@mhosaic/feedback 0.20.0 → 0.22.0

package/dist/error-tracking.d.ts

@@ -1,4 +1,5 @@
-import { F as FeedbackApi } from './types-2dZ9bHAn.js';
+import { F as FeedbackApi } from './types-CfSqqfkw.js';
+import './types-CRbb2Pp0.js';
 
 /**
  * Always-on debugger module. Hooks `window.error` and `unhandledrejection`,

package/dist/{index-Bq4QI0xa.d.ts → index-CmHNkJsj.d.ts}

@@ -1,4 +1,4 @@
-import { a as FeedbackConfig, F as FeedbackApi, R as ReportTransformer } from './types-2dZ9bHAn.js';
+import { a as FeedbackConfig, F as FeedbackApi, R as ReportTransformer } from './types-CfSqqfkw.js';
 
 interface InternalConfig extends FeedbackConfig {
     fetchImpl?: typeof fetch;

package/dist/index.d.ts

@@ -1,2 +1,3 @@
-export { c as createFeedback } from './index-Bq4QI0xa.js';
-export { C as CapturedContext, F as FeedbackApi, a as FeedbackConfig, b as FeedbackEnv, c as FeedbackSeverity, d as FeedbackType, e as ReportPayload, S as SubmittedReport, U as UserIdentity } from './types-2dZ9bHAn.js';
+export { c as createFeedback } from './index-CmHNkJsj.js';
+export { C as CapturedContext, F as FeedbackApi, a as FeedbackConfig, b as FeedbackEnv, c as FeedbackSeverity, d as FeedbackType, e as ReportPayload, S as SubmittedReport, U as UserIdentity } from './types-CfSqqfkw.js';
+import './types-CRbb2Pp0.js';

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import {
   createFeedback
-} from "./chunk-YV7LMW22.mjs";
+} from "./chunk-6OAG72JW.mjs";
 import "./chunk-4QOIFIT5.mjs";
 import "./chunk-FGA63IEZ.mjs";
 export {

package/dist/loader/react.d.ts

@@ -1,7 +1,8 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
 import { ErrorTrackingOptions } from '../error-tracking.js';
-import { a as FeedbackConfig, F as FeedbackApi } from '../types-2dZ9bHAn.js';
+import { a as FeedbackConfig, F as FeedbackApi } from '../types-CfSqqfkw.js';
+import '../types-CRbb2Pp0.js';
 
 interface FeedbackProviderProps extends FeedbackConfig {
     children?: ReactNode;

package/dist/loader.d.ts

@@ -1,5 +1,6 @@
-import { a as FeedbackConfig, F as FeedbackApi } from './types-2dZ9bHAn.js';
+import { a as FeedbackConfig, F as FeedbackApi } from './types-CfSqqfkw.js';
 import { ErrorTrackingOptions } from './error-tracking.js';
+import './types-CRbb2Pp0.js';
 
 /**
  * Fetch the widget-manifest from the Mhosaic backend.

package/dist/loader.min.js

@@ -1,2 +1,2 @@
-"use strict";var MhosaicFeedbackLoader=(()=>{var l="data-mhosaic-feedback-bundle";async function f(t){var n,r;return(n=window.MhosaicFeedback)!=null&&n.createFeedback?window.MhosaicFeedback:document.querySelector(`script[${l}]`)?w((r=t.timeoutMs)!=null?r:3e4):new Promise((e,o)=>{var s;let a=document.createElement("script");a.src=t.bundleUrl,a.integrity=t.sriHash,a.crossOrigin="anonymous",a.async=!0,a.setAttribute(l,"1"),a.onload=()=>{var c;(c=window.MhosaicFeedback)!=null&&c.createFeedback?e(window.MhosaicFeedback):o(new Error("mhosaic-feedback: bundle loaded but window.MhosaicFeedback.createFeedback is missing \u2014 bundle/loader version mismatch?"))},a.onerror=()=>{o(new Error(`mhosaic-feedback: failed to load bundle from ${t.bundleUrl} (network, CSP, or SRI mismatch)`))},document.head.appendChild(a);let d=(s=t.timeoutMs)!=null?s:3e4;setTimeout(()=>{o(new Error(`mhosaic-feedback: bundle load timeout after ${d}ms`))},d)})}function w(t){return new Promise((i,n)=>{let r=Date.now(),e=()=>{var o;if((o=window.MhosaicFeedback)!=null&&o.createFeedback){i(window.MhosaicFeedback);return}if(Date.now()-r>t){n(new Error("mhosaic-feedback: timed out waiting for bundle global (another loader instance started the fetch but never finished)"));return}setTimeout(e,50)};e()})}async function b(t,i,n){let e=`${t.replace(/\/$/,"")}/api/feedback/v1/widget-manifest/?pk=${encodeURIComponent(i)}`,o={credentials:"omit"};n&&(o.signal=n);let a=await fetch(e,o);if(!a.ok)throw new Error(`mhosaic-feedback: manifest fetch failed (HTTP ${a.status})`);return await a.json()}function k(){let t=null,i=null,n=[];function r(e){if(t){e.kind==="void"?t[e.method]():e.kind==="arg"?t[e.method](e.arg):Promise.resolve(t.submit(e.payload)).then(e.resolve,e.reject);return}if(i){e.kind==="submit"&&e.reject(i);return}n.push(e)}return{show(){r({kind:"void",method:"show"})},hide(){r({kind:"void",method:"hide"})},shutdown(){r({kind:"void",method:"shutdown"})},open(e){r({kind:"arg",method:"open",arg:e})},identify(e){r({kind:"arg",method:"identify",arg:e})},setMetadata(e){r({kind:"arg",method:"setMetadata",arg:e})},submit(e){return new Promise((o,a)=>{r({kind:"submit",payload:e,resolve:o,reject:a})})},_attach(e){for(t=e;n.length>0;)r(n.shift())},_fail(e){i=e;for(let o of n)o.kind==="submit"&&o.reject(e);n.length=0}}}function p(t){let i=k();return y(t,i).catch(n=>{console.warn("[mhosaic-feedback] widget did not load:",n.message),i._fail(n)}),i}async function y(t,i){var o,a,d,s,c,u;let n=await b(t.endpoint,t.apiKey);if(!n.enabled||!n.bundle_url||!n.sri_hash){i._fail(new Error(`mhosaic-feedback: widget disabled for this project${n.detail?` \u2014 ${n.detail}`:""}`));return}let e=(await f({bundleUrl:n.bundle_url,sriHash:n.sri_hash})).createFeedback({...t,requiresVisibilityCheck:(d=(a=t.requiresVisibilityCheck)!=null?a:(o=n.config)==null?void 0:o.requires_visibility_check)!=null?d:!1,errorTracking:(u=(c=t.errorTracking)!=null?c:(s=n.config)==null?void 0:s.error_tracking)!=null?u:!0});i._attach(e)}function F(){let t=document.currentScript;if(!t)return null;let i=t.dataset.key,n=t.dataset.endpoint;if(!i||!n)return null;let r=t.dataset.env;return{apiKey:i,endpoint:n,...r!==void 0&&{env:r}}}var m=F(),h,g;if(m){let n=function(e){switch(e.name){case"identify":t.identify(e.args[0]);break;case"setMetadata":t.setMetadata(e.args[0]);break;case"open":t.open(e.args[0]);break;case"show":t.show();break;case"hide":t.hide();break;default:console.warn("[mhosaic-feedback] unknown queue call:",e.name)}};M=n;let t=p(m),i=(g=(h=window.Feedback)==null?void 0:h.q)!=null?g:[];for(let e of i)n(e);let r=Object.assign(function(o,...a){n({name:o,args:a})},{q:[]});window.Feedback=r}var M;})();
+"use strict";var MhosaicFeedbackLoader=(()=>{var u=Object.defineProperty;var F=Object.getOwnPropertyDescriptor;var M=Object.getOwnPropertyNames;var v=Object.prototype.hasOwnProperty;var _=(e,r)=>{for(var t in r)u(e,t,{get:r[t],enumerable:!0})},C=(e,r,t,i)=>{if(r&&typeof r=="object"||typeof r=="function")for(let n of M(r))!v.call(e,n)&&n!==t&&u(e,n,{get:()=>r[n],enumerable:!(i=F(r,n))||i.enumerable});return e};var A=e=>C(u({},"__esModule",{value:!0}),e);var E={};_(E,{configFromDataset:()=>y});var f="data-mhosaic-feedback-bundle";async function b(e){var t,i;return(t=window.MhosaicFeedback)!=null&&t.createFeedback?window.MhosaicFeedback:document.querySelector(`script[${f}]`)?T((i=e.timeoutMs)!=null?i:3e4):new Promise((n,o)=>{var s;let a=document.createElement("script");a.src=e.bundleUrl,a.integrity=e.sriHash,a.crossOrigin="anonymous",a.async=!0,a.setAttribute(f,"1"),a.onload=()=>{var c;(c=window.MhosaicFeedback)!=null&&c.createFeedback?n(window.MhosaicFeedback):o(new Error("mhosaic-feedback: bundle loaded but window.MhosaicFeedback.createFeedback is missing \u2014 bundle/loader version mismatch?"))},a.onerror=()=>{o(new Error(`mhosaic-feedback: failed to load bundle from ${e.bundleUrl} (network, CSP, or SRI mismatch)`))},document.head.appendChild(a);let d=(s=e.timeoutMs)!=null?s:3e4;setTimeout(()=>{o(new Error(`mhosaic-feedback: bundle load timeout after ${d}ms`))},d)})}function T(e){return new Promise((r,t)=>{let i=Date.now(),n=()=>{var o;if((o=window.MhosaicFeedback)!=null&&o.createFeedback){r(window.MhosaicFeedback);return}if(Date.now()-i>e){t(new Error("mhosaic-feedback: timed out waiting for bundle global (another loader instance started the fetch but never finished)"));return}setTimeout(n,50)};n()})}async function k(e,r,t){let n=`${e.replace(/\/$/,"")}/api/feedback/v1/widget-manifest/?pk=${encodeURIComponent(r)}`,o={credentials:"omit"};t&&(o.signal=t);let a=await fetch(n,o);if(!a.ok)throw new Error(`mhosaic-feedback: manifest fetch failed (HTTP ${a.status})`);return await a.json()}function p(){let e=null,r=null,t=[];function i(n){if(e){n.kind==="void"?e[n.method]():n.kind==="arg"?e[n.method](n.arg):Promise.resolve(e.submit(n.payload)).then(n.resolve,n.reject);return}if(r){n.kind==="submit"&&n.reject(r);return}t.push(n)}return{show(){i({kind:"void",method:"show"})},hide(){i({kind:"void",method:"hide"})},shutdown(){i({kind:"void",method:"shutdown"})},open(n){i({kind:"arg",method:"open",arg:n})},identify(n){i({kind:"arg",method:"identify",arg:n})},setMetadata(n){i({kind:"arg",method:"setMetadata",arg:n})},submit(n){return new Promise((o,a)=>{i({kind:"submit",payload:n,resolve:o,reject:a})})},_attach(n){for(e=n;t.length>0;)i(t.shift())},_fail(n){r=n;for(let o of t)o.kind==="submit"&&o.reject(n);t.length=0}}}function m(e){let r=p();return q(e,r).catch(t=>{console.warn("[mhosaic-feedback] widget did not load:",t.message),r._fail(t)}),r}async function q(e,r){var o,a,d,s,c,l;let t=await k(e.endpoint,e.apiKey);if(!t.enabled||!t.bundle_url||!t.sri_hash){r._fail(new Error(`mhosaic-feedback: widget disabled for this project${t.detail?` \u2014 ${t.detail}`:""}`));return}let n=(await b({bundleUrl:t.bundle_url,sriHash:t.sri_hash})).createFeedback({...e,requiresVisibilityCheck:(d=(a=e.requiresVisibilityCheck)!=null?a:(o=t.config)==null?void 0:o.requires_visibility_check)!=null?d:!1,errorTracking:(l=(c=e.errorTracking)!=null?c:(s=t.config)==null?void 0:s.error_tracking)!=null?l:!0});r._attach(n)}function y(e){if(!e.key||!e.endpoint)return null;let r=e.env;return{apiKey:e.key,endpoint:e.endpoint,...r!==void 0&&{env:r},...e.qaSource?{qaMeter:{source:e.qaSource,...e.qaLocale?{locale:e.qaLocale}:{}}}:{}}}function P(){let e=document.currentScript;return e?y(e.dataset):null}var g=P(),h,w;if(g){let t=function(n){switch(n.name){case"identify":e.identify(n.args[0]);break;case"setMetadata":e.setMetadata(n.args[0]);break;case"open":e.open(n.args[0]);break;case"show":e.show();break;case"hide":e.hide();break;default:console.warn("[mhosaic-feedback] unknown queue call:",n.name)}};x=t;let e=m(g),r=(w=(h=window.Feedback)==null?void 0:h.q)!=null?w:[];for(let n of r)t(n);let i=Object.assign(function(o,...a){t({name:o,args:a})},{q:[]});window.Feedback=i}var x;return A(E);})();
 //# sourceMappingURL=loader.min.js.map

