@mhosaic/feedback-cli 0.13.0 → 0.14.0

package/README.md

@@ -0,0 +1,109 @@
+# @mhosaic/feedback-cli
+
+CLI that wires the `@mhosaic/feedback` widget into a host app. Detects your framework, writes `.env.local`, updates `.gitignore`, auto-wraps a Vite + React entry, pings the backend to verify CORS/key/endpoint, and installs the guided integration skill into your global Claude Code skills directory.
+
+```bash
+npm i -g @mhosaic/feedback-cli@latest
+# or, without installing:
+npx @mhosaic/feedback-cli@latest <command>
+```
+
+---
+
+## Commands
+
+### `init` — set up the widget in this project
+
+```bash
+mhosaic-feedback init \
+  --api-key <pk_proj_…> \
+  --endpoint <https://your-backend.example.com> \
+  --yes
+```
+
+- Installs `@mhosaic/feedback` via your detected package manager (pnpm / yarn / npm)
+- Writes `.env.local` with `VITE_FEEDBACK_API_KEY=…` + `VITE_FEEDBACK_ENDPOINT=…` (wrapped in markers so re-running is idempotent)
+- Ensures `.env.local` is in `.gitignore`
+- For Vite + React entries: auto-wraps `src/main.tsx` with `<FeedbackProvider>` (marker comments preserved so `eject` cleans up cleanly)
+
+**Flags:**
+
+| Flag | Default | Notes |
+|---|---|---|
+| `--api-key <key>` | (prompt) | Required if `--yes`; must start with `pk_proj_` |
+| `--endpoint <url>` | `http://localhost:8000` | Must be `http(s)://`; no whitespace |
+| `--yes`, `-y` | `false` | Skip prompts; require `--api-key` |
+| `--no-install` | (install) | Skip `npm install` (useful in CI) |
+| `--cwd <dir>` | `process.cwd()` | Operate on a different project root |
+
+Without `--yes` and `--api-key`, the CLI prompts interactively.
+
+### `doctor` — local health check
+
+```bash
+mhosaic-feedback doctor
+```
+
+Verifies (read-only):
+- A supported framework was detected
+- `.env.local` has `VITE_FEEDBACK_API_KEY=…`
+- `.gitignore` ignores `.env.local`
+- `<FeedbackProvider>` is wired in the entry file
+
+Exits 0 if all pass, 1 otherwise. Run after `init` or whenever you suspect the integration drifted.
+
+### `verify` — end-to-end backend handshake
+
+```bash
+mhosaic-feedback verify --origin <dev-origin> [--with-test-report]
+```
+
+Reads `.env.local`, then checks:
+1. Both env vars present and well-formed
+2. Endpoint is `http(s)://…`
+3. Endpoint resolves and responds
+4. CORS preflight from `--origin` succeeds
+5. (with `--with-test-report`) Submits a synthetic `[mhosaic-feedback verify]` report and prints the resulting `report.id`
+
+Use `--origin` to match your dev server (`http://localhost:5173` for Vite, `http://localhost:3000` for Next/Remix). The test report path is destructive — it adds one row to the project's report stream. Delete it from `/reports` in the admin SPA if you don't want the noise.
+
+### `install-skill` — drop the Claude Code skill in `~/.claude/skills/`
+
+```bash
+mhosaic-feedback install-skill [--force] [--dry-run] [--dest <dir>]
+```
+
+Copies the bundled `integrate-feedback` skill into your global Claude Code skills directory. Run once after installing the CLI; the skill is then invokable as `/integrate-feedback` from any project. Use `--force` to overwrite existing files (e.g. after upgrading the CLI).
+
+### `eject` — strip the widget out of this project
+
+```bash
+mhosaic-feedback eject
+```
+
+Removes the marker-wrapped blocks `init` added: import + provider wrap in the entry file, and the env var block in `.env.local`. Won't touch anything outside those markers. To finish:
+
+```bash
+pnpm remove @mhosaic/feedback   # or npm/yarn equivalent
+```
+
+---
+
+## The guided skill
+
+After `install-skill`, run `/integrate-feedback` inside Claude Code. The skill branches on **operator** vs **consumer** mode and walks you through provisioning a project, generating a public key, and wiring the widget into your specific framework — with explicit checkpoints, framework-aware snippets, and a smoke test that proves the end-to-end path works before declaring done.
+
+Full details: `skills/integrate-feedback/SKILL.md` in this package, or installed at `~/.claude/skills/integrate-feedback/SKILL.md` after `install-skill`.
+
+---
+
+## Development
+
+```bash
+pnpm install
+pnpm --filter @mhosaic/feedback-cli build       # tsup → dist/
+pnpm --filter @mhosaic/feedback-cli exec vitest # unit tests
+node packages/cli/dist/bin.js <command>          # exercise locally
+```
+
+The skill files at `packages/cli/skills/integrate-feedback/` are bundled into the published npm package (`files` in `package.json`) and copied to the user's `~/.claude/skills/` by `install-skill`. Edits to the skill flow through the same `npm publish` pipeline as the CLI itself.

package/dist/bin.js

@@ -15,16 +15,26 @@ async function main() {
     const { runEject } = await import("./eject-VNJVOCQM.js");
     return runEject(args);
   }
+  if (cmd === "verify") {
+    const { runVerify } = await import("./verify-LCXL3WOX.js");
+    return runVerify(args);
+  }
+  if (cmd === "install-skill") {
+    const { runInstallSkill } = await import("./install-skill-CIZ3ZQI7.js");
+    return runInstallSkill(args);
+  }
   if (cmd === "--version" || cmd === "-v") {
-    process.stdout.write("0.3.0\n");
+    process.stdout.write("0.14.0\n");
     return;
   }
   process.stderr.write(`Unknown command: ${cmd}
 
 Usage:
-  mhosaic-feedback init
-  mhosaic-feedback doctor
-  mhosaic-feedback eject
+  mhosaic-feedback init           Set up the widget in this project
+  mhosaic-feedback doctor         Check local setup
+  mhosaic-feedback verify         Ping the backend with the configured key
+  mhosaic-feedback eject          Strip widget integration from this project
+  mhosaic-feedback install-skill  Copy the Claude Code skill to ~/.claude/skills
 `);
   process.exitCode = 1;
 }

