@bitvea/feedback-toolbar 0.0.1

package/dist/capture.d.ts

@@ -0,0 +1,58 @@
+import { type FeedbackMetadata } from "./vendor/types/index.js";
+import type { ToolbarConfig } from "./config.js";
+/** Read the page context. Pure apart from reading `window`/`document`. */
+export declare function captureMetadata(config: ToolbarConfig): FeedbackMetadata;
+/**
+ * Capture the current viewport as a PNG data URL, or null when the browser
+ * will not produce one.
+ *
+ * ## Why this is a DOM rasteriser and not `getDisplayMedia`
+ *
+ * The product promises an *automatic* screenshot on every submission. The
+ * platform's own capture API cannot deliver that: `getDisplayMedia` raises the
+ * browser's screen/window/tab picker on every call, the grant cannot be kept,
+ * and `preferCurrentTab` - the hint that makes the picker a single click - is
+ * Chromium-only, so a reviewer on Firefox or Safari picks a surface by hand for
+ * every piece of feedback they file. A modal dialog in the middle of the core
+ * flow is not automatic; it is the thing most likely to make a reviewer stop
+ * filing feedback at all.
+ *
+ * Rejected alternatives:
+ *
+ *   - *Keep `getDisplayMedia`, retain the stream and reuse it across
+ *     submissions.* A retained stream keeps the browser's "sharing this tab"
+ *     indicator lit for the whole session. Leaving a reviewer to believe they
+ *     are still being recorded, on somebody else's staging site, to save one
+ *     dialog, is not a trade worth making.
+ *   - *A rasteriser dependency (html2canvas and friends).* This bundle ships
+ *     into every reviewed preview deployment, and CLAUDE.md section 8 puts a
+ *     100 KB gzipped ceiling on a package without written justification.
+ *     html2canvas is tens of kilobytes gzipped, so the ceiling is not really
+ *     the objection - the objection is that both it and html-to-image
+ *     reimplement the same `foreignObject` trick that `rasterise.ts` does in
+ *     about 300 lines and 2.5 KB minified and gzipped (measured with esbuild),
+ *     and a toolbar with no dependencies is one less thing to keep in step
+ *     with whatever build the host app happens to have.
+ *   - *A hybrid: rasterise by default, offer `getDisplayMedia` as an opt-in
+ *     "capture the real pixels" button.* Tempting, but there are two submit
+ *     surfaces (the panel and the pin composer) and the affordance would have
+ *     to appear identically on both to avoid teaching the reviewer that a pin
+ *     and a general report capture different things. That is worth revisiting
+ *     when somebody actually asks for pixel-exact capture; it is not worth
+ *     shipping speculatively.
+ *
+ * Null stays a supported outcome all the way through. `screenshot` is optional
+ * on the wire and nullable in the database, because losing a reviewer's words
+ * to a failed screenshot would be the worse trade.
+ */
+export declare function captureScreenshot(): Promise<string | null>;
+/**
+ * Capture ONE element the reviewer pointed at, or null.
+ *
+ * Same posture as `captureScreenshot`: a capture that cannot be produced is a
+ * missing picture, never a failed reply. Everything about a report is more
+ * useful than nothing about it, so every failure here returns null and the
+ * words still get sent.
+ */
+export declare function captureElement(element: Element): Promise<string | null>;
+//# sourceMappingURL=capture.d.ts.map

package/dist/capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../src/capture.ts"],"names":[],"mappings":"AAOA,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAI9C,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CAgBvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQhE;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAM7E"}

