@bitvea/feedback-cli 1.0.0

package/dist/registration.js

@@ -0,0 +1,84 @@
+// Talking to the registration endpoint, and nothing else.
+//
+// The rule this file exists to keep is that the CLI does not know what a valid
+// project URL is. Registration's contract - normalise the URL, key on it, be
+// idempotent, lose the race gracefully - lives once in
+// `packages/api/src/services/projects.ts`, behind
+// `POST /api/v1/projects/register`. A second opinion here would be a second
+// implementation, and the failure mode of two implementations disagreeing is a
+// duplicate project: two rows for one deployment, each holding half its
+// feedback, with no way to merge them afterwards.
+//
+// So this module posts what it was given and translates the answer. It trims
+// no slashes, lowercases no hosts, and rejects nothing.
+/**
+ * A failure the person running the command can act on, as opposed to a bug.
+ * The CLI prints `message` and exits; nothing else is expected to catch it.
+ */
+export class RegistrationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "RegistrationError";
+    }
+}
+/** The real transport. Injected everywhere else so tests stay off the network. */
+export const postRegistration = async (input) => {
+    let res;
+    try {
+        res = await fetch(`${input.apiUrl}/api/v1/projects/register`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${input.apiKey}`,
+            },
+            body: JSON.stringify({
+                url: input.projectUrl,
+                repoOwner: input.repoOwner,
+                repoSlug: input.repoSlug,
+                packageName: input.packageName,
+                origins: input.origins,
+            }),
+        });
+    }
+    catch (err) {
+        // DNS, TLS, a wrong host, no network in the build container. Worth naming
+        // the URL: the commonest cause is an --api-url pointing at nothing.
+        throw new RegistrationError(`could not reach ${input.apiUrl} (${String(err)}). Check --api-url.`);
+    }
+    if (res.status === 401) {
+        // The commonest real failure, and the one a bare status code explains
+        // worst. Absent, mistyped and revoked all answer 401 on purpose - the
+        // route refuses to be an oracle for which - so say all three.
+        throw new RegistrationError("the deploy key was refused (401): it is missing, wrong or revoked. " +
+            "Create one in the dashboard under Settings > Deploy keys, then pass it as " +
+            "--api-key or set FEEDBACK_TOOLBAR_API_KEY.");
+    }
+    if (!res.ok) {
+        // The backend's own error code, verbatim. `invalid_project_url` is the one
+        // that matters, and paraphrasing it here would be the beginning of a
+        // second set of validation rules.
+        const code = await res
+            .json()
+            .then((body) => body !== null && typeof body === "object" && "error" in body
+            ? String(body.error)
+            : undefined)
+            .catch(() => undefined);
+        // The one refusal a build operator can act on, and the one whose bare code
+        // explains nothing. A deploy key belongs to exactly one agency and may
+        // register URLs into that agency alone, so this fires when the URL is
+        // already registered somewhere the key cannot write. What it deliberately
+        // does NOT say is where: the route answers one opaque code precisely so it
+        // cannot be used to enumerate which deployment URLs exist in an install and
+        // which customer runs them, and repeating a guess here would give away by
+        // paraphrase what the status code refuses to give away directly.
+        if (code === "project_url_unavailable") {
+            throw new RegistrationError(`${input.projectUrl} cannot be registered with this deploy key (409). ` +
+                "Either it is already registered outside this key's agency, or the key " +
+                "belongs to a different agency than the one that should own it. Check " +
+                "which key the build is using under Settings > Deploy keys.");
+        }
+        throw new RegistrationError(`registration failed with ${res.status}${code ? ` (${code})` : ""}.`);
+    }
+    return (await res.json());
+};
+//# sourceMappingURL=registration.js.map

package/dist/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../src/registration.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AACvD,kDAAkD;AAClD,4EAA4E;AAC5E,+EAA+E;AAC/E,wEAAwE;AACxE,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,wDAAwD;AAmCxD;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAA6B,KAAK,EAAE,KAAK,EAAE,EAAE;IACxE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,2BAA2B,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,UAAU;gBACrB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,IAAI,iBAAiB,CACzB,mBAAmB,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,qBAAqB,CACrE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,sEAAsE;QACtE,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,IAAI,iBAAiB,CACzB,qEAAqE;YACnE,4EAA4E;YAC5E,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,2EAA2E;QAC3E,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,IAAI,GAAG,MAAM,GAAG;aACnB,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,IAAa,EAAE,EAAE,CACtB,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI;YAC1D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,SAAS,CACd;aACA,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE1B,2EAA2E;QAC3E,uEAAuE;QACvE,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,CAAC,UAAU,oDAAoD;gBACrE,wEAAwE;gBACxE,uEAAuE;gBACvE,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;AACvD,CAAC,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,14 @@
+export interface RunOptions {
+    /**
+     * The version of `@bitvea/feedback-toolbar` the caller was launched
+     * through, when there was one.