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/bin.ts"],"sourcesContent":["async function main() {\n  const [, , cmd, ...args] = process.argv\n  if (!cmd || cmd === 'init') {\n    const { runInit } = await import('./commands/init')\n    return runInit(args)\n  }\n  if (cmd === 'doctor') {\n    const { runDoctor } = await import('./commands/doctor')\n    return runDoctor(args)\n  }\n  if (cmd === 'eject') {\n    const { runEject } = await import('./commands/eject')\n    return runEject(args)\n  }\n  if (cmd === '--version' || cmd === '-v') {\n    process.stdout.write('0.3.0\\n')\n    return\n  }\n  process.stderr.write(`Unknown command: ${cmd}\\n\\nUsage:\\n  mhosaic-feedback init\\n  mhosaic-feedback doctor\\n  mhosaic-feedback eject\\n`)\n  process.exitCode = 1\n}\n\nmain().catch((err) => {\n  process.stderr.write(`${err instanceof Error ? err.message : String(err)}\\n`)\n  process.exitCode = 1\n})\n"],"mappings":";;;AAAA,eAAe,OAAO;AACpB,QAAM,CAAC,EAAE,EAAE,KAAK,GAAG,IAAI,IAAI,QAAQ;AACnC,MAAI,CAAC,OAAO,QAAQ,QAAQ;AAC1B,UAAM,EAAE,QAAQ,IAAI,MAAM,OAAO,oBAAiB;AAClD,WAAO,QAAQ,IAAI;AAAA,EACrB;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,sBAAmB;AACtD,WAAO,UAAU,IAAI;AAAA,EACvB;AACA,MAAI,QAAQ,SAAS;AACnB,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,qBAAkB;AACpD,WAAO,SAAS,IAAI;AAAA,EACtB;AACA,MAAI,QAAQ,eAAe,QAAQ,MAAM;AACvC,YAAQ,OAAO,MAAM,SAAS;AAC9B;AAAA,EACF;AACA,UAAQ,OAAO,MAAM,oBAAoB,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAA4F;AACxI,UAAQ,WAAW;AACrB;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,OAAO,MAAM,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AAC5E,UAAQ,WAAW;AACrB,CAAC;","names":[]}
+{"version":3,"sources":["../src/bin.ts"],"sourcesContent":["async function main() {\n  const [, , cmd, ...args] = process.argv\n  if (!cmd || cmd === 'init') {\n    const { runInit } = await import('./commands/init')\n    return runInit(args)\n  }\n  if (cmd === 'doctor') {\n    const { runDoctor } = await import('./commands/doctor')\n    return runDoctor(args)\n  }\n  if (cmd === 'eject') {\n    const { runEject } = await import('./commands/eject')\n    return runEject(args)\n  }\n  if (cmd === 'verify') {\n    const { runVerify } = await import('./commands/verify')\n    return runVerify(args)\n  }\n  if (cmd === 'install-skill') {\n    const { runInstallSkill } = await import('./commands/install-skill')\n    return runInstallSkill(args)\n  }\n  if (cmd === '--version' || cmd === '-v') {\n    process.stdout.write('0.14.0\\n')\n    return\n  }\n  process.stderr.write(`Unknown command: ${cmd}\\n\\nUsage:\\n  mhosaic-feedback init           Set up the widget in this project\\n  mhosaic-feedback doctor         Check local setup\\n  mhosaic-feedback verify         Ping the backend with the configured key\\n  mhosaic-feedback eject          Strip widget integration from this project\\n  mhosaic-feedback install-skill  Copy the Claude Code skill to ~/.claude/skills\\n`)\n  process.exitCode = 1\n}\n\nmain().catch((err) => {\n  process.stderr.write(`${err instanceof Error ? err.message : String(err)}\\n`)\n  process.exitCode = 1\n})\n"],"mappings":";;;AAAA,eAAe,OAAO;AACpB,QAAM,CAAC,EAAE,EAAE,KAAK,GAAG,IAAI,IAAI,QAAQ;AACnC,MAAI,CAAC,OAAO,QAAQ,QAAQ;AAC1B,UAAM,EAAE,QAAQ,IAAI,MAAM,OAAO,oBAAiB;AAClD,WAAO,QAAQ,IAAI;AAAA,EACrB;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,sBAAmB;AACtD,WAAO,UAAU,IAAI;AAAA,EACvB;AACA,MAAI,QAAQ,SAAS;AACnB,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,qBAAkB;AACpD,WAAO,SAAS,IAAI;AAAA,EACtB;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,sBAAmB;AACtD,WAAO,UAAU,IAAI;AAAA,EACvB;AACA,MAAI,QAAQ,iBAAiB;AAC3B,UAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,6BAA0B;AACnE,WAAO,gBAAgB,IAAI;AAAA,EAC7B;AACA,MAAI,QAAQ,eAAe,QAAQ,MAAM;AACvC,YAAQ,OAAO,MAAM,UAAU;AAC/B;AAAA,EACF;AACA,UAAQ,OAAO,MAAM,oBAAoB,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAoX;AACha,UAAQ,WAAW;AACrB;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,OAAO,MAAM,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AAC5E,UAAQ,WAAW;AACrB,CAAC;","names":[]}

package/dist/install-skill-CIZ3ZQI7.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+
+// src/commands/install-skill.ts
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import kleur from "kleur";
+function parseArgs(argv) {
+  const out = { force: false, dryRun: false, dest: join(homedir(), ".claude", "skills") };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--force" || a === "-f") out.force = true;
+    else if (a === "--dry-run") out.dryRun = true;
+    else if (a === "--dest") out.dest = argv[++i] ?? out.dest;
+  }
+  return out;
+}
+function findSkillsSource() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    join(here, "..", "skills"),
+    join(here, "..", "..", "skills")
+  ];
+  for (const c of candidates) {
+    if (existsSync(c)) return c;
+  }
+  return null;
+}
+function copyRecursive(src, dest, force, dryRun) {
+  let copied = 0;
+  let skipped = 0;
+  if (!dryRun && !existsSync(dest)) mkdirSync(dest, { recursive: true });
+  for (const entry of readdirSync(src)) {
+    const s = join(src, entry);
+    const d = join(dest, entry);
+    const st = statSync(s);
+    if (st.isDirectory()) {
+      const r = copyRecursive(s, d, force, dryRun);
+      copied += r.copied;
+      skipped += r.skipped;
+    } else {
+      if (existsSync(d) && !force) {
+        skipped++;
+        continue;
+      }
+      if (!dryRun) {
+        if (!existsSync(dirname(d))) mkdirSync(dirname(d), { recursive: true });
+        writeFileSync(d, readFileSync(s));
+      }
+      copied++;
+    }
+  }
+  return { copied, skipped };
+}
+async function runInstallSkill(argv) {
+  const args = parseArgs(argv);
+  const src = findSkillsSource();
+  process.stdout.write(kleur.bold("\n\u{1F4E6} Installing Mhosaic Feedback Claude Code skill\n\n"));
+  if (src === null) {
+    process.stderr.write(kleur.red("Could not locate bundled skills/ directory.\n"));
+    process.stderr.write(kleur.gray("Reinstall the CLI: `npm i -g @mhosaic/feedback-cli@latest`\n"));
+    process.exitCode = 1;
+    return;
+  }
+  process.stdout.write(kleur.gray(`Source:      ${src}
+`));
+  process.stdout.write(kleur.gray(`Destination: ${args.dest}
+`));
+  if (args.dryRun) process.stdout.write(kleur.yellow("(dry run \u2014 no files will be written)\n"));
+  process.stdout.write("\n");
+  const { copied, skipped } = copyRecursive(src, args.dest, args.force, args.dryRun);
+  process.stdout.write(kleur.green(`\u2713 ${copied} file(s) ${args.dryRun ? "would be " : ""}copied
+`));
+  if (skipped > 0) {
+    process.stdout.write(kleur.yellow(`\u26A0 ${skipped} file(s) skipped (already exist; use --force to overwrite)
+`));
+  }
+  process.stdout.write("\n");
+  process.stdout.write(kleur.bold("Next:"));
+  process.stdout.write(" open Claude Code in any project and run ");
+  process.stdout.write(kleur.cyan("/integrate-feedback"));
+  process.stdout.write("\n");
+}
+export {
+  runInstallSkill
+};
+//# sourceMappingURL=install-skill-CIZ3ZQI7.js.map

