@mhosaic/feedback-cli 0.13.0 → 0.14.1

package/skills/integrate-feedback/references/operator-provision.md

@@ -0,0 +1,235 @@
+# Operator mode — provisioning a new project
+
+You are guiding the platform operator (Victor or a delegate) through creating a new **Company → Project → public widget key** on the Mhosaic backend, then assembling a handoff payload the consumer pastes into their own integration flow.
+
+**Strategy:** drive the operator's already-authenticated Chrome session at the software-factory admin SPA. For the API calls themselves, use `mcp__claude-in-chrome__javascript_tool` to invoke `fetch()` *from within* the browser tab — that way every call goes through the SPA's auth cookies, hits the DRF stack with full middleware (CSRF, permissions, audit), and never requires copying tokens into shell `curl` commands.
+
+The admin SPA is at https://software-factory-3tbbu.ondigitalocean.app.
+
+---
+
+## Step 1 — Confirm Chrome MCP is available
+
+Before anything else, call `mcp__claude-in-chrome__tabs_context_mcp` to discover what tabs exist. If you don't see a tab pointed at `software-factory-3tbbu.ondigitalocean.app`, create one with `mcp__claude-in-chrome__tabs_create_mcp`.
+
+If `tabs_context_mcp` errors with "no MCP tab group", call it again with `createIfEmpty: true` — that opens a fresh window for the skill to use without disturbing the operator's existing browsing.
+
+---
+
+## Step 2 — Verify operator is logged in
+
+Navigate the chosen tab to `https://software-factory-3tbbu.ondigitalocean.app/`. Take a screenshot. If the page shows `/login`, walk the operator through the SSO flow:
+
+> "You're not logged in. Click 'Continuer avec Google' and pick your @mhosaic.com account. When you land on /, tell me 'ready'."
+
+Wait for the operator to confirm. Then re-screenshot to verify the dashboard is showing.
+
+---
+
+## Step 3 — Collect the project inputs
+
+Use `AskUserQuestion` for **each** of these, one at a time. Always confirm before proceeding.
+
+1. **Company:** existing or new?
+   - Use `AskUserQuestion` with options `Use existing company` and `Create new company`.
+   - If existing: fetch the list with the JS snippet in step 4 and present a multi-choice question.
+   - If new: ask for the company name (plain text). Auto-slugify it (lowercase, hyphens, strip accents — see `apps/admin/src/features/companies/NewCompanyForm.tsx:14-22`).
+
+2. **Project name** (plain text, e.g. `"NoRag Production"`).
+
+3. **Project slug** (plain text, auto-slugified default from name). Must be unique within the company. Lowercase, hyphens, ≤ 80 chars.
+
+4. **Allowed origins** (plain text, comma- or space-separated list). Each must be a full `https?://host[:port]` URL. Rules:
+   - Wildcards (`*`) are rejected.
+   - `http://` is only permitted for localhost / 127.0.0.1 / ::1.
+   - Path is forbidden (e.g. `https://app.example.com/widget` — drop the path).
+   - Strongly recommend including BOTH the prod URL **and** the dev URL (e.g. `https://app.acme.com, http://localhost:5173`) so the teammate can test locally before deploying.
+
+5. **Share reports with widget board?** (`AskUserQuestion`, default No).
+   - `Yes — every authenticated end-user sees every report` (good for internal tools)
+   - `No — strict submitter-only view` (default, safer for public-facing apps)
+
+6. **(Optional) Repo/staging/prod URLs** — surface in admin UI but not load-bearing. Skip unless the operator volunteers.
+
+Display the collected values as a summary table and confirm with `AskUserQuestion` "Proceed?" before mutating anything.
+
+---
+
+## Step 4 — Provision via the browser's fetch()
+
+You'll execute small JavaScript snippets in the admin SPA tab via `mcp__claude-in-chrome__javascript_tool`. The SPA's session cookies authenticate the requests automatically.
+
+### Get a fresh access token
+
+The SPA holds its access token in memory (not localStorage — see `apps/admin/src/api/tokenStore.ts`). To get one from outside the SPA's React state, hit the cookie-backed refresh endpoint: the browser auto-sends the HttpOnly refresh cookie, and the response body returns a fresh access token.
+
+```javascript
+fetch('/api/auth/token/refresh/', { method: 'POST', credentials: 'include' })
+  .then(r => r.json())
+  .then(d => JSON.stringify({ access: d.access ?? d.access_token ?? null }))
+```
+
+If `access` is null and the response was 401, the operator's session is fully expired — re-do step 2 (re-SSO). Otherwise capture the token and use it for `Authorization: Bearer <token>` on subsequent calls.
+
+For the rest of this procedure, treat the captured token as a shell variable `TOKEN`. Each snippet below uses `TOKEN` literally — substitute it before sending to `mcp__claude-in-chrome__javascript_tool`.
+
+### Look up or create the company
+
+To list companies (response wraps them in `{items: [...]}`):
+
+```javascript
+fetch('/api/feedback/v1/companies/', {
+  headers: { 'Authorization': 'Bearer TOKEN' }
+}).then(r => r.json()).then(d => JSON.stringify(d.items ?? d))
+```
+
+Each item has `{id, slug, name}`. Filter client-side by slug if you're looking up an existing company.
+
+To create a new company:
+
+```javascript
+fetch('/api/feedback/v1/companies/', {
+  method: 'POST',
+  headers: {
+    'Authorization': 'Bearer TOKEN',
+    'Content-Type': 'application/json',
+  },
+  body: JSON.stringify({ name: 'COMPANY_NAME', slug: 'company-slug' })
+}).then(r => r.json()).then(d => JSON.stringify(d))
+```
+
+Capture the company `id` (UUID) from the response.