package/dist/capture.js

@@ -0,0 +1,98 @@
+// What the toolbar records about the page without asking the reviewer.
+//
+// The whole point of this product is that a report arrives attached to the
+// page, branch and commit it is about, so none of this is typed by a human and
+// none of it is optional to collect. It is collected at submission time rather
+// than on open, because a reviewer may have scrolled, resized or navigated in
+// between.
+import { SCREENSHOT_DATA_URL_MAX } from "./vendor/types/index.js";
+import { currentPageUrl } from "./deepLink.js";
+import { rasteriseElement, rasteriseViewport } from "./rasterise.js";
+/** Read the page context. Pure apart from reading `window`/`document`. */
+export function captureMetadata(config) {
+    return {
+        // The page's identity, which has no fragment at all - see the note at the
+        // top of deepLink.ts. Two failures this avoids: a reviewer who followed a
+        // deep link and then filed a report of their own would file it against a
+        // URL carrying our fragment, which no other surface ever queries; and a
+        // report filed at `/pricing#plans` would be invisible to a deep link,
+        // which cannot carry the host's fragment and ours at once.
+        pageUrl: currentPageUrl(),
+        viewportWidth: window.innerWidth,
+        viewportHeight: window.innerHeight,
+        userAgent: navigator.userAgent,
+        gitBranch: config.gitBranch,
+        gitCommit: config.gitCommit,
+        environment: config.environment,
+    };
+}
+/**
+ * Capture the current viewport as a PNG data URL, or null when the browser
+ * will not produce one.
+ *
+ * ## Why this is a DOM rasteriser and not `getDisplayMedia`
+ *
+ * The product promises an *automatic* screenshot on every submission. The
+ * platform's own capture API cannot deliver that: `getDisplayMedia` raises the
+ * browser's screen/window/tab picker on every call, the grant cannot be kept,
+ * and `preferCurrentTab` - the hint that makes the picker a single click - is
+ * Chromium-only, so a reviewer on Firefox or Safari picks a surface by hand for
+ * every piece of feedback they file. A modal dialog in the middle of the core
+ * flow is not automatic; it is the thing most likely to make a reviewer stop
+ * filing feedback at all.
+ *
+ * Rejected alternatives:
+ *
+ *   - *Keep `getDisplayMedia`, retain the stream and reuse it across
+ *     submissions.* A retained stream keeps the browser's "sharing this tab"
+ *     indicator lit for the whole session. Leaving a reviewer to believe they
+ *     are still being recorded, on somebody else's staging site, to save one
+ *     dialog, is not a trade worth making.
+ *   - *A rasteriser dependency (html2canvas and friends).* This bundle ships
+ *     into every reviewed preview deployment, and CLAUDE.md section 8 puts a
+ *     100 KB gzipped ceiling on a package without written justification.
+ *     html2canvas is tens of kilobytes gzipped, so the ceiling is not really
+ *     the objection - the objection is that both it and html-to-image
+ *     reimplement the same `foreignObject` trick that `rasterise.ts` does in
+ *     about 300 lines and 2.5 KB minified and gzipped (measured with esbuild),
+ *     and a toolbar with no dependencies is one less thing to keep in step
+ *     with whatever build the host app happens to have.
+ *   - *A hybrid: rasterise by default, offer `getDisplayMedia` as an opt-in
+ *     "capture the real pixels" button.* Tempting, but there are two submit
+ *     surfaces (the panel and the pin composer) and the affordance would have
+ *     to appear identically on both to avoid teaching the reviewer that a pin
+ *     and a general report capture different things. That is worth revisiting
+ *     when somebody actually asks for pixel-exact capture; it is not worth
+ *     shipping speculatively.
+ *
+ * Null stays a supported outcome all the way through. `screenshot` is optional
+ * on the wire and nullable in the database, because losing a reviewer's words
+ * to a failed screenshot would be the worse trade.
+ */
+export async function captureScreenshot() {
+    try {
+        return await rasteriseViewport(SCREENSHOT_DATA_URL_MAX);
+    }
+    catch {
+        // Unsupported, blocked, or a DOM that would not serialise. All the same to
+        // the caller.
+        return null;
+    }
+}
+/**
+ * Capture ONE element the reviewer pointed at, or null.
+ *
+ * Same posture as `captureScreenshot`: a capture that cannot be produced is a
+ * missing picture, never a failed reply. Everything about a report is more
+ * useful than nothing about it, so every failure here returns null and the
+ * words still get sent.
+ */
+export async function captureElement(element) {
+    try {
+        return await rasteriseElement(element, SCREENSHOT_DATA_URL_MAX);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=capture.js.map