package/dist/loader.min.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/loader/bundleLoader.ts","../src/loader/manifest.ts","../src/loader/deferredApi.ts","../src/loader/index.ts","../src/loader-embed.ts"],"sourcesContent":["/**\n * Inject the widget bundle as an SRI-protected <script> and wait for its\n * window global to appear.\n *\n * Why a <script> tag and not `import()`:\n *   `import()` can fetch cross-origin ESM but doesn't honor Subresource\n *   Integrity on the dynamic-import call itself. A <script> tag with\n *   `integrity=…` is the only path where the browser actually refuses\n *   to execute a bundle whose bytes don't match the manifest's hash.\n *\n * The bundle is built with `tsup --format iife --globalName MhosaicFeedback`,\n * so once it parses it sets `window.MhosaicFeedback = { createFeedback }`\n * (per `src/widget.ts`'s exports). We wait for that to appear.\n *\n * Idempotency: if multiple FeedbackProviders mount on the same page (e.g.\n * during a React fast-refresh cycle), we reuse an already-injected bundle\n * instead of fetching a second copy.\n */\n\nimport type { FeedbackApi, FeedbackConfig } from '../types'\nimport type { ErrorTrackingOptions } from '../modules/error-tracking'\n\n/** What the loader may pass to the bundle's `createFeedback`: the public\n *  config plus the bundle-only `errorTracking` knob the loader forwards\n *  from the manifest. */\nexport type BundleConfig = FeedbackConfig & {\n  errorTracking?: boolean | ErrorTrackingOptions\n}\n\ndeclare global {\n  interface Window {\n    MhosaicFeedback?: {\n      createFeedback(config: BundleConfig): FeedbackApi\n    }\n  }\n}\n\nconst SCRIPT_DATA_ATTR = 'data-mhosaic-feedback-bundle'\n\nexport interface BundleLoadOptions {\n  bundleUrl: string\n  sriHash: string\n  /** Default 30 s. Long enough for slow networks; short enough to surface\n   *  CDN outages quickly. */\n  timeoutMs?: number\n}\n\nexport interface BundleHandle {\n  createFeedback(config: BundleConfig): FeedbackApi\n}\n\nexport async function injectBundle(\n  opts: BundleLoadOptions,\n): Promise<BundleHandle> {\n  // Reuse a bundle already loaded this page.\n  if (window.MhosaicFeedback?.createFeedback) {\n    return window.MhosaicFeedback\n  }\n\n  const existing = document.querySelector<HTMLScriptElement>(\n    `script[${SCRIPT_DATA_ATTR}]`,\n  )\n  if (existing) {\n    // Another loader instance started the fetch; wait for the global.\n    return waitForGlobal(opts.timeoutMs ?? 30_000)\n  }\n\n  return new Promise<BundleHandle>((resolve, reject) => {\n    const script = document.createElement('script')\n    script.src = opts.bundleUrl\n    script.integrity = opts.sriHash\n    script.crossOrigin = 'anonymous'\n    script.async = true\n    script.setAttribute(SCRIPT_DATA_ATTR, '1')\n    script.onload = () => {\n      if (window.MhosaicFeedback?.createFeedback) {\n        resolve(window.MhosaicFeedback)\n      } else {\n        reject(\n          new Error(\n            'mhosaic-feedback: bundle loaded but window.MhosaicFeedback.createFeedback is missing — bundle/loader version mismatch?',\n          ),\n        )\n      }\n    }\n    script.onerror = () => {\n      reject(\n        new Error(\n          `mhosaic-feedback: failed to load bundle from ${opts.bundleUrl} ` +\n            '(network, CSP, or SRI mismatch)',\n        ),\n      )\n    }\n    document.head.appendChild(script)\n\n    const timeoutMs = opts.timeoutMs ?? 30_000\n    setTimeout(() => {\n      reject(\n        new Error(`mhosaic-feedback: bundle load timeout after ${timeoutMs}ms`),\n      )\n    }, timeoutMs)\n  })\n}\n\nfunction waitForGlobal(timeoutMs: number): Promise<BundleHandle> {\n  return new Promise((resolve, reject) => {\n    const start = Date.now()\n    const tick = () => {\n      if (window.MhosaicFeedback?.createFeedback) {\n        resolve(window.MhosaicFeedback)\n        return\n      }\n      if (Date.now() - start > timeoutMs) {\n        reject(\n          new Error(\n            'mhosaic-feedback: timed out waiting for bundle global (another loader instance started the fetch but never finished)',\n          ),\n        )\n        return\n      }\n      setTimeout(tick, 50)\n    }\n    tick()\n  })\n}\n","/**\n * Fetch the widget-manifest from the Mhosaic backend.\n *\n * The loader calls this on every page load. The backend reads `Project.\n * pinned_version` (or current stable) + `Project.widget_enabled` and\n * returns the bundle URL + SRI hash for the version this tenant should\n * receive — or `{enabled: false}` if the widget is killed for the tenant.\n *\n * Network failures are surfaced to the caller. The loader degrades to\n * \"widget not present\" rather than crashing the host page.\n */\n\nexport interface Manifest {\n  /** False when the widget is disabled for this project (kill switch) or\n   *  no stable release exists. Loader bails silently. */\n  enabled: boolean\n  /** Semver of the bundle being served. Present when enabled=true. */\n  version?: string\n  /** Fully-qualified URL to the version-pinned bundle (jsDelivr). */\n  bundle_url?: string\n  /** Subresource integrity hash for the bundle. The loader injects the\n   *  script tag with `integrity=…` so the browser refuses to run a\n   *  bundle whose bytes don't match. */\n  sri_hash?: string\n  /** Static config the manifest endpoint passes through to the widget. */\n  config?: {\n    endpoint: string\n    project_slug: string\n    share_reports_with_widget: boolean\n    /** Phase 4: project gates the widget per end-user (default false). */\n    requires_visibility_check?: boolean\n    /** Per-project switch for the bundle's default error capture. When the\n     *  backend omits it, the bundle falls back to its own default (on). */\n    error_tracking?: boolean\n  }\n  /** Human-readable detail when `enabled` is false. */\n  detail?: string\n}\n\nexport async function fetchManifest(\n  endpoint: string,\n  apiKey: string,\n  signal?: AbortSignal,\n): Promise<Manifest> {\n  const base = endpoint.replace(/\\/$/, '')\n  const url = `${base}/api/feedback/v1/widget-manifest/?pk=${encodeURIComponent(apiKey)}`\n  // credentials: 'omit' — we authenticate via the public pk_proj_ query\n  // param; sending cookies would just trigger CORS preflights for no\n  // reason and is unnecessary since the manifest endpoint doesn't read\n  // any session.\n  const init: RequestInit = { credentials: 'omit' }\n  if (signal) init.signal = signal\n  const res = await fetch(url, init)\n  if (!res.ok) {\n    throw new Error(\n      `mhosaic-feedback: manifest fetch failed (HTTP ${res.status})`,\n    )\n  }\n  const body = (await res.json()) as Manifest\n  return body\n}\n","/**\n * A FeedbackApi-shaped object that queues method calls until the real\n * widget bundle finishes loading, then drains the queue against the real\n * implementation.\n *\n * Why we need this: hosts that already have code like\n *   const fb = createFeedback({...})\n *   fb.identify({id, email, name})\n *   useEffect(() => fb.open(...), [])\n * shouldn't have to refactor for async. The loader's createFeedback\n * returns sync — a deferred handle that records intent, then replays it\n * once the real bundle arrives. Idiomatic queue-then-flush pattern.\n *\n * If the bundle never loads (network failure, SRI mismatch, kill switch),\n * `_fail()` is called instead. Void methods (identify/setMetadata/open/...)\n * silently drop in that case — the widget just doesn't appear. The\n * `submit` Promise rejects so callers can surface real errors.