+
+### Create the project
+
+```javascript
+fetch('/api/feedback/v1/projects/', {
+  method: 'POST',
+  headers: {
+    'Authorization': 'Bearer TOKEN',
+    'Content-Type': 'application/json',
+  },
+  body: JSON.stringify({
+    company: 'COMPANY_UUID',
+    name: 'PROJECT_NAME',
+    slug: 'project-slug',
+    allowed_origins: ['https://app.example.com', 'http://localhost:5173'],
+    share_reports_with_widget: false
+  })
+}).then(r => r.json()).then(d => JSON.stringify(d))
+```
+
+If you get a 400 with `allowed_origins` validation error: parse the message, walk the operator through fixing the offending URL, and retry. Common reasons:
+- `http://` in prod (use `https://`)
+- trailing slash or path on the URL (strip it)
+- wildcard `*` (not supported by design)
+
+If you get a 400 with slug collision: append `-2`, `-3`, … and retry. Confirm the new slug with the operator first.
+
+Capture the project `id` from the response.
+
+### Mint the public widget key
+
+```javascript
+fetch('/api/feedback/v1/project-keys/create/', {
+  method: 'POST',
+  headers: {
+    'Authorization': 'Bearer TOKEN',
+    'Content-Type': 'application/json',
+  },
+  body: JSON.stringify({
+    project_id: 'PROJECT_UUID',
+    kind: 'public',
+    label: 'Production widget key — minted by /integrate-feedback'
+  })
+}).then(r => r.json()).then(d => JSON.stringify(d))
+```
+
+The response includes `key: "pk_proj_…"` in plaintext. **This is the only time the plaintext key is ever returned.** Capture it immediately and treat it as a secret in your subsequent skill state (don't echo it more than necessary).
+
+---
+
+## Step 5 — Assemble the handoff payload
+
+Construct this Markdown block and present it to the operator as the deliverable:
+
+````markdown
+## Mhosaic Feedback handoff
+
+**Project slug:** `<project-slug>`
+**Project ID:** `<project-uuid>`
+**Endpoint:** `https://software-factory-3tbbu.ondigitalocean.app`
+**Public widget key:** `<pk_proj_…>`
+**Allowed origin(s):** `<origin1>`, `<origin2>`, …
+**Reports visibility:** `<submitter-only | shared with widget board>`
+
+### Send to your teammate
+
+To install:
+```bash
+npx @mhosaic/feedback-cli@latest init \
+  --api-key <pk_proj_…> \
+  --endpoint https://software-factory-3tbbu.ondigitalocean.app \
+  --yes
+```
+
+To verify after install:
+```bash
+npx @mhosaic/feedback-cli@latest verify \
+  --origin <consumer dev origin> \
+  --with-test-report
+```
+
+Or guide them with Claude Code:
+```
+/integrate-feedback
+```
+(then paste the block above as their first message)
+````
+
+Print this to the chat.
+
+**On sharing the payload:** the `pk_proj_…` is a *public* key (it ships in every consumer's widget bundle, just like a Stripe publishable key). The real threat is "someone with the key + a whitelisted origin can submit junk reports against your project" — noise pollution, not a security breach. So **DM it rather than posting it in a public channel**, but you don't need 1Password levels of caution. The actual secrets in this flow (your SSO session, the backend JWT) never leave your browser; only the public artifacts are in the handoff.
+
+---
+
+## Step 6 — Verify the project really exists
+
+Drive Chrome to `https://software-factory-3tbbu.ondigitalocean.app/companies/<company-slug>` and screenshot. The operator should see the project listed. Then drive to `/settings/widget-keys` and confirm the key shows up there (masked — the plaintext is gone after this point).
+
+If the project doesn't appear: something silently failed (browser cache, deploy mid-rollout, race condition). Open browser DevTools network tab via `mcp__claude-in-chrome__read_network_requests` filtered to `/api/feedback/v1/projects/` and inspect the actual POST response. Surface the diagnostic to the operator and stop.
+
+---
+
+## Step 7 — Offer to continue into consumer mode
+
+`AskUserQuestion`:
+- question: `Want to install the widget into a consumer app right now?`
+- options:
+  - `Yes — continue here`, description: `Move to consumer mode using the handoff payload we just built.`
+  - `No — I'll send the payload to my teammate`, description: `Stop here.`
+
+If yes, follow `references/consumer-install.md` from step 1, pre-filling the handoff payload values.
+
+---
+
+## Rollback / undo
+
+If the operator wants to undo what was just provisioned:
+
+1. **Revoke the key** — admin SPA at `/settings/widget-keys` → find the row → click "Révoquer". This breaks the widget immediately for anyone using it.
+2. **Delete the project** — currently no UI button; instruct the operator to use the DO Console → backend pod → `python manage.py shell -c "from mhosaic_feedback.models import Project; Project.objects.filter(slug='<slug>').delete()"`. This cascades to keys, reports, etc. — only do this if no real reports have been created against the project.
+
+---
+
+## Error catalog
+
+| Symptom | Cause | Fix |
+|---|---|---|
+| `fetch` returns 401 | JWT expired | Re-do step 2 (re-login via SSO) |
+| `fetch` returns 403 on companies POST | Not staff | Operator's user lacks `is_staff` — provision via `/admin/` or `python manage.py shell` |
+| `fetch` returns 400 on projects POST with `allowed_origins` | Origin format invalid | Parse server error, walk operator through fixing the URL, retry |
+| `fetch` returns 400 with `slug` collision | Slug already exists in this company | Append `-2`, confirm with operator, retry |
+| Plaintext key not in response | Wrong endpoint (used `/api/feedback/v1/projects/<id>/keys/` instead of `/api/feedback/v1/project-keys/create/`) | Use the correct endpoint per `packages/backend/mhosaic_feedback/views_project_keys.py:36` |
+| `mcp__claude-in-chrome__javascript_tool` returns null/undefined | Snippet didn't return a value | All snippets above end with `JSON.stringify(...)` — verify the snippet's last expression is a JSON-serializable value |
+| Operator says "I don't see the new project" | Browser cache | Hard reload (Cmd+Shift+R). If still missing, network tab → check POST returned 201 |

package/skills/integrate-feedback/references/verify-install.md

@@ -0,0 +1,151 @@
+# Verify install — live smoke test
+
+After the consumer has installed the widget, run this end-to-end smoke test to confirm everything actually works. Don't claim "done" until this is green.
