@wildo-ai/saas-website 1.1.4 → 1.1.6

package/dist/esm/core/anonymous-session/website-anonymous-session-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"website-anonymous-session-client.d.ts","sourceRoot":"","sources":["../../../../src/core/anonymous-session/website-anonymous-session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAeH,MAAM,WAAW,oCAAoC;IACnD,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,iEAAiE;AACjE,qBAAa,4BAA6B,SAAQ,KAAK;aAEnC,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,MAAM;gBADhB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;CAKnC;AAED,qBAAa,6BAA6B;IACxC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAEjC,OAAO,EAAE,oCAAoC;IAMzD,8FAA8F;IAC9F,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;IACH,yBAAyB,IAAI,MAAM;IAMnC,6EAA6E;IAC7E,eAAe,IAAI,OAAO;IAI1B;;;;;;OAMG;IACG,aAAa,CAAC,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBzF,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,YAAY;IAcpB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,OAAO;CAYhB"}
+{"version":3,"file":"website-anonymous-session-client.d.ts","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/website-anonymous-session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAeH,MAAM,WAAW,oCAAoC;IACnD,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,iEAAiE;AACjE,qBAAa,4BAA6B,SAAQ,KAAK;aAEnC,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,MAAM;gBADhB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;IAMlC;;;OAGG;IACH,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAOlC;CACF;AAED,qBAAa,6BAA6B;IACxC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAEjC,OAAO,EAAE,oCAAoC;IAMzD,8FAA8F;IAC9F,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;IACH,yBAAyB,IAAI,MAAM;IAMnC,6EAA6E;IAC7E,eAAe,IAAI,OAAO;IAI1B;;;;;;OAMG;IACG,aAAa,CAAC,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAI1I;;;OAGG;IACG,SAAS,CAAC,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAYtE;;;;;;;;;OASG;IACG,gBAAgB,CAAC,SAAS,GAAG,OAAO,EACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO;IACb,uHAAuH;IACvH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,OAAO,CAAC,SAAS,CAAC;IAoBrB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,YAAY;IAcpB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,OAAO;CAYhB"}

package/dist/esm/core/anonymous-session/website-anonymous-session-client.js

@@ -49,6 +49,19 @@ export class WebsiteAnonymousRequestError extends Error {
         this.bodyText = bodyText;
         this.name = 'WebsiteAnonymousRequestError';
     }
+    /**
+     * The refusal's stable `error.code` — what a client branches on (the engine hoists an error's `context.code` there) —
+     * or `undefined` when the body is not the engine's error envelope or carries no code.
+     */
+    get errorCode() {
+        try {
+            const code = JSON.parse(this.bodyText).error?.code;
+            return typeof code === 'string' ? code : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
 }
 export class WebsiteAnonymousSessionClient {
     anonymousUserId = null;
@@ -93,11 +106,41 @@ export class WebsiteAnonymousSessionClient {
      * service-name headers, captures any returned session token, and returns the parsed
      * JSON response. Throws `WebsiteAnonymousRequestError` on a non-2xx status.
      */
-    async postAnonymous(path, body) {
+    async postAnonymous(path, body, extraHeaders) {
+        return this.requestAnonymous('POST', path, body, extraHeaders);
+    }
+    /**
+     * GET a PUBLIC endpoint — one that needs no session (a proof-of-work challenge, #1735). Starts no anonymous session
+     * and sends no session header or cookie: asking for a challenge must not mint an identity for the visitor.
+     */
+    async getPublic(path) {
+        const response = await fetch(`${this.apiBaseUrl}${path}`, {
+            method: 'GET',
+            headers: { [WildoHeaderKeys.FRONTEND_SERVICE_NAME]: this.frontendServiceName },
+            credentials: 'omit',
+        });
+        if (!response.ok) {
+            throw new WebsiteAnonymousRequestError(response.status, await safeReadText(response));
+        }
+        return (await response.json());
+    }
+    /**
+     * Send `body` to an anonymous endpoint with an explicit METHOD.
+     *
+     * `postAnonymous` above is the POST case and delegates here. This exists because not every anonymous
+     * door is a POST and the method is not guessable from the path: the visitor consent door declares
+     * `resourceOperationLike: UPDATE_MANY`, which the engine maps to PUT, so a POST to it answers 404 —
+     * and this client's one silent caller swallowed exactly that. A caller reads the door's method from
+     * the same place it reads the path (`ANONYMOUS_CONSENT_RECORD_METHOD` beside
+     * `ANONYMOUS_CONSENT_RECORD_PATH`) rather than inferring it from a method name.
+     */
+    async requestAnonymous(method, path, body, 
+    /** Request-specific headers, such as a public form's challenge answer (#1735). Never overrides the session headers. */
+    extraHeaders) {
         this.ensureSessionStarted();
         const response = await fetch(`${this.apiBaseUrl}${path}`, {
-            method: 'POST',
-            headers: this.buildHeaders(),
+            method,
+            headers: { ...extraHeaders, ...this.buildHeaders() },
             body: JSON.stringify(body),
             // Carry the parent-domain `__wildo_anon_session` cookie to the API so the
             // session is continuous across the apex/app/api origins.