\n */\n\nimport type {\n  FeedbackApi,\n  ReportPayload,\n  SubmittedReport,\n  UserIdentity,\n} from '../types'\n\ntype VoidMethod = 'show' | 'hide' | 'shutdown'\ntype ArgMethod = 'open' | 'identify' | 'setMetadata'\n\ntype Queued =\n  | { kind: 'void'; method: VoidMethod }\n  | { kind: 'arg'; method: 'open'; arg: Parameters<FeedbackApi['open']>[0] }\n  | { kind: 'arg'; method: 'identify'; arg: UserIdentity }\n  | { kind: 'arg'; method: 'setMetadata'; arg: Record<string, unknown> }\n  | {\n      kind: 'submit'\n      payload: Partial<ReportPayload> & { description: string }\n      resolve: (r: SubmittedReport) => void\n      reject: (e: unknown) => void\n    }\n\nexport interface DeferredHandle extends FeedbackApi {\n  /** Called by the loader once the bundle is loaded and a real API exists. */\n  _attach(real: FeedbackApi): void\n  /** Called by the loader if the bundle fails to load. */\n  _fail(err: Error): void\n}\n\nexport function createDeferredApi(): DeferredHandle {\n  let real: FeedbackApi | null = null\n  let failure: Error | null = null\n  const queue: Queued[] = []\n\n  function flush(item: Queued): void {\n    if (real) {\n      if (item.kind === 'void') {\n        ;(real[item.method] as () => void)()\n      } else if (item.kind === 'arg') {\n        ;(real[item.method] as (a: unknown) => void)(item.arg)\n      } else {\n        // submit\n        Promise.resolve(real.submit(item.payload)).then(\n          item.resolve,\n          item.reject,\n        )\n      }\n      return\n    }\n    if (failure) {\n      if (item.kind === 'submit') item.reject(failure)\n      // Void / arg methods silently dropped — the widget never appeared.\n      return\n    }\n    queue.push(item)\n  }\n\n  return {\n    show() {\n      flush({ kind: 'void', method: 'show' })\n    },\n    hide() {\n      flush({ kind: 'void', method: 'hide' })\n    },\n    shutdown() {\n      flush({ kind: 'void', method: 'shutdown' })\n    },\n    open(arg) {\n      flush({ kind: 'arg', method: 'open', arg })\n    },\n    identify(arg) {\n      flush({ kind: 'arg', method: 'identify', arg })\n    },\n    setMetadata(arg) {\n      flush({ kind: 'arg', method: 'setMetadata', arg })\n    },\n    submit(payload) {\n      return new Promise<SubmittedReport>((resolve, reject) => {\n        flush({ kind: 'submit', payload, resolve, reject })\n      })\n    },\n    _attach(impl) {\n      real = impl\n      while (queue.length > 0) flush(queue.shift()!)\n    },\n    _fail(err) {\n      failure = err\n      // Drain any pending submits with the failure; drop void/arg.\n      for (const item of queue) {\n        if (item.kind === 'submit') item.reject(err)\n      }\n      queue.length = 0\n    },\n  }\n}\n","/**\n * `@mhosaic/feedback/loader` — public entry for the loader architecture.\n *\n * Same shape as the direct-import path (`@mhosaic/feedback`), but the\n * widget bundle is fetched at runtime from a CDN URL the Mhosaic backend\n * dictates via the manifest endpoint. Letting hosts switch from the\n * direct-import path to the loader path gives them auto-updates without\n * any further code changes — Mhosaic ships a new Release row, every host\n * picks up the new bundle on next page load.\n *\n * Public surface MUST mirror the direct-import path exactly:\n *   - `createFeedback(config)` returns a `FeedbackApi`-shaped handle.\n *   - Method calls before the bundle finishes loading queue up and replay.\n *   - `submit()` returns a Promise that resolves after the bundle is up\n *     and the real submit completes.\n *\n * If the manifest endpoint reports the widget is disabled for this\n * project (`enabled: false` — kill switch or no stable release configured),\n * the deferred handle silently no-ops void calls and rejects `submit()`\n * calls with a clear error. The host page never crashes.\n */\n\nimport type { FeedbackApi, FeedbackConfig } from '../types'\nimport type { ErrorTrackingOptions } from '../modules/error-tracking'\nimport { injectBundle } from './bundleLoader'\nimport { fetchManifest } from './manifest'\nimport { createDeferredApi, type DeferredHandle } from './deferredApi'\n\nexport type { FeedbackApi, FeedbackConfig } from '../types'\nexport type { Manifest } from './manifest'\n\n/** Loader config = the public widget config plus the loader-only knobs the\n *  host can set to override what the manifest dictates. */\nexport type LoaderConfig = FeedbackConfig & {\n  /** Override the bundle's default error capture. Omit (or pass `undefined`)\n   *  to let the project's manifest flag decide (which itself defaults on). */\n  errorTracking?: boolean | ErrorTrackingOptions | undefined\n}\n\nexport function createFeedback(config: LoaderConfig): FeedbackApi {\n  const deferred = createDeferredApi()\n  loadAndAttach(config, deferred).catch((err: Error) => {\n    // Surface to console — host devtools is the canonical channel for\n    // widget bootstrap errors. Production telemetry is the bundle's job\n    // (it can't run if it never loaded), so console.warn is the floor.\n    // eslint-disable-next-line no-console\n    console.warn('[mhosaic-feedback] widget did not load:', err.message)\n    deferred._fail(err)\n  })\n  return deferred\n}\n\nasync function loadAndAttach(\n  config: LoaderConfig,\n  deferred: DeferredHandle,\n): Promise<void> {\n  const manifest = await fetchManifest(config.endpoint, config.apiKey)\n  if (!manifest.enabled || !manifest.bundle_url || !manifest.sri_hash) {\n    // Disabled by Mhosaic (kill switch) or no stable release. Surface a\n    // clear failure so submit() callers see an error, but no host crash.\n    deferred._fail(\n      new Error(\n        `mhosaic-feedback: widget disabled for this project${\n          manifest.detail ? ` — ${manifest.detail}` : ''\n        }`,\n      ),\n    )\n    return\n  }\n  const bundle = await injectBundle({\n    bundleUrl: manifest.bundle_url,\n    sriHash: manifest.sri_hash,\n  })\n  const real: FeedbackApi = bundle.createFeedback({\n    ...config,\n    // Forward the project's per-end-user gating flag from the manifest unless\n    // the host set it explicitly. The widget then runs the visibility check.\n    requiresVisibilityCheck:\n      config.requiresVisibilityCheck ??\n      manifest.config?.requires_visibility_check ??\n      false,\n    // Error capture is armed INSIDE the bundle (the only auto-updating part\n    // of a loader install), so already-deployed hosts pick it up without a\n    // redeploy. Precedence: explicit host override > per-project manifest\n    // flag > on. The loader provider forwards its `errorTracking` prop here\n    // rather than wrapping host-side, so there's exactly one arm point (the\n    // real instance) — no deferred/real double-registration.\n    errorTracking:\n      config.errorTracking ?? manifest.config?.error_tracking ?? true,\n  })\n  deferred._attach(real)\n}\n","/**\n * IIFE loader for the plain HTML / CDN install path.\n *\n * Hosts drop in a single tag, forever:\n *\n *   <script\n *     src=\"https://cdn.jsdelivr.net/npm/@mhosaic/feedback@1/dist/loader.min.js\"\n *     data-key=\"pk_proj_…\"\n *     data-endpoint=\"https://software-factory-…\"\n *     defer\n *   ></script>\n *\n * The loader reads its own script tag's `data-key`/`data-endpoint`/`data-env`,\n * calls `createFeedback(…)` from `loader/index.ts`, and the deferred handle\n * does the rest (fetch manifest, inject the actual widget bundle with SRI).