package/dist/capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.js","sourceRoot":"","sources":["../src/capture.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,WAAW;AACX,OAAO,EAAE,uBAAuB,EAAyB,MAAM,eAAe,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAElE,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,OAAO;QACL,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,OAAO,EAAE,cAAc,EAAE;QACzB,aAAa,EAAE,MAAM,CAAC,UAAU;QAChC,cAAc,EAAE,MAAM,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,cAAc;QACd,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/cli/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/cli/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":""}

package/dist/cli/bin.js

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+// The `npx @bitvea/feedback-toolbar` entry point: two commands, `init` and
+// `register`.
+//
+// Everything of substance is in init.ts and register.ts, behind an InstallerFs
+// and an injected transport respectively. This file is the part that touches
+// the real disk and the real network, parses argv, and turns a thrown error
+// into an exit code and a message a developer can act on.
+//
+// `register` is a first-class command rather than a step inside `init`,
+// because two install paths need it on its own: a Next.js app runs it from its
+// build (init wires it in as `prebuild`), and a script-tag install has no
+// build at all and runs it once from a terminal or CI.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { mkdirSync } from "node:fs";
+import { init } from "./init.js";
+import { API_KEY_ENV_VAR, register } from "./register.js";
+import { RegistrationError, postRegistration } from "./registration.js";
+import { InjectionError, PACKAGE_NAME } from "./strategies.js";
+const realFs = {
+    exists: (path) => existsSync(path),
+    readFile: (path) => readFileSync(path, "utf8"),
+    writeFile: (path, contents) => {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, contents, "utf8");
+    },
+};
+const USAGE = `feedback-toolbar - BitVea Feedback installer
+
+  init      Install the toolbar into the app in the current directory.
+  register  Make sure this deployment exists as a project in the dashboard.
+
+  npx @bitvea/feedback-toolbar init --api-url https://feedback.bitvea.com
+  npx @bitvea/feedback-toolbar register --project-url https://myapp.com --api-key <key>
+
+Flags
+
+  --api-url <url>       BitVea Feedback backend. Falls back to
+                        NEXT_PUBLIC_FEEDBACK_TOOLBAR_API_URL.
+  --project-url <url>   The deployment to register. Falls back to
+                        VERCEL_PROJECT_PRODUCTION_URL, then VERCEL_URL.
+  --api-key <key>       Deploy key. Falls back to FEEDBACK_TOOLBAR_API_KEY,
+                        which is the better place for it: a key on a command
+                        line ends up in shell history and CI logs. It is never
+                        written to disk and never reaches a browser.
+  --root <path>         The app to work on. Defaults to the current directory.
+  --environment <name>  init, script-tag installs only: what the injected tag
+                        declares. Defaults to "preview", which is what makes it
+                        mount; pass "production" to leave the tag inert.
+  --optional            register only: report a failure and exit 0. This is
+                        what the prebuild hook uses, so a registration problem
+                        can never fail somebody's deploy.`;
+function readFlag(argv, name) {
+    const withEquals = argv.find((a) => a.startsWith(`--${name}=`));
+    if (withEquals)
+        return withEquals.slice(name.length + 3);
+    const index = argv.indexOf(`--${name}`);
+    return index >= 0 ? argv[index + 1] : undefined;
+}
+/**
+ * The host app's package name, which the backend uses to name a project when
+ * there is no git metadata to name it from. Best effort by design: a missing
+ * or unreadable package.json is not a reason to refuse to register.
+ */
+function readPackageName(root) {
+    const path = join(root, "package.json");
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const pkg = JSON.parse(readFileSync(path, "utf8"));
+        return pkg.name;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function runInit(argv) {
+    const apiUrl = readFlag(argv, "api-url") ??
+        process.env.NEXT_PUBLIC_FEEDBACK_TOOLBAR_API_URL;
+    if (!apiUrl) {
+        console.error("missing --api-url. Pass the BitVea Feedback backend URL, e.g.\n" +
+            "  npx @bitvea/feedback-toolbar init --api-url https://feedback.bitvea.com");
+        return 1;
+    }
+    try {