+
+---
+
+## Step 1 — Run the CLI verify
+
+```bash
+npx @mhosaic/feedback-cli@latest verify \
+  --origin <consumer-dev-origin> \
+  --with-test-report
+```
+
+`<consumer-dev-origin>` is the URL where the consumer's app runs locally — `http://localhost:5173` for Vite, `http://localhost:3000` for Next/Remix, etc.
+
+Expected output (all green):
+
+```
+✓ .env.local exists with both keys
+✓ API key starts with pk_proj_
+✓ Endpoint is a valid http(s) URL
+✓ Endpoint reachable over network
+✓ CORS allows POST from <origin>
+✓ POST /api/feedback/v1/reports/ accepts the public key  (submitted (report id: …) — delete it from /reports if you don't want noise)
+
+All checks passed.
+```
+
+If any check is red, **STOP**. Don't proceed to step 2 until they're all green. The hint column tells you what to fix; the diagnostic table at the bottom of this doc covers every failure mode.
+
+---
+
+## Step 2 — Start the consumer's dev server
+
+In the consumer's repo:
+
+```bash
+pnpm dev  # or npm run dev / yarn dev / bun dev
+```
+
+Wait for the server to print its URL (e.g. `Local: http://localhost:5173`).
+
+---
+
+## Step 3 — Drive Chrome to the dev URL
+
+```
+mcp__claude-in-chrome__tabs_create_mcp  # or reuse an existing tab
+mcp__claude-in-chrome__navigate(tabId, url=<dev-url>)
+mcp__claude-in-chrome__computer(action="screenshot")
+```
+
+Inspect the screenshot. You should see:
+
+1. The consumer's actual UI rendered (their app loaded successfully)
+2. A small floating action button (FAB) in the bottom-right corner — a circle with a chat-bubble or megaphone icon
+
+If the FAB is missing, see the diagnostic table at the bottom.
+
+---
+
+## Step 4 — Open DevTools console; verify no widget errors
+
+```
+mcp__claude-in-chrome__read_console_messages(pattern="mhosaic|feedback|widget")
+```
+
+Acceptable: a "widget mounted" or "init complete" debug line. Not acceptable: any `error` or `unhandledrejection` mentioning `@mhosaic/feedback`, `pk_proj_`, CORS, or fingerprint.
+
+If errors appear, surface them to the user before clicking the FAB — they may already explain a failure that the visual test wouldn't catch.
+
+---
+
+## Step 5 — Click the FAB and submit a test report
+
+Use `mcp__claude-in-chrome__find(query="feedback FAB or feedback button")` to locate the element. Click it.
+
+A modal/sheet should open inviting the user to write a description. Fill in:
+
+> `[INTEGRATE-FEEDBACK SMOKE TEST] integration verified at <ISO timestamp>`
+
+…and submit. The widget should close itself + show a success toast.
+
+If the form rejects the submit with a 4xx error, capture the network response via:
+
+```
+mcp__claude-in-chrome__read_network_requests(urlPattern="/api/feedback/v1/reports/")
+```
+
+and surface the status code + response body.
+
+---
+
+## Step 6 — Confirm the report landed in admin
+
+Drive Chrome to `https://software-factory-3tbbu.ondigitalocean.app/reports`. You may need to log in if the operator's session expired.
+
+Filter by description containing `[INTEGRATE-FEEDBACK SMOKE TEST]`. The new report should appear at the top of the list.
+
+Click into it. Verify:
+- Project = the project the operator just provisioned
+- Submitter = whatever identity was wired (anonymous-id, real user, etc.)
+- Page URL = the consumer's dev URL
+- Status = new
+
+Screenshot this to give the user proof-of-life.
+
+---
+
+## Step 7 — (Optional cleanup) delete the smoke-test reports
+
+After confirming, the operator (not the consumer) can clean up the noise:
+
+1. Admin SPA `/reports`, filter by description containing `[INTEGRATE-FEEDBACK SMOKE TEST]` and `[mhosaic-feedback verify]`
+2. Bulk select and delete
+
+Skip this step if the consumer wants to keep the smoke-test reports as a paper trail.
+
+---
+
+## Diagnostic table — when checks fail
+
+| Symptom | Likely cause | Fix |
+|---|---|---|
+| `✗ .env.local exists with both keys` | CLI init never ran, or ran in a different directory | Re-run `mhosaic-feedback init` from the project root |
+| `✗ API key starts with pk_proj_` | Operator pasted the wrong key (e.g. `sk_proj_…`, an MCP key) | Operator mints a *public* widget key (`kind: "public"`) in admin SPA |
+| `✗ Endpoint reachable over network` (network error) | DNS, firewall, offline, or wrong endpoint URL | Verify the URL in `.env.local`; try `curl -I <endpoint>/admin/login/` |
+| `✗ Endpoint reachable` (5xx) | Backend is down or mid-deploy | Wait 1–2 minutes; check DO App Platform deploy status |
+| `✗ CORS allows POST from <origin>` | Operator forgot to add this origin to `allowed_origins` | Operator opens admin SPA → Edit project → adds the dev URL (e.g. `http://localhost:5173`) |
+| `✗ POST /api/feedback/v1/reports/` returns 401 | Key invalid or revoked | Operator mints a new key |
+| `✗ POST /api/feedback/v1/reports/` returns 403 with "origin not allowed" | Same as CORS row above | Operator adds the origin |
+| FAB doesn't render in dev | `identify()` not called with a non-empty `id` | Wire identify per `identify-snippets.md`, OR for testing pass `{id: 'test-user'}` |
+| FAB renders but form submit fails with 403 | Origin not in `allowed_origins` (Vite dev URL differs from prod URL) | Operator adds the dev URL |
+| FAB renders but form submit fails with 400 | Serializer rejected the payload (description empty, env unknown, etc.) | Read DevTools network response — usually a clear field-level error |
+| Console error: `Failed to load module` for `@mhosaic/feedback` | Vite cache mismatch | Stop dev server, delete `node_modules/.vite`, restart |
+| Console error: `Unhandled CORS preflight failure` | Origin not allowlisted on the backend side | Operator adds the origin; consumer hard-reloads |
+| Widget submits anonymous reports despite identify() running | identify() called in a stale closure (effect dep array missing the user) | Re-read identify-snippets.md — every snippet has the right deps |
+| `verify --with-test-report` succeeds but the report doesn't appear in admin | Browser cache; report is filtered by default (e.g. `synthetic=true` hides it) | Refresh admin /reports; toggle "show synthetic" filter |
+
+---
+
+## When to escalate
+
+If after 3 fix-iterations the smoke test still fails, escalate to the operator with:
+
+1. The CLI verify output (full text)
+2. A DevTools network request showing the actual server response
+3. A screenshot of the dev UI showing FAB state
+
+The operator can correlate the failure against the project's `allowed_origins`, key status, and `share_reports_with_widget` flag in the admin SPA — that catches >90% of "weird" failures the consumer can't debug on their own.