package/dist/esm/core/anonymous-session/website-anonymous-session-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"website-anonymous-session-client.js","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/website-anonymous-session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,YAAY,GAAG;IACnB,eAAe,EAAE,iBAAiB;IAClC,qBAAqB,EAAE,uBAAuB;CACtC,CAAC;AASX,iEAAiE;AACjE,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAEnC;IACA;IAFlB,YACkB,MAAc,EACd,QAAgB;QAEhC,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;QAHxC,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,6BAA6B;IAChC,eAAe,GAAkB,IAAI,CAAC;IACtC,YAAY,GAAkB,IAAI,CAAC;IAC1B,UAAU,CAAS;IACnB,mBAAmB,CAAS;IAE7C,YAAY,OAA6C;QACvD,IAAI,CAAC,UAAU,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAClF,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,8FAA8F;IAC9F,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,yBAAyB;QACvB,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,iEAAiE;QACjE,OAAO,IAAI,CAAC,eAAyB,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,eAAe;QACb,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAsB,IAAY,EAAE,IAAa;QAClE,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,0EAA0E;YAC1E,yDAAyD;YACzD,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAc,CAAC;IAC9C,CAAC;IAEO,oBAAoB;QAC1B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,mBAAmB;SAClE,CAAC;QACF,iFAAiF;QACjF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACjE,CAAC;aAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,OAAO,CAAC,eAAe,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,mBAAmB,CAAC,QAAkB;QAC5C,mFAAmF;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC;QAC5E,IAAI,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACvE,IAAI,MAAM;gBAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;YAC1C,IAAI,KAAK;gBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,qCAAqC;QACvC,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * WebsiteAnonymousSessionClient\n *\n * A self-contained, browser-only anonymous-session HTTP client for the marketing\n * website. It MIRRORS the SaaS app's `AnonymousSessionContext` protocol WITHOUT\n * importing `@wildo-ai/saas-frontend-lib` — the website ships into a browser bundle\n * that must not pull the decorator framework / heavy frontend graph (bundle\n * discipline). It uses ONLY browser globals (`fetch` / `crypto` / `localStorage`) and\n * the bundle-safe `@wildo-ai/saas-models/public-runtime` atoms. No axios (axios is the\n * SSR tier), no React — a React island context can wrap this class.\n *\n * Protocol (W7.3a):\n *   1. The first anonymous request sends `x-anonymous-session-init: <clientUuid>` — the\n *      backend mints an `AnonymousUser` (uuidRef = clientUuid) and returns a signed JWT\n *      in the `x-anonymous-session-token` RESPONSE header.\n *   2. Subsequent requests send `x-anonymous-session: <jwt>`.\n *   Every request also sends `X-Frontend-Service-Name` (required by the anon backend\n *   to accept the request and resolve the frontend identity).\n *\n * CORS (critical): the website is a DIFFERENT origin from the backend API, so the\n * `x-anonymous-session-token` response header is readable by `fetch` ONLY if the\n * backend lists it in `Access-Control-Expose-Headers` (non-safelisted response headers\n * are hidden from cross-origin `fetch`). Without that, the captured token is `null`,\n * the session never advances past init, and every request re-mints a session.\n *\n * Cross-origin continuity: the anonymous session created here (uuidRef) is what the\n * SaaS app transposes on signup/login. It is carried across the apex↔app boundary by\n * the backend-set parent-domain `__wildo_anon_session` cookie — hence `credentials:\n * 'include'`, so that cookie rides same-site requests to the API.\n */\n\nimport { WildoHeaderKeys, MAIN_API_BASE_PATH } from '@wildo-ai/saas-models/public-runtime';\n\n/**\n * localStorage keys. The website is self-contained (mirror-don't-import), so it pins\n * the stable literal values rather than importing the decorator-adjacent shared\n * contract. Cross-origin continuity flows through the backend cookie, NOT this\n * localStorage, so these keys need not match the app's byte-for-byte.\n */\nconst STORAGE_KEYS = {\n  anonymousUserId: 'anonymousUserId',\n  anonymousSessionToken: 'anonymousSessionToken',\n} as const;\n\nexport interface WebsiteAnonymousSessionClientOptions {\n  /** Backend API origin WITHOUT a trailing slash, e.g. `https://api.example.com`. */\n  apiOrigin: string;\n  /** `X-Frontend-Service-Name` value identifying this marketing site to the backend. */\n  frontendServiceName: string;\n}\n\n/** Thrown when an anonymous request returns a non-2xx status. */\nexport class WebsiteAnonymousRequestError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly bodyText: string,\n  ) {\n    super(`Anonymous request failed with status ${status}`);\n    this.name = 'WebsiteAnonymousRequestError';\n  }\n}\n\nexport class WebsiteAnonymousSessionClient {\n  private anonymousUserId: string | null = null;\n  private sessionToken: string | null = null;\n  private readonly apiBaseUrl: string;\n  private readonly frontendServiceName: string;\n\n  constructor(options: WebsiteAnonymousSessionClientOptions) {\n    this.apiBaseUrl = `${options.apiOrigin.replace(/\\/+$/, '')}${MAIN_API_BASE_PATH}`;\n    this.frontendServiceName = options.frontendServiceName;\n    this.restoreFromStorage();\n  }\n\n  /** The anonymous session's relational identity (client uuidRef), or `null` if not started. */\n  getAnonymousUserId(): string | null {\n    return this.anonymousUserId;\n  }\n\n  /**\n   * Return the anonymous session's relational identity (client uuidRef),\n   * STARTING the session first if it has not begun yet. Unlike\n   * `getAnonymousUserId()` (which may return `null`), this always yields\n   * a stable uuidRef.\n   *\n   * Used by NESTED anonymous routes that must embed the id in the URL\n   * BEFORE the first request — e.g. draft-notes POSTs to\n   * `/user-anonymous-users/<uuidRef>/draft-notes`. The id generated here\n   * is the SAME one the next `postAnonymous(...)` sends as\n   * `x-anonymous-session-init`, so the URL scope and the minted session\n   * refer to one anonymous user (no split identity).\n   */\n  getOrStartAnonymousUserId(): string {\n    this.ensureSessionStarted();\n    // ensureSessionStarted() guarantees anonymousUserId is non-null.\n    return this.anonymousUserId as string;\n  }\n\n  /** `true` once an init request has succeeded and a session token is held. */\n  isSessionActive(): boolean {\n    return this.anonymousUserId !== null && this.sessionToken !== null;\n  }\n\n  /**\n   * POST `body` to an anonymous endpoint. `path` is relative to `/api/v1`\n   * (e.g. `/inbound-contacts`, or a nested `/anonymous-users/<uuidRef>/draft-notes`).\n   * Lazily starts the session on the first call, attaches the anon-session +\n   * service-name headers, captures any returned session token, and returns the parsed\n   * JSON response. Throws `WebsiteAnonymousRequestError` on a non-2xx status.\n   */\n  async postAnonymous<TResponse = unknown>(path: string, body: unknown): Promise<TResponse> {\n    this.ensureSessionStarted();\n\n    const response = await fetch(`${this.apiBaseUrl}${path}`, {\n      method: 'POST',\n      headers: this.buildHeaders(),\n      body: JSON.stringify(body),\n      // Carry the parent-domain `__wildo_anon_session` cookie to the API so the\n      // session is continuous across the apex/app/api origins.\n      credentials: 'include',\n    });\n\n    this.captureSessionToken(response);\n\n    if (!response.ok) {\n      throw new WebsiteAnonymousRequestError(response.status, await safeReadText(response));\n    }\n    return (await response.json()) as TResponse;\n  }\n\n  private ensureSessionStarted(): void {\n    if (!this.anonymousUserId) {\n      this.anonymousUserId = crypto.randomUUID();\n      this.sessionToken = null;\n      this.persist();\n    }\n  }\n\n  private buildHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      [WildoHeaderKeys.FRONTEND_SERVICE_NAME]: this.frontendServiceName,\n    };\n    // Once we hold the JWT, restore the session; before that, the raw UUID inits it.\n    if (this.sessionToken) {\n      headers[WildoHeaderKeys.ANONYMOUS_SESSION] = this.sessionToken;\n    } else if (this.anonymousUserId) {\n      headers[WildoHeaderKeys.ANONYMOUS_SESSION_INIT] = this.anonymousUserId;\n    }\n    return headers;\n  }\n\n  private captureSessionToken(response: Response): void {\n    // Requires the backend to CORS-expose this header (see the class-level CORS note).\n    const token = response.headers.get(WildoHeaderKeys.ANONYMOUS_SESSION_TOKEN);\n    if (token && token !== this.sessionToken) {\n      this.sessionToken = token;\n      this.persist();\n    }\n  }\n\n  private restoreFromStorage(): void {\n    try {\n      const userId = localStorage.getItem(STORAGE_KEYS.anonymousUserId);\n      const token = localStorage.getItem(STORAGE_KEYS.anonymousSessionToken);\n      if (userId) this.anonymousUserId = userId;\n      if (token) this.sessionToken = token;\n    } catch {\n      // localStorage unavailable (SSR build / privacy mode) — the session stays\n      // in-memory for this page load only.\n    }\n  }\n\n  private persist(): void {\n    try {\n      if (this.anonymousUserId) {\n        localStorage.setItem(STORAGE_KEYS.anonymousUserId, this.anonymousUserId);\n      }\n      if (this.sessionToken) {\n        localStorage.setItem(STORAGE_KEYS.anonymousSessionToken, this.sessionToken);\n      }\n    } catch {\n      // Best-effort persistence; a failure only means the session won't survive reload.\n    }\n  }\n}\n\nasync function safeReadText(response: Response): Promise<string> {\n  try {\n    return await response.text();\n  } catch {\n    return '';\n  }\n}\n"]}
+{"version":3,"file":"website-anonymous-session-client.js","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/website-anonymous-session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,YAAY,GAAG;IACnB,eAAe,EAAE,iBAAiB;IAClC,qBAAqB,EAAE,uBAAuB;CACtC,CAAC;AASX,iEAAiE;AACjE,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAEnC;IACA;IAFlB,YACkB,MAAc,EACd,QAAgB;QAEhC,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;QAHxC,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACH,IAAI,SAAS;QACX,IAAI,CAAC;YACH,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAoC,CAAC,KAAK,EAAE,IAAI,CAAC;YACvF,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,6BAA6B;IAChC,eAAe,GAAkB,IAAI,CAAC;IACtC,YAAY,GAAkB,IAAI,CAAC;IAC1B,UAAU,CAAS;IACnB,mBAAmB,CAAS;IAE7C,YAAY,OAA6C;QACvD,IAAI,CAAC,UAAU,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAClF,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,8FAA8F;IAC9F,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,yBAAyB;QACvB,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,iEAAiE;QACjE,OAAO,IAAI,CAAC,eAAyB,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,eAAe;QACb,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAsB,IAAY,EAAE,IAAa,EAAE,YAA+C;QACnH,OAAO,IAAI,CAAC,gBAAgB,CAAY,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAsB,IAAY;QAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,EAAE;YACxD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE;YAC9E,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAc,CAAC;IAC9C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,IAAY,EACZ,IAAa;IACb,uHAAuH;IACvH,YAA+C;QAE/C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,EAAE;YACxD,MAAM;YACN,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE;YACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,0EAA0E;YAC1E,yDAAyD;YACzD,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAc,CAAC;IAC9C,CAAC;IAEO,oBAAoB;QAC1B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,mBAAmB;SAClE,CAAC;QACF,iFAAiF;QACjF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACjE,CAAC;aAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,OAAO,CAAC,eAAe,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;QACzE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,mBAAmB,CAAC,QAAkB;QAC5C,mFAAmF;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC;QAC5E,IAAI,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACvE,IAAI,MAAM;gBAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;YAC1C,IAAI,KAAK;gBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,qCAAqC;QACvC,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * WebsiteAnonymousSessionClient\n *\n * A self-contained, browser-only anonymous-session HTTP client for the marketing\n * website. It MIRRORS the SaaS app's `AnonymousSessionContext` protocol WITHOUT\n * importing `@wildo-ai/saas-frontend-lib` — the website ships into a browser bundle\n * that must not pull the decorator framework / heavy frontend graph (bundle\n * discipline). It uses ONLY browser globals (`fetch` / `crypto` / `localStorage`) and\n * the bundle-safe `@wildo-ai/saas-models/public-runtime` atoms. No axios (axios is the\n * SSR tier), no React — a React island context can wrap this class.\n *\n * Protocol (W7.3a):\n *   1. The first anonymous request sends `x-anonymous-session-init: <clientUuid>` — the\n *      backend mints an `AnonymousUser` (uuidRef = clientUuid) and returns a signed JWT\n *      in the `x-anonymous-session-token` RESPONSE header.\n *   2. Subsequent requests send `x-anonymous-session: <jwt>`.\n *   Every request also sends `X-Frontend-Service-Name` (required by the anon backend\n *   to accept the request and resolve the frontend identity).\n *\n * CORS (critical): the website is a DIFFERENT origin from the backend API, so the\n * `x-anonymous-session-token` response header is readable by `fetch` ONLY if the\n * backend lists it in `Access-Control-Expose-Headers` (non-safelisted response headers\n * are hidden from cross-origin `fetch`). Without that, the captured token is `null`,\n * the session never advances past init, and every request re-mints a session.\n *\n * Cross-origin continuity: the anonymous session created here (uuidRef) is what the\n * SaaS app transposes on signup/login. It is carried across the apex↔app boundary by\n * the backend-set parent-domain `__wildo_anon_session` cookie — hence `credentials:\n * 'include'`, so that cookie rides same-site requests to the API.\n */\n\nimport { WildoHeaderKeys, MAIN_API_BASE_PATH } from '@wildo-ai/saas-models/public-runtime';\n\n/**\n * localStorage keys. The website is self-contained (mirror-don't-import), so it pins\n * the stable literal values rather than importing the decorator-adjacent shared\n * contract. Cross-origin continuity flows through the backend cookie, NOT this\n * localStorage, so these keys need not match the app's byte-for-byte.\n */\nconst STORAGE_KEYS = {\n  anonymousUserId: 'anonymousUserId',\n  anonymousSessionToken: 'anonymousSessionToken',\n} as const;\n\nexport interface WebsiteAnonymousSessionClientOptions {\n  /** Backend API origin WITHOUT a trailing slash, e.g. `https://api.example.com`. */\n  apiOrigin: string;\n  /** `X-Frontend-Service-Name` value identifying this marketing site to the backend. */\n  frontendServiceName: string;\n}\n\n/** Thrown when an anonymous request returns a non-2xx status. */\nexport class WebsiteAnonymousRequestError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly bodyText: string,\n  ) {\n    super(`Anonymous request failed with status ${status}`);\n    this.name = 'WebsiteAnonymousRequestError';\n  }\n\n  /**\n   * The refusal's stable `error.code` — what a client branches on (the engine hoists an error's `context.code` there) —\n   * or `undefined` when the body is not the engine's error envelope or carries no code.\n   */\n  get errorCode(): string | undefined {\n    try {\n      const code = (JSON.parse(this.bodyText) as { error?: { code?: unknown } }).error?.code;\n      return typeof code === 'string' ? code : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n}\n\nexport class WebsiteAnonymousSessionClient {\n  private anonymousUserId: string | null = null;\n  private sessionToken: string | null = null;\n  private readonly apiBaseUrl: string;\n  private readonly frontendServiceName: string;\n\n  constructor(options: WebsiteAnonymousSessionClientOptions) {\n    this.apiBaseUrl = `${options.apiOrigin.replace(/\\/+$/, '')}${MAIN_API_BASE_PATH}`;\n    this.frontendServiceName = options.frontendServiceName;\n    this.restoreFromStorage();\n  }\n\n  /** The anonymous session's relational identity (client uuidRef), or `null` if not started. */\n  getAnonymousUserId(): string | null {\n    return this.anonymousUserId;\n  }\n\n  /**\n   * Return the anonymous session's relational identity (client uuidRef),\n   * STARTING the session first if it has not begun yet. Unlike\n   * `getAnonymousUserId()` (which may return `null`), this always yields\n   * a stable uuidRef.\n   *\n   * Used by NESTED anonymous routes that must embed the id in the URL\n   * BEFORE the first request — e.g. draft-notes POSTs to\n   * `/user-anonymous-users/<uuidRef>/draft-notes`. The id generated here\n   * is the SAME one the next `postAnonymous(...)` sends as\n   * `x-anonymous-session-init`, so the URL scope and the minted session\n   * refer to one anonymous user (no split identity).\n   */\n  getOrStartAnonymousUserId(): string {\n    this.ensureSessionStarted();\n    // ensureSessionStarted() guarantees anonymousUserId is non-null.\n    return this.anonymousUserId as string;\n  }\n\n  /** `true` once an init request has succeeded and a session token is held. */\n  isSessionActive(): boolean {\n    return this.anonymousUserId !== null && this.sessionToken !== null;\n  }\n\n  /**\n   * POST `body` to an anonymous endpoint. `path` is relative to `/api/v1`\n   * (e.g. `/inbound-contacts`, or a nested `/anonymous-users/<uuidRef>/draft-notes`).\n   * Lazily starts the session on the first call, attaches the anon-session +\n   * service-name headers, captures any returned session token, and returns the parsed\n   * JSON response. Throws `WebsiteAnonymousRequestError` on a non-2xx status.\n   */\n  async postAnonymous<TResponse = unknown>(path: string, body: unknown, extraHeaders?: Readonly<Record<string, string>>): Promise<TResponse> {\n    return this.requestAnonymous<TResponse>('POST', path, body, extraHeaders);\n  }\n\n  /**\n   * GET a PUBLIC endpoint — one that needs no session (a proof-of-work challenge, #1735). Starts no anonymous session\n   * and sends no session header or cookie: asking for a challenge must not mint an identity for the visitor.\n   */\n  async getPublic<TResponse = unknown>(path: string): Promise<TResponse> {\n    const response = await fetch(`${this.apiBaseUrl}${path}`, {\n      method: 'GET',\n      headers: { [WildoHeaderKeys.FRONTEND_SERVICE_NAME]: this.frontendServiceName },\n      credentials: 'omit',\n    });\n    if (!response.ok) {\n      throw new WebsiteAnonymousRequestError(response.status, await safeReadText(response));\n    }\n    return (await response.json()) as TResponse;\n  }\n\n  /**\n   * Send `body` to an anonymous endpoint with an explicit METHOD.\n   *\n   * `postAnonymous` above is the POST case and delegates here. This exists because not every anonymous\n   * door is a POST and the method is not guessable from the path: the visitor consent door declares\n   * `resourceOperationLike: UPDATE_MANY`, which the engine maps to PUT, so a POST to it answers 404 —\n   * and this client's one silent caller swallowed exactly that. A caller reads the door's method from\n   * the same place it reads the path (`ANONYMOUS_CONSENT_RECORD_METHOD` beside\n   * `ANONYMOUS_CONSENT_RECORD_PATH`) rather than inferring it from a method name.\n   */\n  async requestAnonymous<TResponse = unknown>(\n    method: string,\n    path: string,\n    body: unknown,\n    /** Request-specific headers, such as a public form's challenge answer (#1735). Never overrides the session headers. */\n    extraHeaders?: Readonly<Record<string, string>>,\n  ): Promise<TResponse> {\n    this.ensureSessionStarted();\n\n    const response = await fetch(`${this.apiBaseUrl}${path}`, {\n      method,\n      headers: { ...extraHeaders, ...this.buildHeaders() },\n      body: JSON.stringify(body),\n      // Carry the parent-domain `__wildo_anon_session` cookie to the API so the\n      // session is continuous across the apex/app/api origins.\n      credentials: 'include',\n    });\n\n    this.captureSessionToken(response);\n\n    if (!response.ok) {\n      throw new WebsiteAnonymousRequestError(response.status, await safeReadText(response));\n    }\n    return (await response.json()) as TResponse;\n  }\n\n  private ensureSessionStarted(): void {\n    if (!this.anonymousUserId) {\n      this.anonymousUserId = crypto.randomUUID();\n      this.sessionToken = null;\n      this.persist();\n    }\n  }\n\n  private buildHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      [WildoHeaderKeys.FRONTEND_SERVICE_NAME]: this.frontendServiceName,\n    };\n    // Once we hold the JWT, restore the session; before that, the raw UUID inits it.\n    if (this.sessionToken) {\n      headers[WildoHeaderKeys.ANONYMOUS_SESSION] = this.sessionToken;\n    } else if (this.anonymousUserId) {\n      headers[WildoHeaderKeys.ANONYMOUS_SESSION_INIT] = this.anonymousUserId;\n    }\n    return headers;\n  }\n\n  private captureSessionToken(response: Response): void {\n    // Requires the backend to CORS-expose this header (see the class-level CORS note).\n    const token = response.headers.get(WildoHeaderKeys.ANONYMOUS_SESSION_TOKEN);\n    if (token && token !== this.sessionToken) {\n      this.sessionToken = token;\n      this.persist();\n    }\n  }\n\n  private restoreFromStorage(): void {\n    try {\n      const userId = localStorage.getItem(STORAGE_KEYS.anonymousUserId);\n      const token = localStorage.getItem(STORAGE_KEYS.anonymousSessionToken);\n      if (userId) this.anonymousUserId = userId;\n      if (token) this.sessionToken = token;\n    } catch {\n      // localStorage unavailable (SSR build / privacy mode) — the session stays\n      // in-memory for this page load only.\n    }\n  }\n\n  private persist(): void {\n    try {\n      if (this.anonymousUserId) {\n        localStorage.setItem(STORAGE_KEYS.anonymousUserId, this.anonymousUserId);\n      }\n      if (this.sessionToken) {\n        localStorage.setItem(STORAGE_KEYS.anonymousSessionToken, this.sessionToken);\n      }\n    } catch {\n      // Best-effort persistence; a failure only means the session won't survive reload.\n    }\n  }\n}\n\nasync function safeReadText(response: Response): Promise<string> {\n  try {\n    return await response.text();\n  } catch {\n    return '';\n  }\n}\n"]}