\n *\n * Once installed, hosts never touch this file again. Mhosaic publishes a new\n * Release row → every host's next page load picks up the new widget bundle.\n */\n\nimport { createFeedback } from './loader/index'\nimport type { FeedbackConfig } from './types'\n\ninterface QueuedCall {\n  name: string\n  args: unknown[]\n}\n\ninterface WindowFeedback {\n  (name: string, ...args: unknown[]): void\n  q?: QueuedCall[]\n}\n\ndeclare global {\n  interface Window {\n    Feedback?: WindowFeedback\n  }\n}\n\nfunction readConfigFromScriptTag(): FeedbackConfig | null {\n  const script = document.currentScript as HTMLScriptElement | null\n  if (!script) return null\n  const apiKey = script.dataset.key\n  const endpoint = script.dataset.endpoint\n  if (!apiKey || !endpoint) return null\n  const env = script.dataset.env as FeedbackConfig['env'] | undefined\n  return {\n    apiKey,\n    endpoint,\n    ...(env !== undefined && { env }),\n  }\n}\n\nconst config = readConfigFromScriptTag()\nif (config) {\n  const fb = createFeedback(config)\n  // Drain any pre-queued calls a host may have set up before this script\n  // loaded (Google-Analytics-style queue pattern: `window.Feedback = window.\n  // Feedback || function(){(window.Feedback.q=window.Feedback.q||[]).push(\n  // arguments)}; Feedback('identify', {...})`).\n  const pending = window.Feedback?.q ?? []\n  function dispatch(call: QueuedCall): void {\n    switch (call.name) {\n      case 'identify':\n        fb.identify(call.args[0] as Parameters<typeof fb.identify>[0])\n        break\n      case 'setMetadata':\n        fb.setMetadata(call.args[0] as Parameters<typeof fb.setMetadata>[0])\n        break\n      case 'open':\n        fb.open(call.args[0] as Parameters<typeof fb.open>[0])\n        break\n      case 'show':\n        fb.show()\n        break\n      case 'hide':\n        fb.hide()\n        break\n      // submit and shutdown intentionally omitted from the queue API —\n      // they have return values that the queue pattern can't surface\n      // synchronously.\n      default:\n        // eslint-disable-next-line no-console\n        console.warn('[mhosaic-feedback] unknown queue call:', call.name)\n    }\n  }\n  for (const c of pending) dispatch(c)\n\n  const fn = Object.assign(\n    function Feedback(name: string, ...args: unknown[]): void {\n      dispatch({ name, args })\n    },\n    { q: [] as QueuedCall[] },\n  ) as WindowFeedback\n  window.Feedback = fn\n}\n"],"mappings":"6CAqCA,IAAMA,EAAmB,+BAczB,eAAsBC,EACpBC,EACuB,CArDzB,IAAAC,EAAAC,EAuDE,OAAID,EAAA,OAAO,kBAAP,MAAAA,EAAwB,eACnB,OAAO,gBAGC,SAAS,cACxB,UAAUH,CAAgB,GAC5B,EAGSK,GAAcD,EAAAF,EAAK,YAAL,KAAAE,EAAkB,GAAM,EAGxC,IAAI,QAAsB,CAACE,EAASC,IAAW,CAnExD,IAAAJ,EAoEI,IAAMK,EAAS,SAAS,cAAc,QAAQ,EAC9CA,EAAO,IAAMN,EAAK,UAClBM,EAAO,UAAYN,EAAK,QACxBM,EAAO,YAAc,YACrBA,EAAO,MAAQ,GACfA,EAAO,aAAaR,EAAkB,GAAG,EACzCQ,EAAO,OAAS,IAAM,CA1E1B,IAAAL,GA2EUA,EAAA,OAAO,kBAAP,MAAAA,EAAwB,eAC1BG,EAAQ,OAAO,eAAe,EAE9BC,EACE,IAAI,MACF,6HACF,CACF,CAEJ,EACAC,EAAO,QAAU,IAAM,CACrBD,EACE,IAAI,MACF,gDAAgDL,EAAK,SAAS,kCAEhE,CACF,CACF,EACA,SAAS,KAAK,YAAYM,CAAM,EAEhC,IAAMC,GAAYN,EAAAD,EAAK,YAAL,KAAAC,EAAkB,IACpC,WAAW,IAAM,CACfI,EACE,IAAI,MAAM,+CAA+CE,CAAS,IAAI,CACxE,CACF,EAAGA,CAAS,CACd,CAAC,CACH,CAEA,SAASJ,EAAcI,EAA0C,CAC/D,OAAO,IAAI,QAAQ,CAACH,EAASC,IAAW,CACtC,IAAMG,EAAQ,KAAK,IAAI,EACjBC,EAAO,IAAM,CA3GvB,IAAAR,EA4GM,IAAIA,EAAA,OAAO,kBAAP,MAAAA,EAAwB,eAAgB,CAC1CG,EAAQ,OAAO,eAAe,EAC9B,MACF,CACA,GAAI,KAAK,IAAI,EAAII,EAAQD,EAAW,CAClCF,EACE,IAAI,MACF,sHACF,CACF,EACA,MACF,CACA,WAAWI,EAAM,EAAE,CACrB,EACAA,EAAK,CACP,CAAC,CACH,CCrFA,eAAsBC,EACpBC,EACAC,EACAC,EACmB,CAEnB,IAAMC,EAAM,GADCH,EAAS,QAAQ,MAAO,EAAE,CACpB,wCAAwC,mBAAmBC,CAAM,CAAC,GAK/EG,EAAoB,CAAE,YAAa,MAAO,EAC5CF,IAAQE,EAAK,OAASF,GAC1B,IAAMG,EAAM,MAAM,MAAMF,EAAKC,CAAI,EACjC,GAAI,CAACC,EAAI,GACP,MAAM,IAAI,MACR,iDAAiDA,EAAI,MAAM,GAC7D,EAGF,OADc,MAAMA,EAAI,KAAK,CAE/B,CCZO,SAASC,GAAoC,CAClD,IAAIC,EAA2B,KAC3BC,EAAwB,KACtBC,EAAkB,CAAC,EAEzB,SAASC,EAAMC,EAAoB,CACjC,GAAIJ,EAAM,CACJI,EAAK,OAAS,OACdJ,EAAKI,EAAK,MAAM,EAAiB,EAC1BA,EAAK,OAAS,MACrBJ,EAAKI,EAAK,MAAM,EAA2BA,EAAK,GAAG,EAGrD,QAAQ,QAAQJ,EAAK,OAAOI,EAAK,OAAO,CAAC,EAAE,KACzCA,EAAK,QACLA,EAAK,MACP,EAEF,MACF,CACA,GAAIH,EAAS,CACPG,EAAK,OAAS,UAAUA,EAAK,OAAOH,CAAO,EAE/C,MACF,CACAC,EAAM,KAAKE,CAAI,CACjB,CAEA,MAAO,CACL,MAAO,CACLD,EAAM,CAAE,KAAM,OAAQ,OAAQ,MAAO,CAAC,CACxC,EACA,MAAO,CACLA,EAAM,CAAE,KAAM,OAAQ,OAAQ,MAAO,CAAC,CACxC,EACA,UAAW,CACTA,EAAM,CAAE,KAAM,OAAQ,OAAQ,UAAW,CAAC,CAC5C,EACA,KAAKE,EAAK,CACRF,EAAM,CAAE,KAAM,MAAO,OAAQ,OAAQ,IAAAE,CAAI,CAAC,CAC5C,EACA,SAASA,EAAK,CACZF,EAAM,CAAE,KAAM,MAAO,OAAQ,WAAY,IAAAE,CAAI,CAAC,CAChD,EACA,YAAYA,EAAK,CACfF,EAAM,CAAE,KAAM,MAAO,OAAQ,cAAe,IAAAE,CAAI,CAAC,CACnD,EACA,OAAOC,EAAS,CACd,OAAO,IAAI,QAAyB,CAACC,EAASC,IAAW,CACvDL,EAAM,CAAE,KAAM,SAAU,QAAAG,EAAS,QAAAC,EAAS,OAAAC,CAAO,CAAC,CACpD,CAAC,CACH,EACA,QAAQC,EAAM,CAEZ,IADAT,EAAOS,EACAP,EAAM,OAAS,GAAGC,EAAMD,EAAM,MAAM,CAAE,CAC/C,EACA,MAAMQ,EAAK,CACTT,EAAUS,EAEV,QAAWN,KAAQF,EACbE,EAAK,OAAS,UAAUA,EAAK,OAAOM,CAAG,EAE7CR,EAAM,OAAS,CACjB,CACF,CACF,CC1EO,SAASS,EAAeC,EAAmC,CAChE,IAAMC,EAAWC,EAAkB,EACnC,OAAAC,EAAcH,EAAQC,CAAQ,EAAE,MAAOG,GAAe,CAKpD,QAAQ,KAAK,0CAA2CA,EAAI,OAAO,EACnEH,EAAS,MAAMG,CAAG,CACpB,CAAC,EACMH,CACT,CAEA,eAAeE,EACbH,EACAC,EACe,CAvDjB,IAAAI,EAAAC,EAAAC,EAAAC,EAAAC,EAAAC,EAwDE,IAAMC,EAAW,MAAMC,EAAcZ,EAAO,SAAUA,EAAO,MAAM,EACnE,GAAI,CAACW,EAAS,SAAW,CAACA,EAAS,YAAc,CAACA,EAAS,SAAU,CAGnEV,EAAS,MACP,IAAI,MACF,qDACEU,EAAS,OAAS,WAAMA,EAAS,MAAM,GAAK,EAC9C,EACF,CACF,EACA,MACF,CAKA,IAAME,GAJS,MAAMC,EAAa,CAChC,UAAWH,EAAS,WACpB,QAASA,EAAS,QACpB,CAAC,GACgC,eAAe,CAC9C,GAAGX,EAGH,yBACEO,GAAAD,EAAAN,EAAO,0BAAP,KAAAM,GACAD,EAAAM,EAAS,SAAT,YAAAN,EAAiB,4BADjB,KAAAE,EAEA,GAOF,eACEG,GAAAD,EAAAT,EAAO,gBAAP,KAAAS,GAAwBD,EAAAG,EAAS,SAAT,YAAAH,EAAiB,iBAAzC,KAAAE,EAA2D,EAC/D,CAAC,EACDT,EAAS,QAAQY,CAAI,CACvB,CCpDA,SAASE,GAAiD,CACxD,IAAMC,EAAS,SAAS,cACxB,GAAI,CAACA,EAAQ,OAAO,KACpB,IAAMC,EAASD,EAAO,QAAQ,IACxBE,EAAWF,EAAO,QAAQ,SAChC,GAAI,CAACC,GAAU,CAACC,EAAU,OAAO,KACjC,IAAMC,EAAMH,EAAO,QAAQ,IAC3B,MAAO,CACL,OAAAC,EACA,SAAAC,EACA,GAAIC,IAAQ,QAAa,CAAE,IAAAA,CAAI,CACjC,CACF,CAEA,IAAMC,EAASL,EAAwB,EArDvCM,EAAAC,EAsDA,GAAIF,EAAQ,CAOV,IAASG,EAAT,SAAkBC,EAAwB,CACxC,OAAQA,EAAK,KAAM,CACjB,IAAK,WACHC,EAAG,SAASD,EAAK,KAAK,CAAC,CAAsC,EAC7D,MACF,IAAK,cACHC,EAAG,YAAYD,EAAK,KAAK,CAAC,CAAyC,EACnE,MACF,IAAK,OACHC,EAAG,KAAKD,EAAK,KAAK,CAAC,CAAkC,EACrD,MACF,IAAK,OACHC,EAAG,KAAK,EACR,MACF,IAAK,OACHA,EAAG,KAAK,EACR,MAIF,QAEE,QAAQ,KAAK,yCAA0CD,EAAK,IAAI,CACpE,CACF,EAxBSD,IANT,IAAME,EAAKC,EAAeN,CAAM,EAK1BO,GAAUL,GAAAD,EAAA,OAAO,WAAP,YAAAA,EAAiB,IAAjB,KAAAC,EAAsB,CAAC,EA0BvC,QAAWM,KAAKD,EAASJ,EAASK,CAAC,EAEnC,IAAMC,EAAK,OAAO,OAChB,SAAkBC,KAAiBC,EAAuB,CACxDR,EAAS,CAAE,KAAAO,EAAM,KAAAC,CAAK,CAAC,CACzB,EACA,CAAE,EAAG,CAAC,CAAkB,CAC1B,EACA,OAAO,SAAWF,CACpB,CAlCW,IAAAN","names":["SCRIPT_DATA_ATTR","injectBundle","opts","_a","_b","waitForGlobal","resolve","reject","script","timeoutMs","start","tick","fetchManifest","endpoint","apiKey","signal","url","init","res","createDeferredApi","real","failure","queue","flush","item","arg","payload","resolve","reject","impl","err","createFeedback","config","deferred","createDeferredApi","loadAndAttach","err","_a","_b","_c","_d","_e","_f","manifest","fetchManifest","real","injectBundle","readConfigFromScriptTag","script","apiKey","endpoint","env","config","_a","_b","dispatch","call","fb","createFeedback","pending","c","fn","name","args"]}
