@mhosaic/feedback 0.36.0 → 0.37.0

package/dist/{chunk-557ACRBU.mjs → chunk-BQDUJOWL.mjs}

@@ -202,7 +202,8 @@ async function loadAndAttach(config, deferred) {
     // an explicit host value still wins.
     ...config.openToCurrentPageFeedback === void 0 && typeof manifest.config?.behavior?.openToCurrentPageFeedback === "boolean" ? {
       openToCurrentPageFeedback: manifest.config.behavior.openToCurrentPageFeedback
-    } : {}
+    } : {},
+    ...config.metaFeedbackEnabled === void 0 && typeof manifest.config?.behavior?.metaFeedbackEnabled === "boolean" ? { metaFeedbackEnabled: manifest.config.behavior.metaFeedbackEnabled } : {}
   });
   deferred._attach(real);
 }
@@ -210,4 +211,4 @@ async function loadAndAttach(config, deferred) {
 export {
   createFeedback
 };
-//# sourceMappingURL=chunk-557ACRBU.mjs.map
+//# sourceMappingURL=chunk-BQDUJOWL.mjs.map

package/dist/{chunk-557ACRBU.mjs.map → chunk-BQDUJOWL.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/loader/bundleLoader.ts","../src/loader/manifest.ts","../src/loader/deferredApi.ts","../src/loader/index.ts"],"sourcesContent":["/**\n * Inject the widget bundle as an SRI-protected <script> and wait for its\n * window global to appear.\n *\n * Why a <script> tag and not `import()`:\n *   `import()` can fetch cross-origin ESM but doesn't honor Subresource\n *   Integrity on the dynamic-import call itself. A <script> tag with\n *   `integrity=…` is the only path where the browser actually refuses\n *   to execute a bundle whose bytes don't match the manifest's hash.\n *\n * The bundle is built with `tsup --format iife --globalName MhosaicFeedback`,\n * so once it parses it sets `window.MhosaicFeedback = { createFeedback }`\n * (per `src/widget.ts`'s exports). We wait for that to appear.\n *\n * Idempotency: if multiple FeedbackProviders mount on the same page (e.g.\n * during a React fast-refresh cycle), we reuse an already-injected bundle\n * instead of fetching a second copy.\n */\n\nimport type { FeedbackApi, FeedbackConfig } from '../types'\nimport type { ErrorTrackingOptions } from '../modules/error-tracking'\n\n/** What the loader may pass to the bundle's `createFeedback`: the public\n *  config plus the bundle-only `errorTracking` knob the loader forwards\n *  from the manifest. */\nexport type BundleConfig = FeedbackConfig & {\n  errorTracking?: boolean | ErrorTrackingOptions\n}\n\ndeclare global {\n  interface Window {\n    MhosaicFeedback?: {\n      createFeedback(config: BundleConfig): FeedbackApi\n    }\n  }\n}\n\nconst SCRIPT_DATA_ATTR = 'data-mhosaic-feedback-bundle'\n\nexport interface BundleLoadOptions {\n  bundleUrl: string\n  sriHash: string\n  /** Default 30 s. Long enough for slow networks; short enough to surface\n   *  CDN outages quickly. */\n  timeoutMs?: number\n}\n\nexport interface BundleHandle {\n  createFeedback(config: BundleConfig): FeedbackApi\n}\n\nexport async function injectBundle(\n  opts: BundleLoadOptions,\n): Promise<BundleHandle> {\n  // Reuse a bundle already loaded this page.\n  if (window.MhosaicFeedback?.createFeedback) {\n    return window.MhosaicFeedback\n  }\n\n  const existing = document.querySelector<HTMLScriptElement>(\n    `script[${SCRIPT_DATA_ATTR}]`,\n  )\n  if (existing) {\n    // Another loader instance started the fetch; wait for the global.\n    return waitForGlobal(opts.timeoutMs ?? 30_000)\n  }\n\n  return new Promise<BundleHandle>((resolve, reject) => {\n    const script = document.createElement('script')\n    script.src = opts.bundleUrl\n    script.integrity = opts.sriHash\n    script.crossOrigin = 'anonymous'\n    script.async = true\n    script.setAttribute(SCRIPT_DATA_ATTR, '1')\n    script.onload = () => {\n      if (window.MhosaicFeedback?.createFeedback) {\n        resolve(window.MhosaicFeedback)\n      } else {\n        reject(\n          new Error(\n            'mhosaic-feedback: bundle loaded but window.MhosaicFeedback.createFeedback is missing — bundle/loader version mismatch?',\n          ),\n        )\n      }\n    }\n    script.onerror = () => {\n      reject(\n        new Error(\n          `mhosaic-feedback: failed to load bundle from ${opts.bundleUrl} ` +\n            '(network, CSP, or SRI mismatch)',\n        ),\n      )\n    }\n    document.head.appendChild(script)\n\n    const timeoutMs = opts.timeoutMs ?? 30_000\n    setTimeout(() => {\n      reject(\n        new Error(`mhosaic-feedback: bundle load timeout after ${timeoutMs}ms`),\n      )\n    }, timeoutMs)\n  })\n}\n\nfunction waitForGlobal(timeoutMs: number): Promise<BundleHandle> {\n  return new Promise((resolve, reject) => {\n    const start = Date.now()\n    const tick = () => {\n      if (window.MhosaicFeedback?.createFeedback) {\n        resolve(window.MhosaicFeedback)\n        return\n      }\n      if (Date.now() - start > timeoutMs) {\n        reject(\n          new Error(\n            'mhosaic-feedback: timed out waiting for bundle global (another loader instance started the fetch but never finished)',\n          ),\n        )\n        return\n      }\n      setTimeout(tick, 50)\n    }\n    tick()\n  })\n}\n","/**\n * Fetch the widget-manifest from the Mhosaic backend.\n *\n * The loader calls this on every page load. The backend reads `Project.\n * pinned_version` (or current stable) + `Project.widget_enabled` and\n * returns the bundle URL + SRI hash for the version this tenant should\n * receive — or `{enabled: false}` if the widget is killed for the tenant.\n *\n * Network failures are surfaced to the caller. The loader degrades to\n * \"widget not present\" rather than crashing the host page.\n */\n\nexport interface Manifest {\n  /** False when the widget is disabled for this project (kill switch) or\n   *  no stable release exists. Loader bails silently. */\n  enabled: boolean\n  /** Semver of the bundle being served. Present when enabled=true. */\n  version?: string\n  /** Fully-qualified URL to the version-pinned bundle (jsDelivr). */\n  bundle_url?: string\n  /** Subresource integrity hash for the bundle. The loader injects the\n   *  script tag with `integrity=…` so the browser refuses to run a\n   *  bundle whose bytes don't match. */\n  sri_hash?: string\n  /** Static config the manifest endpoint passes through to the widget. */\n  config?: {\n    endpoint: string\n    project_slug: string\n    share_reports_with_widget: boolean\n    /** Phase 4: project gates the widget per end-user (default false). */\n    requires_visibility_check?: boolean\n    /** Per-project switch for the bundle's default error capture. When the\n     *  backend omits it, the bundle falls back to its own default (on). */\n    error_tracking?: boolean\n    behavior?: Record<string, boolean>\n  }\n  /** Human-readable detail when `enabled` is false. */\n  detail?: string\n}\n\nexport async function fetchManifest(\n  endpoint: string,\n  apiKey: string,\n  signal?: AbortSignal,\n): Promise<Manifest> {\n  const base = endpoint.replace(/\\/$/, '')\n  const url = `${base}/api/feedback/v1/widget-manifest/?pk=${encodeURIComponent(apiKey)}`\n  // credentials: 'omit' — we authenticate via the public pk_proj_ query\n  // param; sending cookies would just trigger CORS preflights for no\n  // reason and is unnecessary since the manifest endpoint doesn't read\n  // any session.