package/dist/install-skill-CIZ3ZQI7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/install-skill.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { dirname, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nimport kleur from 'kleur'\n\ninterface Args {\n  force: boolean\n  dryRun: boolean\n  dest: string\n}\n\nfunction parseArgs(argv: string[]): Args {\n  const out: Args = { force: false, dryRun: false, dest: join(homedir(), '.claude', 'skills') }\n  for (let i = 0; i < argv.length; i++) {\n    const a = argv[i]!\n    if (a === '--force' || a === '-f') out.force = true\n    else if (a === '--dry-run') out.dryRun = true\n    else if (a === '--dest') out.dest = argv[++i] ?? out.dest\n  }\n  return out\n}\n\n/**\n * The CLI ships the skill directory inside the npm package. At build time\n * tsup emits dist/bin.js; at runtime we walk up to find the package root\n * and resolve `skills/` from there. This works for global installs (npx)\n * and for symlinked monorepo dev installs.\n */\nfunction findSkillsSource(): string | null {\n  const here = dirname(fileURLToPath(import.meta.url))\n  // bin lives at dist/bin.js — package root is one level up\n  const candidates = [\n    join(here, '..', 'skills'),\n    join(here, '..', '..', 'skills'),\n  ]\n  for (const c of candidates) {\n    if (existsSync(c)) return c\n  }\n  return null\n}\n\nfunction copyRecursive(src: string, dest: string, force: boolean, dryRun: boolean): { copied: number; skipped: number } {\n  let copied = 0\n  let skipped = 0\n  if (!dryRun && !existsSync(dest)) mkdirSync(dest, { recursive: true })\n  for (const entry of readdirSync(src)) {\n    const s = join(src, entry)\n    const d = join(dest, entry)\n    const st = statSync(s)\n    if (st.isDirectory()) {\n      const r = copyRecursive(s, d, force, dryRun)\n      copied += r.copied\n      skipped += r.skipped\n    } else {\n      if (existsSync(d) && !force) {\n        skipped++\n        continue\n      }\n      if (!dryRun) {\n        if (!existsSync(dirname(d))) mkdirSync(dirname(d), { recursive: true })\n        writeFileSync(d, readFileSync(s))\n      }\n      copied++\n    }\n  }\n  return { copied, skipped }\n}\n\nexport async function runInstallSkill(argv: string[]): Promise<void> {\n  const args = parseArgs(argv)\n  const src = findSkillsSource()\n\n  process.stdout.write(kleur.bold('\\n📦 Installing Mhosaic Feedback Claude Code skill\\n\\n'))\n\n  if (src === null) {\n    process.stderr.write(kleur.red('Could not locate bundled skills/ directory.\\n'))\n    process.stderr.write(kleur.gray('Reinstall the CLI: `npm i -g @mhosaic/feedback-cli@latest`\\n'))\n    process.exitCode = 1\n    return\n  }\n\n  process.stdout.write(kleur.gray(`Source:      ${src}\\n`))\n  process.stdout.write(kleur.gray(`Destination: ${args.dest}\\n`))\n  if (args.dryRun) process.stdout.write(kleur.yellow('(dry run — no files will be written)\\n'))\n  process.stdout.write('\\n')\n\n  const { copied, skipped } = copyRecursive(src, args.dest, args.force, args.dryRun)\n\n  process.stdout.write(kleur.green(`✓ ${copied} file(s) ${args.dryRun ? 'would be ' : ''}copied\\n`))\n  if (skipped > 0) {\n    process.stdout.write(kleur.yellow(`⚠ ${skipped} file(s) skipped (already exist; use --force to overwrite)\\n`))\n  }\n  process.stdout.write('\\n')\n  process.stdout.write(kleur.bold('Next:'))\n  process.stdout.write(' open Claude Code in any project and run ')\n  process.stdout.write(kleur.cyan('/integrate-feedback'))\n  process.stdout.write('\\n')\n}\n"],"mappings":";;;AAAA,SAAS,YAAY,WAAW,cAAc,aAAa,UAAU,qBAAqB;AAC1F,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAE9B,OAAO,WAAW;AAQlB,SAAS,UAAU,MAAsB;AACvC,QAAM,MAAY,EAAE,OAAO,OAAO,QAAQ,OAAO,MAAM,KAAK,QAAQ,GAAG,WAAW,QAAQ,EAAE;AAC5F,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,aAAa,MAAM,KAAM,KAAI,QAAQ;AAAA,aACtC,MAAM,YAAa,KAAI,SAAS;AAAA,aAChC,MAAM,SAAU,KAAI,OAAO,KAAK,EAAE,CAAC,KAAK,IAAI;AAAA,EACvD;AACA,SAAO;AACT;AAQA,SAAS,mBAAkC;AACzC,QAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AAEnD,QAAM,aAAa;AAAA,IACjB,KAAK,MAAM,MAAM,QAAQ;AAAA,IACzB,KAAK,MAAM,MAAM,MAAM,QAAQ;AAAA,EACjC;AACA,aAAW,KAAK,YAAY;AAC1B,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AACA,SAAO;AACT;AAEA,SAAS,cAAc,KAAa,MAAc,OAAgB,QAAsD;AACtH,MAAI,SAAS;AACb,MAAI,UAAU;AACd,MAAI,CAAC,UAAU,CAAC,WAAW,IAAI,EAAG,WAAU,MAAM,EAAE,WAAW,KAAK,CAAC;AACrE,aAAW,SAAS,YAAY,GAAG,GAAG;AACpC,UAAM,IAAI,KAAK,KAAK,KAAK;AACzB,UAAM,IAAI,KAAK,MAAM,KAAK;AAC1B,UAAM,KAAK,SAAS,CAAC;AACrB,QAAI,GAAG,YAAY,GAAG;AACpB,YAAM,IAAI,cAAc,GAAG,GAAG,OAAO,MAAM;AAC3C,gBAAU,EAAE;AACZ,iBAAW,EAAE;AAAA,IACf,OAAO;AACL,UAAI,WAAW,CAAC,KAAK,CAAC,OAAO;AAC3B;AACA;AAAA,MACF;AACA,UAAI,CAAC,QAAQ;AACX,YAAI,CAAC,WAAW,QAAQ,CAAC,CAAC,EAAG,WAAU,QAAQ,CAAC,GAAG,EAAE,WAAW,KAAK,CAAC;AACtE,sBAAc,GAAG,aAAa,CAAC,CAAC;AAAA,MAClC;AACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,QAAQ;AAC3B;AAEA,eAAsB,gBAAgB,MAA+B;AACnE,QAAM,OAAO,UAAU,IAAI;AAC3B,QAAM,MAAM,iBAAiB;AAE7B,UAAQ,OAAO,MAAM,MAAM,KAAK,+DAAwD,CAAC;AAEzF,MAAI,QAAQ,MAAM;AAChB,YAAQ,OAAO,MAAM,MAAM,IAAI,+CAA+C,CAAC;AAC/E,YAAQ,OAAO,MAAM,MAAM,KAAK,8DAA8D,CAAC;AAC/F,YAAQ,WAAW;AACnB;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,MAAM,KAAK,gBAAgB,GAAG;AAAA,CAAI,CAAC;AACxD,UAAQ,OAAO,MAAM,MAAM,KAAK,gBAAgB,KAAK,IAAI;AAAA,CAAI,CAAC;AAC9D,MAAI,KAAK,OAAQ,SAAQ,OAAO,MAAM,MAAM,OAAO,6CAAwC,CAAC;AAC5F,UAAQ,OAAO,MAAM,IAAI;AAEzB,QAAM,EAAE,QAAQ,QAAQ,IAAI,cAAc,KAAK,KAAK,MAAM,KAAK,OAAO,KAAK,MAAM;AAEjF,UAAQ,OAAO,MAAM,MAAM,MAAM,UAAK,MAAM,YAAY,KAAK,SAAS,cAAc,EAAE;AAAA,CAAU,CAAC;AACjG,MAAI,UAAU,GAAG;AACf,YAAQ,OAAO,MAAM,MAAM,OAAO,UAAK,OAAO;AAAA,CAA8D,CAAC;AAAA,EAC/G;AACA,UAAQ,OAAO,MAAM,IAAI;AACzB,UAAQ,OAAO,MAAM,MAAM,KAAK,OAAO,CAAC;AACxC,UAAQ,OAAO,MAAM,2CAA2C;AAChE,UAAQ,OAAO,MAAM,MAAM,KAAK,qBAAqB,CAAC;AACtD,UAAQ,OAAO,MAAM,IAAI;AAC3B;","names":[]}