+{"version":3,"sources":["../src/loader-embed.ts","../src/loader/bundleLoader.ts","../src/loader/manifest.ts","../src/loader/deferredApi.ts","../src/loader/index.ts"],"sourcesContent":["/**\n * IIFE loader for the plain HTML / CDN install path.\n *\n * Hosts drop in a single tag, forever:\n *\n *   <script\n *     src=\"https://cdn.jsdelivr.net/npm/@mhosaic/feedback@1/dist/loader.min.js\"\n *     data-key=\"pk_proj_…\"\n *     data-endpoint=\"https://software-factory-…\"\n *     defer\n *   ></script>\n *\n * The loader reads its own script tag's `data-key`/`data-endpoint`/`data-env`,\n * calls `createFeedback(…)` from `loader/index.ts`, and the deferred handle\n * does the rest (fetch manifest, inject the actual widget bundle with SRI).\n *\n * Once installed, hosts never touch this file again. Mhosaic publishes a new\n * Release row → every host's next page load picks up the new widget bundle.\n */\n\nimport { createFeedback } from './loader/index'\nimport type { FeedbackConfig } from './types'\n\ninterface QueuedCall {\n  name: string\n  args: unknown[]\n}\n\ninterface WindowFeedback {\n  (name: string, ...args: unknown[]): void\n  q?: QueuedCall[]\n}\n\ndeclare global {\n  interface Window {\n    Feedback?: WindowFeedback\n  }\n}\n\n/** Pure parser over a script tag's `dataset` — exported for unit testing. */\nexport function configFromDataset(d: {\n  key?: string\n  endpoint?: string\n  env?: string\n  qaSource?: string\n  qaLocale?: string\n}): FeedbackConfig | null {\n  if (!d.key || !d.endpoint) return null\n  const env = d.env as FeedbackConfig['env'] | undefined\n  return {\n    apiKey: d.key,\n    endpoint: d.endpoint,\n    ...(env !== undefined && { env }),\n    ...(d.qaSource\n      ? { qaMeter: { source: d.qaSource, ...(d.qaLocale ? { locale: d.qaLocale as 'fr' | 'en' } : {}) } }\n      : {}),\n  }\n}\n\nfunction readConfigFromScriptTag(): FeedbackConfig | null {\n  const script = document.currentScript as HTMLScriptElement | null\n  if (!script) return null\n  return configFromDataset(script.dataset as Record<string, string | undefined>)\n}\n\nconst config = readConfigFromScriptTag()\nif (config) {\n  const fb = createFeedback(config)\n  // Drain any pre-queued calls a host may have set up before this script\n  // loaded (Google-Analytics-style queue pattern: `window.Feedback = window.\n  // Feedback || function(){(window.Feedback.q=window.Feedback.q||[]).push(\n  // arguments)}; Feedback('identify', {...})`).\n  const pending = window.Feedback?.q ?? []\n  function dispatch(call: QueuedCall): void {\n    switch (call.name) {\n      case 'identify':\n        fb.identify(call.args[0] as Parameters<typeof fb.identify>[0])\n        break\n      case 'setMetadata':\n        fb.setMetadata(call.args[0] as Parameters<typeof fb.setMetadata>[0])\n        break\n      case 'open':\n        fb.open(call.args[0] as Parameters<typeof fb.open>[0])\n        break\n      case 'show':\n        fb.show()\n        break\n      case 'hide':\n        fb.hide()\n        break\n      // submit and shutdown intentionally omitted from the queue API —\n      // they have return values that the queue pattern can't surface\n      // synchronously.\n      default:\n        // eslint-disable-next-line no-console\n        console.warn('[mhosaic-feedback] unknown queue call:', call.name)\n    }\n  }\n  for (const c of pending) dispatch(c)\n\n  const fn = Object.assign(\n    function Feedback(name: string, ...args: unknown[]): void {\n      dispatch({ name, args })\n    },\n    { q: [] as QueuedCall[] },\n  ) as WindowFeedback\n  window.Feedback = fn\n}\n","/**\n * Inject the widget bundle as an SRI-protected <script> and wait for its\n * window global to appear.\n *\n * Why a <script> tag and not `import()`:\n *   `import()` can fetch cross-origin ESM but doesn't honor Subresource\n *   Integrity on the dynamic-import call itself. A <script> tag with\n *   `integrity=…` is the only path where the browser actually refuses\n *   to execute a bundle whose bytes don't match the manifest's hash.\n *\n * The bundle is built with `tsup --format iife --globalName MhosaicFeedback`,\n * so once it parses it sets `window.MhosaicFeedback = { createFeedback }`\n * (per `src/widget.ts`'s exports). We wait for that to appear.\n *\n * Idempotency: if multiple FeedbackProviders mount on the same page (e.g.\n * during a React fast-refresh cycle), we reuse an already-injected bundle\n * instead of fetching a second copy.\n */\n\nimport type { FeedbackApi, FeedbackConfig } from '../types'\nimport type { ErrorTrackingOptions } from '../modules/error-tracking'\n\n/** What the loader may pass to the bundle's `createFeedback`: the public\n *  config plus the bundle-only `errorTracking` knob the loader forwards\n *  from the manifest. */\nexport type BundleConfig = FeedbackConfig & {\n  errorTracking?: boolean | ErrorTrackingOptions\n}\n\ndeclare global {\n  interface Window {\n    MhosaicFeedback?: {\n      createFeedback(config: BundleConfig): FeedbackApi\n    }\n  }\n}\n\nconst SCRIPT_DATA_ATTR = 'data-mhosaic-feedback-bundle'\n\nexport interface BundleLoadOptions {\n  bundleUrl: string\n  sriHash: string\n  /** Default 30 s. Long enough for slow networks; short enough to surface\n   *  CDN outages quickly. */\n  timeoutMs?: number\n}\n\nexport interface BundleHandle {\n  createFeedback(config: BundleConfig): FeedbackApi\n}\n\nexport async function injectBundle(\n  opts: BundleLoadOptions,\n): Promise<BundleHandle> {\n  // Reuse a bundle already loaded this page.\n  if (window.MhosaicFeedback?.createFeedback) {\n    return window.MhosaicFeedback\n  }\n\n  const existing = document.querySelector<HTMLScriptElement>(\n    `script[${SCRIPT_DATA_ATTR}]`,\n  )\n  if (existing) {\n    // Another loader instance started the fetch; wait for the global.\n    return waitForGlobal(opts.timeoutMs ?? 30_000)\n  }\n\n  return new Promise<BundleHandle>((resolve, reject) => {\n    const script = document.createElement('script')\n    script.src = opts.bundleUrl\n    script.integrity = opts.sriHash\n    script.crossOrigin = 'anonymous'\n    script.async = true\n    script.setAttribute(SCRIPT_DATA_ATTR, '1')\n    script.onload = () => {\n      if (window.MhosaicFeedback?.createFeedback) {\n        resolve(window.MhosaicFeedback)\n      } else {\n        reject(\n          new Error(\n            'mhosaic-feedback: bundle loaded but window.MhosaicFeedback.createFeedback is missing — bundle/loader version mismatch?',\n          ),\n        )\n      }\n    }\n    script.onerror = () => {\n      reject(\n        new Error(\n          `mhosaic-feedback: failed to load bundle from ${opts.bundleUrl} ` +\n            '(network, CSP, or SRI mismatch)',\n        ),\n      )\n    }\n    document.head.appendChild(script)\n\n    const timeoutMs = opts.timeoutMs ?? 30_000\n    setTimeout(() => {\n      reject(\n        new Error(`mhosaic-feedback: bundle load timeout after ${timeoutMs}ms`),\n      )\n    }, timeoutMs)\n  })\n}\n\nfunction waitForGlobal(timeoutMs: number): Promise<BundleHandle> {\n  return new Promise((resolve, reject) => {\n    const start = Date.now()\n    const tick = () => {\n      if (window.MhosaicFeedback?.createFeedback) {\n        resolve(window.MhosaicFeedback)\n        return\n      }\n      if (Date.now() - start > timeoutMs) {\n        reject(\n          new Error(\n            'mhosaic-feedback: timed out waiting for bundle global (another loader instance started the fetch but never finished)',\n          ),\n        )\n        return\n      }\n      setTimeout(tick, 50)\n    }\n    tick()\n  })\n}\n","/**\n * Fetch the widget-manifest from the Mhosaic backend.\n *\n * The loader calls this on every page load. The backend reads `Project.