package/dist/esm/core/anonymous-session/website-submission-challenge.d.ts

@@ -0,0 +1,36 @@
+import { type FrontendCaptchaSink } from '@wildo-ai/saas-models/public-runtime';
+import { type WebsiteAnonymousSessionClient } from './website-anonymous-session-client';
+/** @wildo_source:part:start saas.website.submission-challenge facet:layer:frontend facet:audience:app-developer */
+/** What a form knows about the page's captcha when it submits. */
+export interface WebsiteSubmissionChallengeSource {
+    /** This website declares a captcha provider, so its public forms answer a challenge. */
+    readonly captchaDeclared: boolean;
+    /** The captcha vendor RUNNING on the page — present only once the visitor consented and it started. */
+    readonly runningCaptcha?: {
+        readonly providerRef: string;
+        readonly sink: FrontendCaptchaSink;
+    };
+}
+/** The challenge source of the current page: its declared captcha provider and, if started, its running client. */
+export declare function useWebsiteSubmissionChallengeSource(): WebsiteSubmissionChallengeSource;
+/**
+ * The encoded answer to send, or `undefined` when this site asks for none. `proofOfWorkOnly` skips the vendor (the
+ * retry after a refused token). Throws only when the proof-of-work challenge cannot be fetched or solved; the caller
+ * then shows its ordinary failure and does not submit unanswered (`InboundContactForm` shows its `errorMessage`).
+ */
+export declare function obtainSubmissionChallengeAnswer(params: {
+    readonly source: WebsiteSubmissionChallengeSource;
+    /**
+     * The action the operation the form posts to DECLARES in its `submissionChallenge` (#1985): the engine's
+     * `SubmissionChallengeAction.INBOUND_CONTACT` for `/inbound-contacts`, your own action for your own operation. A token
+     * minted for any other action is refused.
+     */
+    readonly action: string;
+    readonly client: Pick<WebsiteAnonymousSessionClient, 'getPublic'>;
+    readonly proofOfWorkOnly?: boolean;
+    readonly signal?: AbortSignal;
+}): Promise<string | undefined>;
+/** Whether a failed submission was refused at its challenge — the one refusal a form answers again, with the proof of work. */
+export declare function isSubmissionChallengeRefusal(error: unknown): boolean;
+/** @wildo_source:part:end saas.website.submission-challenge */
+//# sourceMappingURL=website-submission-challenge.d.ts.map

