundle-safe `@wildo-ai/saas-models/public-runtime` atoms. No axios (axios is the\n * SSR tier), no React — a React island context can wrap this class.\n *\n * Protocol (W7.3a):\n *   1. The first anonymous request sends `x-anonymous-session-init: <clientUuid>` — the\n *      backend mints an `AnonymousUser` (uuidRef = clientUuid) and returns a signed JWT\n *      in the `x-anonymous-session-token` RESPONSE header.\n *   2. Subsequent requests send `x-anonymous-session: <jwt>`.\n *   Every request also sends `X-Frontend-Service-Name` (required by the anon backend\n *   to accept the request and resolve the frontend identity).\n *\n * CORS (critical): the website is a DIFFERENT origin from the backend API, so the\n * `x-anonymous-session-token` response header is readable by `fetch` ONLY if the\n * backend lists it in `Access-Control-Expose-Headers` (non-safelisted response headers\n * are hidden from cross-origin `fetch`). Without that, the captured token is `null`,\n * the session never advances past init, and every request re-mints a session.\n *\n * Cross-origin continuity: the anonymous session created here (uuidRef) is what the\n * SaaS app transposes on signup/login. It is carried across the apex↔app boundary by\n * the backend-set parent-domain `__wildo_anon_session` cookie — hence `credentials:\n * 'include'`, so that cookie rides same-site requests to the API.\n */\n\nimport { WildoHeaderKeys, MAIN_API_BASE_PATH } from '@wildo-ai/saas-models/public-runtime';\n\n/**\n * localStorage keys. The website is self-contained (mirror-don't-import), so it pins\n * the stable literal values rather than importing the decorator-adjacent shared\n * contract. Cross-origin continuity flows through the backend cookie, NOT this\n * localStorage, so these keys need not match the app's byte-for-byte.\n */\nconst STORAGE_KEYS = {\n  anonymousUserId: 'anonymousUserId',\n  anonymousSessionToken: 'anonymousSessionToken',\n} as const;\n\nexport interface WebsiteAnonymousSessionClientOptions {\n  /** Backend API origin WITHOUT a trailing slash, e.g. `https://api.example.com`. */\n  apiOrigin: string;\n  /** `X-Frontend-Service-Name` value identifying this marketing site to the backend. */\n  frontendServiceName: string;\n}\n\n/** Thrown when an anonymous request returns a non-2xx status. */\nexport class WebsiteAnonymousRequestError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly bodyText: string,\n  ) {\n    super(`Anonymous request failed with status ${status}`);\n    this.name = 'WebsiteAnonymousRequestError';\n  }\n}\n\nexport class WebsiteAnonymousSessionClient {\n  private anonymousUserId: string | null = null;\n  private sessionToken: string | null = null;\n  private readonly apiBaseUrl: string;\n  private readonly frontendServiceName: string;\n\n  constructor(options: WebsiteAnonymousSessionClientOptions) {\n    this.apiBaseUrl = `${options.apiOrigin.replace(/\\/+$/, '')}${MAIN_API_BASE_PATH}`;\n    this.frontendServiceName = options.frontendServiceName;\n    this.restoreFromStorage();\n  }\n\n  /** The anonymous session's relational identity (client uuidRef), or `null` if not started. */\n  getAnonymousUserId(): string | null {\n    return this.anonymousUserId;\n  }\n\n  /**\n   * Return the anonymous session's relational identity (client uuidRef),\n   * STARTING the session first if it has not begun yet. Unlike\n   * `getAnonymousUserId()` (which may return `null`), this always yields\n   * a stable uuidRef.\n   *\n   * Used by NESTED anonymous routes that must embed the id in the URL\n   * BEFORE the first request — e.g. draft-notes POSTs to\n   * `/user-anonymous-users/<uuidRef>/draft-notes`. The id generated here\n   * is the SAME one the next `postAnonymous(...)` sends as\n   * `x-anonymous-session-init`, so the URL scope and the minted session\n   * refer to one anonymous user (no split identity).\n   */\n  getOrStartAnonymousUserId(): string {\n    this.ensureSessionStarted();\n    // ensureSessionStarted() guarantees anonymousUserId is non-null.