@cometchat/skills-cli 2.0.0

package/dist/registry/v6/features/catalog.json

@@ -0,0 +1,344 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "version": "1.0.0",
+  "sdk_compatibility": ">=6.0.0 <7.0.0",
+  "description": "Catalog of CometChat features available in the React UI Kit. Categorized by what work is needed to enable each one.",
+  "feature_types": {
+    "default": "Already enabled by default in the UI Kit components your integration uses. Zero code changes needed — the skill just shows you which component renders it.",
+    "dashboard-toggle": "Requires flipping a toggle in the CometChat Dashboard at https://app.cometchat.com. Some have their UI decorator auto-attached by the UI Kit (auto_wired_in_uikit: true) — the dashboard flip is the only thing needed. Others additionally require passing the extension to UIKitSettingsBuilder.setExtensions([...]) before init.",
+    "package-install": "Requires installing an additional npm package. The UI Kit's initiateAfterLogin() auto-calls enableCalling() which detects the calls SDK and wires up call buttons. Currently calls only.",
+    "component-swap": "Requires replacing one UI Kit component with a drop-in variant. One-line change. The SDK currently ships exactly one such variant (CometChatCompactMessageComposer for rich text formatting); more variants will become catalog entries here as the SDK adds them."
+  },
+  "features": [
+    {
+      "id": "instant-messaging",
+      "name": "Instant Messaging",
+      "type": "default",
+      "description": "Real-time text messaging via CometChatMessageList + CometChatMessageComposer. The core of every chat experience.",
+      "components": ["CometChatMessageList", "CometChatMessageComposer"],
+      "docs_topic": "core-features#instant-messaging"
+    },
+    {
+      "id": "media-sharing",
+      "name": "Media Sharing",
+      "type": "default",
+      "description": "Send images, videos, audio, and documents within conversations. Built into CometChatMessageComposer's ActionSheet.",
+      "components": ["CometChatMessageComposer"],
+      "docs_topic": "core-features#media-sharing"
+    },
+    {
+      "id": "read-receipts",
+      "name": "Read Receipts",
+      "type": "default",
+      "description": "See when messages have been delivered and read. Visible in message bubbles and the Conversations list.",
+      "components": ["CometChatMessageList", "CometChatConversations"],
+      "docs_topic": "core-features#read-receipts"
+    },
+    {
+      "id": "mark-as-unread",
+      "name": "Mark as Unread",
+      "type": "default",
+      "description": "Manually mark conversations or messages as unread.",
+      "components": ["CometChatMessageList"],
+      "docs_topic": "core-features#mark-as-unread"
+    },
+    {
+      "id": "typing-indicator",
+      "name": "Typing Indicator",
+      "type": "default",
+      "description": "Real-time typing awareness. Shows in CometChatMessageHeader and CometChatConversations.",
+      "components": ["CometChatMessageHeader", "CometChatConversations"],
+      "docs_topic": "core-features#typing-indicator"
+    },
+    {
+      "id": "user-presence",
+      "name": "User Presence",
+      "type": "default",
+      "description": "Online/offline status across Conversations, Message Header, Users, and Group Members.",
+      "components": ["CometChatConversations", "CometChatMessageHeader", "CometChatUsers", "CometChatGroupMembers"],
+      "docs_topic": "core-features#user-presence"
+    },
+    {
+      "id": "reactions",
+      "name": "Reactions",
+      "type": "default",
+      "description": "React to messages with emojis without typing a full response.",
+      "components": ["CometChatMessageList"],
+      "docs_topic": "core-features#reactions"
+    },
+    {
+      "id": "mentions",
+      "name": "Mentions",
+      "type": "default",
+      "description": "Address specific users with @username, including @all for groups.",
+      "components": ["CometChatMessageComposer", "CometChatMessageList"],
+      "docs_topic": "core-features#mentions"
+    },
+    {