package/dist/esm/core/anonymous-session/website-submission-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"website-submission-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/website-submission-challenge.ts"],"names":[],"mappings":"AAgBA,OAAO,EAQL,KAAK,mBAAmB,EAEzB,MAAM,sCAAsC,CAAC;AAI9C,OAAO,EAAgC,KAAK,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAEtH,mHAAmH;AACnH,kEAAkE;AAClE,MAAM,WAAW,gCAAgC;IAC/C,wFAAwF;IACxF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,uGAAuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;KAAE,CAAC;CAChG;AAED,mHAAmH;AACnH,wBAAgB,mCAAmC,IAAI,gCAAgC,CAatF;AAED;;;;GAIG;AACH,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAC;IAClE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB9B;AAED,+HAA+H;AAC/H,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpE;AACD,+DAA+D"}

package/dist/esm/core/anonymous-session/website-submission-challenge.js

@@ -0,0 +1,69 @@
+/**
+ * The answer a public website form sends with its submission when the application protects it with a captcha (#1735), to
+ * any operation that declares a submission challenge (#1985).
+ *
+ * Two answers, one header (`x-submission-challenge-response`), chosen in the visitor's browser:
+ *
+ * - the consented captcha vendor's TOKEN, when its browser part is running on the page (it starts only once the
+ *   visitor grants the purpose the vendor rests on — Google reCAPTCHA rests on ANALYTICS);
+ * - otherwise the engine's PROOF OF WORK: a challenge fetched from the backend and solved here. Consent-exempt —
+ *   nothing is stored in the browser and nothing reaches a third party — so a visitor who declined still submits.
+ *
+ * The backend requires one of the two whenever it declares a captcha provider, and refuses a submission with neither.
+ * A site that declares none sends nothing. A refused vendor token is retried ONCE with the proof of work (a low score or
+ * an unreachable vendor must not lock a real person out); see {@link isSubmissionChallengeRefusal}.
+ */
+import { useContext, useMemo } from 'react';
+import { BUILTIN_PROVIDER_CAPABILITY, SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH, SubmissionChallengeRefusalCode, SubmissionChallengeResponseKind, encodeSubmissionChallengeResponse, isFrontendCaptchaSink, solveProofOfWorkChallenge, } from '@wildo-ai/saas-models/public-runtime';
+import { WebsiteRuntimeContext } from '../contexts/WebsiteRuntimeContext.js';
+import { useWebsiteProviderSdkActivations } from '../external-providers/website-provider-sdk-activations.js';
+import { WebsiteAnonymousRequestError } from './website-anonymous-session-client.js';
+/** The challenge source of the current page: its declared captcha provider and, if started, its running client. */
+export function useWebsiteSubmissionChallengeSource() {
+    // Read without `useWebsiteRuntime`'s throw: a form rendered outside a page (a test, a storybook) simply has no captcha.
+    const runtime = useContext(WebsiteRuntimeContext);
+    const running = useWebsiteProviderSdkActivations();
+    const captchaDeclared = runtime?.frontendProviderRegistry?.findProviderByProviderCapability(BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA) !== undefined;
+    return useMemo(() => {
+        const captcha = running.find((entry) => entry.providerCapabilities.includes(BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA)
+            && isFrontendCaptchaSink(entry.activation.handle));
+        return {
+            captchaDeclared,
+            ...(captcha === undefined ? {} : { runningCaptcha: { providerRef: captcha.providerRef, sink: captcha.activation.handle } }),
+        };
+    }, [captchaDeclared, running]);
+}
+/**
+ * The encoded answer to send, or `undefined` when this site asks for none. `proofOfWorkOnly` skips the vendor (the
+ * retry after a refused token). Throws only when the proof-of-work challenge cannot be fetched or solved; the caller
+ * then shows its ordinary failure and does not submit unanswered (`InboundContactForm` shows its `errorMessage`).
+ */
+export async function obtainSubmissionChallengeAnswer(params) {
+    const { source, action, client, proofOfWorkOnly = false, signal } = params;
+    if (!proofOfWorkOnly && source.runningCaptcha !== undefined) {
+        const token = await source.runningCaptcha.sink.execute(action);
+        if (token !== undefined) {
+            return encodeSubmissionChallengeResponse({
+                kind: SubmissionChallengeResponseKind.PROVIDER_TOKEN,
+                providerRef: source.runningCaptcha.providerRef,
+                token,
+            });
+        }
+    }
+    if (!source.captchaDeclared && !proofOfWorkOnly)
+        return undefined;
+    const challenge = await client.getPublic(SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH);
+    const answer = await solveProofOfWorkChallenge(challenge, { signal });
+    if (answer === undefined)
+        throw new Error('The proof-of-work challenge could not be solved.');
+    return encodeSubmissionChallengeResponse(answer);
+}
+/** Whether a failed submission was refused at its challenge — the one refusal a form answers again, with the proof of work. */
+export function isSubmissionChallengeRefusal(error) {
+    if (!(error instanceof WebsiteAnonymousRequestError))
+        return false;
+    const code = error.errorCode;
+    return code === SubmissionChallengeRefusalCode.REQUIRED || code === SubmissionChallengeRefusalCode.REFUSED;
+}
+/** @wildo_source:part:end saas.website.submission-challenge */
+//# sourceMappingURL=website-submission-challenge.js.map