\n  const init: RequestInit = { credentials: 'omit' }\n  if (signal) init.signal = signal\n  const res = await fetch(url, init)\n  if (!res.ok) {\n    throw new Error(\n      `mhosaic-feedback: manifest fetch failed (HTTP ${res.status})`,\n    )\n  }\n  const body = (await res.json()) as Manifest\n  return body\n}\n","/**\n * A FeedbackApi-shaped object that queues method calls until the real\n * widget bundle finishes loading, then drains the queue against the real\n * implementation.\n *\n * Why we need this: hosts that already have code like\n *   const fb = createFeedback({...})\n *   fb.identify({id, email, name})\n *   useEffect(() => fb.open(...), [])\n * shouldn't have to refactor for async. The loader's createFeedback\n * returns sync — a deferred handle that records intent, then replays it\n * once the real bundle arrives. Idiomatic queue-then-flush pattern.\n *\n * If the bundle never loads (network failure, SRI mismatch, kill switch),\n * `_fail()` is called instead. Void methods (identify/setMetadata/open/...)\n * silently drop in that case — the widget just doesn't appear. The\n * `submit` Promise rejects so callers can surface real errors.\n */\n\nimport type {\n  FeedbackApi,\n  ReportPayload,\n  SubmittedReport,\n  UserIdentity,\n} from '../types'\n\ntype VoidMethod = 'show' | 'hide' | 'shutdown'\ntype ArgMethod = 'open' | 'identify' | 'setMetadata'\n\ntype Queued =\n  | { kind: 'void'; method: VoidMethod }\n  | { kind: 'arg'; method: 'open'; arg: Parameters<FeedbackApi['open']>[0] }\n  | { kind: 'arg'; method: 'identify'; arg: UserIdentity }\n  | { kind: 'arg'; method: 'setMetadata'; arg: Record<string, unknown> }\n  | {\n      kind: 'submit'\n      payload: Partial<ReportPayload> & { description: string }\n      resolve: (r: SubmittedReport) => void\n      reject: (e: unknown) => void\n    }\n\nexport interface DeferredHandle extends FeedbackApi {\n  /** Called by the loader once the bundle is loaded and a real API exists. */\n  _attach(real: FeedbackApi): void\n  /** Called by the loader if the bundle fails to load. */\n  _fail(err: Error): void\n  /** Buffered transformer registry — forwarded to the real instance on\n   *  attach, so wrapper modules (withReplay) work over loader installs. */\n  _registerTransformer(fn: unknown): void\n}\n\nexport function createDeferredApi(): DeferredHandle {\n  let real: FeedbackApi | null = null\n  let failure: Error | null = null\n  const queue: Queued[] = []\n  // Transformers (withReplay & friends) registered before the bundle\n  // attaches. Forwarded to the real instance's registry on _attach so\n  // host-side wrappers work over a loader install too (roadmap #7).\n  const pendingTransformers: unknown[] = []\n\n  function flush(item: Queued): void {\n    if (real) {\n      if (item.kind === 'void') {\n        ;(real[item.method] as () => void)()\n      } else if (item.kind === 'arg') {\n        ;(real[item.method] as (a: unknown) => void)(item.arg)\n      } else {\n        // submit\n        Promise.resolve(real.submit(item.payload)).then(\n          item.resolve,\n          item.reject,\n        )\n      }\n      return\n    }\n    if (failure) {\n      if (item.kind === 'submit') item.reject(failure)\n      // Void / arg methods silently dropped — the widget never appeared.\n      return\n    }\n    queue.push(item)\n  }\n\n  return {\n    show() {\n      flush({ kind: 'void', method: 'show' })\n    },\n    hide() {\n      flush({ kind: 'void', method: 'hide' })\n    },\n    shutdown() {\n      flush({ kind: 'void', method: 'shutdown' })\n    },\n    open(arg) {\n      flush({ kind: 'arg', method: 'open', arg })\n    },\n    identify(arg) {\n      flush({ kind: 'arg', method: 'identify', arg })\n    },\n    setMetadata(arg) {\n      flush({ kind: 'arg', method: 'setMetadata', arg })\n    },\n    submit(payload) {\n      return new Promise<SubmittedReport>((resolve, reject) => {\n        flush({ kind: 'submit', payload, resolve, reject })\n      })\n    },\n    _registerTransformer(fn: unknown) {\n      const target = real as { _registerTransformer?: (f: unknown) => void } | null\n      if (target && typeof target._registerTransformer === 'function') {\n        target._registerTransformer(fn)\n        return\n      }\n      if (failure) return // widget never appeared — nothing to transform\n      pendingTransformers.push(fn)\n    },\n    _attach(impl) {\n      real = impl\n      const target = impl as { _registerTransformer?: (f: unknown) => void }\n      if (typeof target._registerTransformer === 'function') {\n        for (const fn of pendingTransformers) target._registerTransformer(fn)\n      }\n      pendingTransformers.length = 0\n      while (queue.length > 0) flush(queue.shift()!)\n    },\n    _fail(err) {\n      failure = err\n      pendingTransformers.length = 0\n      // Drain any pending submits with the failure; drop void/arg.\n      for (const item of queue) {\n        if (item.kind === 'submit') item.reject(err)\n      }\n      queue.length = 0\n    },\n  }\n}\n","/**\n * `@mhosaic/feedback/loader` — public entry for the loader architecture.\n *\n * Same shape as the direct-import path (`@mhosaic/feedback`), but the\n * widget bundle is fetched at runtime from a CDN URL the Mhosaic backend\n * dictates via the manifest endpoint. Letting hosts switch from the\n * direct-import path to the loader path gives them auto-updates without\n * any further code changes — Mhosaic ships a new Release row, every host\n * picks up the new bundle on next page load.\n *\n * Public surface MUST mirror the direct-import path exactly:\n *   - `createFeedback(config)` returns a `FeedbackApi`-shaped handle.\n *   - Method calls before the bundle finishes loading queue up and replay.\n *   - `submit()` returns a Promise that resolves after the bundle is up\n *     and the real submit completes.\n *\n * If the manifest endpoint reports the widget is disabled for this\n * project (`enabled: false` — kill switch or no stable release configured),\n * the deferred handle silently no-ops void calls and rejects `submit()`\n * calls with a clear error. The host page never crashes.\n */\n\nimport type { FeedbackApi, FeedbackConfig } from '../types'\nimport type { ErrorTrackingOptions } from '../modules/error-tracking'\nimport { injectBundle } from './bundleLoader'\nimport { fetchManifest } from './manifest'\nimport { createDeferredApi, type DeferredHandle } from './deferredApi'\n\nexport type { FeedbackApi, FeedbackConfig } from '../types'\nexport type { Manifest } from './manifest'\n\n/** Loader config = the public widget config plus the loader-only knobs the\n *  host can set to override what the manifest dictates. */\nexport type LoaderConfig = FeedbackConfig & {\n  /** Override the bundle's default error capture. Omit (or pass `undefined`)\n   *  to let the project's manifest flag decide (which itself defaults on). */\n  errorTracking?: boolean | ErrorTrackingOptions | undefined\n}\n\nexport function createFeedback(config: LoaderConfig): FeedbackApi {\n  const deferred = createDeferredApi()\n  loadAndAttach(config, deferred).catch((err: Error) => {\n    // Surface to console — host devtools is the canonical channel for\n    // widget bootstrap errors. Production telemetry is the bundle's job\n    // (it can't run if it never loaded), so console.warn is the floor.