+     *
+     * Only `@bitvea/feedback-toolbar`'s own bin passes this, from the
+     * `package.json` sitting next to it, and it is the third rung of the ladder
+     * in ./toolbarVersion.ts - the one every `npx @bitvea/feedback-toolbar init`
+     * takes. Absent when this CLI was run directly.
+     */
+    toolbarVersion?: string | undefined;
+}
+export declare function run(argv: string[], options?: RunOptions): Promise<number>;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AA4CA,MAAM,WAAW,UAAU;IACzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AA2PD,wBAAsB,GAAG,CACvB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,UAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CAoBjB"}

package/dist/run.js

@@ -0,0 +1,293 @@
+// The command table, as a function: argv in, exit code out.
+//
+// THIS PACKAGE HAS ZERO RUNTIME DEPENDENCIES, and its publishable check fails
+// if `dependencies` is ever non-empty. That is not asceticism. The whole
+// reason the installer was hard to grow inside the toolbar is that every
+// argument parser, every colour library, every prompt library it might want
+// would land in a customer's browser app - and after the split it still would,
+// because `@bitvea/feedback-toolbar` depends on this package, so this package
+// is installed transitively into every app that installs the toolbar. Moving
+// the files without taking the dependency budget with them would buy a package
+// boundary and nothing else. Node's standard library covers what this CLI
+// needs: `node:util`'s `parseArgs` and `styleText` when the hand-rolled flag
+// reader below stops being enough, `node:readline` if a prompt is ever wanted.
+//
+// `run` is exported from the package root rather than being reachable only as
+// a bin, and that is what lets `@bitvea/feedback-toolbar`'s own `bin` be an
+// in-process call instead of a subprocess: same argv, same stdout, same exit
+// codes, because it is the same function in the same process.
+//
+// Everything of substance is in commands/init.ts and commands/register.ts,
+// behind an InstallerFs and an injected transport respectively. This file is
+// the part that touches the real disk and the real network, parses argv, and
+// turns a thrown error into an exit code and a message a developer can act on.
+//
+// `register` is a first-class command rather than a step inside `init`,
+// because two install paths need it on its own: a Next.js app runs it from its
+// build (init wires it in as `prebuild`), and a script-tag install has no
+// build at all and runs it once from a terminal or CI.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { mkdirSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { init } from "./commands/init.js";
+import { API_KEY_ENV_VAR, register } from "./commands/register.js";
+import { RegistrationError, postRegistration } from "./registration.js";
+import { InjectionError, PACKAGE_NAME } from "./install/strategies.js";
+import { ToolbarVersionError, resolveToolbarRange, } from "./toolbarVersion.js";
+const realFs = {
+    exists: (path) => existsSync(path),
+    readFile: (path) => readFileSync(path, "utf8"),
+    writeFile: (path, contents) => {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, contents, "utf8");
+    },
+};
+// The usage text names `feedback-toolbar`, not this package, and that is
+// deliberate rather than stale. `npx @bitvea/feedback-toolbar init` is printed
+// on the product's homepage, in two dashboard panels and in a `prebuild` line
+// committed in repositories nobody here controls; this package's name is an
+// implementation detail that nobody should have to learn. The text is also
+// read by both packages' publishable checks, which compare this stdout byte
+// for byte across the launcher and this bin - so it says the same thing
+// whichever door a person came in through.