package/dist/esm/core/anonymous-session/website-submission-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"website-submission-challenge.js","sourceRoot":"","sources":["../../../../../src/core/anonymous-session/website-submission-challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EACL,2BAA2B,EAC3B,uCAAuC,EACvC,8BAA8B,EAC9B,+BAA+B,EAC/B,iCAAiC,EACjC,qBAAqB,EACrB,yBAAyB,GAG1B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,4BAA4B,EAAsC,MAAM,oCAAoC,CAAC;AAWtH,mHAAmH;AACnH,MAAM,UAAU,mCAAmC;IACjD,wHAAwH;IACxH,MAAM,OAAO,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,gCAAgC,EAAE,CAAC;IACnD,MAAM,eAAe,GAAG,OAAO,EAAE,wBAAwB,EAAE,gCAAgC,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,KAAK,SAAS,CAAC;IACxJ,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,2BAA2B,CAAC,gBAAgB,CAAC;eACpH,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,OAAO;YACL,eAAe;YACf,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,MAA6B,EAAE,EAAE,CAAC;SACnJ,CAAC;IACJ,CAAC,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,MAWrD;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC3E,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,iCAAiC,CAAC;gBACvC,IAAI,EAAE,+BAA+B,CAAC,cAAc;gBACpD,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,WAAW;gBAC9C,KAAK;aACN,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAuB,uCAAuC,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC9F,OAAO,iCAAiC,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC;IAC7B,OAAO,IAAI,KAAK,8BAA8B,CAAC,QAAQ,IAAI,IAAI,KAAK,8BAA8B,CAAC,OAAO,CAAC;AAC7G,CAAC;AACD,+DAA+D","sourcesContent":["/**\n * The answer a public website form sends with its submission when the application protects it with a captcha (#1735), to\n * any operation that declares a submission challenge (#1985).\n *\n * Two answers, one header (`x-submission-challenge-response`), chosen in the visitor's browser:\n *\n * - the consented captcha vendor's TOKEN, when its browser part is running on the page (it starts only once the\n *   visitor grants the purpose the vendor rests on — Google reCAPTCHA rests on ANALYTICS);\n * - otherwise the engine's PROOF OF WORK: a challenge fetched from the backend and solved here. Consent-exempt —\n *   nothing is stored in the browser and nothing reaches a third party — so a visitor who declined still submits.\n *\n * The backend requires one of the two whenever it declares a captcha provider, and refuses a submission with neither.\n * A site that declares none sends nothing. A refused vendor token is retried ONCE with the proof of work (a low score or\n * an unreachable vendor must not lock a real person out); see {@link isSubmissionChallengeRefusal}.\n */\nimport { useContext, useMemo } from 'react';\nimport {\n  BUILTIN_PROVIDER_CAPABILITY,\n  SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH,\n  SubmissionChallengeRefusalCode,\n  SubmissionChallengeResponseKind,\n  encodeSubmissionChallengeResponse,\n  isFrontendCaptchaSink,\n  solveProofOfWorkChallenge,\n  type FrontendCaptchaSink,\n  type ProofOfWorkChallenge,\n} from '@wildo-ai/saas-models/public-runtime';\n\nimport { WebsiteRuntimeContext } from '../contexts/WebsiteRuntimeContext';\nimport { useWebsiteProviderSdkActivations } from '../external-providers/website-provider-sdk-activations';\nimport { WebsiteAnonymousRequestError, type WebsiteAnonymousSessionClient } from './website-anonymous-session-client';\n\n/** @wildo_source:part:start saas.website.submission-challenge facet:layer:frontend facet:audience:app-developer */\n/** What a form knows about the page's captcha when it submits. */\nexport interface WebsiteSubmissionChallengeSource {\n  /** This website declares a captcha provider, so its public forms answer a challenge. */\n  readonly captchaDeclared: boolean;\n  /** The captcha vendor RUNNING on the page — present only once the visitor consented and it started. */\n  readonly runningCaptcha?: { readonly providerRef: string; readonly sink: FrontendCaptchaSink };\n}\n\n/** The challenge source of the current page: its declared captcha provider and, if started, its running client. */\nexport function useWebsiteSubmissionChallengeSource(): WebsiteSubmissionChallengeSource {\n  // Read without `useWebsiteRuntime`'s throw: a form rendered outside a page (a test, a storybook) simply has no captcha.\n  const runtime = useContext(WebsiteRuntimeContext);\n  const running = useWebsiteProviderSdkActivations();\n  const captchaDeclared = runtime?.frontendProviderRegistry?.findProviderByProviderCapability(BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA) !== undefined;\n  return useMemo(() => {\n    const captcha = running.find((entry) => entry.providerCapabilities.includes(BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA)\n      && isFrontendCaptchaSink(entry.activation.handle));\n    return {\n      captchaDeclared,\n      ...(captcha === undefined ? {} : { runningCaptcha: { providerRef: captcha.providerRef, sink: captcha.activation.handle as FrontendCaptchaSink } }),\n    };\n  }, [captchaDeclared, running]);\n}\n\n/**\n * The encoded answer to send, or `undefined` when this site asks for none. `proofOfWorkOnly` skips the vendor (the\n * retry after a refused token). Throws only when the proof-of-work challenge cannot be fetched or solved; the caller\n * then shows its ordinary failure and does not submit unanswered (`InboundContactForm` shows its `errorMessage`).\n */\nexport async function obtainSubmissionChallengeAnswer(params: {\n  readonly source: WebsiteSubmissionChallengeSource;\n  /**\n   * The action the operation the form posts to DECLARES in its `submissionChallenge` (#1985): the engine's\n   * `SubmissionChallengeAction.INBOUND_CONTACT` for `/inbound-contacts`, your own action for your own operation. A token\n   * minted for any other action is refused.\n   */\n  readonly action: string;\n  readonly client: Pick<WebsiteAnonymousSessionClient, 'getPublic'>;\n  readonly proofOfWorkOnly?: boolean;\n  readonly signal?: AbortSignal;\n}): Promise<string | undefined> {\n  const { source, action, client, proofOfWorkOnly = false, signal } = params;\n  if (!proofOfWorkOnly && source.runningCaptcha !== undefined) {\n    const token = await source.runningCaptcha.sink.execute(action);\n    if (token !== undefined) {\n      return encodeSubmissionChallengeResponse({\n        kind: SubmissionChallengeResponseKind.PROVIDER_TOKEN,\n        providerRef: source.runningCaptcha.providerRef,\n        token,\n      });\n    }\n  }\n  if (!source.captchaDeclared && !proofOfWorkOnly) return undefined;\n  const challenge = await client.getPublic<ProofOfWorkChallenge>(SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH);\n  const answer = await solveProofOfWorkChallenge(challenge, { signal });\n  if (answer === undefined) throw new Error('The proof-of-work challenge could not be solved.');\n  return encodeSubmissionChallengeResponse(answer);\n}\n\n/** Whether a failed submission was refused at its challenge — the one refusal a form answers again, with the proof of work. */\nexport function isSubmissionChallengeRefusal(error: unknown): boolean {\n  if (!(error instanceof WebsiteAnonymousRequestError)) return false;\n  const code = error.errorCode;\n  return code === SubmissionChallengeRefusalCode.REQUIRED || code === SubmissionChallengeRefusalCode.REFUSED;\n}\n/** @wildo_source:part:end saas.website.submission-challenge */\n"]}

package/dist/esm/core/consent/WebsiteConsentBanner.d.ts

@@ -0,0 +1,6 @@
+import { type ReactNode } from 'react';
+export declare function WebsiteConsentBanner(): ReactNode;
+/** The reopen affordance: always reachable once a visitor decided, so every choice can be changed. */
+export declare function WebsiteConsentSettingsButton(): ReactNode;
+/** @wildo_source:part:end saas.website.consent.banner */
+//# sourceMappingURL=WebsiteConsentBanner.d.ts.map

package/dist/esm/core/consent/WebsiteConsentBanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebsiteConsentBanner.d.ts","sourceRoot":"","sources":["../../../../../src/core/consent/WebsiteConsentBanner.tsx"],"names":[],"mappings":"AAAA,OAAc,EAA8B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAyF1E,wBAAgB,oBAAoB,IAAI,SAAS,CAyHhD;AAED,sGAAsG;AACtG,wBAAgB,4BAA4B,IAAI,SAAS,CAQxD;AACD,yDAAyD"}