\n    // eslint-disable-next-line no-console\n    console.warn('[mhosaic-feedback] widget did not load:', err.message)\n    deferred._fail(err)\n  })\n  return deferred\n}\n\nasync function loadAndAttach(\n  config: LoaderConfig,\n  deferred: DeferredHandle,\n): Promise<void> {\n  const manifest = await fetchManifest(config.endpoint, config.apiKey)\n  if (!manifest.enabled || !manifest.bundle_url || !manifest.sri_hash) {\n    // Disabled by Mhosaic (kill switch) or no stable release. Surface a\n    // clear failure so submit() callers see an error, but no host crash.\n    deferred._fail(\n      new Error(\n        `mhosaic-feedback: widget disabled for this project${\n          manifest.detail ? ` — ${manifest.detail}` : ''\n        }`,\n      ),\n    )\n    return\n  }\n  const bundle = await injectBundle({\n    bundleUrl: manifest.bundle_url,\n    sriHash: manifest.sri_hash,\n  })\n  const real: FeedbackApi = bundle.createFeedback({\n    ...config,\n    // Forward the project's per-end-user gating flag from the manifest unless\n    // the host set it explicitly. The widget then runs the visibility check.\n    requiresVisibilityCheck:\n      config.requiresVisibilityCheck ??\n      manifest.config?.requires_visibility_check ??\n      false,\n    // Error capture is armed INSIDE the bundle (the only auto-updating part\n    // of a loader install), so already-deployed hosts pick it up without a\n    // redeploy. Precedence: explicit host override > per-project manifest\n    // flag > on. The loader provider forwards its `errorTracking` prop here\n    // rather than wrapping host-side, so there's exactly one arm point (the\n    // real instance) — no deferred/real double-registration.\n    errorTracking:\n      config.errorTracking ?? manifest.config?.error_tracking ?? true,\n    // Roadmap #17: operator-flipped behavior toggles ride the manifest;\n    // an explicit host value still wins.\n    ...(config.openToCurrentPageFeedback === undefined &&\n    typeof manifest.config?.behavior?.openToCurrentPageFeedback === 'boolean'\n      ? {\n          openToCurrentPageFeedback:\n            manifest.config.behavior.openToCurrentPageFeedback,\n        }\n      : {}),\n  })\n  deferred._attach(real)\n}\n"],"mappings":";AAqCA,IAAM,mBAAmB;AAczB,eAAsB,aACpB,MACuB;AAEvB,MAAI,OAAO,iBAAiB,gBAAgB;AAC1C,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,WAAW,SAAS;AAAA,IACxB,UAAU,gBAAgB;AAAA,EAC5B;AACA,MAAI,UAAU;AAEZ,WAAO,cAAc,KAAK,aAAa,GAAM;AAAA,EAC/C;AAEA,SAAO,IAAI,QAAsB,CAAC,SAAS,WAAW;AACpD,UAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,WAAO,MAAM,KAAK;AAClB,WAAO,YAAY,KAAK;AACxB,WAAO,cAAc;AACrB,WAAO,QAAQ;AACf,WAAO,aAAa,kBAAkB,GAAG;AACzC,WAAO,SAAS,MAAM;AACpB,UAAI,OAAO,iBAAiB,gBAAgB;AAC1C,gBAAQ,OAAO,eAAe;AAAA,MAChC,OAAO;AACL;AAAA,UACE,IAAI;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,UAAU,MAAM;AACrB;AAAA,QACE,IAAI;AAAA,UACF,gDAAgD,KAAK,SAAS;AAAA,QAEhE;AAAA,MACF;AAAA,IACF;AACA,aAAS,KAAK,YAAY,MAAM;AAEhC,UAAM,YAAY,KAAK,aAAa;AACpC,eAAW,MAAM;AACf;AAAA,QACE,IAAI,MAAM,+CAA+C,SAAS,IAAI;AAAA,MACxE;AAAA,IACF,GAAG,SAAS;AAAA,EACd,CAAC;AACH;AAEA,SAAS,cAAc,WAA0C;AAC/D,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,OAAO,MAAM;AACjB,UAAI,OAAO,iBAAiB,gBAAgB;AAC1C,gBAAQ,OAAO,eAAe;AAC9B;AAAA,MACF;AACA,UAAI,KAAK,IAAI,IAAI,QAAQ,WAAW;AAClC;AAAA,UACE,IAAI;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA;AAAA,MACF;AACA,iBAAW,MAAM,EAAE;AAAA,IACrB;AACA,SAAK;AAAA,EACP,CAAC;AACH;;;ACpFA,eAAsB,cACpB,UACA,QACA,QACmB;AACnB,QAAM,OAAO,SAAS,QAAQ,OAAO,EAAE;AACvC,QAAM,MAAM,GAAG,IAAI,wCAAwC,mBAAmB,MAAM,CAAC;AAKrF,QAAM,OAAoB,EAAE,aAAa,OAAO;AAChD,MAAI,OAAQ,MAAK,SAAS;AAC1B,QAAM,MAAM,MAAM,MAAM,KAAK,IAAI;AACjC,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,iDAAiD,IAAI,MAAM;AAAA,IAC7D;AAAA,EACF;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO;AACT;;;ACVO,SAAS,oBAAoC;AAClD,MAAI,OAA2B;AAC/B,MAAI,UAAwB;AAC5B,QAAM,QAAkB,CAAC;AAIzB,QAAM,sBAAiC,CAAC;AAExC,WAAS,MAAM,MAAoB;AACjC,QAAI,MAAM;AACR,UAAI,KAAK,SAAS,QAAQ;AACxB;AAAC,QAAC,KAAK,KAAK,MAAM,EAAiB;AAAA,MACrC,WAAW,KAAK,SAAS,OAAO;AAC9B;AAAC,QAAC,KAAK,KAAK,MAAM,EAA2B,KAAK,GAAG;AAAA,MACvD,OAAO;AAEL,gBAAQ,QAAQ,KAAK,OAAO,KAAK,OAAO,CAAC,EAAE;AAAA,UACzC,KAAK;AAAA,UACL,KAAK;AAAA,QACP;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,SAAS;AACX,UAAI,KAAK,SAAS,SAAU,MAAK,OAAO,OAAO;AAE/C;AAAA,IACF;AACA,UAAM,KAAK,IAAI;AAAA,EACjB;AAEA,SAAO;AAAA,IACL,OAAO;AACL,YAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAAA,IACxC;AAAA,IACA,OAAO;AACL,YAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAAA,IACxC;AAAA,IACA,WAAW;AACT,YAAM,EAAE,MAAM,QAAQ,QAAQ,WAAW,CAAC;AAAA,IAC5C;AAAA,IACA,KAAK,KAAK;AACR,YAAM,EAAE,MAAM,OAAO,QAAQ,QAAQ,IAAI,CAAC;AAAA,IAC5C;AAAA,IACA,SAAS,KAAK;AACZ,YAAM,EAAE,MAAM,OAAO,QAAQ,YAAY,IAAI,CAAC;AAAA,IAChD;AAAA,IACA,YAAY,KAAK;AACf,YAAM,EAAE,MAAM,OAAO,QAAQ,eAAe,IAAI,CAAC;AAAA,IACnD;AAAA,IACA,OAAO,SAAS;AACd,aAAO,IAAI,QAAyB,CAAC,SAAS,WAAW;AACvD,cAAM,EAAE,MAAM,UAAU,SAAS,SAAS,OAAO,CAAC;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,IACA,qBAAqB,IAAa;AAChC,YAAM,SAAS;AACf,UAAI,UAAU,OAAO,OAAO,yBAAyB,YAAY;AAC/D,eAAO,qBAAqB,EAAE;AAC9B;AAAA,MACF;AACA,UAAI,QAAS;AACb,0BAAoB,KAAK,EAAE;AAAA,IAC7B;AAAA,IACA,QAAQ,MAAM;AACZ,aAAO;AACP,YAAM,SAAS;AACf,UAAI,OAAO,OAAO,yBAAyB,YAAY;AACrD,mBAAW,MAAM,oBAAqB,QAAO,qBAAqB,EAAE;AAAA,MACtE;AACA,0BAAoB,SAAS;AAC7B,aAAO,MAAM,SAAS,EAAG,OAAM,MAAM,MAAM,CAAE;AAAA,IAC/C;AAAA,IACA,MAAM,KAAK;AACT,gBAAU;AACV,0BAAoB,SAAS;AAE7B,iBAAW,QAAQ,OAAO;AACxB,YAAI,KAAK,SAAS,SAAU,MAAK,OAAO,GAAG;AAAA,MAC7C;AACA,YAAM,SAAS;AAAA,IACjB;AAAA,EACF;AACF;;;AChGO,SAAS,eAAe,QAAmC;AAChE,QAAM,WAAW,kBAAkB;AACnC,gBAAc,QAAQ,QAAQ,EAAE,MAAM,CAAC,QAAe;AAKpD,YAAQ,KAAK,2CAA2C,IAAI,OAAO;AACnE,aAAS,MAAM,GAAG;AAAA,EACpB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,cACb,QACA,UACe;AACf,QAAM,WAAW,MAAM,cAAc,OAAO,UAAU,OAAO,MAAM;AACnE,MAAI,CAAC,SAAS,WAAW,CAAC,SAAS,cAAc,CAAC,SAAS,UAAU;AAGnE,aAAS;AAAA,MACP,IAAI;AAAA,QACF,qDACE,SAAS,SAAS,WAAM,SAAS,MAAM,KAAK,EAC9C;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,SAAS,MAAM,aAAa;AAAA,IAChC,WAAW,SAAS;AAAA,IACpB,SAAS,SAAS;AAAA,EACpB,CAAC;AACD,QAAM,OAAoB,OAAO,eAAe;AAAA,IAC9C,GAAG;AAAA;AAAA;AAAA,IAGH,yBACE,OAAO,2BACP,SAAS,QAAQ,6BACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOF,eACE,OAAO,iBAAiB,SAAS,QAAQ,kBAAkB;AAAA;AAAA;AAAA,IAG7D,GAAI,OAAO,8BAA8B,UACzC,OAAO,SAAS,QAAQ,UAAU,8BAA8B,YAC5D;AAAA,MACE,2BACE,SAAS,OAAO,SAAS;AAAA,IAC7B,IACA,CAAC;AAAA,EACP,CAAC;AACD,WAAS,QAAQ,IAAI;AACvB;","names":[]}