+        const result = await init(realFs, {
+            root: readFlag(argv, "root") ?? process.cwd(),
+            apiUrl,
+            // Only needed to register the project from this machine, which is the
+            // exception rather than the rule: the prebuild step init writes is what
+            // normally registers, from a build environment that has the key.
+            apiKey: readFlag(argv, "api-key") ?? process.env.FEEDBACK_TOOLBAR_API_KEY,
+            projectUrl: readFlag(argv, "project-url"),
+            environment: readFlag(argv, "environment"),
+            registerProject: postRegistration,
+            env: process.env,
+        });
+        if (result.alreadyInstalled) {
+            console.log("Already installed. Nothing to change.");
+            for (const note of result.notes)
+                console.log(`  - ${note}`);
+            return 0;
+        }
+        console.log(`Installed via the ${result.strategy} strategy:`);
+        for (const change of result.changes)
+            console.log(`  - ${change}`);
+        for (const note of result.notes)
+            console.log(`  - ${note}`);
+        // What is actually left to do, named. The previous sign-off ("redeploy to
+        // finish") was wrong in a way that cost a whole issue: the deploy key is
+        // a secret, it can only come from the build environment, and without it
+        // the prebuild step registers nothing and no project ever appears.
+        console.log(result.delivery === "script-tag"
+            ? "\nDeploy the page to finish. Nothing to install.\n" +
+                "Then register the project once, from a terminal or CI:\n" +
+                `  npx ${PACKAGE_NAME} register --api-url ${apiUrl} --project-url <url> --api-key <key>`
+            : "\nTwo things left:\n" +
+                "  1. install dependencies, commit, and deploy\n" +
+                `  2. set ${API_KEY_ENV_VAR} in your hosting provider's environment variables\n` +
+                "     (dashboard > Settings > Deploy keys)\n" +
+                "The build then registers this deployment itself, on every deploy. The backend\n" +
+                "URL needs no configuration: it is committed in package.json and in your layout.");
+        return 0;
+    }
+    catch (err) {
+        if (err instanceof InjectionError) {
+            console.error(`Could not install: ${err.message}`);
+            return 1;
+        }
+        throw err;
+    }
+}
+async function runRegister(argv) {
+    const root = readFlag(argv, "root") ?? process.cwd();
+    // See USAGE: the prebuild hook passes this so that a registration problem
+    // is reported and forgiven rather than failing the host app's deploy.
+    const optional = argv.includes("--optional");
+    try {
+        const outcome = await register({
+            apiUrl: readFlag(argv, "api-url"),
+            apiKey: readFlag(argv, "api-key"),
+            projectUrl: readFlag(argv, "project-url"),
+            packageName: readPackageName(root),
+            env: process.env,
+            registerProject: postRegistration,
+        });
+        // Two distinct successes, said differently on purpose: somebody running
+        // this by hand needs to know whether they just created a project, and
+        // somebody reading a build log needs to see that a repeat run is normal.
+        if (outcome.created) {
+            const named = outcome.projectName ? ` as "${outcome.projectName}"` : "";
+            console.log(`Registered ${outcome.projectUrl}${named}. It is in the dashboard now.`);
+        }
+        else {
+            console.log(`${outcome.projectUrl} is already registered. Nothing to do.`);
+        }
+        return 0;
+    }
+    catch (err) {
+        if (err instanceof RegistrationError) {
+            if (optional) {
+                console.warn(`feedback-toolbar register: skipped - ${err.message}`);
+                return 0;
+            }
+            console.error(`Could not register: ${err.message}`);
+            return 1;
+        }
+        throw err;
+    }
+}
+async function main() {
+    const argv = process.argv.slice(2);
+    const command = argv[0];
+    switch (command) {
+        case "init":
+            return runInit(argv);
+        case "register":
+            return runRegister(argv);
+        case "help":
+        case "--help":
+        case "-h":
+            console.log(USAGE);
+            return 0;
+        default:
+            console.error(USAGE);
+            return 1;
+    }
+}
+main().then((code) => {
+    process.exitCode = code;
+}, (err) => {
+    console.error(err);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=bin.js.map