\n * pinned_version` (or current stable) + `Project.widget_enabled` and\n * returns the bundle URL + SRI hash for the version this tenant should\n * receive — or `{enabled: false}` if the widget is killed for the tenant.\n *\n * Network failures are surfaced to the caller. The loader degrades to\n * \"widget not present\" rather than crashing the host page.\n */\n\nexport interface Manifest {\n  /** False when the widget is disabled for this project (kill switch) or\n   *  no stable release exists. Loader bails silently. */\n  enabled: boolean\n  /** Semver of the bundle being served. Present when enabled=true. */\n  version?: string\n  /** Fully-qualified URL to the version-pinned bundle (jsDelivr). */\n  bundle_url?: string\n  /** Subresource integrity hash for the bundle. The loader injects the\n   *  script tag with `integrity=…` so the browser refuses to run a\n   *  bundle whose bytes don't match. */\n  sri_hash?: string\n  /** Static config the manifest endpoint passes through to the widget. */\n  config?: {\n    endpoint: string\n    project_slug: string\n    share_reports_with_widget: boolean\n    /** Phase 4: project gates the widget per end-user (default false). */\n    requires_visibility_check?: boolean\n    /** Per-project switch for the bundle's default error capture. When the\n     *  backend omits it, the bundle falls back to its own default (on). */\n    error_tracking?: boolean\n  }\n  /** Human-readable detail when `enabled` is false. */\n  detail?: string\n}\n\nexport async function fetchManifest(\n  endpoint: string,\n  apiKey: string,\n  signal?: AbortSignal,\n): Promise<Manifest> {\n  const base = endpoint.replace(/\\/$/, '')\n  const url = `${base}/api/feedback/v1/widget-manifest/?pk=${encodeURIComponent(apiKey)}`\n  // credentials: 'omit' — we authenticate via the public pk_proj_ query\n  // param; sending cookies would just trigger CORS preflights for no\n  // reason and is unnecessary since the manifest endpoint doesn't read\n  // any session.\n  const init: RequestInit = { credentials: 'omit' }\n  if (signal) init.signal = signal\n  const res = await fetch(url, init)\n  if (!res.ok) {\n    throw new Error(\n      `mhosaic-feedback: manifest fetch failed (HTTP ${res.status})`,\n    )\n  }\n  const body = (await res.json()) as Manifest\n  return body\n}\n","/**\n * A FeedbackApi-shaped object that queues method calls until the real\n * widget bundle finishes loading, then drains the queue against the real\n * implementation.\n *\n * Why we need this: hosts that already have code like\n *   const fb = createFeedback({...})\n *   fb.identify({id, email, name})\n *   useEffect(() => fb.open(...), [])\n * shouldn't have to refactor for async. The loader's createFeedback\n * returns sync — a deferred handle that records intent, then replays it\n * once the real bundle arrives. Idiomatic queue-then-flush pattern.\n *\n * If the bundle never loads (network failure, SRI mismatch, kill switch),\n * `_fail()` is called instead. Void methods (identify/setMetadata/open/...)\n * silently drop in that case — the widget just doesn't appear. The\n * `submit` Promise rejects so callers can surface real errors.\n */\n\nimport type {\n  FeedbackApi,\n  ReportPayload,\n  SubmittedReport,\n  UserIdentity,\n} from '../types'\n\ntype VoidMethod = 'show' | 'hide' | 'shutdown'\ntype ArgMethod = 'open' | 'identify' | 'setMetadata'\n\ntype Queued =\n  | { kind: 'void'; method: VoidMethod }\n  | { kind: 'arg'; method: 'open'; arg: Parameters<FeedbackApi['open']>[0] }\n  | { kind: 'arg'; method: 'identify'; arg: UserIdentity }\n  | { kind: 'arg'; method: 'setMetadata'; arg: Record<string, unknown> }\n  | {\n      kind: 'submit'\n      payload: Partial<ReportPayload> & { description: string }\n      resolve: (r: SubmittedReport) => void\n      reject: (e: unknown) => void\n    }\n\nexport interface DeferredHandle extends FeedbackApi {\n  /** Called by the loader once the bundle is loaded and a real API exists. */\n  _attach(real: FeedbackApi): void\n  /** Called by the loader if the bundle fails to load. */\n  _fail(err: Error): void\n}\n\nexport function createDeferredApi(): DeferredHandle {\n  let real: FeedbackApi | null = null\n  let failure: Error | null = null\n  const queue: Queued[] = []\n\n  function flush(item: Queued): void {\n    if (real) {\n      if (item.kind === 'void') {\n        ;(real[item.method] as () => void)()\n      } else if (item.kind === 'arg') {\n        ;(real[item.method] as (a: unknown) => void)(item.arg)\n      } else {\n        // submit\n        Promise.resolve(real.submit(item.payload)).then(\n          item.resolve,\n          item.reject,\n        )\n      }\n      return\n    }\n    if (failure) {\n      if (item.kind === 'submit') item.reject(failure)\n      // Void / arg methods silently dropped — the widget never appeared.\n      return\n    }\n    queue.push(item)\n  }\n\n  return {\n    show() {\n      flush({ kind: 'void', method: 'show' })\n    },\n    hide() {\n      flush({ kind: 'void', method: 'hide' })\n    },\n    shutdown() {\n      flush({ kind: 'void', method: 'shutdown' })\n    },\n    open(arg) {\n      flush({ kind: 'arg', method: 'open', arg })\n    },\n    identify(arg) {\n      flush({ kind: 'arg', method: 'identify', arg })\n    },\n    setMetadata(arg) {\n      flush({ kind: 'arg', method: 'setMetadata', arg })\n    },\n    submit(payload) {\n      return new Promise<SubmittedReport>((resolve, reject) => {\n        flush({ kind: 'submit', payload, resolve, reject })\n      })\n    },\n    _attach(impl) {\n      real = impl\n      while (queue.length > 0) flush(queue.shift()!)\n    },\n    _fail(err) {\n      failure = err\n      // Drain any pending submits with the failure; drop void/arg.\n      for (const item of queue) {\n        if (item.kind === 'submit') item.reject(err)\n      }\n      queue.length = 0\n    },\n  }\n}\n","/**\n * `@mhosaic/feedback/loader` — public entry for the loader architecture.\n *\n * Same shape as the direct-import path (`@mhosaic/feedback`), but the\n * widget bundle is fetched at runtime from a CDN URL the Mhosaic backend\n * dictates via the manifest endpoint. Letting hosts switch from the\n * direct-import path to the loader path gives them auto-updates without\n * any further code changes — Mhosaic ships a new Release row, every host\n * picks up the new bundle on next page load.\n *\n * Public surface MUST mirror the direct-import path exactly:\n *   - `createFeedback(config)` returns a `FeedbackApi`-shaped handle.\n *   - Method calls before the bundle finishes loading queue up and replay.\n *   - `submit()` returns a Promise that resolves after the bundle is up\n *     and the real submit completes.\n *\n * If the manifest endpoint reports the widget is disabled for this\n * project (`enabled: false` — kill switch or no stable release configured),\n * the deferred handle silently no-ops void calls and rejects `submit()`\n * calls with a clear error. The host page never crashes.\n */\n\nimport type { FeedbackApi, FeedbackConfig } from '../types'\nimport type { ErrorTrackingOptions } from '../modules/error-tracking'\nimport { injectBundle } from './bundleLoader'\nimport { fetchManifest } from './manifest'\nimport { createDeferredApi, type DeferredHandle } from './deferredApi'\n\nexport type { FeedbackApi, FeedbackConfig } from '../types'\nexport type { Manifest } from './manifest'\n\n/** Loader config = the public widget config plus the loader-only knobs the\n *  host can set to override what the manifest dictates. */\nexport type LoaderConfig = FeedbackConfig & {\n  /** Override the bundle's default error capture. Omit (or pass `undefined`)\n   *  to let the project's manifest flag decide (which itself defaults on). */\n  errorTracking?: boolean | ErrorTrackingOptions | undefined\n}\n\nexport function createFeedback(config: LoaderConfig): FeedbackApi {\n  const deferred = createDeferredApi()\n  loadAndAttach(config, deferred).catch((err: Error) => {\n    // Surface to console — host devtools is the canonical channel for\n    // widget bootstrap errors. Production telemetry is the bundle's job\n    // (it can't run if it never loaded), so console.warn is the floor.