+{"version":3,"sources":["../src/loader/bundleLoader.ts","../src/loader/manifest.ts","../src/loader/deferredApi.ts","../src/loader/index.ts"],"sourcesContent":["/**\n * Inject the widget bundle as an SRI-protected <script> and wait for its\n * window global to appear.\n *\n * Why a <script> tag and not `import()`:\n *   `import()` can fetch cross-origin ESM but doesn't honor Subresource\n *   Integrity on the dynamic-import call itself. A <script> tag with\n *   `integrity=…` is the only path where the browser actually refuses\n *   to execute a bundle whose bytes don't match the manifest's hash.\n *\n * The bundle is built with `tsup --format iife --globalName MhosaicFeedback`,\n * so once it parses it sets `window.MhosaicFeedback = { createFeedback }`\n * (per `src/widget.ts`'s exports). We wait for that to appear.\n *\n * Idempotency: if multiple FeedbackProviders mount on the same page (e.g.\n * during a React fast-refresh cycle), we reuse an already-injected bundle\n * instead of fetching a second copy.\n */\n\nimport type { FeedbackApi, FeedbackConfig } from '../types'\nimport type { ErrorTrackingOptions } from '../modules/error-tracking'\n\n/** What the loader may pass to the bundle's `createFeedback`: the public\n *  config plus the bundle-only `errorTracking` knob the loader forwards\n *  from the manifest. */\nexport type BundleConfig = FeedbackConfig & {\n  errorTracking?: boolean | ErrorTrackingOptions\n}\n\ndeclare global {\n  interface Window {\n    MhosaicFeedback?: {\n      createFeedback(config: BundleConfig): FeedbackApi\n    }\n  }\n}\n\nconst SCRIPT_DATA_ATTR = 'data-mhosaic-feedback-bundle'\n\nexport interface BundleLoadOptions {\n  bundleUrl: string\n  sriHash: string\n  /** Default 30 s. Long enough for slow networks; short enough to surface\n   *  CDN outages quickly. */\n  timeoutMs?: number\n}\n\nexport interface BundleHandle {\n  createFeedback(config: BundleConfig): FeedbackApi\n}\n\nexport async function injectBundle(\n  opts: BundleLoadOptions,\n): Promise<BundleHandle> {\n  // Reuse a bundle already loaded this page.\n  if (window.MhosaicFeedback?.createFeedback) {\n    return window.MhosaicFeedback\n  }\n\n  const existing = document.querySelector<HTMLScriptElement>(\n    `script[${SCRIPT_DATA_ATTR}]`,\n  )\n  if (existing) {\n    // Another loader instance started the fetch; wait for the global.\n    return waitForGlobal(opts.timeoutMs ?? 30_000)\n  }\n\n  return new Promise<BundleHandle>((resolve, reject) => {\n    const script = document.createElement('script')\n    script.src = opts.bundleUrl\n    script.integrity = opts.sriHash\n    script.crossOrigin = 'anonymous'\n    script.async = true\n    script.setAttribute(SCRIPT_DATA_ATTR, '1')\n    script.onload = () => {\n      if (window.MhosaicFeedback?.createFeedback) {\n        resolve(window.MhosaicFeedback)\n      } else {\n        reject(\n          new Error(\n            'mhosaic-feedback: bundle loaded but window.MhosaicFeedback.createFeedback is missing — bundle/loader version mismatch?',\n          ),\n        )\n      }\n    }\n    script.onerror = () => {\n      reject(\n        new Error(\n          `mhosaic-feedback: failed to load bundle from ${opts.bundleUrl} ` +\n            '(network, CSP, or SRI mismatch)',\n        ),\n      )\n    }\n    document.head.appendChild(script)\n\n    const timeoutMs = opts.timeoutMs ?? 30_000\n    setTimeout(() => {\n      reject(\n        new Error(`mhosaic-feedback: bundle load timeout after ${timeoutMs}ms`),\n      )\n    }, timeoutMs)\n  })\n}\n\nfunction waitForGlobal(timeoutMs: number): Promise<BundleHandle> {\n  return new Promise((resolve, reject) => {\n    const start = Date.now()\n    const tick = () => {\n      if (window.MhosaicFeedback?.createFeedback) {\n        resolve(window.MhosaicFeedback)\n        return\n      }\n      if (Date.now() - start > timeoutMs) {\n        reject(\n          new Error(\n            'mhosaic-feedback: timed out waiting for bundle global (another loader instance started the fetch but never finished)',\n          ),\n        )\n        return\n      }\n      setTimeout(tick, 50)\n    }\n    tick()\n  })\n}\n","/**\n * Fetch the widget-manifest from the Mhosaic backend.\n *\n * The loader calls this on every page load. The backend reads `Project.\n * pinned_version` (or current stable) + `Project.widget_enabled` and\n * returns the bundle URL + SRI hash for the version this tenant should\n * receive — or `{enabled: false}` if the widget is killed for the tenant.\n *\n * Network failures are surfaced to the caller. The loader degrades to\n * \"widget not present\" rather than crashing the host page.\n */\n\nexport interface Manifest {\n  /** False when the widget is disabled for this project (kill switch) or\n   *  no stable release exists. Loader bails silently. */\n  enabled: boolean\n  /** Semver of the bundle being served. Present when enabled=true. */\n  version?: string\n  /** Fully-qualified URL to the version-pinned bundle (jsDelivr). */\n  bundle_url?: string\n  /** Subresource integrity hash for the bundle. The loader injects the\n   *  script tag with `integrity=…` so the browser refuses to run a\n   *  bundle whose bytes don't match. */\n  sri_hash?: string\n  /** Static config the manifest endpoint passes through to the widget. */\n  config?: {\n    endpoint: string\n    project_slug: string\n    share_reports_with_widget: boolean\n    /** Phase 4: project gates the widget per end-user (default false). */\n    requires_visibility_check?: boolean\n    /** Per-project switch for the bundle's default error capture. When the\n     *  backend omits it, the bundle falls back to its own default (on). */\n    error_tracking?: boolean\n    behavior?: Record<string, boolean>\n  }\n  /** Human-readable detail when `enabled` is false. */\n  detail?: string\n}\n\nexport async function fetchManifest(\n  endpoint: string,\n  apiKey: string,\n  signal?: AbortSignal,\n): Promise<Manifest> {\n  const base = endpoint.replace(/\\/$/, '')\n  const url = `${base}/api/feedback/v1/widget-manifest/?pk=${encodeURIComponent(apiKey)}`\n  // credentials: 'omit' — we authenticate via the public pk_proj_ query\n  // param; sending cookies would just trigger CORS preflights for no\n  // reason and is unnecessary since the manifest endpoint doesn't read\n  // any session.\n  const init: RequestInit = { credentials: 'omit' }\n  if (signal) init.signal = signal\n  const res = await fetch(url, init)\n  if (!res.ok) {\n    throw new Error(\n      `mhosaic-feedback: manifest fetch failed (HTTP ${res.status})`,\n    )\n  }\n  const body = (await res.json()) as Manifest\n  return body\n}\n","/**\n * A FeedbackApi-shaped object that queues method calls until the real\n * widget bundle finishes loading, then drains the queue against the real\n * implementation.\n *\n * Why we need this: hosts that already have code like\n *   const fb = createFeedback({...})\n *   fb.identify({id, email, name})\n *   useEffect(() => fb.open(...), [])\n * shouldn't have to refactor for async. The loader's createFeedback\n * returns sync — a deferred handle that records intent, then replays it\n * once the real bundle arrives. Idiomatic queue-then-flush pattern.\n *\n * If the bundle never loads (network failure, SRI mismatch, kill switch),\n * `_fail()` is called instead. Void methods (identify/setMetadata/open/...)\n * silently drop in that case — the widget just doesn't appear. The\n * `submit` Promise rejects so callers can surface real errors.\n */\n\nimport type {\n  FeedbackApi,\n  ReportPayload,\n  SubmittedReport,\n  UserIdentity,\n} from '../types'\n\ntype VoidMethod = 'show' | 'hide' | 'shutdown'\ntype ArgMethod = 'open' | 'identify' | 'setMetadata'\n\ntype Queued =\n  | { kind: 'void'; method: VoidMethod }\n  | { kind: 'arg'; method: 'open'; arg: Parameters<FeedbackApi['open']>[0] }\n  | { kind: 'arg'; method: 'identify'; arg: UserIdentity }\n  | { kind: 'arg'; method: 'setMetadata'; arg: Record<string, unknown> }\n  | {\n      kind: 'submit'\n      payload: Partial<ReportPayload> & { description: string }\n      resolve: (r: SubmittedReport) => void\n      reject: (e: unknown) => void\n    }\n\nexport interface DeferredHandle extends FeedbackApi {\n  /** Called by the loader once the bundle is loaded and a real API exists. */\n  _attach(real: FeedbackApi): void\n  /** Called by the loader if the bundle fails to load. */\n  _fail(err: Error): void\n  /** Buffered transformer registry — forwarded to the real instance on\n   *  attach, so wrapper modules (withReplay) work over loader installs. */\n  _registerTransformer(fn: unknown): void\n}\n\nexport function createDeferredApi(): DeferredHandle {\n  let real: FeedbackApi | null = null\n  let failure: Error | null = null\n  const queue: Queued[] = []\n  // Transformers (withReplay & friends) registered before the bundle\n  // attaches. Forwarded to the real instance's registry on _attach so\n  // host-side wrappers work over a loader install too (roadmap #7).