\n    return this.anonymousUserId as string;\n  }\n\n  /** `true` once an init request has succeeded and a session token is held. */\n  isSessionActive(): boolean {\n    return this.anonymousUserId !== null && this.sessionToken !== null;\n  }\n\n  /**\n   * POST `body` to an anonymous endpoint. `path` is relative to `/api/v1`\n   * (e.g. `/inbound-contacts`, or a nested `/anonymous-users/<uuidRef>/draft-notes`).\n   * Lazily starts the session on the first call, attaches the anon-session +\n   * service-name headers, captures any returned session token, and returns the parsed\n   * JSON response. Throws `WebsiteAnonymousRequestError` on a non-2xx status.\n   */\n  async postAnonymous<TResponse = unknown>(path: string, body: unknown): Promise<TResponse> {\n    this.ensureSessionStarted();\n\n    const response = await fetch(`${this.apiBaseUrl}${path}`, {\n      method: 'POST',\n      headers: this.buildHeaders(),\n      body: JSON.stringify(body),\n      // Carry the parent-domain `__wildo_anon_session` cookie to the API so the\n      // session is continuous across the apex/app/api origins.\n      credentials: 'include',\n    });\n\n    this.captureSessionToken(response);\n\n    if (!response.ok) {\n      throw new WebsiteAnonymousRequestError(response.status, await safeReadText(response));\n    }\n    return (await response.json()) as TResponse;\n  }\n\n  private ensureSessionStarted(): void {\n    if (!this.anonymousUserId) {\n      this.anonymousUserId = crypto.randomUUID();\n      this.sessionToken = null;\n      this.persist();\n    }\n  }\n\n  private buildHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      [WildoHeaderKeys.FRONTEND_SERVICE_NAME]: this.frontendServiceName,\n    };\n    // Once we hold the JWT, restore the session; before that, the raw UUID inits it.\n    if (this.sessionToken) {\n      headers[WildoHeaderKeys.ANONYMOUS_SESSION] = this.sessionToken;\n    } else if (this.anonymousUserId) {\n      headers[WildoHeaderKeys.ANONYMOUS_SESSION_INIT] = this.anonymousUserId;\n    }\n    return headers;\n  }\n\n  private captureSessionToken(response: Response): void {\n    // Requires the backend to CORS-expose this header (see the class-level CORS note).\n    const token = response.headers.get(WildoHeaderKeys.ANONYMOUS_SESSION_TOKEN);\n    if (token && token !== this.sessionToken) {\n      this.sessionToken = token;\n      this.persist();\n    }\n  }\n\n  private restoreFromStorage(): void {\n    try {\n      const userId = localStorage.getItem(STORAGE_KEYS.anonymousUserId);\n      const token = localStorage.getItem(STORAGE_KEYS.anonymousSessionToken);\n      if (userId) this.anonymousUserId = userId;\n      if (token) this.sessionToken = token;\n    } catch {\n      // localStorage unavailable (SSR build / privacy mode) — the session stays\n      // in-memory for this page load only.\n    }\n  }\n\n  private persist(): void {\n    try {\n      if (this.anonymousUserId) {\n        localStorage.setItem(STORAGE_KEYS.anonymousUserId, this.anonymousUserId);\n      }\n      if (this.sessionToken) {\n        localStorage.setItem(STORAGE_KEYS.anonymousSessionToken, this.sessionToken);\n      }\n    } catch {\n      // Best-effort persistence; a failure only means the session won't survive reload.\n    }\n  }\n}\n\nasync function safeReadText(response: Response): Promise<string> {\n  try {\n    return await response.text();\n  } catch {\n    return '';\n  }\n}\n"]}
+{"version":3,"file":"website-anonymous-session-client.js","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/website-anonymous-session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,YAAY,GAAG;IACnB,eAAe,EAAE,iBAAiB;IAClC,qBAAqB,EAAE,uBAAuB;CACtC,CAAC;AASX,iEAAiE;AACjE,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAEnC;IACA;IAFlB,YACkB,MAAc,EACd,QAAgB;QAEhC,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;QAHxC,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,6BAA6B;IAChC,eAAe,GAAkB,IAAI,CAAC;IACtC,YAAY,GAAkB,IAAI,CAAC;IAC1B,UAAU,CAAS;IACnB,mBAAmB,CAAS;IAE7C,YAAY,OAA6C;QACvD,IAAI,CAAC,UAAU,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAClF,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,8FAA8F;IAC9F,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,yBAAyB;QACvB,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,iEAAiE;QACjE,OAAO,IAAI,CAAC,eAAyB,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,eAAe;QACb,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAsB,IAAY,EAAE,IAAa;QAClE,OAAO,IAAI,CAAC,gBAAgB,CAAY,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CAAsB,MAAc,EAAE,IAAY,EAAE,IAAa;QACrF,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,EAAE;YACxD,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,0EAA0E;YAC1E,yDAAyD;YACzD,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAc,CAAC;IAC9C,CAAC;IAEO,oBAAoB;QAC1B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,mBAAmB;SAClE,CAAC;QACF,iFAAiF;QACjF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACjE,CAAC;aAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,OAAO,CAAC,eAAe,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,mBAAmB,CAAC,QAAkB;QAC5C,mFAAmF;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC;QAC5E,IAAI,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACvE,IAAI,MAAM;gBAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;YAC1C,IAAI,KAAK;gBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,qCAAqC;QACvC,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * WebsiteAnonymousSessionClient\n *\n * A self-contained, browser-only anonymous-session HTTP client for the marketing\n * website. It MIRRORS the SaaS app's `AnonymousSessionContext` protocol WITHOUT\n * importing `@wildo-ai/saas-frontend-lib` — the website ships into a browser bundle\n * that must not pull the decorator framework / heavy frontend graph (bundle\n * discipline). It uses ONLY browser globals (`fetch` / `crypto` / `localStorage`) and\n * the bundle-safe `@wildo-ai/saas-models/public-runtime` atoms. No axios (axios is the\n * SSR tier), no React — a React island context can wrap this class.\n *\n * Protocol (W7.3a):\n *   1. The first anonymous request sends `x-anonymous-session-init: <clientUuid>` — the\n *      backend mints an `AnonymousUser` (uuidRef = clientUuid) and returns a signed JWT\n *      in the `x-anonymous-session-token` RESPONSE header.\n *   2. Subsequent requests send `x-anonymous-session: <jwt>`.\n *   Every request also sends `X-Frontend-Service-Name` (required by the anon backend\n *   to accept the request and resolve the frontend identity).\n *\n * CORS (critical): the website is a DIFFERENT origin from the backend API, so the\n * `x-anonymous-session-token` response header is readable by `fetch` ONLY if the\n * backend lists it in `Access-Control-Expose-Headers` (non-safelisted response headers\n * are hidden from cross-origin `fetch`). Without that, the captured token is `null`,\n * the session never advances past init, and every request re-mints a session.\n *\n * Cross-origin continuity: the anonymous session created here (uuidRef) is what the\n * SaaS app transposes on signup/login. It is carried across the apex↔app boundary by\n * the backend-set parent-domain `__wildo_anon_session` cookie — hence `credentials:\n * 'include'`, so that cookie rides same-site requests to the API.\n */\n\nimport { WildoHeaderKeys, MAIN_API_BASE_PATH } from '@wildo-ai/saas-models/public-runtime';\n\n/**\n * localStorage keys. The website is self-contained (mirror-don't-import), so it pins\n * the stable literal values rather than importing the decorator-adjacent shared\n * contract. Cross-origin continuity flows through the backend cookie, NOT this\n * localStorage, so these keys need not match the app's byte-for-byte.