package/dist/verify-LCXL3WOX.js

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+
+// src/commands/verify.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import kleur from "kleur";
+function parseArgs(argv) {
+  const out = { cwd: process.cwd(), withTestReport: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--cwd") out.cwd = argv[++i] ?? process.cwd();
+    else if (a === "--with-test-report") out.withTestReport = true;
+    else if (a === "--origin") {
+      const v = argv[++i];
+      if (v !== void 0) out.origin = v;
+    }
+  }
+  return out;
+}
+function readEnvLocal(cwd) {
+  const path = join(cwd, ".env.local");
+  if (!existsSync(path)) return { apiKey: null, endpoint: null };
+  const text = readFileSync(path, "utf8");
+  let apiKey = null;
+  let endpoint = null;
+  for (const line of text.split(/\r?\n/)) {
+    const m = /^([A-Z0-9_]+)=(.*)$/.exec(line);
+    if (!m) continue;
+    if (m[1] === "VITE_FEEDBACK_API_KEY") apiKey = m[2].trim();
+    else if (m[1] === "VITE_FEEDBACK_ENDPOINT") endpoint = m[2].trim();
+  }
+  return { apiKey, endpoint };
+}
+async function fetchWithTimeout(url, init, timeoutMs) {
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+async function runVerify(argv) {
+  const args = parseArgs(argv);
+  const checks = [];
+  process.stdout.write(kleur.bold("\n\u{1F50D} Mhosaic Feedback verify\n\n"));
+  const env = readEnvLocal(args.cwd);
+  checks.push({
+    name: ".env.local exists with both keys",
+    ok: env.apiKey !== null && env.endpoint !== null,
+    hint: "run `mhosaic-feedback init`"
+  });
+  if (env.apiKey === null || env.endpoint === null) {
+    report(checks);
+    return;
+  }
+  checks.push({
+    name: "API key starts with pk_proj_",
+    ok: env.apiKey.startsWith("pk_proj_") && env.apiKey.length >= 16,
+    detail: env.apiKey.length < 16 ? "suspiciously short" : void 0,
+    hint: "mint a new key in the admin SPA (Project keys page)"
+  });
+  let endpointUrl = null;
+  try {
+    endpointUrl = new URL(env.endpoint);
+  } catch {
+  }
+  checks.push({
+    name: "Endpoint is a valid http(s) URL",
+    ok: endpointUrl !== null && /^https?:$/.test(endpointUrl.protocol),
+    detail: endpointUrl ? `${endpointUrl.origin}` : void 0,
+    hint: "should look like https://your-backend.example.com"
+  });
+  if (endpointUrl === null || !/^https?:$/.test(endpointUrl.protocol)) {
+    report(checks);
+    return;
+  }
+  let reachable = false;
+  let reachableDetail = "";
+  try {
+    const res = await fetchWithTimeout(endpointUrl.origin + "/admin/login/", { method: "GET" }, 5e3);
+    reachable = res.status > 0;
+    reachableDetail = `HTTP ${res.status}`;
+  } catch (err) {
+    reachableDetail = err instanceof Error ? err.message : String(err);
+  }
+  checks.push({
+    name: "Endpoint reachable over network",
+    ok: reachable,
+    detail: reachableDetail,
+    hint: "check DNS, firewall, and that the backend is running"
+  });
+  const origin = args.origin ?? "http://localhost:5173";
+  let corsOk = false;
+  let corsDetail = "";
+  try {
+    const res = await fetchWithTimeout(
+      endpointUrl.origin + "/api/feedback/v1/reports/",
+      {
+        method: "OPTIONS",
+        headers: {
+          "Origin": origin,
+          "Access-Control-Request-Method": "POST",
+          "Access-Control-Request-Headers": "authorization,content-type"
+        }
+      },
+      5e3
+    );
+    const allowOrigin = res.headers.get("access-control-allow-origin");
+    corsOk = res.status >= 200 && res.status < 300 && (allowOrigin === origin || allowOrigin === "*");
+    corsDetail = allowOrigin ? `allow-origin: ${allowOrigin}` : `HTTP ${res.status}, no allow-origin header`;
+  } catch (err) {
+    corsDetail = err instanceof Error ? err.message : String(err);
+  }
+  checks.push({
+    name: `CORS allows POST from ${origin}`,
+    ok: corsOk,
+    detail: corsDetail,
+    hint: "add this origin to the project's allowed_origins (admin SPA: Edit project)"
+  });
+  if (args.withTestReport) {
+    let testReportOk = false;
+    let testReportDetail = "";
+    try {
+      const body = new URLSearchParams({
+        description: `[mhosaic-feedback verify] CLI smoke test at ${(/* @__PURE__ */ new Date()).toISOString()}`,
+        feedback_type: "feature",
+        severity: "low",
+        page_url: origin,
+        user_agent: `mhosaic-feedback-cli`,
+        env: "dev"
+      });
+      const res = await fetchWithTimeout(
+        endpointUrl.origin + "/api/feedback/v1/reports/",
+        {
+          method: "POST",
+          headers: {
+            "Authorization": `Bearer ${env.apiKey}`,
+            "Content-Type": "application/x-www-form-urlencoded",
+            "Origin": origin
+          },
+          body: body.toString()
+        },
+        1e4
+      );
+      let json = null;
+      try {
+        json = await res.json();
+      } catch {
+      }
+      const reportId = json && typeof json === "object" && "id" in json ? json.id : void 0;
+      testReportOk = res.status === 201 && Boolean(reportId);
+      testReportDetail = testReportOk ? `submitted (report id: ${reportId}) \u2014 delete it from /reports if you don't want noise` : `HTTP ${res.status} \u2014 ${typeof json === "object" ? JSON.stringify(json) : "(no body)"}`;
+    } catch (err) {
+      testReportDetail = err instanceof Error ? err.message : String(err);
+    }
+    checks.push({
+      name: "POST /api/feedback/v1/reports/ accepts the public key",
+      ok: testReportOk,
+      detail: testReportDetail,
+      hint: "401 = key invalid or revoked; 403 = origin not allowed; 4xx = serializer rejected payload"
+    });
+  }
+  report(checks);
+}
+function report(checks) {
+  let failed = 0;
+  for (const c of checks) {
+    const icon = c.ok ? kleur.green("\u2713") : kleur.red("\u2717");
+    const detail = c.detail ? kleur.gray(`  (${c.detail})`) : "";
+    const hint = !c.ok && c.hint ? kleur.gray(`  \u2014 ${c.hint}`) : "";
+    process.stdout.write(`${icon} ${c.name}${detail}${hint}
+`);
+    if (!c.ok) failed++;
+  }
+  if (failed > 0) {
+    process.stdout.write(kleur.red(`
+${failed} check(s) failed.
+`));
+    process.exitCode = 1;
+  } else {
+    process.stdout.write(kleur.green("\nAll checks passed.\n"));
+  }
+}
+export {
+  runVerify
+};
+//# sourceMappingURL=verify-LCXL3WOX.js.map