package/dist/init-64QSAHMB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/commands/init.ts","../src/edits/env.ts","../src/edits/gitignore.ts","../src/edits/react.ts"],"sourcesContent":["import { existsSync } from 'node:fs'\nimport { join } from 'node:path'\nimport { spawnSync } from 'node:child_process'\n\nimport kleur from 'kleur'\nimport prompts from 'prompts'\n\nimport { detectFramework } from '../detect'\nimport { writeEnvLocal } from '../edits/env'\nimport { ensureGitignore } from '../edits/gitignore'\nimport { wrapReactEntry } from '../edits/react'\n\ninterface InitArgs {\n  apiKey?: string\n  endpoint?: string\n  yes: boolean\n  install: boolean\n  cwd: string\n}\n\nfunction parseArgs(argv: string[]): InitArgs {\n  const out: InitArgs = { yes: false, install: true, cwd: process.cwd() }\n  for (let i = 0; i < argv.length; i++) {\n    const a = argv[i]!\n    if (a === '--api-key') { const v = argv[++i]; if (v !== undefined) out.apiKey = v }\n    else if (a === '--endpoint') { const v = argv[++i]; if (v !== undefined) out.endpoint = v }\n    else if (a === '--yes' || a === '-y') out.yes = true\n    else if (a === '--no-install') out.install = false\n    else if (a === '--cwd') out.cwd = argv[++i] ?? process.cwd()\n  }\n  return out\n}\n\nfunction detectPackageManager(cwd: string): 'pnpm' | 'yarn' | 'npm' {\n  if (existsSync(join(cwd, 'pnpm-lock.yaml'))) return 'pnpm'\n  if (existsSync(join(cwd, 'yarn.lock'))) return 'yarn'\n  return 'npm'\n}\n\nexport async function runInit(argv: string[]): Promise<void> {\n  const args = parseArgs(argv)\n  const { cwd } = args\n\n  process.stdout.write(kleur.bold('\\n⚡ Mhosaic Feedback setup\\n\\n'))\n\n  const framework = await detectFramework(cwd)\n  process.stdout.write(kleur.gray(`Detected: ${framework.kind}${framework.entry ? ' (' + framework.entry + ')' : ''}\\n`))\n\n  let apiKey = args.apiKey\n  let endpoint = args.endpoint ?? 'http://localhost:8000'\n  if (!args.yes && !apiKey) {\n    const answers = await prompts([\n      { type: 'text', name: 'endpoint', message: 'Backend endpoint', initial: endpoint },\n      { type: 'text', name: 'apiKey', message: 'Public API key (pk_proj_…)', validate: (v: string) => v.startsWith('pk_proj_') || 'must start with pk_proj_' },\n    ])\n    if (!answers.apiKey) {\n      process.stdout.write(kleur.red('Aborted.\\n'))\n      process.exitCode = 1\n      return\n    }\n    endpoint = answers.endpoint\n    apiKey = answers.apiKey\n  }\n  if (!apiKey) {\n    process.stderr.write('api-key is required (flag or prompt)\\n')\n    process.exitCode = 1\n    return\n  }\n\n  const pm = detectPackageManager(cwd)\n  if (args.install) {\n    process.stdout.write(kleur.gray(`Installing @mhosaic/feedback via ${pm}…\\n`))\n    const cmd = pm === 'pnpm' ? ['pnpm', 'add', '@mhosaic/feedback'] : pm === 'yarn' ? ['yarn', 'add', '@mhosaic/feedback'] : ['npm', 'install', '@mhosaic/feedback']\n    const res = spawnSync(cmd[0]!, cmd.slice(1), { cwd, stdio: 'inherit' })\n    if (res.status !== 0) {\n      process.stderr.write(kleur.red('install failed\\n'))\n      process.exitCode = res.status ?? 1\n      return\n    }\n    process.stdout.write(kleur.green('✓ Installed @mhosaic/feedback\\n'))\n  }\n\n  await writeEnvLocal(join(cwd, '.env.local'), { apiKey, endpoint })\n  process.stdout.write(kleur.green('✓ Wrote .env.local\\n'))\n\n  await ensureGitignore(join(cwd, '.gitignore'))\n  process.stdout.write(kleur.green('✓ Updated .gitignore\\n'))\n\n  if (framework.entry && framework.kind === 'vite-react') {\n    const entryPath = join(cwd, framework.entry)\n    if (existsSync(entryPath)) {\n      await wrapReactEntry(entryPath, {\n        apiKeyEnv: 'VITE_FEEDBACK_API_KEY',\n        endpointEnv: 'VITE_FEEDBACK_ENDPOINT',\n      })\n      process.stdout.write(kleur.green(`✓ Wrapped ${framework.entry}\\n`))\n    } else {\n      process.stdout.write(kleur.yellow(`⚠ Expected entry ${framework.entry} not found — wire <FeedbackProvider> manually.