package/dist/esm/core/consent/WebsiteConsentBanner.js

@@ -0,0 +1,129 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useId, useState } from 'react';
+import { websiteDesignTokenCssVar } from '../../schemas/design-tokens/website-design-tokens.shared.schemas.js';
+import { useWebsiteLabelByKey } from '../hooks/useWebsiteLabel.js';
+import { WebsiteConsentStatus } from './WebsiteConsentContext.js';
+import { useWebsiteConsent } from './useWebsiteConsent.js';
+import { WebsiteConsentLabelSlot, websiteConsentLabelKey, websiteConsentPurposeDescriptionLabelKey, websiteConsentPurposeLabelKey, } from '../../schemas/label-keys/website-consent-label-keys.schemas.js';
+/**
+ * @wildo_source:part:start saas.website.consent.banner facet:layer:core facet:family:website
+ *
+ * `WebsiteConsentBanner` — the framework's default visitor consent panel (#534).
+ *
+ * Rendered by `WebsitePageLayout` when the site runs a consent-based provider and the visitor has not
+ * decided, or re-opened the panel. A site replaces it by passing `consentBannerComponent` to its bridge
+ * island; a replacement reads `useWebsiteConsent()` exactly as this one does and must keep its three
+ * properties:
+ *
+ * 1. **No box is pre-ticked.** A pre-ticked box is not a choice.
+ * 2. **Declining is as easy as accepting**, and is RECORDED — so the panel does not return on every page.
+ * 3. **Only purposes in use are offered** (`purposesInUse`), each named by its label.
+ *
+ * Styled only through the site's `--website-*` design tokens, like the skip link, so it needs no
+ * stylesheet and cannot be shadowed by a utility class.
+ */
+function useWebsiteConsentSlotLabel(slot) {
+    return useWebsiteLabelByKey(websiteConsentLabelKey(slot));
+}
+/**
+ * Every row has the SAME shape: the control, then the name on its line, then the explanation beneath
+ * the NAME rather than beneath the control — a two-column grid, so the second line starts where the
+ * first line's words do and the row stays scannable.
+ *
+ * That includes the row that cannot be changed, which carries a real checkbox, CHECKED and DISABLED,
+ * rather than a text status. A person scanning the panel reads DOWN the column of controls, and a row
+ * whose control is missing does not read as "cannot be changed" — it reads as a row that was
+ * forgotten. A checked, disabled box says it in the vocabulary the rest of the list already uses, and
+ * a screen reader announces "checked, unavailable" without any extra words.
+ */
+const ROW_STYLE = {
+    display: 'grid',
+    gridTemplateColumns: 'auto 1fr',
+    columnGap: '0.625rem',
+    alignItems: 'center',
+    padding: '0.5rem 0.75rem',
+    borderBottom: `1px solid ${websiteDesignTokenCssVar('colors', 'border', '#ccc')}`,
+};
+const ROW_DESCRIPTION_STYLE = { margin: 0, gridColumn: 2, fontSize: '0.75rem', opacity: 0.8 };
+/** Slightly larger than a default box: this is the one control the whole panel exists to offer. */
+const ROW_CONTROL_STYLE = { width: '1.15rem', height: '1.15rem' };
+/**
+ * One purpose: its NAME, what agreeing to it MEANS for this visitor, and the control.
+ *
+ * The explanation is the half that was missing. A tick box labelled "Analytics" is a category, not
+ * something a visitor can weigh, and consent is only valid if it is informed — which is why every
+ * specialized consent platform pairs the two and why the label key is derived from the vocabulary,
+ * so a purpose can never arrive with a name and no explanation.
+ */
+function PurposeChoice({ purpose, checked, onChange }) {
+    const label = useWebsiteLabelByKey(websiteConsentPurposeLabelKey(purpose));
+    const description = useWebsiteLabelByKey(websiteConsentPurposeDescriptionLabelKey(purpose));
+    return (_jsxs("label", { "data-website-consent-purpose": purpose, style: { ...ROW_STYLE, cursor: 'pointer' }, children: [_jsx("input", { type: "checkbox", checked: checked, style: ROW_CONTROL_STYLE, onChange: (event) => onChange(event.target.checked) }), _jsx("span", { style: { fontWeight: 600 }, children: label }), _jsx("span", { style: ROW_DESCRIPTION_STYLE, children: description })] }));
+}
+const BUTTON_STYLE = {
+    padding: '0.5rem 1rem',
+    borderRadius: websiteDesignTokenCssVar('radii', 'md', '0.375rem'),
+    border: `1px solid ${websiteDesignTokenCssVar('colors', 'border', '#ccc')}`,
+    background: websiteDesignTokenCssVar('colors', 'background', '#fff'),
+    color: websiteDesignTokenCssVar('colors', 'foreground', '#000'),
+    cursor: 'pointer',
+};
+export function WebsiteConsentBanner() {
+    const consent = useWebsiteConsent();
+    const headingId = useId();
+    const [selected, setSelected] = useState(consent.grantedPurposes);
+    // Re-seed from the stored decision each time the panel is re-opened, so it shows what is in force.
+    useEffect(() => setSelected(consent.grantedPurposes), [consent.grantedPurposes, consent.isSettingsOpen]);
+    const title = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.TITLE);
+    const description = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.DESCRIPTION);
+    const acceptAll = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.ACCEPT_ALL);
+    const declineAll = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.DECLINE_ALL);
+    const save = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.SAVE);
+    const essentialTitle = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.ESSENTIAL_TITLE);
+    const essentialDescription = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.ESSENTIAL_DESCRIPTION);
+    const offered = consent.purposesInUse;
+    // Purposes the panel does not offer keep their stored grant; offered ones are granted exactly when ticked.
+    const choose = (chosen) => consent.decide([...consent.grantedPurposes.filter((purpose) => !offered.includes(purpose)), ...chosen]);
+    return (_jsxs("section", { role: "region", "aria-labelledby": headingId, "data-website-consent-banner": consent.status === WebsiteConsentStatus.UNDECIDED ? 'undecided' : 'settings', style: {
+            /*
+             * BOTTOM-RIGHT CORNER, and the three properties together are what make that work on a phone
+             * too. `left` and `right` both bound the box to the viewport with a gutter; `maxWidth` caps it
+             * on a wide screen; `marginLeft: auto` pushes the remaining slack to the left so the box hugs
+             * the right edge. On a narrow screen the gutters bind before the cap does and it simply spans
+             * the width — a corner popup that overflowed a phone would be worse than a bar.
+             *
+             * Inline styles, not a media query: this ships into a static marketing page with no stylesheet
+             * of its own, which is the same constraint that keeps the rest of this file inline.
+             */
+            position: 'fixed',
+            left: '1rem',
+            right: '1rem',
+            bottom: '1rem',
+            zIndex: 9000,
+            maxWidth: '30rem',
+            marginLeft: 'auto',
+            /*
+             * The panel never exceeds the viewport, and its ACTIONS are never what gets cut off: the rows
+             * scroll inside `maxHeight`, the buttons sit outside that box. A panel that grows with its
+             * content pushes accept and reject off the bottom of a short screen — and a refusal that
+             * cannot be reached is a refusal that was not offered, whatever the markup says. `dvh` rather
+             * than `vh` because a mobile browser's toolbars make `vh` taller than the visible page.
+             */
+            maxHeight: '85dvh',
+            padding: '0.875rem 1rem',
+            display: 'flex',
+            flexDirection: 'column',
+            gap: '0.625rem',
+            background: websiteDesignTokenCssVar('colors', 'surface', '#fff'),
+            color: websiteDesignTokenCssVar('colors', 'surfaceForeground', '#000'),
+            border: `1px solid ${websiteDesignTokenCssVar('colors', 'border', '#ccc')}`,
+            borderRadius: websiteDesignTokenCssVar('radii', 'lg', '0.5rem'),
+        }, children: [_jsx("h2", { id: headingId, style: { margin: 0, fontSize: '1.125rem' }, children: title }), _jsx("p", { style: { margin: 0 }, children: description }), _jsxs("div", { "data-website-consent-rows": "", style: { minHeight: 0, flex: 1, overflowY: 'auto', border: `1px solid ${websiteDesignTokenCssVar('colors', 'border', '#ccc')}`, borderRadius: websiteDesignTokenCssVar('radii', 'md', '0.375rem') }, children: [_jsxs("div", { "data-website-consent-essential": "", style: ROW_STYLE, children: [_jsx("input", { type: "checkbox", checked: true, disabled: true, "aria-label": essentialTitle, style: ROW_CONTROL_STYLE }), _jsx("span", { style: { fontWeight: 600 }, children: essentialTitle }), _jsx("span", { style: ROW_DESCRIPTION_STYLE, children: essentialDescription })] }), offered.map((purpose) => (_jsx(PurposeChoice, { purpose: purpose, checked: selected.includes(purpose), onChange: (checked) => setSelected((current) => (checked ? [...current.filter((entry) => entry !== purpose), purpose] : current.filter((entry) => entry !== purpose))) }, purpose)))] }), _jsxs("div", { style: { display: 'flex', flexWrap: 'wrap', gap: '0.5rem', justifyContent: 'flex-end' }, children: [_jsx("button", { type: "button", style: BUTTON_STYLE, onClick: () => choose([]), children: declineAll }), offered.length > 1 && (_jsx("button", { type: "button", style: BUTTON_STYLE, onClick: () => choose(selected.filter((purpose) => offered.includes(purpose))), children: save })), _jsx("button", { type: "button", style: BUTTON_STYLE, onClick: () => choose(offered), children: acceptAll })] })] }));
+}
+/** The reopen affordance: always reachable once a visitor decided, so every choice can be changed. */
+export function WebsiteConsentSettingsButton() {
+    const consent = useWebsiteConsent();
+    const manage = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.MANAGE);
+    return (_jsx("button", { type: "button", "data-website-consent-manage": "", style: BUTTON_STYLE, onClick: consent.openSettings, children: manage }));
+}
+//# sourceMappingURL=WebsiteConsentBanner.js.map