\n  const pendingTransformers: unknown[] = []\n\n  function flush(item: Queued): void {\n    if (real) {\n      if (item.kind === 'void') {\n        ;(real[item.method] as () => void)()\n      } else if (item.kind === 'arg') {\n        ;(real[item.method] as (a: unknown) => void)(item.arg)\n      } else {\n        // submit\n        Promise.resolve(real.submit(item.payload)).then(\n          item.resolve,\n          item.reject,\n        )\n      }\n      return\n    }\n    if (failure) {\n      if (item.kind === 'submit') item.reject(failure)\n      // Void / arg methods silently dropped — the widget never appeared.\n      return\n    }\n    queue.push(item)\n  }\n\n  return {\n    show() {\n      flush({ kind: 'void', method: 'show' })\n    },\n    hide() {\n      flush({ kind: 'void', method: 'hide' })\n    },\n    shutdown() {\n      flush({ kind: 'void', method: 'shutdown' })\n    },\n    open(arg) {\n      flush({ kind: 'arg', method: 'open', arg })\n    },\n    identify(arg) {\n      flush({ kind: 'arg', method: 'identify', arg })\n    },\n    setMetadata(arg) {\n      flush({ kind: 'arg', method: 'setMetadata', arg })\n    },\n    submit(payload) {\n      return new Promise<SubmittedReport>((resolve, reject) => {\n        flush({ kind: 'submit', payload, resolve, reject })\n      })\n    },\n    _registerTransformer(fn: unknown) {\n      const target = real as { _registerTransformer?: (f: unknown) => void } | null\n      if (target && typeof target._registerTransformer === 'function') {\n        target._registerTransformer(fn)\n        return\n      }\n      if (failure) return // widget never appeared — nothing to transform\n      pendingTransformers.push(fn)\n    },\n    _attach(impl) {\n      real = impl\n      const target = impl as { _registerTransformer?: (f: unknown) => void }\n      if (typeof target._registerTransformer === 'function') {\n        for (const fn of pendingTransformers) target._registerTransformer(fn)\n      }\n      pendingTransformers.length = 0\n      while (queue.length > 0) flush(queue.shift()!)\n    },\n    _fail(err) {\n      failure = err\n      pendingTransformers.length = 0\n      // Drain any pending submits with the failure; drop void/arg.\n      for (const item of queue) {\n        if (item.kind === 'submit') item.reject(err)\n      }\n      queue.length = 0\n    },\n  }\n}\n","/**\n * `@mhosaic/feedback/loader` — public entry for the loader architecture.\n *\n * Same shape as the direct-import path (`@mhosaic/feedback`), but the\n * widget bundle is fetched at runtime from a CDN URL the Mhosaic backend\n * dictates via the manifest endpoint. Letting hosts switch from the\n * direct-import path to the loader path gives them auto-updates without\n * any further code changes — Mhosaic ships a new Release row, every host\n * picks up the new bundle on next page load.\n *\n * Public surface MUST mirror the direct-import path exactly:\n *   - `createFeedback(config)` returns a `FeedbackApi`-shaped handle.\n *   - Method calls before the bundle finishes loading queue up and replay.\n *   - `submit()` returns a Promise that resolves after the bundle is up\n *     and the real submit completes.\n *\n * If the manifest endpoint reports the widget is disabled for this\n * project (`enabled: false` — kill switch or no stable release configured),\n * the deferred handle silently no-ops void calls and rejects `submit()`\n * calls with a clear error. The host page never crashes.\n */\n\nimport type { FeedbackApi, FeedbackConfig } from '../types'\nimport type { ErrorTrackingOptions } from '../modules/error-tracking'\nimport { injectBundle } from './bundleLoader'\nimport { fetchManifest } from './manifest'\nimport { createDeferredApi, type DeferredHandle } from './deferredApi'\n\nexport type { FeedbackApi, FeedbackConfig } from '../types'\nexport type { Manifest } from './manifest'\n\n/** Loader config = the public widget config plus the loader-only knobs the\n *  host can set to override what the manifest dictates. */\nexport type LoaderConfig = FeedbackConfig & {\n  /** Override the bundle's default error capture. Omit (or pass `undefined`)\n   *  to let the project's manifest flag decide (which itself defaults on). */\n  errorTracking?: boolean | ErrorTrackingOptions | undefined\n}\n\nexport function createFeedback(config: LoaderConfig): FeedbackApi {\n  const deferred = createDeferredApi()\n  loadAndAttach(config, deferred).catch((err: Error) => {\n    // Surface to console — host devtools is the canonical channel for\n    // widget bootstrap errors. Production telemetry is the bundle's job\n    // (it can't run if it never loaded), so console.warn is the floor.\n    // eslint-disable-next-line no-console\n    console.warn('[mhosaic-feedback] widget did not load:', err.message)\n    deferred._fail(err)\n  })\n  return deferred\n}\n\nasync function loadAndAttach(config: LoaderConfig, deferred: DeferredHandle): Promise<void> {\n  const manifest = await fetchManifest(config.endpoint, config.apiKey)\n  if (!manifest.enabled || !manifest.bundle_url || !manifest.sri_hash) {\n    // Disabled by Mhosaic (kill switch) or no stable release. Surface a\n    // clear failure so submit() callers see an error, but no host crash.\n    deferred._fail(\n      new Error(\n        `mhosaic-feedback: widget disabled for this project${\n          manifest.detail ? ` — ${manifest.detail}` : ''\n        }`,\n      ),\n    )\n    return\n  }\n  const bundle = await injectBundle({\n    bundleUrl: manifest.bundle_url,\n    sriHash: manifest.sri_hash,\n  })\n  const real: FeedbackApi = bundle.createFeedback({\n    ...config,\n    // Forward the project's per-end-user gating flag from the manifest unless\n    // the host set it explicitly. The widget then runs the visibility check.\n    requiresVisibilityCheck:\n      config.requiresVisibilityCheck ?? manifest.config?.requires_visibility_check ?? false,\n    // Error capture is armed INSIDE the bundle (the only auto-updating part\n    // of a loader install), so already-deployed hosts pick it up without a\n    // redeploy. Precedence: explicit host override > per-project manifest\n    // flag > on. The loader provider forwards its `errorTracking` prop here\n    // rather than wrapping host-side, so there's exactly one arm point (the\n    // real instance) — no deferred/real double-registration.\n    errorTracking: config.errorTracking ?? manifest.config?.error_tracking ?? true,\n    // Roadmap #17: operator-flipped behavior toggles ride the manifest;\n    // an explicit host value still wins.\n    ...