package/dist/verify-LCXL3WOX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/verify.ts"],"sourcesContent":["import { existsSync, readFileSync } from 'node:fs'\nimport { join } from 'node:path'\n\nimport kleur from 'kleur'\n\ninterface VerifyArgs {\n  cwd: string\n  withTestReport: boolean\n  origin?: string\n}\n\nfunction parseArgs(argv: string[]): VerifyArgs {\n  const out: VerifyArgs = { cwd: process.cwd(), withTestReport: false }\n  for (let i = 0; i < argv.length; i++) {\n    const a = argv[i]!\n    if (a === '--cwd') out.cwd = argv[++i] ?? process.cwd()\n    else if (a === '--with-test-report') out.withTestReport = true\n    else if (a === '--origin') { const v = argv[++i]; if (v !== undefined) out.origin = v }\n  }\n  return out\n}\n\ninterface EnvFields {\n  apiKey: string | null\n  endpoint: string | null\n}\n\nfunction readEnvLocal(cwd: string): EnvFields {\n  const path = join(cwd, '.env.local')\n  if (!existsSync(path)) return { apiKey: null, endpoint: null }\n  const text = readFileSync(path, 'utf8')\n  let apiKey: string | null = null\n  let endpoint: string | null = null\n  for (const line of text.split(/\\r?\\n/)) {\n    const m = /^([A-Z0-9_]+)=(.*)$/.exec(line)\n    if (!m) continue\n    if (m[1] === 'VITE_FEEDBACK_API_KEY') apiKey = m[2]!.trim()\n    else if (m[1] === 'VITE_FEEDBACK_ENDPOINT') endpoint = m[2]!.trim()\n  }\n  return { apiKey, endpoint }\n}\n\ninterface CheckResult {\n  name: string\n  ok: boolean\n  detail?: string | undefined\n  hint?: string | undefined\n}\n\nasync function fetchWithTimeout(url: string, init: RequestInit, timeoutMs: number): Promise<Response> {\n  const controller = new AbortController()\n  const t = setTimeout(() => controller.abort(), timeoutMs)\n  try {\n    return await fetch(url, { ...init, signal: controller.signal })\n  } finally {\n    clearTimeout(t)\n  }\n}\n\nexport async function runVerify(argv: string[]): Promise<void> {\n  const args = parseArgs(argv)\n  const checks: CheckResult[] = []\n\n  process.stdout.write(kleur.bold('\\n🔍 Mhosaic Feedback verify\\n\\n'))\n\n  // 1. .env.local exists\n  const env = readEnvLocal(args.cwd)\n  checks.push({\n    name: '.env.local exists with both keys',\n    ok: env.apiKey !== null && env.endpoint !== null,\n    hint: 'run `mhosaic-feedback init`',\n  })\n\n  if (env.apiKey === null || env.endpoint === null) {\n    report(checks)\n    return\n  }\n\n  // 2. key format\n  checks.push({\n    name: 'API key starts with pk_proj_',\n    ok: env.apiKey.startsWith('pk_proj_') && env.apiKey.length >= 16,\n    detail: env.apiKey.length < 16 ? 'suspiciously short' : undefined,\n    hint: 'mint a new key in the admin SPA (Project keys page)',\n  })\n\n  // 3. endpoint format\n  let endpointUrl: URL | null = null\n  try {\n    endpointUrl = new URL(env.endpoint)\n  } catch {\n    /* falls through */\n  }\n  checks.push({\n    name: 'Endpoint is a valid http(s) URL',\n    ok: endpointUrl !== null && /^https?:$/.test(endpointUrl.protocol),\n    detail: endpointUrl ? `${endpointUrl.origin}` : undefined,\n    hint: 'should look like https://your-backend.example.com',\n  })\n  if (endpointUrl === null || !/^https?:$/.test(endpointUrl.protocol)) {\n    report(checks)\n    return\n  }\n\n  // 4. endpoint reachable (HEAD root or GET /admin/login/ which always exists)\n  let reachable = false\n  let reachableDetail = ''\n  try {\n    const res = await fetchWithTimeout(endpointUrl.origin + '/admin/login/', { method: 'GET' }, 5000)\n    reachable = res.status > 0\n    reachableDetail = `HTTP ${res.status}`\n  } catch (err) {\n    reachableDetail = err instanceof Error ? err.message : String(err)\n  }\n  checks.push({\n    name: 'Endpoint reachable over network',\n    ok: reachable,\n    detail: reachableDetail,\n    hint: 'check DNS, firewall, and that the backend is running',\n  })\n\n  // 5. CORS preflight from the consumer's origin\n  // Default origin: from --origin flag, or guessed dev server (http://localhost:5173 — Vite default)\n  const origin = args.origin ?? 