\n */\nconst STORAGE_KEYS = {\n  anonymousUserId: 'anonymousUserId',\n  anonymousSessionToken: 'anonymousSessionToken',\n} as const;\n\nexport interface WebsiteAnonymousSessionClientOptions {\n  /** Backend API origin WITHOUT a trailing slash, e.g. `https://api.example.com`. */\n  apiOrigin: string;\n  /** `X-Frontend-Service-Name` value identifying this marketing site to the backend. */\n  frontendServiceName: string;\n}\n\n/** Thrown when an anonymous request returns a non-2xx status. */\nexport class WebsiteAnonymousRequestError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly bodyText: string,\n  ) {\n    super(`Anonymous request failed with status ${status}`);\n    this.name = 'WebsiteAnonymousRequestError';\n  }\n}\n\nexport class WebsiteAnonymousSessionClient {\n  private anonymousUserId: string | null = null;\n  private sessionToken: string | null = null;\n  private readonly apiBaseUrl: string;\n  private readonly frontendServiceName: string;\n\n  constructor(options: WebsiteAnonymousSessionClientOptions) {\n    this.apiBaseUrl = `${options.apiOrigin.replace(/\\/+$/, '')}${MAIN_API_BASE_PATH}`;\n    this.frontendServiceName = options.frontendServiceName;\n    this.restoreFromStorage();\n  }\n\n  /** The anonymous session's relational identity (client uuidRef), or `null` if not started. */\n  getAnonymousUserId(): string | null {\n    return this.anonymousUserId;\n  }\n\n  /**\n   * Return the anonymous session's relational identity (client uuidRef),\n   * STARTING the session first if it has not begun yet. Unlike\n   * `getAnonymousUserId()` (which may return `null`), this always yields\n   * a stable uuidRef.\n   *\n   * Used by NESTED anonymous routes that must embed the id in the URL\n   * BEFORE the first request — e.g. draft-notes POSTs to\n   * `/user-anonymous-users/<uuidRef>/draft-notes`. The id generated here\n   * is the SAME one the next `postAnonymous(...)` sends as\n   * `x-anonymous-session-init`, so the URL scope and the minted session\n   * refer to one anonymous user (no split identity).\n   */\n  getOrStartAnonymousUserId(): string {\n    this.ensureSessionStarted();\n    // ensureSessionStarted() guarantees anonymousUserId is non-null.\n    return this.anonymousUserId as string;\n  }\n\n  /** `true` once an init request has succeeded and a session token is held. */\n  isSessionActive(): boolean {\n    return this.anonymousUserId !== null && this.sessionToken !== null;\n  }\n\n  /**\n   * POST `body` to an anonymous endpoint. `path` is relative to `/api/v1`\n   * (e.g. `/inbound-contacts`, or a nested `/anonymous-users/<uuidRef>/draft-notes`).\n   * Lazily starts the session on the first call, attaches the anon-session +\n   * service-name headers, captures any returned session token, and returns the parsed\n   * JSON response. Throws `WebsiteAnonymousRequestError` on a non-2xx status.\n   */\n  async postAnonymous<TResponse = unknown>(path: string, body: unknown): Promise<TResponse> {\n    return this.requestAnonymous<TResponse>('POST', path, body);\n  }\n\n  /**\n   * Send `body` to an anonymous endpoint with an explicit METHOD.\n   *\n   * `postAnonymous` above is the POST case and delegates here. This exists because not every anonymous\n   * door is a POST and the method is not guessable from the path: the visitor consent door declares\n   * `resourceOperationLike: UPDATE_MANY`, which the engine maps to PUT, so a POST to it answers 404 —\n   * and this client's one silent caller swallowed exactly that. A caller reads the door's method from\n   * the same place it reads the path (`ANONYMOUS_CONSENT_RECORD_METHOD` beside\n   * `ANONYMOUS_CONSENT_RECORD_PATH`) rather than inferring it from a method name.\n   */\n  async requestAnonymous<TResponse = unknown>(method: string, path: string, body: unknown): Promise<TResponse> {\n    this.ensureSessionStarted();\n\n    const response = await fetch(`${this.apiBaseUrl}${path}`, {\n      method,\n      headers: this.buildHeaders(),\n      body: JSON.stringify(body),\n      // Carry the parent-domain `__wildo_anon_session` cookie to the API so the\n      // session is continuous across the apex/app/api origins.\n      credentials: 'include',\n    });\n\n    this.captureSessionToken(response);\n\n    if (!response.ok) {\n      throw new WebsiteAnonymousRequestError(response.status, await safeReadText(response));\n    }\n    return (await response.json()) as TResponse;\n  }\n\n  private ensureSessionStarted(): void {\n    if (!this.anonymousUserId) {\n      this.anonymousUserId = crypto.randomUUID();\n      this.sessionToken = null;\n      this.persist();\n    }\n  }\n\n  private buildHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      [WildoHeaderKeys.FRONTEND_SERVICE_NAME]: this.frontendServiceName,\n    };\n    // Once we hold the JWT, restore the session; before that, the raw UUID inits it.