@mindbowser_inc/ui-feedback-plugin 0.1.0 → 0.3.0

package/README.md

@@ -8,9 +8,7 @@ A drop-in floating widget for collecting annotated UI feedback on web prototypes
 - Full-page screenshots with annotations
 - Comment threads with replies
 - Open / Resolved filter
-- Real-time sync across tabs
-- Firebase **or** Supabase backend
-- S3 screenshot storage via a backend proxy
+- Three fully independent backend options — no lock-in
 
 ---
 
@@ -22,140 +20,412 @@ npm install @mindbowser_inc/ui-feedback-plugin
 
 ---
 
-## Quick start
+## Backends
 
-### With Firebase
+Choose **one** backend. They are fully independent — switch any time by changing the `backend` config.
+
+| Backend | Database | Screenshots | Real-time |
+|---|---|---|---|
+| **Firebase** | Firestore | Firebase Storage | Yes (onSnapshot) |
+| **Supabase** | Postgres | Supabase Storage | Yes (Realtime) |
+| **AWS** | JSON files in S3 | S3 | Polling (5 s default) |
+
+---
+
+## Firebase
+
+Firestore stores comments and replies. Firebase Storage holds screenshots. No backend required — Firebase keys are public identifiers, secured by Security Rules.
+
+### Quick start
 
 ```js
 import { initFeedbackPlugin } from '@mindbowser_inc/ui-feedback-plugin'
 
 initFeedbackPlugin({
-  database: {
-    provider: 'firebase',
-    apiKey: process.env.FIREBASE_API_KEY,
-    authDomain: process.env.FIREBASE_AUTH_DOMAIN,
-    projectId: process.env.FIREBASE_PROJECT_ID,
-    storageBucket: process.env.FIREBASE_STORAGE_BUCKET,
-    messagingSenderId: process.env.FIREBASE_MESSAGING_SENDER_ID,
-    appId: process.env.FIREBASE_APP_ID,
+  backend: {
+    provider:          'firebase',
+    apiKey:            'AIzaSy...',
+    authDomain:        'your-project.firebaseapp.com',
+    projectId:         'your-project',
+    storageBucket:     'your-project.appspot.com',
+    messagingSenderId: '123456789',
+    appId:             '1:123456789:web:abc123',
   },
   projectKey: 'my-project',
 })
 ```
 
-> The Firebase API key is a **public identifier**, not a secret. Secure your data with [Firebase Security Rules](https://firebase.google.com/docs/rules).
+> The Firebase `apiKey` is a **public identifier**, not a secret. Secure your data with [Firebase Security Rules](https://firebase.google.com/docs/rules).
+
+### Firebase console setup
+
+1. Go to [console.firebase.google.com](https://console.firebase.google.com) and create a project.
+2. **Firestore** → Create database → Start in test mode (then lock it down with rules below).
+3. **Storage** → Get started → set rules below.
+4. **Project Settings** → Your apps → Add a web app → copy the config values above.
+
+### Recommended Security Rules
+
+**Firestore** (`firestore.rules`):
+```
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    match /ufp_comments/{doc} {
+      allow read, write: if true;  // Replace with auth checks for production
+    }
+    match /ufp_replies/{doc} {
+      allow read, write: if true;
+    }
+  }
+}
+```
+
+**Storage** (`storage.rules`):
+```
+rules_version = '2';
+service firebase.storage {
+  match /b/{bucket}/o {
+    match /ufp/{allPaths=**} {
+      allow read, write: if true;  // Replace with auth checks for production
+    }
+  }
+}
+```
+
+---
+
+## Supabase
+
+Postgres stores comments and replies. Supabase Storage holds screenshots. No backend required — the `anonKey` is a public key secured by Row Level Security.
 