\n    // eslint-disable-next-line no-console\n    console.warn('[mhosaic-feedback] widget did not load:', err.message)\n    deferred._fail(err)\n  })\n  return deferred\n}\n\nasync function loadAndAttach(\n  config: LoaderConfig,\n  deferred: DeferredHandle,\n): Promise<void> {\n  const manifest = await fetchManifest(config.endpoint, config.apiKey)\n  if (!manifest.enabled || !manifest.bundle_url || !manifest.sri_hash) {\n    // Disabled by Mhosaic (kill switch) or no stable release. Surface a\n    // clear failure so submit() callers see an error, but no host crash.\n    deferred._fail(\n      new Error(\n        `mhosaic-feedback: widget disabled for this project${\n          manifest.detail ? ` — ${manifest.detail}` : ''\n        }`,\n      ),\n    )\n    return\n  }\n  const bundle = await injectBundle({\n    bundleUrl: manifest.bundle_url,\n    sriHash: manifest.sri_hash,\n  })\n  const real: FeedbackApi = bundle.createFeedback({\n    ...config,\n    // Forward the project's per-end-user gating flag from the manifest unless\n    // the host set it explicitly. The widget then runs the visibility check.\n    requiresVisibilityCheck:\n      config.requiresVisibilityCheck ??\n      manifest.config?.requires_visibility_check ??\n      false,\n    // Error capture is armed INSIDE the bundle (the only auto-updating part\n    // of a loader install), so already-deployed hosts pick it up without a\n    // redeploy. Precedence: explicit host override > per-project manifest\n    // flag > on. The loader provider forwards its `errorTracking` prop here\n    // rather than wrapping host-side, so there's exactly one arm point (the\n    // real instance) — no deferred/real double-registration.\n    errorTracking:\n      config.errorTracking ?? manifest.config?.error_tracking ?? true,\n  })\n  deferred._attach(real)\n}\n"],"mappings":"ycAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,uBAAAE,ICqCA,IAAMC,EAAmB,+BAczB,eAAsBC,EACpBC,EACuB,CArDzB,IAAAC,EAAAC,EAuDE,OAAID,EAAA,OAAO,kBAAP,MAAAA,EAAwB,eACnB,OAAO,gBAGC,SAAS,cACxB,UAAUH,CAAgB,GAC5B,EAGSK,GAAcD,EAAAF,EAAK,YAAL,KAAAE,EAAkB,GAAM,EAGxC,IAAI,QAAsB,CAACE,EAASC,IAAW,CAnExD,IAAAJ,EAoEI,IAAMK,EAAS,SAAS,cAAc,QAAQ,EAC9CA,EAAO,IAAMN,EAAK,UAClBM,EAAO,UAAYN,EAAK,QACxBM,EAAO,YAAc,YACrBA,EAAO,MAAQ,GACfA,EAAO,aAAaR,EAAkB,GAAG,EACzCQ,EAAO,OAAS,IAAM,CA1E1B,IAAAL,GA2EUA,EAAA,OAAO,kBAAP,MAAAA,EAAwB,eAC1BG,EAAQ,OAAO,eAAe,EAE9BC,EACE,IAAI,MACF,6HACF,CACF,CAEJ,EACAC,EAAO,QAAU,IAAM,CACrBD,EACE,IAAI,MACF,gDAAgDL,EAAK,SAAS,kCAEhE,CACF,CACF,EACA,SAAS,KAAK,YAAYM,CAAM,EAEhC,IAAMC,GAAYN,EAAAD,EAAK,YAAL,KAAAC,EAAkB,IACpC,WAAW,IAAM,CACfI,EACE,IAAI,MAAM,+CAA+CE,CAAS,IAAI,CACxE,CACF,EAAGA,CAAS,CACd,CAAC,CACH,CAEA,SAASJ,EAAcI,EAA0C,CAC/D,OAAO,IAAI,QAAQ,CAACH,EAASC,IAAW,CACtC,IAAMG,EAAQ,KAAK,IAAI,EACjBC,EAAO,IAAM,CA3GvB,IAAAR,EA4GM,IAAIA,EAAA,OAAO,kBAAP,MAAAA,EAAwB,eAAgB,CAC1CG,EAAQ,OAAO,eAAe,EAC9B,MACF,CACA,GAAI,KAAK,IAAI,EAAII,EAAQD,EAAW,CAClCF,EACE,IAAI,MACF,sHACF,CACF,EACA,MACF,CACA,WAAWI,EAAM,EAAE,CACrB,EACAA,EAAK,CACP,CAAC,CACH,CCrFA,eAAsBC,EACpBC,EACAC,EACAC,EACmB,CAEnB,IAAMC,EAAM,GADCH,EAAS,QAAQ,MAAO,EAAE,CACpB,wCAAwC,mBAAmBC,CAAM,CAAC,GAK/EG,EAAoB,CAAE,YAAa,MAAO,EAC5CF,IAAQE,EAAK,OAASF,GAC1B,IAAMG,EAAM,MAAM,MAAMF,EAAKC,CAAI,EACjC,GAAI,CAACC,EAAI,GACP,MAAM,IAAI,MACR,iDAAiDA,EAAI,MAAM,GAC7D,EAGF,OADc,MAAMA,EAAI,KAAK,CAE/B,CCZO,SAASC,GAAoC,CAClD,IAAIC,EAA2B,KAC3BC,EAAwB,KACtBC,EAAkB,CAAC,EAEzB,SAASC,EAAMC,EAAoB,CACjC,GAAIJ,EAAM,CACJI,EAAK,OAAS,OACdJ,EAAKI,EAAK,MAAM,EAAiB,EAC1BA,EAAK,OAAS,MACrBJ,EAAKI,EAAK,MAAM,EAA2BA,EAAK,GAAG,EAGrD,QAAQ,QAAQJ,EAAK,OAAOI,EAAK,OAAO,CAAC,EAAE,KACzCA,EAAK,QACLA,EAAK,MACP,EAEF,MACF,CACA,GAAIH,EAAS,CACPG,EAAK,OAAS,UAAUA,EAAK,OAAOH,CAAO,EAE/C,MACF,CACAC,EAAM,KAAKE,CAAI,CACjB,CAEA,MAAO,CACL,MAAO,CACLD,EAAM,CAAE,KAAM,OAAQ,OAAQ,MAAO,CAAC,CACxC,EACA,MAAO,CACLA,EAAM,CAAE,KAAM,OAAQ,OAAQ,MAAO,CAAC,CACxC,EACA,UAAW,CACTA,EAAM,CAAE,KAAM,OAAQ,OAAQ,UAAW,CAAC,CAC5C,EACA,KAAKE,EAAK,CACRF,EAAM,CAAE,KAAM,MAAO,OAAQ,OAAQ,IAAAE,CAAI,CAAC,CAC5C,EACA,SAASA,EAAK,CACZF,EAAM,CAAE,KAAM,MAAO,OAAQ,WAAY,IAAAE,CAAI,CAAC,CAChD,EACA,YAAYA,EAAK,CACfF,EAAM,CAAE,KAAM,MAAO,OAAQ,cAAe,IAAAE,CAAI,CAAC,CACnD,EACA,OAAOC,EAAS,CACd,OAAO,IAAI,QAAyB,CAACC,EAASC,IAAW,CACvDL,EAAM,CAAE,KAAM,SAAU,QAAAG,EAAS,QAAAC,EAAS,OAAAC,CAAO,CAAC,CACpD,CAAC,CACH,EACA,QAAQC,EAAM,CAEZ,IADAT,EAAOS,EACAP,EAAM,OAAS,GAAGC,EAAMD,EAAM,MAAM,CAAE,CAC/C,EACA,MAAMQ,EAAK,CACTT,EAAUS,EAEV,QAAWN,KAAQF,EACbE,EAAK,OAAS,UAAUA,EAAK,OAAOM,CAAG,EAE7CR,EAAM,OAAS,CACjB,CACF,CACF,CC1EO,SAASS,EAAeC,EAAmC,CAChE,IAAMC,EAAWC,EAAkB,EACnC,OAAAC,EAAcH,EAAQC,CAAQ,EAAE,MAAOG,GAAe,CAKpD,QAAQ,KAAK,0CAA2CA,EAAI,OAAO,EACnEH,EAAS,MAAMG,CAAG,CACpB,CAAC,EACMH,CACT,CAEA,eAAeE,EACbH,EACAC,EACe,CAvDjB,IAAAI,EAAAC,EAAAC,EAAAC,EAAAC,EAAAC,EAwDE,IAAMC,EAAW,MAAMC,EAAcZ,EAAO,SAAUA,EAAO,MAAM,EACnE,GAAI,CAACW,EAAS,SAAW,CAACA,EAAS,YAAc,CAACA,EAAS,SAAU,CAGnEV,EAAS,MACP,IAAI,MACF,qDACEU,EAAS,OAAS,WAAMA,EAAS,MAAM,GAAK,EAC9C,EACF,CACF,EACA,MACF,CAKA,IAAME,GAJS,MAAMC,EAAa,CAChC,UAAWH,EAAS,WACpB,QAASA,EAAS,QACpB,CAAC,GACgC,eAAe,CAC9C,GAAGX,EAGH,yBACEO,GAAAD,EAAAN,EAAO,0BAAP,KAAAM,GACAD,EAAAM,EAAS,SAAT,YAAAN,EAAiB,4BADjB,KAAAE,EAEA,GAOF,eACEG,GAAAD,EAAAT,EAAO,gBAAP,KAAAS,GAAwBD,EAAAG,EAAS,SAAT,YAAAH,EAAiB,iBAAzC,KAAAE,EAA2D,EAC/D,CAAC,EACDT,EAAS,QAAQY,CAAI,CACvB,CJnDO,SAASE,EAAkBC,EAMR,CACxB,GAAI,CAACA,EAAE,KAAO,CAACA,EAAE,SAAU,OAAO,KAClC,IAAMC,EAAMD,EAAE,IACd,MAAO,CACL,OAAQA,EAAE,IACV,SAAUA,EAAE,SACZ,GAAIC,IAAQ,QAAa,CAAE,IAAAA,CAAI,EAC/B,GAAID,EAAE,SACF,CAAE,QAAS,CAAE,OAAQA,EAAE,SAAU,GAAIA,EAAE,SAAW,CAAE,OAAQA,EAAE,QAAwB,EAAI,CAAC,CAAG,CAAE,EAChG,CAAC,CACP,CACF,CAEA,SAASE,GAAiD,CACxD,IAAMC,EAAS,SAAS,cACxB,OAAKA,EACEJ,EAAkBI,EAAO,OAA6C,EADzD,IAEtB,CAEA,IAAMC,EAASF,EAAwB,EAjEvCG,EAAAC,EAkEA,GAAIF,EAAQ,CAOV,IAASG,EAAT,SAAkBC,EAAwB,CACxC,OAAQA,EAAK,KAAM,CACjB,IAAK,WACHC,EAAG,SAASD,EAAK,KAAK,CAAC,CAAsC,EAC7D,MACF,IAAK,cACHC,EAAG,YAAYD,EAAK,KAAK,CAAC,CAAyC,EACnE,MACF,IAAK,OACHC,EAAG,KAAKD,EAAK,KAAK,CAAC,CAAkC,EACrD,MACF,IAAK,OACHC,EAAG,KAAK,EACR,MACF,IAAK,OACHA,EAAG,KAAK,EACR,MAIF,QAEE,QAAQ,KAAK,yCAA0CD,EAAK,IAAI,CACpE,CACF,EAxBSD,IANT,IAAME,EAAKC,EAAeN,CAAM,EAK1BO,GAAUL,GAAAD,EAAA,OAAO,WAAP,YAAAA,EAAiB,IAAjB,KAAAC,EAAsB,CAAC,EA0BvC,QAAWM,KAAKD,EAASJ,EAASK,CAAC,EAEnC,IAAMC,EAAK,OAAO,OAChB,SAAkBC,KAAiBC,EAAuB,CACxDR,EAAS,CAAE,KAAAO,EAAM,KAAAC,CAAK,CAAC,CACzB,EACA,CAAE,EAAG,CAAC,CAAkB,CAC1B,EACA,OAAO,SAAWF,CACpB,CAlCW,IAAAN","names":["loader_embed_exports","__export","configFromDataset","SCRIPT_DATA_ATTR","injectBundle","opts","_a","_b","waitForGlobal","resolve","reject","script","timeoutMs","start","tick","fetchManifest","endpoint","apiKey","signal","url","init","res","createDeferredApi","real","failure","queue","flush","item","arg","payload","resolve","reject","impl","err","createFeedback","config","deferred","createDeferredApi","loadAndAttach","err","_a","_b","_c","_d","_e","_f","manifest","fetchManifest","real","injectBundle","configFromDataset","d","env","readConfigFromScriptTag","script","config","_a","_b","dispatch","call","fb","createFeedback","pending","c","fn","name","args"]}