+const USAGE = `feedback-toolbar - BitVea Feedback installer
+
+  init      Install the toolbar into the app in the current directory.
+  register  Make sure this deployment exists as a project in the dashboard.
+
+  npx @bitvea/feedback-toolbar init --api-url https://feedback.bitvea.com
+  npx @bitvea/feedback-toolbar register --project-url https://myapp.com --api-key <key>
+
+Flags
+
+  --api-url <url>       BitVea Feedback backend. Falls back to
+                        NEXT_PUBLIC_FEEDBACK_TOOLBAR_API_URL.
+  --project-url <url>   The deployment to register. Falls back to
+                        VERCEL_PROJECT_PRODUCTION_URL, then VERCEL_URL.
+  --api-key <key>       Deploy key. Falls back to FEEDBACK_TOOLBAR_API_KEY,
+                        which is the better place for it: a key on a command
+                        line ends up in shell history and CI logs. It is never
+                        written to disk and never reaches a browser.
+  --root <path>         The app to work on. Defaults to the current directory.
+  --environment <name>  init, script-tag installs only: what the injected tag
+                        declares. Defaults to "preview", which is what makes it
+                        mount; pass "production" to leave the tag inert.
+  --toolbar-version <r> init only: the range to write into package.json for
+                        @bitvea/feedback-toolbar. Defaults to the version this
+                        command was launched through, then to the latest on the
+                        registry. Nothing is guessed: if neither answers, the
+                        install refuses rather than pin a number nobody chose.
+  --optional            register only: report a failure and exit 0. This is
+                        what the prebuild hook uses, so a registration problem
+                        can never fail somebody's deploy.
+  --version             Print versions. Two packages are in play since the
+                        installer moved out of the toolbar, so this prints both
+                        when it knows both.`;
+function readFlag(argv, name) {
+    const withEquals = argv.find((a) => a.startsWith(`--${name}=`));
+    if (withEquals)
+        return withEquals.slice(name.length + 3);
+    const index = argv.indexOf(`--${name}`);
+    return index >= 0 ? argv[index + 1] : undefined;
+}
+/**
+ * The host app's package name, which the backend uses to name a project when
+ * there is no git metadata to name it from. Best effort by design: a missing
+ * or unreadable package.json is not a reason to refuse to register.
+ */
+function readPackageName(root) {
+    const path = join(root, "package.json");
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const pkg = JSON.parse(readFileSync(path, "utf8"));
+        return pkg.name;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * This package's own version, read off its own manifest.
+ *
+ * `../package.json` from this module resolves to the package root from both
+ * `src/` and `dist/`, which is why nothing here has to be stamped at build
+ * time. Unknown rather than fatal: `--version` failing to read a manifest is
+ * not a reason to fail the process it was asked to describe.
+ */
+function cliVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8"));
+        return pkg.version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+async function runInit(argv, options) {
+    const apiUrl = readFlag(argv, "api-url") ??
+        process.env.NEXT_PUBLIC_FEEDBACK_TOOLBAR_API_URL;
+    if (!apiUrl) {
+        console.error("missing --api-url. Pass the BitVea Feedback backend URL, e.g.\n" +
+            "  npx @bitvea/feedback-toolbar init --api-url https://feedback.bitvea.com");
+        return 1;
+    }
+    // Resolved lazily, and reported once: only the npm route writes a
+    // dependency, and a script-tag install on a machine with no registry must
+    // not be refused for a number it will never use.
+    let resolved;
+    try {
+        const result = await init(realFs, {
+            root: readFlag(argv, "root") ?? process.cwd(),
+            apiUrl,
+            // Only needed to register the project from this machine, which is the
+            // exception rather than the rule: the prebuild step init writes is what
+            // normally registers, from a build environment that has the key.
