@mhosaic/feedback 0.12.2 → 0.13.0

package/dist/{chunk-TBT2OODO.mjs → chunk-64HXWJCH.mjs}

@@ -43,6 +43,13 @@ function createApiClient(options) {
     if (payload.synthetic) {
       headers["X-Mhosaic-Capture-Source"] = "error-tracking";
     }
+    const signed = options.getSignedIdentity?.();
+    if (signed && signed.userHash && signed.exp && payload.user?.id) {
+      headers["X-Mhosaic-User"] = String(payload.user.id);
+      headers["X-Mhosaic-User-Hmac"] = signed.userHash;
+      headers["X-Mhosaic-User-Exp"] = String(signed.exp);
+      if (signed.email) headers["X-Mhosaic-User-Email"] = signed.email;
+    }
     const response = await fetcher(`${endpoint}/api/feedback/v1/reports/`, {
       method: "POST",
       headers,
@@ -55,10 +62,17 @@ function createApiClient(options) {
     return response.json();
   }
   function widgetHeaders(externalId) {
-    return {
+    const headers = {
       Authorization: `Bearer ${options.apiKey}`,
       "X-Mhosaic-User": externalId
     };
+    const signed = options.getSignedIdentity?.();
+    if (signed && signed.userHash && signed.exp) {
+      headers["X-Mhosaic-User-Hmac"] = signed.userHash;
+      headers["X-Mhosaic-User-Exp"] = String(signed.exp);
+      if (signed.email) headers["X-Mhosaic-User-Email"] = signed.email;
+    }
+    return headers;
   }
   async function listMine(externalId) {
     const response = await fetcher(`${endpoint}/api/feedback/v1/reports/widget/mine/`, {
@@ -4697,14 +4711,26 @@ function createFeedback(config) {
   const capture = installCapture({
     ...config.sanitizeUrl !== void 0 && { sanitizeUrl: config.sanitizeUrl }
   });
+  let user = config.user;
+  let metadata = config.metadata ?? {};
   const api = createApiClient({
     apiKey: config.apiKey,
     endpoint: config.endpoint,
     ...config.fetchImpl !== void 0 && { fetch: config.fetchImpl },
-    ...config.beforeSend !== void 0 && { beforeSend: config.beforeSend }
+    ...config.beforeSend !== void 0 && { beforeSend: config.beforeSend },
+    // v0.13: the API client reads this on every request so a late
+    // `identify({userHash, exp, ...})` lights up signed headers
+    // immediately on subsequent calls. Returns null when the host
+    // hasn't supplied a signature (legacy unsigned path).
+    getSignedIdentity: () => {
+      if (!user || !user.userHash || !user.exp || !user.email) return null;
+      return {
+        userHash: user.userHash,
+        exp: user.exp,
+        email: user.email
+      };
+    }
   });
-  let user = config.user;
-  let metadata = config.metadata ?? {};
   const transformers = [];
   const host = document.createElement("div");
   host.className = "mhosaic-feedback";
@@ -4732,8 +4758,8 @@ function createFeedback(config) {
       capture_method: captureMethod,
       technical_context
     };
-    if ("0.12.2") {
-      payload.widget_version = "0.12.2";
+    if ("0.13.0") {
+      payload.widget_version = "0.13.0";
     }
     if (manualScreenshot) payload.screenshot = manualScreenshot;
     if (values.synthetic) payload.synthetic = true;
@@ -4819,4 +4845,4 @@ function createFeedback(config) {
 export {
   createFeedback
 };
-//# sourceMappingURL=chunk-TBT2OODO.mjs.map
+//# sourceMappingURL=chunk-64HXWJCH.mjs.map