'http://localhost:5173'\n  let corsOk = false\n  let corsDetail = ''\n  try {\n    const res = await fetchWithTimeout(\n      endpointUrl.origin + '/api/feedback/v1/reports/',\n      {\n        method: 'OPTIONS',\n        headers: {\n          'Origin': origin,\n          'Access-Control-Request-Method': 'POST',\n          'Access-Control-Request-Headers': 'authorization,content-type',\n        },\n      },\n      5000,\n    )\n    const allowOrigin = res.headers.get('access-control-allow-origin')\n    corsOk = res.status >= 200 && res.status < 300 && (allowOrigin === origin || allowOrigin === '*')\n    corsDetail = allowOrigin ? `allow-origin: ${allowOrigin}` : `HTTP ${res.status}, no allow-origin header`\n  } catch (err) {\n    corsDetail = err instanceof Error ? err.message : String(err)\n  }\n  checks.push({\n    name: `CORS allows POST from ${origin}`,\n    ok: corsOk,\n    detail: corsDetail,\n    hint: 'add this origin to the project\\'s allowed_origins (admin SPA: Edit project)',\n  })\n\n  // 6. Optional destructive check: submit a synthetic test report\n  if (args.withTestReport) {\n    let testReportOk = false\n    let testReportDetail = ''\n    try {\n      const body = new URLSearchParams({\n        description: `[mhosaic-feedback verify] CLI smoke test at ${new Date().toISOString()}`,\n        feedback_type: 'feature',\n        severity: 'low',\n        page_url: origin,\n        user_agent: `mhosaic-feedback-cli`,\n        env: 'dev',\n      })\n      const res = await fetchWithTimeout(\n        endpointUrl.origin + '/api/feedback/v1/reports/',\n        {\n          method: 'POST',\n          headers: {\n            'Authorization': `Bearer ${env.apiKey}`,\n            'Content-Type': 'application/x-www-form-urlencoded',\n            'Origin': origin,\n          },\n          body: body.toString(),\n        },\n        10_000,\n      )\n      let json: unknown = null\n      try { json = await res.json() } catch { /* non-JSON body */ }\n      const reportId = json && typeof json === 'object' && 'id' in json ? (json as { id: string }).id : undefined\n      testReportOk = res.status === 201 && Boolean(reportId)\n      testReportDetail = testReportOk\n        ? `submitted (report id: ${reportId}) — delete it from /reports if you don't want noise`\n        : `HTTP ${res.status} — ${typeof json === 'object' ? JSON.stringify(json) : '(no body)'}`\n    } catch (err) {\n      testReportDetail = err instanceof Error ? err.message : String(err)\n    }\n    checks.push({\n      name: 'POST /api/feedback/v1/reports/ accepts the public key',\n      ok: testReportOk,\n      detail: testReportDetail,\n      hint: '401 = key invalid or revoked; 403 = origin not allowed; 4xx = serializer rejected payload',\n    })\n  }\n\n  report(checks)\n}\n\nfunction report(checks: CheckResult[]): void {\n  let failed = 0\n  for (const c of checks) {\n    const icon = c.ok ? kleur.green('✓') : kleur.red('✗')\n    const detail = c.detail ? kleur.gray(`  (${c.detail})`) : ''\n    const hint = !c.ok && c.hint ? kleur.gray(`  — ${c.hint}`) : ''\n    process.stdout.write(`${icon} ${c.name}${detail}${hint}\\n`)\n    if (!c.ok) failed++\n  }\n  if (failed > 0) {\n    process.stdout.write(kleur.red(`\\n${failed} check(s) failed.\\n`))\n    process.exitCode = 1\n  } else {\n    process.stdout.write(kleur.green('\\nAll checks passed.