(config.openToCurrentPageFeedback === undefined &&\n    typeof manifest.config?.behavior?.openToCurrentPageFeedback === 'boolean'\n      ? {\n          openToCurrentPageFeedback: manifest.config.behavior.openToCurrentPageFeedback,\n        }\n      : {}),\n    ...(config.metaFeedbackEnabled === undefined &&\n    typeof manifest.config?.behavior?.metaFeedbackEnabled === 'boolean'\n      ? { metaFeedbackEnabled: manifest.config.behavior.metaFeedbackEnabled }\n      : {}),\n  })\n  deferred._attach(real)\n}\n"],"mappings":";AAqCA,IAAM,mBAAmB;AAczB,eAAsB,aACpB,MACuB;AAEvB,MAAI,OAAO,iBAAiB,gBAAgB;AAC1C,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,WAAW,SAAS;AAAA,IACxB,UAAU,gBAAgB;AAAA,EAC5B;AACA,MAAI,UAAU;AAEZ,WAAO,cAAc,KAAK,aAAa,GAAM;AAAA,EAC/C;AAEA,SAAO,IAAI,QAAsB,CAAC,SAAS,WAAW;AACpD,UAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,WAAO,MAAM,KAAK;AAClB,WAAO,YAAY,KAAK;AACxB,WAAO,cAAc;AACrB,WAAO,QAAQ;AACf,WAAO,aAAa,kBAAkB,GAAG;AACzC,WAAO,SAAS,MAAM;AACpB,UAAI,OAAO,iBAAiB,gBAAgB;AAC1C,gBAAQ,OAAO,eAAe;AAAA,MAChC,OAAO;AACL;AAAA,UACE,IAAI;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,UAAU,MAAM;AACrB;AAAA,QACE,IAAI;AAAA,UACF,gDAAgD,KAAK,SAAS;AAAA,QAEhE;AAAA,MACF;AAAA,IACF;AACA,aAAS,KAAK,YAAY,MAAM;AAEhC,UAAM,YAAY,KAAK,aAAa;AACpC,eAAW,MAAM;AACf;AAAA,QACE,IAAI,MAAM,+CAA+C,SAAS,IAAI;AAAA,MACxE;AAAA,IACF,GAAG,SAAS;AAAA,EACd,CAAC;AACH;AAEA,SAAS,cAAc,WAA0C;AAC/D,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,OAAO,MAAM;AACjB,UAAI,OAAO,iBAAiB,gBAAgB;AAC1C,gBAAQ,OAAO,eAAe;AAC9B;AAAA,MACF;AACA,UAAI,KAAK,IAAI,IAAI,QAAQ,WAAW;AAClC;AAAA,UACE,IAAI;AAAA,YACF;AAAA,UACF;AAAA,QACF;AACA;AAAA,MACF;AACA,iBAAW,MAAM,EAAE;AAAA,IACrB;AACA,SAAK;AAAA,EACP,CAAC;AACH;;;ACpFA,eAAsB,cACpB,UACA,QACA,QACmB;AACnB,QAAM,OAAO,SAAS,QAAQ,OAAO,EAAE;AACvC,QAAM,MAAM,GAAG,IAAI,wCAAwC,mBAAmB,MAAM,CAAC;AAKrF,QAAM,OAAoB,EAAE,aAAa,OAAO;AAChD,MAAI,OAAQ,MAAK,SAAS;AAC1B,QAAM,MAAM,MAAM,MAAM,KAAK,IAAI;AACjC,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,iDAAiD,IAAI,MAAM;AAAA,IAC7D;AAAA,EACF;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO;AACT;;;ACVO,SAAS,oBAAoC;AAClD,MAAI,OAA2B;AAC/B,MAAI,UAAwB;AAC5B,QAAM,QAAkB,CAAC;AAIzB,QAAM,sBAAiC,CAAC;AAExC,WAAS,MAAM,MAAoB;AACjC,QAAI,MAAM;AACR,UAAI,KAAK,SAAS,QAAQ;AACxB;AAAC,QAAC,KAAK,KAAK,MAAM,EAAiB;AAAA,MACrC,WAAW,KAAK,SAAS,OAAO;AAC9B;AAAC,QAAC,KAAK,KAAK,MAAM,EAA2B,KAAK,GAAG;AAAA,MACvD,OAAO;AAEL,gBAAQ,QAAQ,KAAK,OAAO,KAAK,OAAO,CAAC,EAAE;AAAA,UACzC,KAAK;AAAA,UACL,KAAK;AAAA,QACP;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,SAAS;AACX,UAAI,KAAK,SAAS,SAAU,MAAK,OAAO,OAAO;AAE/C;AAAA,IACF;AACA,UAAM,KAAK,IAAI;AAAA,EACjB;AAEA,SAAO;AAAA,IACL,OAAO;AACL,YAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAAA,IACxC;AAAA,IACA,OAAO;AACL,YAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAAA,IACxC;AAAA,IACA,WAAW;AACT,YAAM,EAAE,MAAM,QAAQ,QAAQ,WAAW,CAAC;AAAA,IAC5C;AAAA,IACA,KAAK,KAAK;AACR,YAAM,EAAE,MAAM,OAAO,QAAQ,QAAQ,IAAI,CAAC;AAAA,IAC5C;AAAA,IACA,SAAS,KAAK;AACZ,YAAM,EAAE,MAAM,OAAO,QAAQ,YAAY,IAAI,CAAC;AAAA,IAChD;AAAA,IACA,YAAY,KAAK;AACf,YAAM,EAAE,MAAM,OAAO,QAAQ,eAAe,IAAI,CAAC;AAAA,IACnD;AAAA,IACA,OAAO,SAAS;AACd,aAAO,IAAI,QAAyB,CAAC,SAAS,WAAW;AACvD,cAAM,EAAE,MAAM,UAAU,SAAS,SAAS,OAAO,CAAC;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,IACA,qBAAqB,IAAa;AAChC,YAAM,SAAS;AACf,UAAI,UAAU,OAAO,OAAO,yBAAyB,YAAY;AAC/D,eAAO,qBAAqB,EAAE;AAC9B;AAAA,MACF;AACA,UAAI,QAAS;AACb,0BAAoB,KAAK,EAAE;AAAA,IAC7B;AAAA,IACA,QAAQ,MAAM;AACZ,aAAO;AACP,YAAM,SAAS;AACf,UAAI,OAAO,OAAO,yBAAyB,YAAY;AACrD,mBAAW,MAAM,oBAAqB,QAAO,qBAAqB,EAAE;AAAA,MACtE;AACA,0BAAoB,SAAS;AAC7B,aAAO,MAAM,SAAS,EAAG,OAAM,MAAM,MAAM,CAAE;AAAA,IAC/C;AAAA,IACA,MAAM,KAAK;AACT,gBAAU;AACV,0BAAoB,SAAS;AAE7B,iBAAW,QAAQ,OAAO;AACxB,YAAI,KAAK,SAAS,SAAU,MAAK,OAAO,GAAG;AAAA,MAC7C;AACA,YAAM,SAAS;AAAA,IACjB;AAAA,EACF;AACF;;;AChGO,SAAS,eAAe,QAAmC;AAChE,QAAM,WAAW,kBAAkB;AACnC,gBAAc,QAAQ,QAAQ,EAAE,MAAM,CAAC,QAAe;AAKpD,YAAQ,KAAK,2CAA2C,IAAI,OAAO;AACnE,aAAS,MAAM,GAAG;AAAA,EACpB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,cAAc,QAAsB,UAAyC;AAC1F,QAAM,WAAW,MAAM,cAAc,OAAO,UAAU,OAAO,MAAM;AACnE,MAAI,CAAC,SAAS,WAAW,CAAC,SAAS,cAAc,CAAC,SAAS,UAAU;AAGnE,aAAS;AAAA,MACP,IAAI;AAAA,QACF,qDACE,SAAS,SAAS,WAAM,SAAS,MAAM,KAAK,EAC9C;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,SAAS,MAAM,aAAa;AAAA,IAChC,WAAW,SAAS;AAAA,IACpB,SAAS,SAAS;AAAA,EACpB,CAAC;AACD,QAAM,OAAoB,OAAO,eAAe;AAAA,IAC9C,GAAG;AAAA;AAAA;AAAA,IAGH,yBACE,OAAO,2BAA2B,SAAS,QAAQ,6BAA6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOlF,eAAe,OAAO,iBAAiB,SAAS,QAAQ,kBAAkB;AAAA;AAAA;AAAA,IAG1E,GAAI,OAAO,8BAA8B,UACzC,OAAO,SAAS,QAAQ,UAAU,8BAA8B,YAC5D;AAAA,MACE,2BAA2B,SAAS,OAAO,SAAS;AAAA,IACtD,IACA,CAAC;AAAA,IACL,GAAI,OAAO,wBAAwB,UACnC,OAAO,SAAS,QAAQ,UAAU,wBAAwB,YACtD,EAAE,qBAAqB,SAAS,OAAO,SAAS,oBAAoB,IACpE,CAAC;AAAA,EACP,CAAC;AACD,WAAS,QAAQ,IAAI;AACvB;","names":[]}

package/dist/{chunk-T36VC7TZ.mjs → chunk-C3ILJCVI.mjs}

@@ -20,9 +20,7 @@ function assertSafeEndpoint(endpoint) {
   try {
     parsed = new URL(endpoint);
   } catch {
-    throw new Error(
-      `[mhosaic-feedback] \`endpoint\` is not a valid URL: ${endpoint}`
-    );
+    throw new Error(`[mhosaic-feedback] \`endpoint\` is not a valid URL: ${endpoint}`);
   }
   if (parsed.protocol === "https:") return;
   if (parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]")) {
@@ -91,6 +89,7 @@ function createApiClient(options) {
       form.append("screenshot", blob, i === 0 ? "screenshot.png" : `screenshot-${i + 1}.png`);
     });
     if (payload.synthetic) form.append("synthetic", "true");
+    if (payload.meta) form.append("meta", "true");
     if (payload.user?.id) {
       form.append("user", JSON.stringify(payload.user));
     }
@@ -172,29 +171,26 @@ function createApiClient(options) {
     return "healthy";
   }
   async function listChangelog(externalId) {
-    const response = await fetcher(
-      `${endpoint}/api/feedback/v1/reports/widget/changelog/`,
-      { method: "GET", headers: widgetHeaders(externalId) }
-    );
+    const response = await fetcher(`${endpoint}/api/feedback/v1/reports/widget/changelog/`, {
+      method: "GET",
+      headers: widgetHeaders(externalId)
+    });
     if (response.status === 404) return [];
     return readJsonArray(response, "listChangelog");
   }
   async function getReport(reportId, externalId, opts) {
-    const response = await fetcher(
-      `${endpoint}/api/feedback/v1/reports/widget/${reportId}/`,
-      {
-        method: "GET",
-        headers: widgetHeaders(externalId),
-        ...opts?.signal ? { signal: opts.signal } : {}
-      }
-    );
+    const response = await fetcher(`${endpoint}/api/feedback/v1/reports/widget/${reportId}/`, {
+      method: "GET",
+      headers: widgetHeaders(externalId),
+      ...opts?.signal ? { signal: opts.signal } : {}
+    });
     return readJsonObject(response, "getReport");
   }
   async function getReportBySeq(seq, externalId) {
-    const response = await fetcher(
-      `${endpoint}/api/feedback/v1/reports/widget/by-seq/${seq}/`,
-      { method: "GET", headers: widgetHeaders(externalId) }
-    );
+    const response = await fetcher(`${endpoint}/api/feedback/v1/reports/widget/by-seq/${seq}/`, {
+      method: "GET",
+      headers: widgetHeaders(externalId)
+    });
     return readJsonObject(response, "getReportBySeq");
   }
   async function addComment(reportId, externalId, body, clientNonce, attachments) {
@@ -203,9 +199,7 @@ function createApiClient(options) {