+            apiKey: readFlag(argv, "api-key") ?? process.env.FEEDBACK_TOOLBAR_API_KEY,
+            projectUrl: readFlag(argv, "project-url"),
+            environment: readFlag(argv, "environment"),
+            resolveToolbarRange: async () => {
+                resolved = await resolveToolbarRange({
+                    flag: readFlag(argv, "toolbar-version"),
+                    launcherVersion: options.toolbarVersion,
+                    env: process.env,
+                });
+                return resolved.range;
+            },
+            registerProject: postRegistration,
+            env: process.env,
+        });
+        if (result.alreadyInstalled) {
+            console.log("Already installed. Nothing to change.");
+            for (const note of result.notes)
+                console.log(`  - ${note}`);
+            return 0;
+        }
+        console.log(`Installed via the ${result.strategy} strategy:`);
+        for (const change of result.changes)
+            console.log(`  - ${change}`);
+        for (const note of result.notes)
+            console.log(`  - ${note}`);
+        const provenance = resolved && describeRange(resolved);
+        if (provenance)
+            console.log(`  - ${provenance}`);
+        // What is actually left to do, named. The previous sign-off ("redeploy to
+        // finish") was wrong in a way that cost a whole issue: the deploy key is
+        // a secret, it can only come from the build environment, and without it
+        // the prebuild step registers nothing and no project ever appears.
+        console.log(result.delivery === "script-tag"
+            ? "\nDeploy the page to finish. Nothing to install.\n" +
+                "Then register the project once, from a terminal or CI:\n" +
+                `  npx ${PACKAGE_NAME} register --api-url ${apiUrl} --project-url <url> --api-key <key>`
+            : "\nTwo things left:\n" +
+                "  1. install dependencies, commit, and deploy\n" +
+                `  2. set ${API_KEY_ENV_VAR} in your hosting provider's environment variables\n` +
+                "     (dashboard > Settings > Deploy keys)\n" +
+                "The build then registers this deployment itself, on every deploy. The backend\n" +
+                "URL needs no configuration: it is committed in package.json and in your layout.");
+        return 0;
+    }
+    catch (err) {
+        if (err instanceof InjectionError || err instanceof ToolbarVersionError) {
+            console.error(`Could not install: ${err.message}`);
+            return 1;
+        }
+        throw err;
+    }
+}
+/**
+ * Where that range came from, when the person running this did not choose it.
+ *
+ * Silent for `--toolbar-version` and `FEEDBACK_TOOLBAR_VERSION`, because
+ * telling somebody what they just typed is noise. The other two are worth a
+ * line: the number is about to be committed in their repository, and which of
+ * the two answered is the difference between "the toolbar you just downloaded"
+ * and "whatever npm currently calls latest".
+ */
+function describeRange(resolved) {
+    switch (resolved.source) {
+        case "launcher":
+            return "that range is the toolbar this command was launched through";
+        case "registry":
+            return "that range is the latest published version";
+        default:
+            return undefined;
+    }
+}
+async function runRegister(argv) {
+    const root = readFlag(argv, "root") ?? process.cwd();
+    // See USAGE: the prebuild hook passes this so that a registration problem
+    // is reported and forgiven rather than failing the host app's deploy.
+    const optional = argv.includes("--optional");
+    try {
+        const outcome = await register({
+            apiUrl: readFlag(argv, "api-url"),
+            apiKey: readFlag(argv, "api-key"),
+            projectUrl: readFlag(argv, "project-url"),
+            packageName: readPackageName(root),
+            env: process.env,
+            registerProject: postRegistration,
+        });
+        // Two distinct successes, said differently on purpose: somebody running
+        // this by hand needs to know whether they just created a project, and
+        // somebody reading a build log needs to see that a repeat run is normal.
+        if (outcome.created) {
+            const named = outcome.projectName ? ` as "${outcome.projectName}"` : "";
+            console.log(`Registered ${outcome.projectUrl}${named}. It is in the dashboard now.`);
+        }
+        else {
+            console.log(`${outcome.projectUrl} is already registered. Nothing to do.`);
+        }
+        return 0;
+    }
+    catch (err) {
+        if (err instanceof RegistrationError) {
+            if (optional) {
+                console.warn(`feedback-toolbar register: skipped - ${err.message}`);
+                return 0;
+            }
+            console.error(`Could not register: ${err.message}`);
+            return 1;
+        }
+        throw err;
+    }
+}
+/**
+ * Both numbers, because after the split there are two.