\\n'))\n  }\n}\n"],"mappings":";;;AAAA,SAAS,YAAY,oBAAoB;AACzC,SAAS,YAAY;AAErB,OAAO,WAAW;AAQlB,SAAS,UAAU,MAA4B;AAC7C,QAAM,MAAkB,EAAE,KAAK,QAAQ,IAAI,GAAG,gBAAgB,MAAM;AACpE,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,QAAS,KAAI,MAAM,KAAK,EAAE,CAAC,KAAK,QAAQ,IAAI;AAAA,aAC7C,MAAM,qBAAsB,KAAI,iBAAiB;AAAA,aACjD,MAAM,YAAY;AAAE,YAAM,IAAI,KAAK,EAAE,CAAC;AAAG,UAAI,MAAM,OAAW,KAAI,SAAS;AAAA,IAAE;AAAA,EACxF;AACA,SAAO;AACT;AAOA,SAAS,aAAa,KAAwB;AAC5C,QAAM,OAAO,KAAK,KAAK,YAAY;AACnC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,EAAE,QAAQ,MAAM,UAAU,KAAK;AAC7D,QAAM,OAAO,aAAa,MAAM,MAAM;AACtC,MAAI,SAAwB;AAC5B,MAAI,WAA0B;AAC9B,aAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;AACtC,UAAM,IAAI,sBAAsB,KAAK,IAAI;AACzC,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,CAAC,MAAM,wBAAyB,UAAS,EAAE,CAAC,EAAG,KAAK;AAAA,aACjD,EAAE,CAAC,MAAM,yBAA0B,YAAW,EAAE,CAAC,EAAG,KAAK;AAAA,EACpE;AACA,SAAO,EAAE,QAAQ,SAAS;AAC5B;AASA,eAAe,iBAAiB,KAAa,MAAmB,WAAsC;AACpG,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,IAAI,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AACxD,MAAI;AACF,WAAO,MAAM,MAAM,KAAK,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAAA,EAChE,UAAE;AACA,iBAAa,CAAC;AAAA,EAChB;AACF;AAEA,eAAsB,UAAU,MAA+B;AAC7D,QAAM,OAAO,UAAU,IAAI;AAC3B,QAAM,SAAwB,CAAC;AAE/B,UAAQ,OAAO,MAAM,MAAM,KAAK,yCAAkC,CAAC;AAGnE,QAAM,MAAM,aAAa,KAAK,GAAG;AACjC,SAAO,KAAK;AAAA,IACV,MAAM;AAAA,IACN,IAAI,IAAI,WAAW,QAAQ,IAAI,aAAa;AAAA,IAC5C,MAAM;AAAA,EACR,CAAC;AAED,MAAI,IAAI,WAAW,QAAQ,IAAI,aAAa,MAAM;AAChD,WAAO,MAAM;AACb;AAAA,EACF;AAGA,SAAO,KAAK;AAAA,IACV,MAAM;AAAA,IACN,IAAI,IAAI,OAAO,WAAW,UAAU,KAAK,IAAI,OAAO,UAAU;AAAA,IAC9D,QAAQ,IAAI,OAAO,SAAS,KAAK,uBAAuB;AAAA,IACxD,MAAM;AAAA,EACR,CAAC;AAGD,MAAI,cAA0B;AAC9B,MAAI;AACF,kBAAc,IAAI,IAAI,IAAI,QAAQ;AAAA,EACpC,QAAQ;AAAA,EAER;AACA,SAAO,KAAK;AAAA,IACV,MAAM;AAAA,IACN,IAAI,gBAAgB,QAAQ,YAAY,KAAK,YAAY,QAAQ;AAAA,IACjE,QAAQ,cAAc,GAAG,YAAY,MAAM,KAAK;AAAA,IAChD,MAAM;AAAA,EACR,CAAC;AACD,MAAI,gBAAgB,QAAQ,CAAC,YAAY,KAAK,YAAY,QAAQ,GAAG;AACnE,WAAO,MAAM;AACb;AAAA,EACF;AAGA,MAAI,YAAY;AAChB,MAAI,kBAAkB;AACtB,MAAI;AACF,UAAM,MAAM,MAAM,iBAAiB,YAAY,SAAS,iBAAiB,EAAE,QAAQ,MAAM,GAAG,GAAI;AAChG,gBAAY,IAAI,SAAS;AACzB,sBAAkB,QAAQ,IAAI,MAAM;AAAA,EACtC,SAAS,KAAK;AACZ,sBAAkB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,EACnE;AACA,SAAO,KAAK;AAAA,IACV,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAID,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,SAAS;AACb,MAAI,aAAa;AACjB,MAAI;AACF,UAAM,MAAM,MAAM;AAAA,MAChB,YAAY,SAAS;AAAA,MACrB;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,UAAU;AAAA,UACV,iCAAiC;AAAA,UACjC,kCAAkC;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,IACF;AACA,UAAM,cAAc,IAAI,QAAQ,IAAI,6BAA6B;AACjE,aAAS,IAAI,UAAU,OAAO,IAAI,SAAS,QAAQ,gBAAgB,UAAU,gBAAgB;AAC7F,iBAAa,cAAc,iBAAiB,WAAW,KAAK,QAAQ,IAAI,MAAM;AAAA,EAChF,SAAS,KAAK;AACZ,iBAAa,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,EAC9D;AACA,SAAO,KAAK;AAAA,IACV,MAAM,yBAAyB,MAAM;AAAA,IACrC,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AAGD,MAAI,KAAK,gBAAgB;AACvB,QAAI,eAAe;AACnB,QAAI,mBAAmB;AACvB,QAAI;AACF,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,aAAa,gDAA+C,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA,QACpF,eAAe;AAAA,QACf,UAAU;AAAA,QACV,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,KAAK;AAAA,MACP,CAAC;AACD,YAAM,MAAM,MAAM;AAAA,QAChB,YAAY,SAAS;AAAA,QACrB;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,iBAAiB,UAAU,IAAI,MAAM;AAAA,YACrC,gBAAgB;AAAA,YAChB,UAAU;AAAA,UACZ;AAAA,UACA,MAAM,KAAK,SAAS;AAAA,QACtB;AAAA,QACA;AAAA,MACF;AACA,UAAI,OAAgB;AACpB,UAAI;AAAE,eAAO,MAAM,IAAI,KAAK;AAAA,MAAE,QAAQ;AAAA,MAAsB;AAC5D,YAAM,WAAW,QAAQ,OAAO,SAAS,YAAY,QAAQ,OAAQ,KAAwB,KAAK;AAClG,qBAAe,IAAI,WAAW,OAAO,QAAQ,QAAQ;AACrD,yBAAmB,eACf,yBAAyB,QAAQ,6DACjC,QAAQ,IAAI,MAAM,WAAM,OAAO,SAAS,WAAW,KAAK,UAAU,IAAI,IAAI,WAAW;AAAA,IAC3F,SAAS,KAAK;AACZ,yBAAmB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,IACpE;AACA,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAEA,SAAO,MAAM;AACf;AAEA,SAAS,OAAO,QAA6B;AAC3C,MAAI,SAAS;AACb,aAAW,KAAK,QAAQ;AACtB,UAAM,OAAO,EAAE,KAAK,MAAM,MAAM,QAAG,IAAI,MAAM,IAAI,QAAG;AACpD,UAAM,SAAS,EAAE,SAAS,MAAM,KAAK,MAAM,EAAE,MAAM,GAAG,IAAI;AAC1D,UAAM,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,MAAM,KAAK,YAAO,EAAE,IAAI,EAAE,IAAI;AAC7D,YAAQ,OAAO,MAAM,GAAG,IAAI,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI;AAAA,CAAI;AAC1D,QAAI,CAAC,EAAE,GAAI;AAAA,EACb;AACA,MAAI,SAAS,GAAG;AACd,YAAQ,OAAO,MAAM,MAAM,IAAI;AAAA,EAAK,MAAM;AAAA,CAAqB,CAAC;AAChE,YAAQ,WAAW;AAAA,EACrB,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM,MAAM,wBAAwB,CAAC;AAAA,EAC5D;AACF;","names":[]}