+      "id": "threaded-conversations",
+      "name": "Threaded Conversations",
+      "type": "default",
+      "description": "Reply to specific messages in a thread, keeping conversations organized.",
+      "components": ["CometChatMessageList", "CometChatThreadHeader"],
+      "docs_topic": "core-features#threaded-conversations"
+    },
+    {
+      "id": "quoted-replies",
+      "name": "Quoted Replies",
+      "type": "default",
+      "description": "Quote a specific message when replying to maintain context.",
+      "components": ["CometChatMessageComposer", "CometChatMessageList"],
+      "docs_topic": "core-features#quoted-replies"
+    },
+    {
+      "id": "group-chat",
+      "name": "Group Chat",
+      "type": "default",
+      "description": "Multi-participant conversations via CometChatGroups.",
+      "components": ["CometChatGroups"],
+      "docs_topic": "core-features#group-chat"
+    },
+    {
+      "id": "report-message",
+      "name": "Report Message",
+      "type": "default",
+      "description": "Users can flag inappropriate messages with predefined reasons.",
+      "components": ["CometChatMessageList"],
+      "docs_topic": "core-features#report-message"
+    },
+    {
+      "id": "search",
+      "name": "Conversation and Advanced Search",
+      "type": "default",
+      "description": "Full-text search across conversations, messages, and media.",
+      "components": ["CometChatSearch"],
+      "docs_topic": "core-features#search"
+    },
+    {
+      "id": "moderation",
+      "name": "Moderation",
+      "type": "default",
+      "description": "Automatic content filtering. Requires moderation rule configuration in the dashboard.",
+      "components": ["CometChatMessageList"],
+      "docs_topic": "core-features#moderation",
+      "requires_dashboard_setup": true
+    },
+    {
+      "id": "bitly",
+      "name": "Bitly URL Shortening",
+      "type": "dashboard-toggle",
+      "description": "Automatically shorten long URLs in messages using Bitly.",
+      "dashboard_path": "Extensions → Bitly → Toggle on",
+      "docs_topic": "extensions#bitly"
+    },
+    {
+      "id": "link-preview",
+      "name": "Link Preview",
+      "type": "dashboard-toggle",
+      "auto_wired_in_uikit": true,
+      "description": "Show URL previews with title, description, and thumbnail. UI decorator auto-attached by the UI Kit (in defaultExtensions[]).",
+      "dashboard_path": "Extensions → Link Preview → Toggle on",
+      "docs_topic": "extensions#link-preview"
+    },
+    {
+      "id": "message-shortcuts",
+      "name": "Message Shortcuts",
+      "type": "dashboard-toggle",
+      "description": "Expand predefined short codes into full messages.",
+      "dashboard_path": "Extensions → Message Shortcuts → Configure shortcuts",
+      "docs_topic": "extensions#message-shortcuts"
+    },
+    {
+      "id": "pin-message",
+      "name": "Pin Message",
+      "type": "dashboard-toggle",
+      "description": "Pin important messages for easy access.",
+      "dashboard_path": "Extensions → Pin Message → Toggle on",
+      "docs_topic": "extensions#pin-message"
+    },
+    {
+      "id": "rich-media-preview",
+      "name": "Rich Media Preview",
+      "type": "dashboard-toggle",
+      "description": "Generate rich preview panels for URLs via iFramely.",
+      "dashboard_path": "Extensions → Rich Media Preview → Toggle on",
+      "docs_topic": "extensions#rich-media-preview"
+    },
+    {
+      "id": "save-message",
+      "name": "Save Message",
+      "type": "dashboard-toggle",
+      "description": "Bookmark messages privately for later.",
+      "dashboard_path": "Extensions → Save Message → Toggle on",
+      "docs_topic": "extensions#save-message"
+    },
+    {
+      "id": "thumbnail-generation",
+      "name": "Thumbnail Generation",
+      "type": "dashboard-toggle",
+      "auto_wired_in_uikit": true,
+      "description": "Auto-generate thumbnails for shared media to reduce bandwidth. UI decorator auto-attached by the UI Kit (in defaultExtensions[]).",