+ *
+ * The installer and the component it installs now ship as separate packages on
+ * separate version lines, so "which halves are in play" stopped being
+ * answerable from the outside - and it is the first question of every support
+ * conversation about an install. No network: this reports what is on this
+ * machine, not what could be.
+ */
+function runVersion(options) {
+    console.log(`@bitvea/feedback-cli ${cliVersion()}`);
+    if (options.toolbarVersion) {
+        console.log(`${PACKAGE_NAME} ${options.toolbarVersion}`);
+    }
+    return 0;
+}
+export async function run(argv, options = {}) {
+    const command = argv[0];
+    switch (command) {
+        case "init":
+            return runInit(argv, options);
+        case "register":
+            return runRegister(argv);
+        case "help":
+        case "--help":
+        case "-h":
+            console.log(USAGE);
+            return 0;
+        case "--version":
+        case "-v":
+            return runVersion(options);
+        default:
+            console.error(USAGE);
+            return 1;
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,6EAA6E;AAC7E,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,0EAA0E;AAC1E,uDAAuD;AACvD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAe1B,MAAM,MAAM,GAAgB;IAC1B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC5B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;CACF,CAAC;AAEF,yEAAyE;AACzE,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,2CAA2C;AAC3C,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAgC8B,CAAC;AAE7C,SAAS,QAAQ,CAAC,IAAc,EAAE,IAAY;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;QACxE,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAChB,CAAC;QACzC,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,OAAmB;IACxD,MAAM,MAAM,GACV,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CACX,iEAAiE;YAC/D,2EAA2E,CAC9E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,kEAAkE;IAClE,0EAA0E;IAC1E,iDAAiD;IACjD,IAAI,QAA0C,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;YAChC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE;YAC7C,MAAM;YACN,sEAAsE;YACtE,wEAAwE;YACxE,iEAAiE;YACjE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACzE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;YACzC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;YAC1C,mBAAmB,EAAE,KAAK,IAAI,EAAE;gBAC9B,QAAQ,GAAG,MAAM,mBAAmB,CAAC;oBACnC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;oBACvC,eAAe,EAAE,OAAO,CAAC,cAAc;oBACvC,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;YACD,eAAe,EAAE,gBAAgB;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,QAAQ,YAAY,CAAC,CAAC;QAC9D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,UAAU;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,UAAU,EAAE,CAAC,CAAC;QACjD,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,QAAQ,KAAK,YAAY;YAC9B,CAAC,CAAC,oDAAoD;gBAClD,0DAA0D;gBAC1D,SAAS,YAAY,uBAAuB,MAAM,sCAAsC;YAC5F,CAAC,CAAC,sBAAsB;gBACpB,iDAAiD;gBACjD,YAAY,eAAe,qDAAqD;gBAChF,6CAA6C;gBAC7C,iFAAiF;gBACjF,iFAAiF,CACxF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxE,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,QAA8B;IACnD,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxB,KAAK,UAAU;YACb,OAAO,6DAA6D,CAAC;QACvE,KAAK,UAAU;YACb,OAAO,4CAA4C,CAAC;QACtD;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAc;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACrD,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;YAC7B,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YACjC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YACjC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;YACzC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC;YAClC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,eAAe,EAAE,gBAAgB;SAClC,CAAC,CAAC;QAEH,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,UAAU,GAAG,KAAK,+BAA+B,CACxE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,GAAG,OAAO,CAAC,UAAU,wCAAwC,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wCAAwC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpE,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,OAAmB;IACrC,OAAO,CAAC,GAAG,CAAC,wBAAwB,UAAU,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAAc,EACd,UAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChC,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,CAAC,CAAC;QACX,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B;YACE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/toolbarVersion.d.ts

@@ -0,0 +1,36 @@
+/** Where the answer came from, so `--version` and `init` can say. */
+export type ToolbarRangeSource = "flag" | "env" | "launcher" | "registry";
+export declare const TOOLBAR_VERSION_ENV_VAR = "FEEDBACK_TOOLBAR_VERSION";
+export interface ToolbarRangeInput {
+    /** `--toolbar-version`. */
+    flag?: string | undefined;
+    /** What the launcher in `@bitvea/feedback-toolbar` read off its own disk. */
+    launcherVersion?: string | undefined;
+    env: Record<string, string | undefined>;
+    /** Injected so tests stay off the network. */
+    fetchLatestVersion?: () => Promise<string | undefined>;
+}
+export interface ResolvedToolbarRange {
+    /** The range as it will be written, e.g. `^1.1.2`. */
+    range: string;
+    source: ToolbarRangeSource;
+}
+/**
+ * A refusal the person running the command can act on, as opposed to a bug.