\\n`))\n    }\n  } else if (framework.kind !== 'vite-react') {\n    process.stdout.write(kleur.yellow(`⚠ Auto-wiring is only supported for Vite + React today. For ${framework.kind}, add <FeedbackProvider> manually.\\n`))\n  }\n\n  process.stdout.write(kleur.bold('\\nDone.\\n'))\n}\n","import { readFile, writeFile } from 'node:fs/promises'\nimport { existsSync } from 'node:fs'\n\nconst MARK = '# === mhosaic-feedback ==='\n\nexport interface EnvEntries {\n  apiKey: string\n  endpoint: string\n}\n\n/**\n * Reject values that could escape the `KEY=value` line in a .env file.\n *\n * Audit R5/M3: the previous version interpolated user input verbatim,\n * so a paste containing `\\n` would inject arbitrary additional\n * variables, and `\"` would unbalance any later parser. The user owns\n * their own machine — this is a defense-in-depth guard against\n * accidental misuse (e.g. paste from a multi-line message) more than\n * an attack surface.\n */\nfunction ensureEnvSafe(field: 'apiKey' | 'endpoint', value: string): string {\n  if (/[\\r\\n]/.test(value)) {\n    throw new Error(`${field} contains a newline; refusing to write .env.local.`)\n  }\n  if (value.includes('\"')) {\n    throw new Error(`${field} contains a double-quote; refusing to write .env.local.`)\n  }\n  if (value.includes('\\0')) {\n    throw new Error(`${field} contains a NUL byte; refusing to write .env.local.`)\n  }\n  return value\n}\n\nfunction ensureKnownEndpoint(value: string): string {\n  // http(s) only — a `javascript:` or `file:` URL in .env would silently\n  // become the configured backend after `pnpm dev`.\n  if (!/^https?:\\/\\/[^\\s]+$/i.test(value)) {\n    throw new Error(\n      `endpoint must be an http(s) URL with no whitespace; got ${JSON.stringify(value)}`,\n    )\n  }\n  return value\n}\n\nfunction ensureApiKey(value: string): string {\n  // Trim accidental leading/trailing whitespace — pasted keys frequently\n  // arrive with a trailing newline that survives split-on-tab.\n  const trimmed = value.trim()\n  if (!trimmed.startsWith('pk_proj_')) {\n    throw new Error(\n      'apiKey must look like a widget public key (starts with `pk_proj_`).',\n    )\n  }\n  return trimmed\n}\n\nexport function renderEnv(existing: string, entries: EnvEntries): string {\n  const apiKey = ensureEnvSafe('apiKey', ensureApiKey(entries.apiKey))\n  const endpoint = ensureEnvSafe('endpoint', ensureKnownEndpoint(entries.endpoint))\n  const lines = existing.split(/\\r?\\n/)\n  const filtered: string[] = []\n  let inBlock = false\n  for (const line of lines) {\n    if (line.trim() === MARK) { inBlock = !inBlock; continue }\n    if (inBlock) continue\n    if (line.startsWith('VITE_FEEDBACK_API_KEY=') || line.startsWith('VITE_FEEDBACK_ENDPOINT=')) continue\n    filtered.push(line)\n  }\n  // Trim trailing empty lines\n  while (filtered.length > 0 && filtered[filtered.length - 1] === '') filtered.pop()\n  const block = [\n    MARK,\n    `VITE_FEEDBACK_API_KEY=${apiKey}`,\n    `VITE_FEEDBACK_ENDPOINT=${endpoint}`,\n    MARK,\n  ].join('\\n')\n  return (filtered.length > 0 ? filtered.join('\\n') + '\\n\\n' : '') + block + '\\n'\n}\n\nexport async function writeEnvLocal(path: string, entries: EnvEntries): Promise<void> {\n  const existing = existsSync(path) ? await readFile(path, 'utf8') : ''\n  await writeFile(path, renderEnv(existing, entries))\n}\n","import { readFile, writeFile } from 'node:fs/promises'\nimport { existsSync } from 'node:fs'\n\nconst REQUIRED = ['.env.local']\n\nexport function renderGitignore(existing: string): string {\n  const lines = new Set(existing.split(/\\r?