package/package.json

@@ -1,13 +1,15 @@
 {
   "name": "@mhosaic/feedback-cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
+  "description": "CLI to install @mhosaic/feedback into a host app, verify the integration, and drop a guided Claude Code skill (/integrate-feedback) into ~/.claude/skills.",
   "type": "module",
   "bin": {
     "mhosaic-feedback": "./dist/bin.js",
     "@mhosaic/feedback": "./dist/bin.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "skills"
   ],
   "dependencies": {
     "kleur": "^4.1.5",

package/skills/integrate-feedback/SKILL.md

@@ -0,0 +1,142 @@
+---
+name: integrate-feedback
+description: Walk a teammate through integrating @mhosaic/feedback — either provisioning a project as the platform operator, or installing the widget in a host app as the consumer. Use when the user mentions adding the Mhosaic feedback widget, onboarding a new app, getting a public key, or wiring the widget into their codebase.
+---
+
+# /integrate-feedback — guided widget integration
+
+You are guiding a teammate through integrating the **@mhosaic/feedback** widget into a project. The workflow splits into two modes:
+
+- **Operator mode** — the platform admin (Victor or a delegate). Provisions a new Company / Project / public key on the Mhosaic backend. Has admin access to the software-factory admin SPA.
+- **Consumer mode** — a teammate. Installs the widget in their own app, given a key + endpoint from the operator.
+
+**Both modes are guided. Never assume — confirm at every checkpoint.**
+
+---
+
+## Step 0: Identify the mode
+
+Ask the user which mode they're in. Use `AskUserQuestion` with:
+
+- question: `Which side of the integration are you working on?`
+- header: `Mode`
+- options:
+  - label: `Provision (operator)`, description: `Create a new Company/Project/key in the Mhosaic backend. Requires admin SPA access.`
+  - label: `Install (consumer)`, description: `Add the widget to a host app. You already have a pk_proj_… key + endpoint from the operator.`
+  - label: `Both — start with operator, then consumer`, description: `Provision first, then keep going.`
+
+Branch on the answer. Each branch is documented in detail under `references/`.
+
+---
+
+## Operator mode — provisioning
+
+**Goal:** end-to-end, produce a Markdown "handoff payload" the teammate can paste into Claude Code (or follow manually) to install the widget.
+
+**Read** the full step-by-step procedure at:
+
+- `references/operator-provision.md`
+
+The procedure walks through:
+
+1. Confirming the company exists (or creating it)
+2. Collecting the project name, slug, and `allowed_origins` (the teammate's deployment URL[s])
+3. Driving Chrome MCP to the admin SPA at https://software-factory-3tbbu.ondigitalocean.app
+4. Calling the DRF API from the *already-authenticated* browser context (no token copy-paste)
+5. Minting a `pk_proj_…` widget key and capturing its plaintext value
+6. Assembling and printing the handoff payload
+
+**Crucial:** the operator must already be SSO-logged-in to software-factory before the skill drives Chrome. If they're not, the skill detects this and walks them through `/login` first.
+
+After the operator branch finishes, ask whether they want to continue into consumer mode in the same conversation (helpful when they're integrating into one of their own apps).
+
+---
+
+## Consumer mode — installing
+
+**Goal:** end-to-end, the widget loads on the host app and a smoke-test report lands in the admin.
+
+**Read** the framework-aware install procedure at:
+
+- `references/consumer-install.md`
+
+The procedure walks through:
+
+1. Verifying we're in a JS/TS project (reads `package.json`)
+2. Detecting the framework (Vite/Next/Remix/Vue/SvelteKit/CDN)
+3. Accepting the handoff payload — either pasted verbatim or via `--from-clipboard`
+4. Running `npx @mhosaic/feedback-cli init --api-key=… --endpoint=… --yes` (non-interactive)
+5. For non-Vite-React frameworks: pasting the framework-specific snippet from `references/consumer-install-<framework>.md` and asking the user to apply it
+6. Wiring `fb.identify()` against the consumer's auth provider — recipes in `references/identify-snippets.md`
+7. Optionally wiring `withErrorTracking` + `withReplay` + `withWebVitals`
+8. Running `mhosaic-feedback verify --origin <consumer dev origin>` to confirm CORS, key, and endpoint
+9. Starting the consumer's dev server and driving Chrome to verify the FAB renders
+10. Submitting a `[INTEGRATE-FEEDBACK SMOKE TEST]` synthetic report from the FAB
+11. Driving Chrome to software-factory's `/reports` and confirming the smoke-test report appears
+
+The smoke-test workflow lives at:
+
+- `references/verify-install.md`
+
+---
+
+## Principles to follow
+
+- **Confirm at every fork.** Never assume a default. Use `AskUserQuestion` for choices, plain text questions for free-form input.
+- **Show, don't tell.** When you can run a command and show output, run it. When you can drive Chrome and screenshot, drive Chrome.
+- **Idempotent and reversible.** Every state-changing step has a stated rollback (e.g. revoke key in admin SPA, run `mhosaic-feedback eject`). Surface that to the user.
+- **Stop on first red.** If the smoke test fails, do not silently retry. Read `references/verify-install.md`'s diagnostic table, narrow the cause, fix it, then re-run from the failing step.
+- **Don't paste secret keys into git.** Walk the user through adding `.env.local` to `.gitignore` (CLI does this automatically; double-check).
+- **Don't claim "done" without proof.** End the workflow with a screenshot of the smoke-test report landing in admin OR with a clearly enumerated red checklist of what's still broken.
+
+---
+
+## Operator → consumer handoff payload format
+
+Always produce this Markdown block at the end of operator mode. The consumer pastes it as the very first message to Claude after running `/integrate-feedback` in their own repo:
+
+````markdown
+## Mhosaic Feedback handoff
+
+**Project slug:** `your-project-slug`
+**Endpoint:** `https://software-factory-3tbbu.ondigitalocean.app`
+**Public widget key:** `pk_proj_xxxxxxxxxxxxxxxxxxxxxxxxxx`
+**Allowed origin(s):** `https://your-app.example.com`, `http://localhost:5173`
+
+To install:
+```bash
+npx @mhosaic/feedback-cli@latest init \
+  --api-key pk_proj_xxxxxxxxxxxxxxxxxxxxxxxxxx \
+  --endpoint https://software-factory-3tbbu.ondigitalocean.app \
+  --yes
+```
+
+Then verify:
+```bash
+npx @mhosaic/feedback-cli@latest verify \
+  --origin http://localhost:5173 \
+  --with-test-report
+```
+````
+
+The skill's consumer mode parses this block automatically when pasted as input.
+
+---
+
+## Skill files
+
+```
+skills/integrate-feedback/
+├── SKILL.md                              # this file (mode router)
+├── references/
+│   ├── operator-provision.md             # Chrome MCP → admin SPA → DRF
+│   ├── consumer-install.md               # framework router
+│   ├── consumer-install-vite.md          # Vite + React (CLI auto-wires)
+│   ├── consumer-install-next.md          # Next.js App Router + Pages
+│   ├── consumer-install-remix.md         # Remix root.tsx
+│   ├── consumer-install-vue.md           # Vue 3 + Vite
+│   ├── consumer-install-svelte.md        # SvelteKit
+│   ├── consumer-install-plain.md         # CDN <script> tag
+│   ├── identify-snippets.md              # fb.identify() per auth provider
+│   └── verify-install.md                 # smoke test + diagnostics
+```