+ * Carries the remedy, because the remedy is a flag they can type immediately.
+ */
+export declare class ToolbarVersionError extends Error {
+    constructor(message: string);
+}
+export declare function resolveToolbarRange(input: ToolbarRangeInput): Promise<ResolvedToolbarRange>;
+/**
+ * A bare `x.y.z` becomes `^x.y.z`; anything that already reads as a range is
+ * written through untouched.
+ *
+ * Untouched rather than normalised, because the shapes a person reaches for
+ * here - an exact pin, a `~`, a dist-tag like `next` - are all things they
+ * mean, and quietly turning a pin into a caret would be this command
+ * overruling the one decision it was explicitly told.
+ */
+export declare function asRange(value: string): string;
+//# sourceMappingURL=toolbarVersion.d.ts.map

package/dist/toolbarVersion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolbarVersion.d.ts","sourceRoot":"","sources":["../src/toolbarVersion.ts"],"names":[],"mappings":"AA0CA,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,UAAU,CAAC;AAE1E,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAoB/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG7C"}

package/dist/toolbarVersion.js

@@ -0,0 +1,106 @@
+// Which version of `@bitvea/feedback-toolbar` `init` writes into a host app.
+//
+// This used to be one literal in `init.ts`, rewritten by the toolbar's release
+// script at publish time. That coupling could not survive the split - a
+// release script editing another package's source is a boundary in name only,
+// and a CLI published between two toolbar releases would carry a number
+// nothing could tell it was stale. So the number is asked for, in this order,
+// and the order is the whole design:
+//
+//   1. `--toolbar-version <range>`, for pinning deliberately, and for tests.
+//   2. FEEDBACK_TOOLBAR_VERSION in the environment, for a CI that pins.
+//   3. What the launcher passed, which it read out of the installed
+//      `@bitvea/feedback-toolbar/package.json` sitting next to it. This is the
+//      normal path - `npx @bitvea/feedback-toolbar init` - and it is correct
+//      by construction: whatever version npx just resolved is the version
+//      written into the host app, including `@1.1.2`, `@pr-42` and an old pin.
+//      The baked literal got exactly those cases wrong and could not express
+//      them at all.
+//   4. The registry, once, with a short timeout. This is the
+//      `npx @bitvea/feedback-cli init` path, where there is no toolbar next to
+//      us to ask. `init` on that path is interactive and has network by
+//      definition, since npx just used it.
+//
+// And then it REFUSES. There is deliberately no fallback constant: a fallback
+// is the stale literal wearing a different name, and it would be stale exactly
+// on the path that has no launcher to correct it. `init` already refuses
+// before touching the tree for everything else that can fail, and a range is
+// the most consequential thing it writes into a stranger's committed
+// package.json - so a refusal that names `--toolbar-version` beats a wrong
+// number committed under their name.
+/** The package whose version is being resolved. Never imported, only named. */
+const TOOLBAR_PACKAGE = "@bitvea/feedback-toolbar";
+const REGISTRY_URL = `https://registry.npmjs.org/${TOOLBAR_PACKAGE}/latest`;
+/**
+ * Long enough for a warm registry, short enough that a machine with no route
+ * to npm reaches the refusal while somebody is still watching the terminal.
+ */
+const REGISTRY_TIMEOUT_MS = 3_000;
+export const TOOLBAR_VERSION_ENV_VAR = "FEEDBACK_TOOLBAR_VERSION";
+/**
+ * A refusal the person running the command can act on, as opposed to a bug.