       const form = new FormData();
       form.append("body", body);
       if (clientNonce !== void 0) form.append("client_nonce", clientNonce);
-      attachments.forEach(
-        (blob, i) => form.append("attachment", blob, `attachment-${i + 1}.png`)
-      );
+      attachments.forEach((blob, i) => form.append("attachment", blob, `attachment-${i + 1}.png`));
       init = { method: "POST", headers: widgetHeaders(externalId), body: form };
     } else {
       init = {
@@ -231,17 +225,14 @@ function createApiClient(options) {
     return response.json();
   }
   async function editDescription(reportId, externalId, description) {
-    const response = await fetcher(
-      `${endpoint}/api/feedback/v1/reports/widget/${reportId}/`,
-      {
-        method: "PATCH",
-        headers: {
-          ...widgetHeaders(externalId),
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({ description })
-      }
-    );
+    const response = await fetcher(`${endpoint}/api/feedback/v1/reports/widget/${reportId}/`, {
+      method: "PATCH",
+      headers: {
+        ...widgetHeaders(externalId),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ description })
+    });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       throw new Error(`editDescription failed: ${response.status} ${text}`);
@@ -249,17 +240,14 @@ function createApiClient(options) {
     return response.json();
   }
   async function closeAsResolved(reportId, externalId) {
-    const response = await fetcher(
-      `${endpoint}/api/feedback/v1/reports/widget/${reportId}/`,
-      {
-        method: "PATCH",
-        headers: {
-          ...widgetHeaders(externalId),
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({ status: "closed" })
-      }
-    );
+    const response = await fetcher(`${endpoint}/api/feedback/v1/reports/widget/${reportId}/`, {
+      method: "PATCH",
+      headers: {
+        ...widgetHeaders(externalId),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ status: "closed" })
+    });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       throw new Error(`closeAsResolved failed: ${response.status} ${text}`);
@@ -267,17 +255,14 @@ function createApiClient(options) {
     return response.json();
   }
   async function reopenUnresolved(reportId, externalId) {
-    const response = await fetcher(
-      `${endpoint}/api/feedback/v1/reports/widget/${reportId}/`,
-      {
-        method: "PATCH",
-        headers: {
-          ...widgetHeaders(externalId),
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({ status: "in_progress" })
-      }
-    );
+    const response = await fetcher(`${endpoint}/api/feedback/v1/reports/widget/${reportId}/`, {
+      method: "PATCH",
+      headers: {
+        ...widgetHeaders(externalId),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ status: "in_progress" })
+    });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       throw new Error(`reopenUnresolved failed: ${response.status} ${text}`);
@@ -331,20 +316,17 @@ function createApiClient(options) {
     return readJsonObject(response, "fetchBoardKpis");
   }
   async function checkVisibility(externalId, email) {
-    const response = await fetcher(
-      `${endpoint}/api/feedback/v1/widget/visibility/`,
-      {
-        method: "POST",
-        headers: {
-          ...widgetHeaders(externalId),
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({
-          external_id: externalId,
-          ...email ? { email } : {}
-        })
-      }
-    );
+    const response = await fetcher(`${endpoint}/api/feedback/v1/widget/visibility/`, {
+      method: "POST",
+      headers: {
+        ...widgetHeaders(externalId),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        external_id: externalId,
+        ...email ? { email } : {}
+      })
+    });
     if (!response.ok) {
       throw new Error(`checkVisibility failed: ${response.status}`);
     }
@@ -677,6 +659,9 @@ var DEFAULT_STRINGS = {
   "form.cancel": "Cancel",
   "form.close": "Close",
   "form.submitting": "Sending\u2026",
+  "form.meta.action": "Report a problem with this feedback tool",
+  "form.meta.badge": "\u2192 goes to the feedback-tool team",
+  "form.meta.cancel": "Back to normal feedback",
   "form.success": "Thanks \u2014 your feedback was sent.",
   "form.success.seq": "Thanks \u2014 report #{seq} was sent. \u2713",
   "form.discard.title": "Unsaved changes",
@@ -881,6 +866,9 @@ var FRENCH_STRINGS = {
   "form.cancel": "Annuler",
   "form.close": "Fermer",
   "form.submitting": "Envoi\u2026",
+  "form.meta.action": "Signaler un probl\xE8me avec l'outil de feedback",
+  "form.meta.badge": "\u2192 envoy\xE9 \xE0 l'\xE9quipe de l'outil de feedback",
+  "form.meta.cancel": "Revenir au commentaire normal",
   "form.success": "Merci \u2014 votre commentaire a \xE9t\xE9 envoy\xE9.",
   "form.success.seq": "Merci \u2014 rapport n\xB0{seq} envoy\xE9. \u2713",
   "form.discard.title": "Modifications non enregistr\xE9es",
@@ -1318,6 +1306,26 @@ var ALLOWED_IMAGE_TYPES = [
 ];
 var MAX_SCREENSHOT_BYTES = 10 * 1024 * 1024;
 var MAX_SCREENSHOTS = 5;
+var ALLOWED_ATTACHMENT_TYPES = [
+  ...ALLOWED_IMAGE_TYPES,
+  "application/pdf",
+  "text/plain",
+  "text/csv",
+  "application/json",
+  ""
+];
+var ATTACHMENT_ACCEPT = "image/png,image/jpeg,image/webp,application/pdf,text/plain,.log,.txt,.csv,.json";
+function validateAttachmentFile(file) {
+  if (!ALLOWED_ATTACHMENT_TYPES.includes(
+    file.type
+  )) {
+    return { kind: "type" };
+  }
+  if (file.size > MAX_SCREENSHOT_BYTES) {
+    return { kind: "size", maxMb: MAX_SCREENSHOT_BYTES / (1024 * 1024) };
+  }
+  return null;
+}
 function validateScreenshotFile(file) {
   if (!ALLOWED_IMAGE_TYPES.includes(
     file.type
@@ -1404,7 +1412,7 @@ function ReportDetailView({
     const remaining = MAX_SCREENSHOTS - composeShots.length;
     const batch = files.slice(0, Math.max(0, remaining));
     for (const file of batch) {
-      const err = validateScreenshotFile(file);
+      const err = validateAttachmentFile(file);
       if (err) {
         setAttachError(
           err.kind === "type" ? strings["form.screenshot.error_type"] : strings["form.screenshot.error_size"].replace("{max}", String(err.maxMb))
@@ -1776,7 +1784,7 @@ function ReportDetailView({
           {
             ref: fileInputRef,
             type: "file",
-            accept: "image/png,image/jpeg,image/webp",
+            accept: ATTACHMENT_ACCEPT,
             multiple: true,
             class: "compose-attach-input",
             onChange: handleAttachChange,
@@ -3386,8 +3394,10 @@ function Form({
   status,
   errorMessage,
   submittedSeq,
-  onDirtyChange
+  onDirtyChange,
+  metaFeedbackEnabled
 }) {
+  const [metaMode, setMetaMode] = useState6(false);
   const [description, setDescription] = useState6("");
   const [feedbackType, setFeedbackType] = useState6("bug");
   const [severity, setSeverity] = useState6("medium");
@@ -3507,10 +3517,14 @@ function Form({
       values.screenshots = shots.map((s) => s.blob);
       values.capture_method = "manual";
     }
+    if (metaMode) {
+      values.meta = true;
+    }
     onSubmit(values);
   };
   return /* @__PURE__ */ jsxs9("form", { onSubmit: handleSubmit, onPaste: handlePaste, children: [
     /* @__PURE__ */ jsx9("h2", { children: strings["form.title"] }),