-### With Supabase
+### Quick start
 
 ```js
 import { initFeedbackPlugin } from '@mindbowser_inc/ui-feedback-plugin'
 
 initFeedbackPlugin({
-  database: {
+  backend: {
     provider: 'supabase',
-    url: process.env.SUPABASE_URL,
-    anonKey: process.env.SUPABASE_ANON_KEY,
+    url:      'https://xxxx.supabase.co',
+    anonKey:  'eyJhbGci...',
   },
   projectKey: 'my-project',
 })
 ```
 
-> The Supabase `anonKey` is a **public key by design**. Secure your data with [Row Level Security (RLS)](https://supabase.com/docs/guides/auth/row-level-security) policies.
+> The Supabase `anonKey` is a **public key by design**. Secure your data with [Row Level Security (RLS)](https://supabase.com/docs/guides/auth/row-level-security).
+
+### Supabase setup
 
-**Supabase setup** — run this SQL in your Supabase SQL editor:
+1. Create a project at [supabase.com](https://supabase.com).
+2. Go to **SQL Editor** and run the SQL below.
+3. Go to **Storage** → New bucket → name it `ufp-screenshots` → set it to **Public**.
+4. Run the storage policy SQL below.
+5. Find your URL and anon key in **Project Settings → API**.
 
+**Database SQL** (run once in SQL Editor):
 ```sql
 create table if not exists ufp_comments (
-  id uuid primary key default gen_random_uuid(),
-  page_url text not null,
-  project_key text not null default 'default',
-  author_name text not null,
-  text text not null,
-  screenshot_url text default '',
-  annotation jsonb not null default '{}',
-  resolved boolean default false,
-  created_at bigint not null
+  id           uuid    primary key default gen_random_uuid(),
+  page_url     text    not null,
+  project_key  text    not null default 'default',
+  author_name  text    not null,
+  text         text    not null,
+  screenshot_url text  default '',
+  annotation   jsonb   not null default '{}',
+  resolved     boolean default false,
+  created_at   bigint  not null
 );
 
 create table if not exists ufp_replies (
-  id uuid primary key default gen_random_uuid(),
-  comment_id uuid not null references ufp_comments(id) on delete cascade,
+  id          uuid primary key default gen_random_uuid(),
+  comment_id  uuid not null references ufp_comments(id) on delete cascade,
   author_name text not null,
-  text text not null,
-  created_at bigint not null
+  text        text not null,
+  created_at  bigint not null
 );
 
+-- Enable Row Level Security
 alter table ufp_comments enable row level security;
-alter table ufp_replies enable row level security;
+alter table ufp_replies   enable row level security;
+
+-- Allow all operations (restrict per your auth strategy in production)
 create policy "ufp_comments_all" on ufp_comments for all using (true) with check (true);
-create policy "ufp_replies_all" on ufp_replies for all using (true) with check (true);
+create policy "ufp_replies_all"  on ufp_replies  for all using (true) with check (true);
 
+-- Grant table access to the anon role (RLS policies alone are not enough)
 grant select, insert, update, delete on ufp_comments to anon;
-grant select, insert, update, delete on ufp_replies to anon;
+grant select, insert, update, delete on ufp_replies  to anon;
 
+-- Enable real-time for comments
 alter publication supabase_realtime add table ufp_comments;
 ```
 
-Then create a **public** Storage bucket named `ufp-screenshots` and add these policies:
-
+**Storage policy SQL** (run after creating the `ufp-screenshots` bucket):
 ```sql
-create policy "ufp_storage_insert" on storage.objects for insert to anon with check (bucket_id = 'ufp-screenshots');
-create policy "ufp_storage_select" on storage.objects for select to anon using (bucket_id = 'ufp-screenshots');
-create policy "ufp_storage_update" on storage.objects for update to anon using (bucket_id = 'ufp-screenshots');
+create policy "ufp_storage_insert" on storage.objects
+  for insert to anon with check (bucket_id = 'ufp-screenshots');
+
+create policy "ufp_storage_select" on storage.objects
+  for select to anon using (bucket_id = 'ufp-screenshots');
+
+create policy "ufp_storage_update" on storage.objects
+  for update to anon using (bucket_id = 'ufp-screenshots');
 ```
 
 ---
 
-## S3 screenshot storage
+## AWS (Cognito Identity Pool)
+
+Everything — comments, replies, and screenshots — is stored directly in S3 as JSON and PNG files. No backend server required. No Firebase or Supabase needed.
 