+      "dashboard_path": "Extensions → Thumbnail Generation → Toggle on",
+      "docs_topic": "extensions#thumbnail-generation"
+    },
+    {
+      "id": "tinyurl",
+      "name": "TinyURL Shortening",
+      "type": "dashboard-toggle",
+      "description": "Shorten URLs using TinyURL service.",
+      "dashboard_path": "Extensions → TinyURL → Toggle on",
+      "docs_topic": "extensions#tinyurl"
+    },
+    {
+      "id": "voice-transcription",
+      "name": "Voice Transcription",
+      "type": "dashboard-toggle",
+      "description": "Convert audio messages to text automatically.",
+      "dashboard_path": "Extensions → Voice Transcription → Toggle on",
+      "docs_topic": "extensions#voice-transcription"
+    },
+    {
+      "id": "giphy",
+      "name": "Giphy GIFs",
+      "type": "dashboard-toggle",
+      "description": "Search and share GIFs from Giphy.",
+      "dashboard_path": "Extensions → Giphy → Configure API key",
+      "docs_topic": "extensions#giphy"
+    },
+    {
+      "id": "message-translation",
+      "name": "Message Translation",
+      "type": "dashboard-toggle",
+      "auto_wired_in_uikit": true,
+      "description": "Translate messages into the user's locale. UI decorator auto-attached by the UI Kit (in defaultExtensions[]).",
+      "dashboard_path": "Extensions → Message Translation → Toggle on",
+      "docs_topic": "extensions#message-translation"
+    },
+    {
+      "id": "polls",
+      "name": "Polls",
+      "type": "dashboard-toggle",
+      "auto_wired_in_uikit": true,
+      "description": "Create polls in group discussions with preset answers. UI decorator auto-attached by the UI Kit (in defaultExtensions[]).",
+      "dashboard_path": "Extensions → Polls → Toggle on",
+      "docs_topic": "extensions#polls"
+    },
+    {
+      "id": "reminders",
+      "name": "Reminders",
+      "type": "dashboard-toggle",
+      "description": "Set message reminders or personal notifications via bot.",
+      "dashboard_path": "Extensions → Reminders → Toggle on",
+      "docs_topic": "extensions#reminders"
+    },
+    {
+      "id": "stickers",
+      "name": "Stickers",
+      "type": "dashboard-toggle",
+      "auto_wired_in_uikit": true,
+      "description": "Send pre-designed stickers in conversations. UI decorator auto-attached by the UI Kit (in defaultExtensions[]).",
+      "dashboard_path": "Extensions → Stickers → Toggle on",
+      "docs_topic": "extensions#stickers"
+    },
+    {
+      "id": "stipop",
+      "name": "Stipop Sticker Library",
+      "type": "dashboard-toggle",
+      "description": "Integrates the Stipop sticker library.",
+      "dashboard_path": "Extensions → Stipop → Configure API key",
+      "docs_topic": "extensions#stipop"
+    },
+    {
+      "id": "tenor",
+      "name": "Tenor GIFs",
+      "type": "dashboard-toggle",
+      "description": "Search and share GIFs from Tenor.",
+      "dashboard_path": "Extensions → Tenor → Configure API key",
+      "docs_topic": "extensions#tenor"
+    },
+    {
+      "id": "collaborative-document",
+      "name": "Collaborative Document",
+      "type": "dashboard-toggle",
+      "auto_wired_in_uikit": true,
+      "description": "Real-time shared document editing. UI decorator auto-attached by the UI Kit (in defaultExtensions[]).",
+      "dashboard_path": "Extensions → Collaborative Document → Toggle on",
+      "docs_topic": "extensions#collaborative-document"
+    },
+    {
+      "id": "collaborative-whiteboard",
+      "name": "Collaborative Whiteboard",
+      "type": "dashboard-toggle",
+      "auto_wired_in_uikit": true,
+      "description": "Shared whiteboard for drawing and brainstorming. UI decorator auto-attached by the UI Kit (in defaultExtensions[]).",
+      "dashboard_path": "Extensions → Collaborative Whiteboard → Toggle on",
+      "docs_topic": "extensions#collaborative-whiteboard"
+    },
+    {
+      "id": "disappearing-messages",
+      "name": "Disappearing Messages",
+      "type": "dashboard-toggle",
+      "description": "Messages auto-delete after a specified interval.",