\\n/).map((l) => l.trim()))\n  const missing = REQUIRED.filter((entry) => !lines.has(entry))\n  if (missing.length === 0) return existing\n  const trailingNewline = existing.endsWith('\\n') || existing === ''\n  return existing + (trailingNewline ? '' : '\\n') + missing.join('\\n') + '\\n'\n}\n\nexport async function ensureGitignore(path: string): Promise<void> {\n  const existing = existsSync(path) ? await readFile(path, 'utf8') : ''\n  const next = renderGitignore(existing)\n  if (next !== existing) await writeFile(path, next)\n}\n","import { readFile, writeFile } from 'node:fs/promises'\n\nconst IMPORT_MARK_START = '// === mhosaic-feedback:import:start ==='\nconst IMPORT_MARK_END = '// === mhosaic-feedback:import:end ==='\nconst WRAP_MARK_START = '{/* === mhosaic-feedback:wrap:start === */}'\nconst WRAP_MARK_END = '{/* === mhosaic-feedback:wrap:end === */}'\n\nexport interface WrapOptions {\n  apiKeyEnv: string       // 'VITE_FEEDBACK_API_KEY'\n  endpointEnv: string     // 'VITE_FEEDBACK_ENDPOINT'\n}\n\nfunction escapeRegex(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n}\n\nfunction buildImportBlock(): string {\n  return [\n    IMPORT_MARK_START,\n    \"import { FeedbackProvider } from '@mhosaic/feedback/react'\",\n    IMPORT_MARK_END,\n  ].join('\\n')\n}\n\nfunction buildWrapOpen(opts: WrapOptions): string {\n  return [\n    WRAP_MARK_START,\n    `<FeedbackProvider apiKey={import.meta.env.${opts.apiKeyEnv} as string} endpoint={import.meta.env.${opts.endpointEnv} as string} env=\"prod\">`,\n  ].join('\\n      ')\n}\n\nfunction buildWrapClose(): string {\n  return ['</FeedbackProvider>', WRAP_MARK_END].join('\\n      ')\n}\n\nexport function transformReactEntry(source: string, opts: WrapOptions): string {\n  let out = source\n\n  // If markers are already present, do an in-place update of the FeedbackProvider\n  // props (import block + wrap tag) without restructuring anything — this is what\n  // makes re-runs idempotent without needing to parse/unwrap the JSX tree.\n  const alreadyWrapped =\n    out.includes(IMPORT_MARK_START) && out.includes(WRAP_MARK_START)\n\n  if (alreadyWrapped) {\n    // Update import block (replace old import line inside the markers)\n    out = out.replace(\n      new RegExp(`(${escapeRegex(IMPORT_MARK_START)}\\\\n)[^\\\\n]*(\\\\n${escapeRegex(IMPORT_MARK_END)})`),\n      `$1import { FeedbackProvider } from '@mhosaic/feedback/react'$2`,\n    )\n    // Update FeedbackProvider opening tag props\n    out = out.replace(\n      /<FeedbackProvider[^>]*>/,\n      `<FeedbackProvider apiKey={import.meta.env.${opts.apiKeyEnv} as string} endpoint={import.meta.env.${opts.endpointEnv} as string} env=\"prod\">`,\n    )\n    return out\n  }\n\n  // Fresh insert: strip any partial markers that may exist (safety), then insert.\n  out = out.replace(\n    new RegExp(`${escapeRegex(IMPORT_MARK_START)}[\\\\s\\\\S]*?${escapeRegex(IMPORT_MARK_END)}\\\\n?`, 'g'),\n    '',\n  )\n  out = out.replace(\n    new RegExp(`${escapeRegex(WRAP_MARK_START)}[\\\\s\\\\S]*?${escapeRegex(WRAP_MARK_END)}\\\\n?`, 'g'),\n    '',\n  )\n\n  // Insert import block after the last existing import statement.\n  const importRegex = /^(import[^\\n]+\\n)+/m\n  const importMatch = out.match(importRegex)\n  if (importMatch) {\n    const idx = importMatch.index! + importMatch[0].length\n    out = out.slice(0, idx) + buildImportBlock() + '\\n\\n' + out.slice(idx)\n  } else {\n    out = buildImportBlock() + '\\n\\n' + out\n  }\n\n  // Wrap the App component inside the render call.\n  // Pattern A: createRoot(...).render(<jsx>) — covers both single-line and multi-line.\n  // Pattern B: ReactDOM.render(<jsx>, document.getElementById(...))\n  const renderPatterns: Array<RegExp> = [\n    /\\.render\\(\\s*([\\s\\S]*?)\\s*\\)\\s*[,;]?\\s*\\n/,\n    /ReactDOM\\.render\\(\\s*([\\s\\S]*?),\\s*document\\.getElementById/,\n  ]\n  for (const re of renderPatterns) {\n    const m = out.match(re)\n    if (m && m.index !