-Store screenshots in S3 while keeping your database on Firebase or Supabase. **AWS credentials must never appear in frontend code** — provide a backend proxy endpoint instead.
+The browser obtains **temporary, rotating credentials** from a Cognito Identity Pool. No long-lived AWS keys ever touch the browser. The IAM role follows the least-privilege principle (file-type restrictions, size limits, no delete permission).
+
+### Quick start
 
 ```js
+import { initFeedbackPlugin } from '@mindbowser_inc/ui-feedback-plugin'
+
 initFeedbackPlugin({
-  database: {
-    provider: 'supabase',
-    url: process.env.SUPABASE_URL,
-    anonKey: process.env.SUPABASE_ANON_KEY,
+  backend: {
+    provider:       'aws',
+    region:         'us-east-1',
+    bucket:         'your-bucket-name',
+    identityPoolId: 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
+    pollInterval:   5000,  // optional, default 5000 ms
   },
-  screenshots: {
-    provider: 's3',
-    uploadEndpoint: 'https://your-api.com/upload-screenshot',
-    headers: { Authorization: 'Bearer your-internal-token' },
+  projectKey: 'my-project',
+})
+```
+
+### AWS setup (step by step)
+
+#### Step 1 — Create an S3 bucket
+
+1. Open the [S3 console](https://s3.console.aws.amazon.com/s3).
+2. Click **Create bucket**.
+3. Choose a name and region (remember these — you'll need them in the plugin config).
+4. Leave **Block all public access** ON (you'll open just the screenshots prefix below).
+5. Enable **Versioning** (optional, but useful for recovery).
+6. Create the bucket.
+
+#### Step 2 — Configure CORS
+
+Go to your bucket → **Permissions** → **Cross-origin resource sharing (CORS)** → Edit, and paste:
+
+```json
+[
+  {
+    "AllowedOrigins": ["https://your-domain.com"],
+    "AllowedMethods": ["GET", "PUT", "HEAD"],
+    "AllowedHeaders": ["*"],
+    "ExposeHeaders": ["ETag"],
+    "MaxAgeSeconds": 3000
+  }
+]
+```
+
+> Use `"*"` for `AllowedOrigins` during local development. Restrict to real domains in production.
+
+#### Step 3 — Bucket policy (public read for screenshots only)
+
+Go to bucket → **Permissions** → **Bucket policy** → Edit, and paste (replace `YOUR_BUCKET`):
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "PublicReadScreenshots",
+      "Effect": "Allow",
+      "Principal": "*",
+      "Action": "s3:GetObject",
+      "Resource": "arn:aws:s3:::YOUR_BUCKET/ufp/*/screenshots/*"
+    }
+  ]
+}
+```
+
+This makes only screenshots publicly readable so they can display in `<img>` tags. Comments and reply JSON files remain private.
+
+#### Step 4 — Create an IAM policy
+
+Go to **IAM** → **Policies** → **Create policy** → JSON tab, and paste (replace `YOUR_BUCKET`):
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "WriteJsonFiles",
+      "Effect": "Allow",
+      "Action": "s3:PutObject",
+      "Resource": "arn:aws:s3:::YOUR_BUCKET/ufp/*",
+      "Condition": {
+        "StringLike": {
+          "s3:RequestObjectKey": [
+            "ufp/*/comments/*.json",
+            "ufp/replies/*/*.json",
+            "ufp/_index/*.json"
+          ]
+        },
+        "NumericLessThanEquals": {
+          "s3:content-length": "51200"
+        }
+      }
+    },
+    {
+      "Sid": "WriteScreenshots",
+      "Effect": "Allow",
+      "Action": "s3:PutObject",
+      "Resource": "arn:aws:s3:::YOUR_BUCKET/ufp/*",
+      "Condition": {
+        "StringLike": {
+          "s3:RequestObjectKey": "ufp/*/screenshots/*.png"
+        },
+        "NumericLessThanEquals": {
+          "s3:content-length": "3145728"
+        }
+      }
+    },
+    {
+      "Sid": "ReadFiles",
+      "Effect": "Allow",
+      "Action": "s3:GetObject",
+      "Resource": "arn:aws:s3:::YOUR_BUCKET/ufp/*"
+    },
+    {
+      "Sid": "ListFiles",
+      "Effect": "Allow",
+      "Action": "s3:ListBucket",
+      "Resource": "arn:aws:s3:::YOUR_BUCKET",
+      "Condition": {
+        "StringLike": {
+          "s3:prefix": "ufp/*"
+        }
+      }
+    }
+  ]
+}
+```
+
+What this enforces:
+- Only `.json` files under the correct paths can be written (no arbitrary uploads)
+- JSON files are capped at **50 KB** per file
+- Screenshot `.png` files are capped at **3 MB** per file
+- All access is scoped to the `ufp/` prefix
+- **`s3:DeleteObject` is absent** — the browser can never delete files (soft delete is used instead)
+
+Name the policy (e.g. `ufp-plugin-policy`) and save it.
+
+#### Step 5 — Create an IAM role
+
+1. Go to **IAM** → **Roles** → **Create role**.
+2. Trusted entity type: **Web identity**.
+3. Identity provider: **Amazon Cognito**.
+4. Leave the audience field blank for now (Cognito will configure it).
+5. Click **Next**, attach the policy you created in Step 4.
+6. Name the role (e.g. `ufp-plugin-cognito-unauth`) and create it.
+
+#### Step 6 — Create a Cognito Identity Pool
+
+1. Go to **Cognito** → **Identity pools** → **Create identity pool**.
+2. **User access**: check **Guest access** (unauthenticated identities).
+3. **Guest role**: select **Use an existing IAM role** → choose the role from Step 5.
+4. Give the pool a name (e.g. `ufp-plugin-pool`) and create it.
+5. On the pool detail page, copy the **Identity pool ID** — it looks like `us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`.
+
+#### Step 7 — Configure the plugin
+
+```js
+initFeedbackPlugin({
+  backend: {
+    provider:       'aws',
+    region:         'us-east-1',          // same region as your bucket and Identity Pool
+    bucket:         'your-bucket-name',
+    identityPoolId: 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
   },
   projectKey: 'my-project',
 })
 ```
 