+      "dashboard_path": "Extensions → Disappearing Messages → Configure interval",
+      "docs_topic": "extensions#disappearing-messages"
+    },
+    {
+      "id": "chatwoot",
+      "name": "Chatwoot Integration",
+      "type": "dashboard-toggle",
+      "description": "Route messages to Chatwoot for customer support.",
+      "dashboard_path": "Extensions → Chatwoot → Configure webhook",
+      "docs_topic": "extensions#chatwoot"
+    },
+    {
+      "id": "intercom",
+      "name": "Intercom Integration",
+      "type": "dashboard-toggle",
+      "description": "Integrate Intercom for in-app customer support.",
+      "dashboard_path": "Extensions → Intercom → Configure API key",
+      "docs_topic": "extensions#intercom"
+    },
+    {
+      "id": "conversation-starter",
+      "name": "AI Conversation Starter",
+      "type": "dashboard-toggle",
+      "description": "AI-generated opening messages for new chats.",
+      "dashboard_path": "AI Features → Conversation Starter → Toggle on",
+      "docs_topic": "ai-features#conversation-starter"
+    },
+    {
+      "id": "smart-replies",
+      "name": "AI Smart Replies",
+      "type": "dashboard-toggle",
+      "description": "AI-generated contextual response suggestions.",
+      "dashboard_path": "AI Features → Smart Replies → Toggle on",
+      "docs_topic": "ai-features#smart-replies"
+    },
+    {
+      "id": "conversation-summary",
+      "name": "AI Conversation Summary",
+      "type": "dashboard-toggle",
+      "description": "AI-generated recaps of extended conversations.",
+      "dashboard_path": "AI Features → Conversation Summary → Toggle on",
+      "docs_topic": "ai-features#conversation-summary"
+    },
+    {
+      "id": "calls",
+      "name": "Audio/Video Calls",
+      "type": "package-install",
+      "description": "1:1 and group audio/video calling. Includes call buttons in headers, incoming/outgoing call UI, and call logs. Requires installing @cometchat/calls-sdk-javascript.",
+      "package": "@cometchat/calls-sdk-javascript",
+      "components": ["CometChatIncomingCall", "CometChatOutgoingCall", "CometChatCallLogs"],
+      "docs_topic": "call-features"
+    },
+    {
+      "id": "rich-text-formatting",
+      "name": "Rich Text Formatting",
+      "type": "component-swap",
+      "description": "Bold, italic, underline, code, links, lists in messages. Replace CometChatMessageComposer with CometChatCompactMessageComposer.",
+      "swap_from": "CometChatMessageComposer",
+      "swap_to": "CometChatCompactMessageComposer",
+      "docs_topic": "core-features#rich-text-formatting"
+    }
+  ]
+}

package/dist/registry/v6/production/astro/cometchat-token.ts.tpl

@@ -0,0 +1,86 @@
+/**
+ * /api/cometchat-token — server-side endpoint that mints CometChat auth tokens.
+ *
+ * Astro API route. The Auth Key NEVER leaves the server. The client calls
+ * this endpoint to get a short-lived auth token, then passes it to
+ * CometChatUIKit.loginWithAuthToken().
+ *
+ * Generated by `cometchat production-auth`. Customize freely:
+ *   - Add real authentication: read the user's session cookie / JWT here
+ *   - Map your app's user IDs to CometChat UIDs
+ *   - Add rate limiting if exposed publicly
+ *
+ * Astro requirement: your astro.config.mjs must have `output: 'server'` or
+ * `output: 'hybrid'` for API routes to work. Static-only Astro builds
+ * cannot run server-side endpoints.
+ *
+ * Security note: this file MUST NOT use PUBLIC_* env vars for the Auth Key.
+ * The whole point is to keep the Auth Key out of the browser.
+ */
+import type { APIRoute } from "astro";
+
+const COMETCHAT_APP_ID = import.meta.env.PUBLIC_COMETCHAT_APP_ID!;
+const COMETCHAT_REGION = import.meta.env.PUBLIC_COMETCHAT_REGION!;
+// IMPORTANT: server-only — no PUBLIC_ prefix
+const COMETCHAT_AUTH_KEY = import.meta.env.COMETCHAT_AUTH_KEY!;
+
+export const GET: APIRoute = async ({ request }) => {
+  const url = new URL(request.url);
+  // ⚠ Replace this with your real auth: read the session, extract the user ID,
+  // then map it to a CometChat UID. Do not trust the query param in production.