\n    if (this.sessionToken) {\n      headers[WildoHeaderKeys.ANONYMOUS_SESSION] = this.sessionToken;\n    } else if (this.anonymousUserId) {\n      headers[WildoHeaderKeys.ANONYMOUS_SESSION_INIT] = this.anonymousUserId;\n    }\n    return headers;\n  }\n\n  private captureSessionToken(response: Response): void {\n    // Requires the backend to CORS-expose this header (see the class-level CORS note).\n    const token = response.headers.get(WildoHeaderKeys.ANONYMOUS_SESSION_TOKEN);\n    if (token && token !== this.sessionToken) {\n      this.sessionToken = token;\n      this.persist();\n    }\n  }\n\n  private restoreFromStorage(): void {\n    try {\n      const userId = localStorage.getItem(STORAGE_KEYS.anonymousUserId);\n      const token = localStorage.getItem(STORAGE_KEYS.anonymousSessionToken);\n      if (userId) this.anonymousUserId = userId;\n      if (token) this.sessionToken = token;\n    } catch {\n      // localStorage unavailable (SSR build / privacy mode) — the session stays\n      // in-memory for this page load only.\n    }\n  }\n\n  private persist(): void {\n    try {\n      if (this.anonymousUserId) {\n        localStorage.setItem(STORAGE_KEYS.anonymousUserId, this.anonymousUserId);\n      }\n      if (this.sessionToken) {\n        localStorage.setItem(STORAGE_KEYS.anonymousSessionToken, this.sessionToken);\n      }\n    } catch {\n      // Best-effort persistence; a failure only means the session won't survive reload.\n    }\n  }\n}\n\nasync function safeReadText(response: Response): Promise<string> {\n  try {\n    return await response.text();\n  } catch {\n    return '';\n  }\n}\n"]}

package/dist/esm/core/consent/WebsiteConsentBanner.d.ts

@@ -0,0 +1,6 @@
+import { type ReactNode } from 'react';
+export declare function WebsiteConsentBanner(): ReactNode;
+/** The reopen affordance: always reachable once a visitor decided, so every choice can be changed. */
+export declare function WebsiteConsentSettingsButton(): ReactNode;
+/** @wildo_source:part:end saas.website.consent.banner */
+//# sourceMappingURL=WebsiteConsentBanner.d.ts.map

package/dist/esm/core/consent/WebsiteConsentBanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebsiteConsentBanner.d.ts","sourceRoot":"","sources":["../../../../../src/core/consent/WebsiteConsentBanner.tsx"],"names":[],"mappings":"AAAA,OAAc,EAA8B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAwF1E,wBAAgB,oBAAoB,IAAI,SAAS,CAyHhD;AAED,sGAAsG;AACtG,wBAAgB,4BAA4B,IAAI,SAAS,CAQxD;AACD,yDAAyD"}

package/dist/esm/core/consent/WebsiteConsentBanner.js

@@ -0,0 +1,128 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useId, useState } from 'react';
+import { useWebsiteLabelByKey } from '../hooks/useWebsiteLabel.js';
+import { WebsiteConsentStatus } from './WebsiteConsentContext.js';
+import { useWebsiteConsent } from './useWebsiteConsent.js';
+import { WebsiteConsentLabelSlot, websiteConsentLabelKey, websiteConsentPurposeDescriptionLabelKey, websiteConsentPurposeLabelKey, } from '../../schemas/label-keys/website-consent-label-keys.schemas.js';
+/**
+ * @wildo_source:part:start saas.website.consent.banner facet:layer:core facet:family:website
+ *
+ * `WebsiteConsentBanner` — the framework's default visitor consent panel (#534).
+ *
+ * Rendered by `WebsitePageLayout` when the site runs a consent-based provider and the visitor has not
+ * decided, or re-opened the panel. A site replaces it by passing `consentBannerComponent` to its bridge
+ * island; a replacement reads `useWebsiteConsent()` exactly as this one does and must keep its three
+ * properties:
+ *
+ * 1. **No box is pre-ticked.** A pre-ticked box is not a choice.
+ * 2. **Declining is as easy as accepting**, and is RECORDED — so the panel does not return on every page.