package/dist/qa-meter.d.ts

@@ -0,0 +1,28 @@
+import { Q as QaStatusArtifact } from './types-CRbb2Pp0.js';
+export { a as QaColor, b as QaPageStatus, c as QaScenario, d as QaSitemapNode } from './types-CRbb2Pp0.js';
+
+interface QaMeterOptions {
+    /** Where the QA status artifact comes from. An inline object renders
+     *  immediately; a URL is `fetch`ed lazily on first open/hover; a function is
+     *  invoked lazily likewise. */
+    source: string | QaStatusArtifact | (() => Promise<QaStatusArtifact>);
+    /** Router-aware override. Defaults to a routerless resolver over the
+     *  artifact's path_patterns + `window.location.pathname`. */
+    getCurrentPage?: () => string | null;
+    locale?: 'fr' | 'en';
+    /** Pastille size. 'md' (48px, default) for standalone; the feedback-widget
+     *  integration passes 'sm' (24px) so the QA FAB reads as secondary. */
+    size?: 'sm' | 'md';
+    position?: {
+        right?: number;
+        bottom?: number;
+    };
+}
+interface QaMeterHandle {
+    open(): void;
+    close(): void;
+    dispose(): void;
+}
+declare function createQaMeter(options: QaMeterOptions): QaMeterHandle;
+
+export { type QaMeterHandle, type QaMeterOptions, QaStatusArtifact, createQaMeter };