== undefined) {\n      // Strip any trailing argument-list punctuation from the captured JSX —\n      // `render(<App />,)` is valid JS but wrapping a trailing `,` inside the\n      // FeedbackProvider children would render a literal \",\" as a text node.\n      const jsx = m[1]!.replace(/[,;]\\s*$/, '')\n      const wrapped = `\\n      ${buildWrapOpen(opts)}\\n        ${jsx.replace(/\\n/g, '\\n        ')}\\n      ${buildWrapClose()}\\n    `\n      const startIdx = m.index + m[0].indexOf(m[1]!)\n      out = out.slice(0, startIdx) + wrapped + out.slice(startIdx + m[1]!.length)\n      break\n    }\n  }\n\n  return out\n}\n\nexport async function wrapReactEntry(path: string, opts: WrapOptions): Promise<void> {\n  const source = await readFile(path, 'utf8')\n  const next = transformReactEntry(source, opts)\n  if (next !== source) await writeFile(path, next)\n}\n"],"mappings":";;;;;;AAAA,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,iBAAiB;AAE1B,OAAO,WAAW;AAClB,OAAO,aAAa;;;ACLpB,SAAS,UAAU,iBAAiB;AACpC,SAAS,kBAAkB;AAE3B,IAAM,OAAO;AAiBb,SAAS,cAAc,OAA8B,OAAuB;AAC1E,MAAI,SAAS,KAAK,KAAK,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,KAAK,oDAAoD;AAAA,EAC9E;AACA,MAAI,MAAM,SAAS,GAAG,GAAG;AACvB,UAAM,IAAI,MAAM,GAAG,KAAK,yDAAyD;AAAA,EACnF;AACA,MAAI,MAAM,SAAS,IAAI,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,KAAK,qDAAqD;AAAA,EAC/E;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAuB;AAGlD,MAAI,CAAC,uBAAuB,KAAK,KAAK,GAAG;AACvC,UAAM,IAAI;AAAA,MACR,2DAA2D,KAAK,UAAU,KAAK,CAAC;AAAA,IAClF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAuB;AAG3C,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAQ,WAAW,UAAU,GAAG;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,UAAU,UAAkB,SAA6B;AACvE,QAAM,SAAS,cAAc,UAAU,aAAa,QAAQ,MAAM,CAAC;AACnE,QAAM,WAAW,cAAc,YAAY,oBAAoB,QAAQ,QAAQ,CAAC;AAChF,QAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,QAAM,WAAqB,CAAC;AAC5B,MAAI,UAAU;AACd,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,KAAK,MAAM,MAAM;AAAE,gBAAU,CAAC;AAAS;AAAA,IAAS;AACzD,QAAI,QAAS;AACb,QAAI,KAAK,WAAW,wBAAwB,KAAK,KAAK,WAAW,yBAAyB,EAAG;AAC7F,aAAS,KAAK,IAAI;AAAA,EACpB;AAEA,SAAO,SAAS,SAAS,KAAK,SAAS,SAAS,SAAS,CAAC,MAAM,GAAI,UAAS,IAAI;AACjF,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,yBAAyB,MAAM;AAAA,IAC/B,0BAA0B,QAAQ;AAAA,IAClC;AAAA,EACF,EAAE,KAAK,IAAI;AACX,UAAQ,SAAS,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,MAAM,QAAQ;AAC7E;AAEA,eAAsB,cAAc,MAAc,SAAoC;AACpF,QAAM,WAAW,WAAW,IAAI,IAAI,MAAM,SAAS,MAAM,MAAM,IAAI;AACnE,QAAM,UAAU,MAAM,UAAU,UAAU,OAAO,CAAC;AACpD;;;AClFA,SAAS,YAAAC,WAAU,aAAAC,kBAAiB;AACpC,SAAS,cAAAC,mBAAkB;AAE3B,IAAM,WAAW,CAAC,YAAY;AAEvB,SAAS,gBAAgB,UAA0B;AACxD,QAAM,QAAQ,IAAI,IAAI,SAAS,MAAM,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAClE,QAAM,UAAU,SAAS,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC;AAC5D,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,kBAAkB,SAAS,SAAS,IAAI,KAAK,aAAa;AAChE,SAAO,YAAY,kBAAkB,KAAK,QAAQ,QAAQ,KAAK,IAAI,IAAI;AACzE;AAEA,eAAsB,gBAAgB,MAA6B;AACjE,QAAM,WAAWA,YAAW,IAAI,IAAI,MAAMF,UAAS,MAAM,MAAM,IAAI;AACnE,QAAM,OAAO,gBAAgB,QAAQ;AACrC,MAAI,SAAS,SAAU,OAAMC,WAAU,MAAM,IAAI;AACnD;;;ACjBA,SAAS,YAAAE,WAAU,aAAAC,kBAAiB;AAEpC,IAAM,oBAAoB;AAC1B,IAAM,kBAAkB;AACxB,IAAM,kBAAkB;AACxB,IAAM,gBAAgB;AAOtB,SAAS,YAAY,GAAmB;AACtC,SAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;AAEA,SAAS,mBAA2B;AAClC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,cAAc,MAA2B;AAChD,SAAO;AAAA,IACL;AAAA,IACA,6CAA6C,KAAK,SAAS,yCAAyC,KAAK,WAAW;AAAA,EACtH,EAAE,KAAK,UAAU;AACnB;AAEA,SAAS,iBAAyB;AAChC,SAAO,CAAC,uBAAuB,aAAa,EAAE,KAAK,UAAU;AAC/D;AAEO,SAAS,oBAAoB,QAAgB,MAA2B;AAC7E,MAAI,MAAM;AAKV,QAAM,iBACJ,IAAI,SAAS,iBAAiB,KAAK,IAAI,SAAS,eAAe;AAEjE,MAAI,gBAAgB;AAElB,UAAM,IAAI;AAAA,MACR,IAAI,OAAO,IAAI,YAAY,iBAAiB,CAAC,kBAAkB,YAAY,eAAe,CAAC,GAAG;AAAA,MAC9F;AAAA,IACF;AAEA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,6CAA6C,KAAK,SAAS,yCAAyC,KAAK,WAAW;AAAA,IACtH;AACA,WAAO;AAAA,EACT;AAGA,QAAM,IAAI;AAAA,IACR,IAAI,OAAO,GAAG,YAAY,iBAAiB,CAAC,aAAa,YAAY,eAAe,CAAC,QAAQ,GAAG;AAAA,IAChG;AAAA,EACF;AACA,QAAM,IAAI;AAAA,IACR,IAAI,OAAO,GAAG,YAAY,eAAe,CAAC,aAAa,YAAY,aAAa,CAAC,QAAQ,GAAG;AAAA,IAC5F;AAAA,EACF;AAGA,QAAM,cAAc;AACpB,QAAM,cAAc,IAAI,MAAM,WAAW;AACzC,MAAI,aAAa;AACf,UAAM,MAAM,YAAY,QAAS,YAAY,CAAC,EAAE;AAChD,UAAM,IAAI,MAAM,GAAG,GAAG,IAAI,iBAAiB,IAAI,SAAS,IAAI,MAAM,GAAG;AAAA,EACvE,OAAO;AACL,UAAM,iBAAiB,IAAI,SAAS;AAAA,EACtC;AAKA,QAAM,iBAAgC;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACA,aAAW,MAAM,gBAAgB;AAC/B,UAAM,IAAI,IAAI,MAAM,EAAE;AACtB,QAAI,KAAK,EAAE,UAAU,QAAW;AAI9B,YAAM,MAAM,EAAE,CAAC,EAAG,QAAQ,YAAY,EAAE;AACxC,YAAM,UAAU;AAAA,QAAW,cAAc,IAAI,CAAC;AAAA,UAAa,IAAI,QAAQ,OAAO,YAAY,CAAC;AAAA,QAAW,eAAe,CAAC;AAAA;AACtH,YAAM,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAE;AAC7C,YAAM,IAAI,MAAM,GAAG,QAAQ,IAAI,UAAU,IAAI,MAAM,WAAW,EAAE,CAAC,EAAG,MAAM;AAC1E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,eAAe,MAAc,MAAkC;AACnF,QAAM,SAAS,MAAMD,UAAS,MAAM,MAAM;AAC1C,QAAM,OAAO,oBAAoB,QAAQ,IAAI;AAC7C,MAAI,SAAS,OAAQ,OAAMC,WAAU,MAAM,IAAI;AACjD;;;AHtFA,SAAS,UAAU,MAA0B;AAC3C,QAAM,MAAgB,EAAE,KAAK,OAAO,SAAS,MAAM,KAAK,QAAQ,IAAI,EAAE;AACtE,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,aAAa;AAAE,YAAM,IAAI,KAAK,EAAE,CAAC;AAAG,UAAI,MAAM,OAAW,KAAI,SAAS;AAAA,IAAE,WACzE,MAAM,cAAc;AAAE,YAAM,IAAI,KAAK,EAAE,CAAC;AAAG,UAAI,MAAM,OAAW,KAAI,WAAW;AAAA,IAAE,WACjF,MAAM,WAAW,MAAM,KAAM,KAAI,MAAM;AAAA,aACvC,MAAM,eAAgB,KAAI,UAAU;AAAA,aACpC,MAAM,QAAS,KAAI,MAAM,KAAK,EAAE,CAAC,KAAK,QAAQ,IAAI;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,KAAsC;AAClE,MAAIC,YAAW,KAAK,KAAK,gBAAgB,CAAC,EAAG,QAAO;AACpD,MAAIA,YAAW,KAAK,KAAK,WAAW,CAAC,EAAG,QAAO;AAC/C,SAAO;AACT;AAEA,eAAsB,QAAQ,MAA+B;AAC3D,QAAM,OAAO,UAAU,IAAI;AAC3B,QAAM,EAAE,IAAI,IAAI;AAEhB,UAAQ,OAAO,MAAM,MAAM,KAAK,qCAAgC,CAAC;AAEjE,QAAM,YAAY,MAAM,gBAAgB,GAAG;AAC3C,UAAQ,OAAO,MAAM,MAAM,KAAK,aAAa,UAAU,IAAI,GAAG,UAAU,QAAQ,OAAO,UAAU,QAAQ,MAAM,EAAE;AAAA,CAAI,CAAC;AAEtH,MAAI,SAAS,KAAK;AAClB,MAAI,WAAW,KAAK,YAAY;AAChC,MAAI,CAAC,KAAK,OAAO,CAAC,QAAQ;AACxB,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,EAAE,MAAM,QAAQ,MAAM,YAAY,SAAS,oBAAoB,SAAS,SAAS;AAAA,MACjF,EAAE,MAAM,QAAQ,MAAM,UAAU,SAAS,mCAA8B,UAAU,CAAC,MAAc,EAAE,WAAW,UAAU,KAAK,2BAA2B;AAAA,IACzJ,CAAC;AACD,QAAI,CAAC,QAAQ,QAAQ;AACnB,cAAQ,OAAO,MAAM,MAAM,IAAI,YAAY,CAAC;AAC5C,cAAQ,WAAW;AACnB;AAAA,IACF;AACA,eAAW,QAAQ;AACnB,aAAS,QAAQ;AAAA,EACnB;AACA,MAAI,CAAC,QAAQ;AACX,YAAQ,OAAO,MAAM,wCAAwC;AAC7D,YAAQ,WAAW;AACnB;AAAA,EACF;AAEA,QAAM,KAAK,qBAAqB,GAAG;AACnC,MAAI,KAAK,SAAS;AAChB,YAAQ,OAAO,MAAM,MAAM,KAAK,oCAAoC,EAAE;AAAA,CAAK,CAAC;AAC5E,UAAM,MAAM,OAAO,SAAS,CAAC,QAAQ,OAAO,mBAAmB,IAAI,OAAO,SAAS,CAAC,QAAQ,OAAO,mBAAmB,IAAI,CAAC,OAAO,WAAW,mBAAmB;AAChK,UAAM,MAAM,UAAU,IAAI,CAAC,GAAI,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,OAAO,UAAU,CAAC;AACtE,QAAI,IAAI,WAAW,GAAG;AACpB,cAAQ,OAAO,MAAM,MAAM,IAAI,kBAAkB,CAAC;AAClD,cAAQ,WAAW,IAAI,UAAU;AACjC;AAAA,IACF;AACA,YAAQ,OAAO,MAAM,MAAM,MAAM,sCAAiC,CAAC;AAAA,EACrE;AAEA,QAAM,cAAc,KAAK,KAAK,YAAY,GAAG,EAAE,QAAQ,SAAS,CAAC;AACjE,UAAQ,OAAO,MAAM,MAAM,MAAM,2BAAsB,CAAC;AAExD,QAAM,gBAAgB,KAAK,KAAK,YAAY,CAAC;AAC7C,UAAQ,OAAO,MAAM,MAAM,MAAM,6BAAwB,CAAC;AAE1D,MAAI,UAAU,SAAS,UAAU,SAAS,cAAc;AACtD,UAAM,YAAY,KAAK,KAAK,UAAU,KAAK;AAC3C,QAAIA,YAAW,SAAS,GAAG;AACzB,YAAM,eAAe,WAAW;AAAA,QAC9B,WAAW;AAAA,QACX,aAAa;AAAA,MACf,CAAC;AACD,cAAQ,OAAO,MAAM,MAAM,MAAM,kBAAa,UAAU,KAAK;AAAA,CAAI,CAAC;AAAA,IACpE,OAAO;AACL,cAAQ,OAAO,MAAM,MAAM,OAAO,yBAAoB,UAAU,KAAK;AAAA,CAAkD,CAAC;AAAA,IAC1H;AAAA,EACF,WAAW,UAAU,SAAS,cAAc;AAC1C,YAAQ,OAAO,MAAM,MAAM,OAAO,oEAA+D,UAAU,IAAI;AAAA,CAAsC,CAAC;AAAA,EACxJ;AAEA,UAAQ,OAAO,MAAM,MAAM,KAAK,WAAW,CAAC;AAC9C;","names":["existsSync","readFile","writeFile","existsSync","readFile","writeFile","existsSync"]}