package/dist/esm/core/consent/WebsiteConsentBanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebsiteConsentBanner.js","sourceRoot":"","sources":["../../../../../src/core/consent/WebsiteConsentBanner.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAkB,MAAM,OAAO,CAAC;AAG1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,wCAAwC,EACxC,6BAA6B,GAC9B,MAAM,6DAA6D,CAAC;AAErE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,0BAA0B,CAAC,IAA6B;IAC/D,OAAO,oBAAoB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,SAAS,GAAwB;IACrC,OAAO,EAAE,MAAM;IACf,mBAAmB,EAAE,UAAU;IAC/B,SAAS,EAAE,UAAU;IACrB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,aAAa,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;CAClF,CAAC;AAEF,MAAM,qBAAqB,GAAwB,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAEnH,mGAAmG;AACnG,MAAM,iBAAiB,GAAwB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAEvF;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAuF;IACxI,MAAM,KAAK,GAAG,oBAAoB,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,oBAAoB,CAAC,wCAAwC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,OAAO,CACL,iDAAqC,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,aACtF,gBAAO,IAAI,EAAC,UAAU,EAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAI,EAC1H,eAAM,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAG,KAAK,GAAQ,EAChD,eAAM,KAAK,EAAE,qBAAqB,YAAG,WAAW,GAAQ,IAClD,CACT,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAwB;IACxC,OAAO,EAAE,aAAa;IACtB,YAAY,EAAE,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC;IACjE,MAAM,EAAE,aAAa,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;IAC3E,UAAU,EAAE,wBAAwB,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC;IACpE,KAAK,EAAE,wBAAwB,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC;IAC/D,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAA4B,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7F,mGAAmG;IACnG,SAAS,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAEzG,MAAM,KAAK,GAAG,0BAA0B,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,0BAA0B,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,0BAA0B,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,0BAA0B,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,0BAA0B,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,0BAA0B,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAC3F,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;IAEvG,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IACtC,2GAA2G;IAC3G,MAAM,MAAM,GAAG,CAAC,MAAiC,EAAQ,EAAE,CACzD,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IAE1G,OAAO,CACL,mBACE,IAAI,EAAC,QAAQ,qBACI,SAAS,iCACG,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EACzG,KAAK,EAAE;YACL;;;;;;;;;eASG;YACH,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,MAAM;YAClB;;;;;;eAMG;YACH,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,QAAQ;YACvB,GAAG,EAAE,UAAU;YACf,UAAU,EAAE,wBAAwB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;YACjE,KAAK,EAAE,wBAAwB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC;YACtE,MAAM,EAAE,aAAa,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;YAC3E,YAAY,EAAE,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC;SAChE,aAED,aAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAG,KAAK,GAAM,EAC3E,YAAG,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,YAAG,WAAW,GAAK,EAI1C,4CAC4B,EAAE,EAC5B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,aAanM,iDAAoC,EAAE,EAAC,KAAK,EAAE,SAAS,aAUrD,gBAAO,IAAI,EAAC,UAAU,EAAC,OAAO,QAAC,QAAQ,sBAAa,cAAc,EAAE,KAAK,EAAE,iBAAiB,GAAI,EAChG,eAAM,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAG,cAAc,GAAQ,EACzD,eAAM,KAAK,EAAE,qBAAqB,YAAG,oBAAoB,GAAQ,IAC7D,EACL,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACxB,KAAC,aAAa,IAEZ,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EACnC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,IAHjK,OAAO,CAIZ,CACH,CAAC,IACE,EACN,eAAK,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,aAC1F,iBAAQ,IAAI,EAAC,QAAQ,EAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,YAAG,UAAU,GAAU,EAS1F,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CACrB,iBAAQ,IAAI,EAAC,QAAQ,EAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,YAAG,IAAI,GAAU,CAC3I,EACD,iBAAQ,IAAI,EAAC,QAAQ,EAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAG,SAAS,GAAU,IAC3F,IACE,CACX,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,4BAA4B;IAC1C,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,0BAA0B,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC1E,OAAO,CACL,iBAAQ,IAAI,EAAC,QAAQ,iCAA6B,EAAE,EAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,YACpG,MAAM,GACA,CACV,CAAC;AACJ,CAAC","sourcesContent":["import React, { useEffect, useId, useState, type ReactNode } from 'react';\nimport type { ConsentPurpose } from '@wildo-ai/saas-models/public-runtime';\n\nimport { websiteDesignTokenCssVar } from '../../schemas/design-tokens/website-design-tokens.shared.schemas';\nimport { useWebsiteLabelByKey } from '../hooks/useWebsiteLabel';\nimport { WebsiteConsentStatus } from './WebsiteConsentContext';\nimport { useWebsiteConsent } from './useWebsiteConsent';\nimport {\n  WebsiteConsentLabelSlot,\n  websiteConsentLabelKey,\n  websiteConsentPurposeDescriptionLabelKey,\n  websiteConsentPurposeLabelKey,\n} from '../../schemas/label-keys/website-consent-label-keys.schemas';\n\n/**\n * @wildo_source:part:start saas.website.consent.banner facet:layer:core facet:family:website\n *\n * `WebsiteConsentBanner` — the framework's default visitor consent panel (#534).\n *\n * Rendered by `WebsitePageLayout` when the site runs a consent-based provider and the visitor has not\n * decided, or re-opened the panel. A site replaces it by passing `consentBannerComponent` to its bridge\n * island; a replacement reads `useWebsiteConsent()` exactly as this one does and must keep its three\n * properties:\n *\n * 1. **No box is pre-ticked.** A pre-ticked box is not a choice.\n * 2. **Declining is as easy as accepting**, and is RECORDED — so the panel does not return on every page.\n * 3. **Only purposes in use are offered** (`purposesInUse`), each named by its label.\n *\n * Styled only through the site's `--website-*` design tokens, like the skip link, so it needs no\n * stylesheet and cannot be shadowed by a utility class.\n */\nfunction useWebsiteConsentSlotLabel(slot: WebsiteConsentLabelSlot): string {\n  return useWebsiteLabelByKey(websiteConsentLabelKey(slot));\n}\n\n/**\n * Every row has the SAME shape: the control, then the name on its line, then the explanation beneath\n * the NAME rather than beneath the control — a two-column grid, so the second line starts where the\n * first line's words do and the row stays scannable.\n *\n * That includes the row that cannot be changed, which carries a real checkbox, CHECKED and DISABLED,\n * rather than a text status. A person scanning the panel reads DOWN the column of controls, and a row\n * whose control is missing does not read as \"cannot be changed\" — it reads as a row that was\n * forgotten. A checked, disabled box says it in the vocabulary the rest of the list already uses, and\n * a screen reader announces \"checked, unavailable\" without any extra words.\n */\nconst ROW_STYLE: React.CSSProperties = {\n  display: 'grid',\n  gridTemplateColumns: 'auto 1fr',\n  columnGap: '0.625rem',\n  alignItems: 'center',\n  padding: '0.5rem 0.75rem',\n  borderBottom: `1px solid ${websiteDesignTokenCssVar('colors', 'border', '#ccc')}`,\n};\n\nconst ROW_DESCRIPTION_STYLE: React.CSSProperties = { margin: 0, gridColumn: 2, fontSize: '0.75rem', opacity: 0.8 };\n\n/** Slightly larger than a default box: this is the one control the whole panel exists to offer. */\nconst ROW_CONTROL_STYLE: React.CSSProperties = { width: '1.15rem', height: '1.15rem' };\n\n/**\n * One purpose: its NAME, what agreeing to it MEANS for this visitor, and the control.\n *\n * The explanation is the half that was missing. A tick box labelled \"Analytics\" is a category, not\n * something a visitor can weigh, and consent is only valid if it is informed — which is why every\n * specialized consent platform pairs the two and why the label key is derived from the vocabulary,\n * so a purpose can never arrive with a name and no explanation.\n */\nfunction PurposeChoice({ purpose, checked, onChange }: { purpose: ConsentPurpose; checked: boolean; onChange: (checked: boolean) => void }): ReactNode {\n  const label = useWebsiteLabelByKey(websiteConsentPurposeLabelKey(purpose));\n  const description = useWebsiteLabelByKey(websiteConsentPurposeDescriptionLabelKey(purpose));\n  return (\n    <label data-website-consent-purpose={purpose} style={{ ...ROW_STYLE, cursor: 'pointer' }}>\n      <input type=\"checkbox\" checked={checked} style={ROW_CONTROL_STYLE} onChange={(event) => onChange(event.target.checked)} />\n      <span style={{ fontWeight: 600 }}>{label}</span>\n      <span style={ROW_DESCRIPTION_STYLE}>{description}</span>\n    </label>\n  );\n}\n\nconst BUTTON_STYLE: React.CSSProperties = {\n  padding: '0.5rem 1rem',\n  borderRadius: websiteDesignTokenCssVar('radii', 'md', '0.375rem'),\n  border: `1px solid ${websiteDesignTokenCssVar('colors', 'border', '#ccc')}`,\n  background: websiteDesignTokenCssVar('colors', 'background', '#fff'),\n  color: websiteDesignTokenCssVar('colors', 'foreground', '#000'),\n  cursor: 'pointer',\n};\n\nexport function WebsiteConsentBanner(): ReactNode {\n  const consent = useWebsiteConsent();\n  const headingId = useId();\n  const [selected, setSelected] = useState<readonly ConsentPurpose[]>(consent.grantedPurposes);\n  // Re-seed from the stored decision each time the panel is re-opened, so it shows what is in force.\n  useEffect(() => setSelected(consent.grantedPurposes), [consent.grantedPurposes, consent.isSettingsOpen]);\n\n  const title = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.TITLE);\n  const description = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.DESCRIPTION);\n  const acceptAll = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.ACCEPT_ALL);\n  const declineAll = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.DECLINE_ALL);\n  const save = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.SAVE);\n  const essentialTitle = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.ESSENTIAL_TITLE);\n  const essentialDescription = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.ESSENTIAL_DESCRIPTION);\n\n  const offered = consent.purposesInUse;\n  // Purposes the panel does not offer keep their stored grant; offered ones are granted exactly when ticked.\n  const choose = (chosen: readonly ConsentPurpose[]): void =>\n    consent.decide([...consent.grantedPurposes.filter((purpose) => !offered.includes(purpose)), ...chosen]);\n\n  return (\n    <section\n      role=\"region\"\n      aria-labelledby={headingId}\n      data-website-consent-banner={consent.status === WebsiteConsentStatus.UNDECIDED ? 'undecided' : 'settings'}\n      style={{\n        /*\n         * BOTTOM-RIGHT CORNER, and the three properties together are what make that work on a phone\n         * too. `left` and `right` both bound the box to the viewport with a gutter; `maxWidth` caps it\n         * on a wide screen; `marginLeft: auto` pushes the remaining slack to the left so the box hugs\n         * the right edge. On a narrow screen the gutters bind before the cap does and it simply spans\n         * the width — a corner popup that overflowed a phone would be worse than a bar.\n         *\n         * Inline styles, not a media query: this ships into a static marketing page with no stylesheet\n         * of its own, which is the same constraint that keeps the rest of this file inline.\n         */\n        position: 'fixed',\n        left: '1rem',\n        right: '1rem',\n        bottom: '1rem',\n        zIndex: 9000,\n        maxWidth: '30rem',\n        marginLeft: 'auto',\n        /*\n         * The panel never exceeds the viewport, and its ACTIONS are never what gets cut off: the rows\n         * scroll inside `maxHeight`, the buttons sit outside that box. A panel that grows with its\n         * content pushes accept and reject off the bottom of a short screen — and a refusal that\n         * cannot be reached is a refusal that was not offered, whatever the markup says. `dvh` rather\n         * than `vh` because a mobile browser's toolbars make `vh` taller than the visible page.\n         */\n        maxHeight: '85dvh',\n        padding: '0.875rem 1rem',\n        display: 'flex',\n        flexDirection: 'column',\n        gap: '0.625rem',\n        background: websiteDesignTokenCssVar('colors', 'surface', '#fff'),\n        color: websiteDesignTokenCssVar('colors', 'surfaceForeground', '#000'),\n        border: `1px solid ${websiteDesignTokenCssVar('colors', 'border', '#ccc')}`,\n        borderRadius: websiteDesignTokenCssVar('radii', 'lg', '0.5rem'),\n      }}\n    >\n      <h2 id={headingId} style={{ margin: 0, fontSize: '1.125rem' }}>{title}</h2>\n      <p style={{ margin: 0 }}>{description}</p>\n      {/* `data-website-consent-rows` is the scroll box's own hook. A test anchoring on a style\n          substring instead matched the ROW (whose grid template also contains \"auto\") and asserted\n          nothing — the same vacuous pin the app tier already had to repair. */}\n      <div\n        data-website-consent-rows=\"\"\n        style={{ minHeight: 0, flex: 1, overflowY: 'auto', border: `1px solid ${websiteDesignTokenCssVar('colors', 'border', '#ccc')}`, borderRadius: websiteDesignTokenCssVar('radii', 'md', '0.375rem') }}\n      >\n        {/*\n          * The always-active row, first, carrying a CHECKED and DISABLED box. It is not a purpose the\n          * visitor decides — which is exactly why it is stated: a panel listing only the optional\n          * purposes leaves them unable to see what is happening on the site at all, which is the\n          * question they opened it to answer.\n          *\n          * It carried a text status instead until 2026-09-20, on the argument that a disabled control\n          * invites a click that cannot work. The reversal: a visitor scans DOWN the column of boxes,\n          * and a gap there does not read as \"cannot be changed\", it reads as a row that was\n          * forgotten. A disabled box says it in the vocabulary the rest of the list already uses.\n          */}\n        <div data-website-consent-essential=\"\" style={ROW_STYLE}>\n          {/*\n            * `aria-label`, because this row is a `div` rather than a `<label>` — nothing else names\n            * the control, and a checkbox with no accessible name is announced as an unlabelled\n            * checkbox. Its own note claimed AT would announce \"checked, unavailable\"; it announced\n            * no words at all.\n            *\n            * `readOnly` is gone: it is inert on a checkbox per HTML, and leaving it invites a later\n            * reader to delete `disabled` believing the lock survives.\n            */}\n          <input type=\"checkbox\" checked disabled aria-label={essentialTitle} style={ROW_CONTROL_STYLE} />\n          <span style={{ fontWeight: 600 }}>{essentialTitle}</span>\n          <span style={ROW_DESCRIPTION_STYLE}>{essentialDescription}</span>\n        </div>\n        {offered.map((purpose) => (\n          <PurposeChoice\n            key={purpose}\n            purpose={purpose}\n            checked={selected.includes(purpose)}\n            onChange={(checked) => setSelected((current) => (checked ? [...current.filter((entry) => entry !== purpose), purpose] : current.filter((entry) => entry !== purpose)))}\n          />\n        ))}\n      </div>\n      <div style={{ display: 'flex', flexWrap: 'wrap', gap: '0.5rem', justifyContent: 'flex-end' }}>\n        <button type=\"button\" style={BUTTON_STYLE} onClick={() => choose([])}>{declineAll}</button>\n        {/*\n          * SAVE appears only when a MIXED choice exists to save — two or more purposes in use.\n          *\n          * With one purpose the button is unanswerable: \"decline all\" and \"accept all\" already cover\n          * the whole space, so a third action beside them describes nothing a visitor can picture and\n          * reads as a question rather than an answer. Derived from the offered set, so a site that\n          * adds a second purpose gets the control with no edit here.\n          */}\n        {offered.length > 1 && (\n          <button type=\"button\" style={BUTTON_STYLE} onClick={() => choose(selected.filter((purpose) => offered.includes(purpose)))}>{save}</button>\n        )}\n        <button type=\"button\" style={BUTTON_STYLE} onClick={() => choose(offered)}>{acceptAll}</button>\n      </div>\n    </section>\n  );\n}\n\n/** The reopen affordance: always reachable once a visitor decided, so every choice can be changed. */\nexport function WebsiteConsentSettingsButton(): ReactNode {\n  const consent = useWebsiteConsent();\n  const manage = useWebsiteConsentSlotLabel(WebsiteConsentLabelSlot.MANAGE);\n  return (\n    <button type=\"button\" data-website-consent-manage=\"\" style={BUTTON_STYLE} onClick={consent.openSettings}>\n      {manage}\n    </button>\n  );\n}\n/** @wildo_source:part:end saas.website.consent.banner */\n"]}