+ * Carries the remedy, because the remedy is a flag they can type immediately.
+ */
+export class ToolbarVersionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ToolbarVersionError";
+    }
+}
+export async function resolveToolbarRange(input) {
+    if (input.flag)
+        return { range: asRange(input.flag), source: "flag" };
+    const fromEnv = input.env[TOOLBAR_VERSION_ENV_VAR];
+    if (fromEnv)
+        return { range: asRange(fromEnv), source: "env" };
+    if (input.launcherVersion) {
+        return { range: asRange(input.launcherVersion), source: "launcher" };
+    }
+    const latest = await (input.fetchLatestVersion ?? fetchLatestVersion)();
+    if (latest)
+        return { range: asRange(latest), source: "registry" };
+    throw new ToolbarVersionError(`could not tell which version of ${TOOLBAR_PACKAGE} to install, and this ` +
+        "command will not guess one: the range goes into your committed " +
+        "package.json.\n" +
+        "Pass it: --toolbar-version ^1.2.0 (or set " +
+        `${TOOLBAR_VERSION_ENV_VAR}).`);
+}
+/**
+ * A bare `x.y.z` becomes `^x.y.z`; anything that already reads as a range is
+ * written through untouched.
+ *
+ * Untouched rather than normalised, because the shapes a person reaches for
+ * here - an exact pin, a `~`, a dist-tag like `next` - are all things they
+ * mean, and quietly turning a pin into a caret would be this command
+ * overruling the one decision it was explicitly told.
+ */
+export function asRange(value) {
+    const trimmed = value.trim();
+    return /^\d+\.\d+\.\d+(?:[-+].+)?$/.test(trimmed) ? `^${trimmed}` : trimmed;
+}
+/**
+ * One GET of the registry's `latest` document. Every failure - no network, a
+ * proxy, a 404, a body that is not what we expect - is the same answer here:
+ * nothing, so the caller refuses. Nothing is inferred from a failed lookup.
+ */
+async function fetchLatestVersion() {
+    try {
+        const res = await fetch(REGISTRY_URL, {
+            headers: { accept: "application/json" },
+            signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return undefined;
+        const body = await res.json();
+        if (body !== null && typeof body === "object" && "version" in body) {
+            const version = body.version;
+            if (typeof version === "string" && version.length > 0)
+                return version;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=toolbarVersion.js.map

package/dist/toolbarVersion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolbarVersion.js","sourceRoot":"","sources":["../src/toolbarVersion.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,qCAAqC;AACrC,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,oEAAoE;AACpE,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,oBAAoB;AACpB,6DAA6D;AAC7D,+EAA+E;AAC/E,wEAAwE;AACxE,2CAA2C;AAC3C,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,yEAAyE;AACzE,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,qCAAqC;AAErC,+EAA+E;AAC/E,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,MAAM,YAAY,GAAG,8BAA8B,eAAe,SAAS,CAAC;AAE5E;;;GAGG;AACH,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAKlC,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAkBlE;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAwB;IAExB,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAEtE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAE/D,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,EAAE,CAAC;IACxE,IAAI,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAElE,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,eAAe,wBAAwB;QACxE,iEAAiE;QACjE,iBAAiB;QACjB,4CAA4C;QAC5C,GAAG,uBAAuB,IAAI,CACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACnE,MAAM,OAAO,GAAI,IAA8B,CAAC,OAAO,CAAC;YACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,OAAO,CAAC;QACxE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@bitvea/feedback-cli",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "BitVea Feedback installer: install the toolbar into an app, and register a deployment as a project",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "feedback-cli": "./dist/bin.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "eslint": "^10.9.1",
+    "typescript": "^6.0.0",
+    "vitest": "^2.1.9",
+    "@bitvea/release-tools": "0.0.0",
+    "@bitvea/config": "0.0.0"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/add-emitted-import-extensions.mjs",
+    "check-publishable": "node scripts/check-publishable.mjs",
+    "release": "node scripts/release.mjs",
+    "type-check": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint .",
+    "test": "vitest run --passWithNoTests",
+    "clean": "rm -rf dist .turbo *.tsbuildinfo"
+  }
+}