package/dist/cli/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":";AACA,2EAA2E;AAC3E,cAAc;AACd,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,0EAA0E;AAC1E,uDAAuD;AACvD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAE9B,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,MAAM,GAAgB;IAC1B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC5B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;CACF,CAAC;AAEF,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;0DAwB4C,CAAC;AAE3D,SAAS,QAAQ,CAAC,IAAc,EAAE,IAAY;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;QACxE,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAc;IACnC,MAAM,MAAM,GACV,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CACX,iEAAiE;YAC/D,2EAA2E,CAC9E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;YAChC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE;YAC7C,MAAM;YACN,sEAAsE;YACtE,wEAAwE;YACxE,iEAAiE;YACjE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACzE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;YACzC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;YAC1C,eAAe,EAAE,gBAAgB;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,QAAQ,YAAY,CAAC,CAAC;QAC9D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC5D,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,QAAQ,KAAK,YAAY;YAC9B,CAAC,CAAC,oDAAoD;gBAClD,0DAA0D;gBAC1D,SAAS,YAAY,uBAAuB,MAAM,sCAAsC;YAC5F,CAAC,CAAC,sBAAsB;gBACpB,iDAAiD;gBACjD,YAAY,eAAe,qDAAqD;gBAChF,6CAA6C;gBAC7C,iFAAiF;gBACjF,iFAAiF,CACxF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAc;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACrD,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;YAC7B,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YACjC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YACjC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;YACzC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC;YAClC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,eAAe,EAAE,gBAAgB;SAClC,CAAC,CAAC;QAEH,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,UAAU,GAAG,KAAK,+BAA+B,CACxE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,GAAG,OAAO,CAAC,UAAU,wCAAwC,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wCAAwC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpE,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,CAAC,CAAC;QACX;YACE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE;IACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;IACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CACF,CAAC"}

package/dist/cli/fs.d.ts

@@ -0,0 +1,16 @@
+export interface InstallerFs {
+    exists(path: string): boolean;
+    readFile(path: string): string;
+    writeFile(path: string, contents: string): void;
+}
+/** An in-memory tree, which is what the installer's tests run against. */
+export declare class MemoryFs implements InstallerFs {
+    readonly files: Map<string, string>;
+    constructor(files?: Record<string, string>);
+    exists(path: string): boolean;
+    readFile(path: string): string;
+    writeFile(path: string, contents: string): void;
+}
+/** Join path segments with `/`, collapsing the duplicates that creep in. */
+export declare function joinPath(...parts: string[]): string;
+//# sourceMappingURL=fs.d.ts.map

package/dist/cli/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/cli/fs.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACjD;AAED,0EAA0E;AAC1E,qBAAa,QAAS,YAAW,WAAW;IAC1C,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAExB,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAI9C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAM9B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;CAGhD;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAKnD"}

package/dist/cli/fs.js

@@ -0,0 +1,33 @@
+// The filesystem the installer talks to, as an interface.
+//
+// The installer edits somebody else's repository, so its tests need to run
+// against a tree they fully control, and a codemod tested only against the
+// real disk is a codemod nobody dares change. Everything below the interface
+// is a handful of thin wrappers; everything above it is pure logic.
+/** An in-memory tree, which is what the installer's tests run against. */
+export class MemoryFs {
+    files;
+    constructor(files = {}) {
+        this.files = new Map(Object.entries(files));
+    }
+    exists(path) {
+        return this.files.has(path);
+    }
+    readFile(path) {
+        const contents = this.files.get(path);
+        if (contents === undefined)
+            throw new Error(`no such file: ${path}`);
+        return contents;
+    }
+    writeFile(path, contents) {
+        this.files.set(path, contents);
+    }
+}
+/** Join path segments with `/`, collapsing the duplicates that creep in. */
+export function joinPath(...parts) {
+    return parts
+        .filter((p) => p.length > 0)
+        .join("/")
+        .replace(/\/{2,}/g, "/");
+}
+//# sourceMappingURL=fs.js.map

package/dist/cli/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/cli/fs.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,oEAAoE;AAQpE,0EAA0E;AAC1E,MAAM,OAAO,QAAQ;IACV,KAAK,CAAsB;IAEpC,YAAY,QAAgC,EAAE;QAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,QAAgB;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,GAAG,KAAe;IACzC,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/cli/init.d.ts