+ * 3. **Only purposes in use are offered** (`purposesInUse`), each named by its label.
+ *
+ * Styled only through the site's `--website-*` design tokens, like the skip link, so it needs no
+ * stylesheet and cannot be shadowed by a utility class.
+ */
+function useWebsiteConsentSlotLabel(slot) {
+    return useWebsiteLabelByKey(websiteConsentLabelKey(slot));
+}
+/**
+ * Every row has the SAME shape: the control, then the name on its line, then the explanation beneath
+ * the NAME rather than beneath the control — a two-column grid, so the second line starts where the
+ * first line's words do and the row stays scannable.
+ *
+ * That includes the row that cannot be changed, which carries a real checkbox, CHECKED and DISABLED,
+ * rather than a text status. A person scanning the panel reads DOWN the column of controls, and a row
+ * whose control is missing does not read as "cannot be changed" — it reads as a row that was
+ * forgotten. A checked, disabled box says it in the vocabulary the rest of the list already uses, and
+ * a screen reader announces "checked, unavailable" without any extra words.
+ */
+const ROW_STYLE = {
+    display: 'grid',
+    gridTemplateColumns: 'auto 1fr',
+    columnGap: '0.625rem',
+    alignItems: 'center',
+    padding: '0.5rem 0.75rem',
+    borderBottom: '1px solid var(--website-colors-border, #ccc)',
+};
+const ROW_DESCRIPTION_STYLE = { margin: 0, gridColumn: 2, fontSize: '0.75rem', opacity: 0.8 };
+/** Slightly larger than a default box: this is the one control the whole panel exists to offer. */
+const ROW_CONTROL_STYLE = { width: '1.15rem', height: '1.15rem' };
+/**
+ * One purpose: its NAME, what agreeing to it MEANS for this visitor, and the control.
+ *
+ * The explanation is the half that was missing. A tick box labelled "Analytics" is a category, not
+ * something a visitor can weigh, and consent is only valid if it is informed — which is why every
+ * specialized consent platform pairs the two and why the label key is derived from the vocabulary,
+ * so a purpose can never arrive with a name and no explanation.
+ */
+function PurposeChoice({ purpose, checked, onChange }) {
+    const label = useWebsiteLabelByKey(websiteConsentPurposeLabelKey(purpose));
+    const description = useWebsiteLabelByKey(websiteConsentPurposeDescriptionLabelKey(purpose));
+    return (_jsxs("label", { "data-website-consent-purpose": purpose, style: { ...ROW_STYLE, cursor: 'pointer' }, children: [_jsx("input", { type: "checkbox", checked: checked, style: ROW_CONTROL_STYLE, onChange: (event) => onChange(event.target.checked) }), _jsx("span", { style: { fontWeight: 600 }, children: label }), _jsx("span", { style: ROW_DESCRIPTION_STYLE, children: description })] }));
+}
+const BUTTON_STYLE = {
+    padding: '0.5rem 1rem',
+    borderRadius: 'var(--website-radii-md, 0.375rem)',
+    border: '1px solid var(--website-colors-border, #ccc)',
+    background: 'var(--website-colors-background, #fff)',
+    color: 'var(--website-colors-foreground, #000)',
+    cursor: 'pointer',
+};
+export function WebsiteConsentBanner() {
+    const consent = useWebsiteConsent();
+    const headingId = useId();
+    const [selected, setSelected] = useState(consent.grantedPurposes);
+    // Re-seed from the stored decision each time the panel is re-opened, so it shows what is in force.
+    useEffect(() => setSelected(consent.grantedPurposes), [consent.grantedPurposes, consent.isSettingsOpen]);
+    const title = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.TITLE);
+    const description = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.DESCRIPTION);
+    const acceptAll = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.ACCEPT_ALL);
+    const declineAll = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.DECLINE_ALL);
+    const save = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.SAVE);
+    const essentialTitle = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.ESSENTIAL_TITLE);
+    const essentialDescription = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.ESSENTIAL_DESCRIPTION);
+    const offered = consent.purposesInUse;
+    // Purposes the panel does not offer keep their stored grant; offered ones are granted exactly when ticked.