package/dist/esm/core/consent/WebsiteConsentContext.d.ts

@@ -0,0 +1,85 @@
+import React, { type ReactNode } from 'react';
+import type { ConsentPurpose } from '@wildo-ai/saas-models/public-runtime';
+/**
+ * @wildo_source:part:start saas.website.consent.context facet:layer:core facet:family:website
+ *
+ * `WebsiteConsentContext` — a website visitor's consent state (#534), provided once per page by
+ * `WebsitePageLayout`.
+ *
+ * Consent is a SET of `ConsentPurpose`s, each granted or not on its own. Nothing optional runs until its
+ * purpose is granted: the layout's provider SDKs and scripts read `grantedPurposes`, and so does
+ * `<WebsiteConsentGate purpose={…}>`.
+ *
+ * `purposesInUse` is DERIVED from the live providers (`consentPurposesInUseByProviders`), so the panel asks
+ * about exactly the purposes this site processes and nothing else. A site running no consent-based
+ * provider shows no panel at all.
+ */
+export declare enum WebsiteConsentStatus {
+    /** The visitor has not decided — or their decision cannot be read. Nothing optional runs. */
+    UNDECIDED = "undecided",
+    /** The visitor decided; `grantedPurposes` is their answer, possibly empty. */
+    DECIDED = "decided"
+}
+export interface WebsiteConsentContextValue {
+    status: WebsiteConsentStatus;
+    /**
+     * `false` during the server render and the first client render, before storage has been read. A
+     * consent panel must not render while this is false: it would flash for a visitor who already decided,
+     * and differ from the static HTML. Optional behaviour stays off either way.
+     */
+    isResolved: boolean;
+    /** What the visitor granted. Empty while UNDECIDED. */
+    grantedPurposes: readonly ConsentPurpose[];
+    /** When the visitor decided, ISO-8601; absent while UNDECIDED. */
+    decidedAt?: string;
+    /** The purposes this site's live providers rest on — what a consent panel offers. */
+    purposesInUse: readonly ConsentPurpose[];
+    /** Whether the visitor re-opened the panel to change a decision already made. */
+    isSettingsOpen: boolean;
+    /** Whether `purpose` is granted. */
+    hasGranted: (purpose: ConsentPurpose) => boolean;
+    /** Record the WHOLE set the visitor grants — a purpose left out is not granted. Closes the panel. */
+    decide: (grantedPurposes: readonly ConsentPurpose[]) => void;
+    /** Re-open the panel so the visitor can change their decision. */
+    openSettings: () => void;
+    /** Close a re-opened panel without changing anything. */
+    closeSettings: () => void;
+}
+export declare const WebsiteConsentContext: React.Context<WebsiteConsentContextValue | null>;
+/**
+ * The narrow slice of `WebsiteAnonymousSessionClient` this provider needs, declared structurally
+ * rather than imported (#1258).
+ *
+ * Structural because the provider does not want the client's construction concerns — an `apiOrigin`
+ * and the application's own `frontendServiceName`, which only the application knows — and because it
+ * makes the durable write trivially substitutable in a test.
+ */
+export interface WebsiteConsentRecorder {
+    /**
+     * NOT generic, deliberately, though `WebsiteAnonymousSessionClient.requestAnonymous` is: this
+     * provider ignores the response entirely, so a type parameter here would be a promise to the caller
+     * that nothing keeps. The client's generic method satisfies this shape structurally.
+     *
+     * It takes the METHOD rather than being named after one. The consent door is a PUT — its operation
+     * borrows `UPDATE_MANY` — and this interface previously named `postAnonymous`, so every decision a
+     * visitor made 404'd, silently, by this provider's own (correct) design of never telling a visitor
+     * their privacy choice failed. A door's method is part of its address, so it is passed like one.
+     */
+    requestAnonymous(method: string, path: string, body: unknown): Promise<unknown>;
+}
+export interface WebsiteConsentProviderProps {
+    purposesInUse: readonly ConsentPurpose[];
+    /**
+     * OPTIONAL. When present, a decision is ALSO recorded server-side against the visitor's anonymous
+     * session, which is what lets it follow them into the account they go on to create (#1258).
+     *
+     * Absent is a first-class answer and is exactly today's behaviour: the decision lives in this
+     * browser and nowhere else. A site with no anonymous-session wiring keeps working, gates the same
+     * way, and simply carries nothing forward.
+     */
+    recorder?: WebsiteConsentRecorder;
+    children: ReactNode;
+}
+export declare function WebsiteConsentProvider({ purposesInUse, recorder, children }: WebsiteConsentProviderProps): ReactNode;
+/** @wildo_source:part:end saas.website.consent.context */
+//# sourceMappingURL=WebsiteConsentContext.d.ts.map

package/dist/esm/core/consent/WebsiteConsentContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebsiteConsentContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/consent/WebsiteConsentContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAA4D,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAExG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAS3E;;;;;;;;;;;;;GAaG;AACH,oBAAY,oBAAoB;IAC9B,6FAA6F;IAC7F,SAAS,cAAc;IACvB,8EAA8E;IAC9E,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,oBAAoB,CAAC;IAC7B;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,uDAAuD;IACvD,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,aAAa,EAAE,SAAS,cAAc,EAAE,CAAC;IACzC,iFAAiF;IACjF,cAAc,EAAE,OAAO,CAAC;IACxB,oCAAoC;IACpC,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IACjD,qGAAqG;IACrG,MAAM,EAAE,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,KAAK,IAAI,CAAC;IAC7D,kEAAkE;IAClE,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,yDAAyD;IACzD,aAAa,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAA0D,CAAC;AAE9I;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,SAAS,cAAc,EAAE,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,sBAAsB,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,2BAA2B,GAAG,SAAS,CAkEpH;AACD,0DAA0D"}