@@ -0,0 +1,75 @@
+import { API_URL_ENV_VAR } from "../config.js";
+import { type InstallerFs } from "./fs.js";
+export { API_URL_ENV_VAR };
+import { type Delivery, type InjectionStrategy } from "./strategies.js";
+import type { RegisterProjectTransport } from "./registration.js";
+/**
+ * The command wired into the host app's build, and the marker that says it is
+ * already wired. `--optional` is load-bearing: see the comment on
+ * `wirePrebuild` for why a registration failure must not fail a deploy.
+ */
+export declare const REGISTER_COMMAND = "feedback-toolbar register";
+/**
+ * The prebuild line, with the backend URL BAKED IN.
+ *
+ * This is the second half of #11's reopened acceptance criterion, and the
+ * reason it reopened twice. `register` resolves its backend URL from a flag or
+ * from the build environment - and the build environment does not have it:
+ * `init` writes `NEXT_PUBLIC_FEEDBACK_TOOLBAR_API_URL` into `.env.local`,
+ * which create-next-app gitignores, and a plain node process does not load a
+ * dotenv file anyway. So on a real Vercel build the prebuild step threw "no
+ * backend URL", `--optional` turned that into one warning line, and no project
+ * ever appeared.
+ *
+ * package.json IS committed, so putting the URL here is what carries it into
+ * the build. It is a public URL, not a credential; the key still comes from
+ * `FEEDBACK_TOOLBAR_API_KEY` in the build environment and from nowhere else.
+ */
+export declare function prebuildScript(apiUrl: string): string;
+export interface InitOptions {
+    /** Repository root to install into. */
+    root: string;
+    /** Base URL of the BitVea Feedback backend. */
+    apiUrl: string;
+    /**
+     * Deploy key authorising registration. Optional: without it the install
+     * still happens, and only the registration step is skipped - the prebuild
+     * step this writes registers on the next build instead.
+     */
+    apiKey?: string;
+    /** Deployment URL to register the project under, when it is known. */
+    projectUrl?: string;
+    /**
+     * What a script-tag install declares as its environment. Ignored by the npm
+     * route, which reads the host build's own `NEXT_PUBLIC_VERCEL_ENV`.
+     */
+    environment?: string;
+    /** Injected so tests do not have to reach the network. */
+    registerProject?: RegisterProjectTransport;
+    /** Env bag, for the Vercel git metadata. Defaults to `process.env`. */
+    env?: Record<string, string | undefined>;
+    strategies?: readonly InjectionStrategy[];
+}
+export interface InitResult {
+    /** What actually changed, one line each, for the CLI to print. */
+    changes: string[];
+    /**
+     * Things worth saying that are not changes: a project that was already
+     * registered, or a registration that did not go through. These are kept
+     * apart from `changes` because `alreadyInstalled` is derived from that
+     * list, and a re-run must still report itself as a no-op even though it
+     * talks to the backend every time.
+     */
+    notes: string[];
+    /** True when nothing needed doing, which is what a re-run should report. */
+    alreadyInstalled: boolean;
+    strategy: string;
+    /**
+     * How the host app gets the code. Reported because it decides what the
+     * developer has to do next: an npm install needs a dependency install and a
+     * redeploy, a script tag needs neither.
+     */
+    delivery: Delivery;
+}
+export declare function init(fs: InstallerFs, options: InitOptions): Promise<InitResult>;
+//# sourceMappingURL=init.d.ts.map

package/dist/cli/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAY,KAAK,WAAW,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,OAAO,EAML,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAK/D;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;OAMG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,wBAAsB,IAAI,CACxB,EAAE,EAAE,WAAW,EACf,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CA4KrB"}