+  const uid = url.searchParams.get("uid") ?? "cometchat-uid-1";
+
+  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
+    return new Response(
+      JSON.stringify({ error: "CometChat credentials not configured on the server" }),
+      { status: 500, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  try {
+    const res = await fetch(
+      `https://${COMETCHAT_APP_ID}.api-${COMETCHAT_REGION}.cometchat.io/v3/users/${encodeURIComponent(uid)}/auth_tokens`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          appid: COMETCHAT_APP_ID,
+          apikey: COMETCHAT_AUTH_KEY,
+        },
+      },
+    );
+
+    if (!res.ok) {
+      const text = await res.text();
+      return new Response(
+        JSON.stringify({ error: `CometChat token mint failed (${res.status})`, detail: text }),
+        { status: 502, headers: { "Content-Type": "application/json" } },
+      );
+    }
+
+    const body = (await res.json()) as { data?: { authToken?: string } };
+    const authToken = body.data?.authToken;
+    if (!authToken) {
+      return new Response(
+        JSON.stringify({ error: "CometChat returned no authToken in response" }),
+        { status: 502, headers: { "Content-Type": "application/json" } },
+      );
+    }
+
+    return new Response(JSON.stringify({ authToken, uid }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  } catch (err) {
+    return new Response(
+      JSON.stringify({
+        error: "Token mint failed",
+        detail: err instanceof Error ? err.message : String(err),
+      }),
+      { status: 500, headers: { "Content-Type": "application/json" } },
+    );
+  }
+};
+
+// Astro requires this for non-static routes
+export const prerender = false;

package/dist/registry/v6/production/astro.template.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "../../schemas/template.schema.json",
+  "version": "1.0.0",
+  "experience_id": 1,
+  "framework": "astro",
+  "sdk_compatibility": ">=6.0.0 <7.0.0",
+  "default_placement": "dedicated-route",
+  "deps": [],
+  "env_vars": [
+    {
+      "name": "COMETCHAT_AUTH_KEY",
+      "required": true,
+      "secret": true,
+      "description": "Server-side only Auth Key (no PUBLIC_ prefix). Used by the /api/cometchat-token endpoint to mint user-scoped auth tokens. Remove PUBLIC_COMETCHAT_AUTH_KEY from .env — that variable is for development only and exposes the key to the browser."
+    },
+    {
+      "name": "PUBLIC_COMETCHAT_APP_ID",
+      "required": true,
+      "description": "Same as before — App ID is safe to expose"
+    },
+    {
+      "name": "PUBLIC_COMETCHAT_REGION",
+      "required": true,
+      "description": "Same as before — region is safe to expose"
+    }
+  ],
+  "files": [
+    {
+      "path": "src/pages/api/cometchat-token.ts",
+      "action": "create",
+      "template_ref": "cometchat-token.ts.tpl",
+      "owned": true
+    }
+  ],
+  "verify_rules": [],
+  "next_steps": [
+    "1. Make sure your astro.config.mjs has output: 'server' or 'hybrid' (API endpoints need SSR-capable output).",
+    "2. Add COMETCHAT_AUTH_KEY (NO PUBLIC_ prefix) to .env with your CometChat Auth Key.",
+    "3. REMOVE PUBLIC_COMETCHAT_AUTH_KEY from .env (keep APP_ID and REGION).",
+    "4. In src/cometchat/ChatApp.tsx, replace the login flow:",
+    "   FROM: CometChatUIKit.login('cometchat-uid-1').then(setUser).catch(setError);",
+    "   TO:   fetch('/api/cometchat-token?uid=' + encodeURIComponent(userId))",
+    "           .then(r => r.json())",
+    "           .then(data => CometChatUIKit.loginWithAuthToken(data.authToken))",
+    "           .then(setUser)",
+    "           .catch(e => setError(String(e)));",
+    "5. Replace 'cometchat-uid-1' with your real authenticated user's ID.",
+    "6. Restart the dev server (`npm run dev`) so the new env var takes effect.",
+    "7. The Auth Key is now ONLY in server memory — never sent to the browser."
+  ]
+}

package/dist/registry/v6/production/nextjs/route.ts.tpl

@@ -0,0 +1,79 @@
+/**
+ * /api/cometchat-token — server-side endpoint that mints CometChat auth tokens.
+ *
+ * This is the production-mode replacement for client-side login(UID) + Auth Key.
+ * The Auth Key NEVER leaves the server. The client calls this endpoint to get
+ * a short-lived auth token, then passes it to CometChatUIKit.loginWithAuthToken().
+ *
+ * Generated by `cometchat production-auth`. Customize freely:
+ *   - Add real authentication: read the user's session cookie / JWT here, do
+ *     not trust the `?uid=` query param in production.
+ *   - Map your app's user IDs to CometChat UIDs.
+ *   - Add rate limiting if exposed publicly.
+ *   - Cache tokens per UID for short windows to reduce CometChat API load.
+ *
+ * Security note: this file MUST NOT use NEXT_PUBLIC_* env vars for the Auth Key.
+ * The whole point of this endpoint is to keep the Auth Key out of the browser.
+ */
+import { NextRequest, NextResponse } from "next/server";
+
+const COMETCHAT_APP_ID = process.env.NEXT_PUBLIC_COMETCHAT_APP_ID!;
+const COMETCHAT_REGION = process.env.NEXT_PUBLIC_COMETCHAT_REGION!;
+// IMPORTANT: server-only — no NEXT_PUBLIC_ prefix
+const COMETCHAT_AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
+
+export async function GET(request: NextRequest) {
+  // ⚠ Replace this with your real auth: read the session, extract the user ID,
+  // then map it to a CometChat UID. Do not trust the query param in production.