+    metaMode && /* @__PURE__ */ jsx9("div", { class: "meta-badge", children: strings["form.meta.badge"] }),
     /* @__PURE__ */ jsxs9("div", { class: "field", children: [
       /* @__PURE__ */ jsx9("label", { for: "mfb-desc", children: strings["form.description.label"] }),
       /* @__PURE__ */ jsx9(
@@ -3677,6 +3691,16 @@ function Form({
       /* @__PURE__ */ jsx9("button", { type: "button", class: "btn", onClick: onCancel, disabled: submitting, children: strings["form.cancel"] }),
       /* @__PURE__ */ jsx9("button", { type: "submit", class: "btn btn--primary", disabled: submitting, children: submitLabel })
     ] }),
+    metaFeedbackEnabled && /* @__PURE__ */ jsx9(
+      "button",
+      {
+        type: "button",
+        class: "meta-toggle",
+        onClick: () => setMetaMode(!metaMode),
+        disabled: submitting,
+        children: metaMode ? strings["form.meta.cancel"] : strings["form.meta.action"]
+      }
+    ),
     annotatingIndex !== null && shots[annotatingIndex] && /* @__PURE__ */ jsx9(
       Annotator,
       {
@@ -4540,6 +4564,12 @@ var WIDGET_STYLES = `
 /* REQ-A7: quiet transparency line under the form. */
 .capture-notice { color: var(--mfb-muted, #6b7280); font-size: 11px; line-height: 1.4; margin-top: 6px; }
 
+/* Meta-feedback: footer escape hatch + active-mode badge. Deliberately as
+   quiet as the capture notice \u2014 never competes with the host's own flow. */
+.meta-toggle { background: none; border: none; padding: 0; margin-top: 10px; color: var(--mfb-muted, #6b7280); font-size: 11px; text-decoration: underline; cursor: pointer; align-self: flex-start; }
+.meta-toggle:hover { color: var(--mfb-text, #111827); }
+.meta-badge { display: inline-block; margin: 2px 0 6px; padding: 2px 8px; border-radius: 999px; background: var(--mfb-accent-soft, #eef2ff); color: var(--mfb-accent, #4f46e5); font-size: 11px; font-weight: 600; }
+
 /* #85: inline "#NN" report reference rendered as a link (a button for a11y). */
 .seq-link {
   display: inline;
@@ -6323,8 +6353,7 @@ function mountWidget(options) {
           });
         }, 1200);
       } catch (err) {
-        if (typeof console !== "undefined")
-          console.warn("[mhosaic] submit:", err);
+        if (typeof console !== "undefined") console.warn("[mhosaic] submit:", err);
         rerender({
           ...currentState,
           status: "error",
@@ -6358,9 +6387,7 @@ function mountWidget(options) {
       enabled: pageActivityEnabled
     });
     const fabLabel = pageSignal.open === 1 ? options.strings["page.badge.aria.one"] : pageSignal.open > 0 ? options.strings["page.badge.aria"].replace("{n}", String(pageSignal.open)) : options.strings["fab.label"];
-    const [visibilityAllowed, setVisibilityAllowed] = useState10(
-      !options.requiresVisibilityCheck
-    );
+    const [visibilityAllowed, setVisibilityAllowed] = useState10(!options.requiresVisibilityCheck);
     useEffect10(() => {
       if (!options.requiresVisibilityCheck) {
         setVisibilityAllowed(true);
@@ -6564,6 +6591,9 @@ function mountWidget(options) {
                   },
                   onDirtyChange: (d) => {
                     formDirty = d;
+                  },
+                  ...options.metaFeedbackEnabled !== void 0 && {
+                    metaFeedbackEnabled: options.metaFeedbackEnabled
                   }
                 }
               )
@@ -6607,8 +6637,12 @@ function mountWidget(options) {
                 api: options.api,
                 externalId,
                 strings: options.strings,
-                ...options.getCurrentPage !== void 0 && { getCurrentPage: options.getCurrentPage },
-                ...state.boardSelectId !== void 0 && { initialSelectedId: state.boardSelectId }
+                ...options.getCurrentPage !== void 0 && {
+                  getCurrentPage: options.getCurrentPage
+                },
+                ...state.boardSelectId !== void 0 && {
+                  initialSelectedId: state.boardSelectId
+                }
               }
             )
           ]
@@ -6623,9 +6657,7 @@ function mountWidget(options) {
     if (!api || !externalId || !ref) return;
     const seq = /^\d+$/.test(ref) ? parseInt(ref, 10) : null;
     const resolve = seq !== null ? api.getReportBySeq(seq, externalId) : api.getReport(ref, externalId);
-    void resolve.then(
-      (r) => rerender({ ...currentState, open: true, tab: "mine", selectedReportId: r.id })
-    ).catch(() => {
+    void resolve.then((r) => rerender({ ...currentState, open: true, tab: "mine", selectedReportId: r.id })).catch(() => {
     });
   }
   if (options.deepLinkParam !== false) {
@@ -6664,10 +6696,7 @@ function defaultQaPosition() {
 function createFeedback(config) {
   const env = config.env ?? "prod";
   const locale = config.locale ?? (typeof navigator !== "undefined" ? navigator.language : void 0);
-  const strings = resolveStrings(
-    config.translations ?? {},
-    locale !== void 0 ? { locale } : {}
-  );
+  const strings = resolveStrings(config.translations ?? {}, locale !== void 0 ? { locale } : {});
   const capture = installCapture({
     ...config.sanitizeUrl !== void 0 && { sanitizeUrl: config.sanitizeUrl }
   });
@@ -6722,14 +6751,15 @@ function createFeedback(config) {
       capture_method: captureMethod,
       technical_context
     };
-    if ("0.36.0") {
-      payload.widget_version = "0.36.0";
+    if ("0.37.0") {
+      payload.widget_version = "0.37.0";
     }
     if (manualScreenshots?.length) {
       payload.screenshots = manualScreenshots;
       payload.screenshot = manualScreenshots[0];
     }
     if (values.synthetic) payload.synthetic = true;
+    if (values.meta) payload.meta = true;
     const pagePath = currentPagePath(config);
     if (pagePath) payload.page_path = pagePath;
     if (user?.id !== void 0 && user.id !== null && user.id !== "") {
@@ -6779,12 +6809,15 @@ function createFeedback(config) {
     ...config.openToCurrentPageFeedback !== void 0 && {
       openToCurrentPageFeedback: config.openToCurrentPageFeedback
     },
+    ...config.metaFeedbackEnabled !== void 0 && {
+      metaFeedbackEnabled: config.metaFeedbackEnabled
+    },
     ...config.showPageActivity !== void 0 && {
       showPageActivity: config.showPageActivity
     }
   };
   const handle = mountWidget(mountOptions);
-  if (config.openToCurrentPageFeedback === void 0 && config.showFAB !== false) {
+  if ((config.openToCurrentPageFeedback === void 0 || config.metaFeedbackEnabled === void 0) && config.showFAB !== false) {
     const behaviorFetch = config.fetchImpl ?? globalThis.fetch;
     void (async () => {
       try {
@@ -6797,6 +6830,10 @@ function createFeedback(config) {
         if (typeof v === "boolean" && mountOptions.openToCurrentPageFeedback === void 0) {
           mountOptions.openToCurrentPageFeedback = v;
         }
+        const meta = m?.config?.behavior?.metaFeedbackEnabled;
+        if (typeof meta === "boolean" && mountOptions.metaFeedbackEnabled === void 0) {
+          mountOptions.metaFeedbackEnabled = meta;
+        }
       } catch {
       }
     })();
@@ -6867,4 +6904,4 @@ function createFeedback(config) {
 export {
   createFeedback
 };
-//# sourceMappingURL=chunk-T36VC7TZ.mjs.map
+//# sourceMappingURL=chunk-C3ILJCVI.mjs.map