+    const choose = (chosen) => consent.decide([...consent.grantedPurposes.filter((purpose) => !offered.includes(purpose)), ...chosen]);
+    return (_jsxs("section", { role: "region", "aria-labelledby": headingId, "data-website-consent-banner": consent.status === WebsiteConsentStatus.UNDECIDED ? 'undecided' : 'settings', style: {
+            /*
+             * BOTTOM-RIGHT CORNER, and the three properties together are what make that work on a phone
+             * too. `left` and `right` both bound the box to the viewport with a gutter; `maxWidth` caps it
+             * on a wide screen; `marginLeft: auto` pushes the remaining slack to the left so the box hugs
+             * the right edge. On a narrow screen the gutters bind before the cap does and it simply spans
+             * the width — a corner popup that overflowed a phone would be worse than a bar.
+             *
+             * Inline styles, not a media query: this ships into a static marketing page with no stylesheet
+             * of its own, which is the same constraint that keeps the rest of this file inline.
+             */
+            position: 'fixed',
+            left: '1rem',
+            right: '1rem',
+            bottom: '1rem',
+            zIndex: 9000,
+            maxWidth: '30rem',
+            marginLeft: 'auto',
+            /*
+             * The panel never exceeds the viewport, and its ACTIONS are never what gets cut off: the rows
+             * scroll inside `maxHeight`, the buttons sit outside that box. A panel that grows with its
+             * content pushes accept and reject off the bottom of a short screen — and a refusal that
+             * cannot be reached is a refusal that was not offered, whatever the markup says. `dvh` rather
+             * than `vh` because a mobile browser's toolbars make `vh` taller than the visible page.
+             */
+            maxHeight: '85dvh',
+            padding: '0.875rem 1rem',
+            display: 'flex',
+            flexDirection: 'column',
+            gap: '0.625rem',
+            background: 'var(--website-colors-surface, #fff)',
+            color: 'var(--website-colors-surface-foreground, #000)',
+            border: '1px solid var(--website-colors-border, #ccc)',
+            borderRadius: 'var(--website-radii-lg, 0.5rem)',
+        }, children: [_jsx("h2", { id: headingId, style: { margin: 0, fontSize: '1.125rem' }, children: title }), _jsx("p", { style: { margin: 0 }, children: description }), _jsxs("div", { "data-website-consent-rows": "", style: { minHeight: 0, flex: 1, overflowY: 'auto', border: '1px solid var(--website-colors-border, #ccc)', borderRadius: 'var(--website-radii-md, 0.375rem)' }, children: [_jsxs("div", { "data-website-consent-essential": "", style: ROW_STYLE, children: [_jsx("input", { type: "checkbox", checked: true, disabled: true, "aria-label": essentialTitle, style: ROW_CONTROL_STYLE }), _jsx("span", { style: { fontWeight: 600 }, children: essentialTitle }), _jsx("span", { style: ROW_DESCRIPTION_STYLE, children: essentialDescription })] }), offered.map((purpose) => (_jsx(PurposeChoice, { purpose: purpose, checked: selected.includes(purpose), onChange: (checked) => setSelected((current) => (checked ? [...current.filter((entry) => entry !== purpose), purpose] : current.filter((entry) => entry !== purpose))) }, purpose)))] }), _jsxs("div", { style: { display: 'flex', flexWrap: 'wrap', gap: '0.5rem', justifyContent: 'flex-end' }, children: [_jsx("button", { type: "button", style: BUTTON_STYLE, onClick: () => choose([]), children: declineAll }), offered.length > 1 && (_jsx("button", { type: "button", style: BUTTON_STYLE, onClick: () => choose(selected.filter((purpose) => offered.includes(purpose))), children: save })), _jsx("button", { type: "button", style: BUTTON_STYLE, onClick: () => choose(offered), children: acceptAll })] })] }));
+}
+/** The reopen affordance: always reachable once a visitor decided, so every choice can be changed. */
+export function WebsiteConsentSettingsButton() {
+    const consent = useWebsiteConsent();
+    const manage = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.MANAGE);
+    return (_jsx("button", { type: "button", "data-website-consent-manage": "", style: BUTTON_STYLE, onClick: consent.openSettings, children: manage }));
+}
+//# sourceMappingURL=WebsiteConsentBanner.js.map