+  const uid = request.nextUrl.searchParams.get("uid") ?? "cometchat-uid-1";
+
+  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
+    return NextResponse.json(
+      { error: "CometChat credentials not configured on the server" },
+      { status: 500 },
+    );
+  }
+
+  try {
+    // Mint a fresh auth token for this UID via the CometChat REST API.
+    // Endpoint: POST https://{appId}.api-{region}.cometchat.io/v3/users/{uid}/auth_tokens
+    const res = await fetch(
+      `https://${COMETCHAT_APP_ID}.api-${COMETCHAT_REGION}.cometchat.io/v3/users/${encodeURIComponent(uid)}/auth_tokens`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          appid: COMETCHAT_APP_ID,
+          apikey: COMETCHAT_AUTH_KEY,
+        },
+      },
+    );
+
+    if (!res.ok) {
+      const text = await res.text();
+      return NextResponse.json(
+        { error: `CometChat token mint failed (${res.status})`, detail: text },
+        { status: 502 },
+      );
+    }
+
+    const body = (await res.json()) as { data?: { authToken?: string } };
+    const authToken = body.data?.authToken;
+    if (!authToken) {
+      return NextResponse.json(
+        { error: "CometChat returned no authToken in response" },
+        { status: 502 },
+      );
+    }
+
+    return NextResponse.json({ authToken, uid });
+  } catch (err) {
+    return NextResponse.json(
+      { error: "Token mint failed", detail: err instanceof Error ? err.message : String(err) },
+      { status: 500 },
+    );
+  }
+}
+
+// Disable static rendering — this is a dynamic API route
+export const dynamic = "force-dynamic";

package/dist/registry/v6/production/nextjs.template.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "../../schemas/template.schema.json",
+  "version": "1.0.0",
+  "experience_id": 1,
+  "framework": "nextjs",
+  "sdk_compatibility": ">=6.0.0 <7.0.0",
+  "default_placement": "dedicated-route",
+  "deps": [],
+  "env_vars": [
+    {
+      "name": "COMETCHAT_AUTH_KEY",
+      "required": true,
+      "secret": true,
+      "description": "Server-side only Auth Key (no NEXT_PUBLIC_ prefix). Used by the /api/cometchat-token endpoint to mint user-scoped auth tokens. Remove NEXT_PUBLIC_COMETCHAT_AUTH_KEY from .env.local — that variable is for development only and exposes the key to the browser."
+    },
+    {
+      "name": "NEXT_PUBLIC_COMETCHAT_APP_ID",
+      "required": true,
+      "description": "Same as before — App ID is safe to expose"
+    },
+    {
+      "name": "NEXT_PUBLIC_COMETCHAT_REGION",
+      "required": true,
+      "description": "Same as before — region is safe to expose"
+    }
+  ],
+  "files": [
+    {
+      "path": "src/app/api/cometchat-token/route.ts",
+      "action": "create",
+      "template_ref": "route.ts.tpl",
+      "owned": true
+    }
+  ],
+  "verify_rules": [],
+  "next_steps": [
+    "1. Add COMETCHAT_AUTH_KEY (NO NEXT_PUBLIC_ prefix) to .env.local with your CometChat Auth Key.",
+    "2. REMOVE NEXT_PUBLIC_COMETCHAT_AUTH_KEY from .env.local (keep APP_ID and REGION).",
+    "3. In src/app/cometchat/CometChatNoSSR.tsx, replace the login flow:",
+    "   FROM: CometChatUIKit.login('cometchat-uid-1').then(setUser).catch(setError);",
+    "   TO:   fetch('/api/cometchat-token?uid=' + encodeURIComponent(userId))",
+    "           .then(r => r.json())",
+    "           .then(data => CometChatUIKit.loginWithAuthToken(data.authToken))",
+    "           .then(setUser)",
+    "           .catch(e => setError(String(e)));",
+    "4. Replace the hardcoded 'cometchat-uid-1' with your real authenticated user's ID.",
+    "5. Restart the dev server (`npm run dev`) so the new env var takes effect.",
+    "6. The Auth Key is now ONLY in server memory — never sent to the browser."
+  ]
+}