-Your endpoint receives `POST { commentId: string, imageData: string }` (base64) and must return `{ url: string }`. See the [minimal Node/Express example](src/adapters/s3.ts).
+### How data is stored
+
+```
+your-bucket/
+  ufp/
+    {projectKey}/
+      {sha256(pageUrl)[0..15]}/
+        comments/
+          {commentId}.json     ← comment data
+        screenshots/
+          {commentId}.png      ← publicly readable
+    replies/
+      {commentId}/
+        {replyId}.json         ← reply data
+    _index/
+      {commentId}.json         ← { "p": projectKey, "h": pageHash }
+```
+
+### Limitations
+
+| Limitation | Detail |
+|---|---|
+| No real-time | New comments from other users appear after the next poll (default 5 s) |
+| Soft delete only | Deleted comments are hidden but remain in S3 (good for audit trail) |
+| N+1 reads | Loading comments = 1 LIST + N GET requests (fine for typical 10–30 comments) |
+| CORS required | Your bucket must whitelist the domains the plugin runs on |
 
 ---
 
-## Configuration
+## Configuration reference
 
 ```ts
 initFeedbackPlugin({
-  database: FirebaseProviderConfig | SupabaseProviderConfig   // required
-  screenshots?: 'firebase' | 'supabase' | S3ScreenshotConfig // optional, defaults to same as database
-  projectKey?: string        // namespace comments per project (default: 'default')
-  position?: 'bottom-right' | 'bottom-left' | 'top-right' | 'top-left'  // default: 'bottom-right'
-  theme?: { primaryColor?: string }  // default: '#6366f1'
+  backend:     FirebaseProviderConfig | SupabaseProviderConfig | AWSProviderConfig  // required
+  projectKey?: string           // namespace comments per project (default: 'default')
+  position?:  'bottom-right' | 'bottom-left' | 'top-right' | 'top-left'
+  theme?:     { primaryColor?: string }   // default: '#6366f1'
 })
 ```
 
 ---
 
-## Usage in plain HTML (UMD)
+## Plain HTML / CDN (UMD)
+
+No build step needed — load directly from a CDN:
 
 ```html
 <script src="https://unpkg.com/@mindbowser_inc/ui-feedback-plugin/dist/ui-feedback-plugin.umd.js"></script>
 <script>
   UIFeedbackPlugin.initFeedbackPlugin({
-    database: { provider: 'supabase', url: '...', anonKey: '...' },
+    backend: {
+      provider: 'supabase',
+      url:      'https://xxxx.supabase.co',
+      anonKey:  'eyJhbGci...',
+    },
     projectKey: 'my-project',
   })
 </script>
 ```
 
+Replace the `backend` block with any of the three provider configs shown above.
+
+---
+
+## Local development
+
+```bash
+git clone https://github.com/vishmindbowser/ui-feedback-plugin.git
+cd ui-feedback-plugin
+npm install
+cp .env.local.example .env.local   # fill in your credentials
+npm run dev
+```
+
+Set `VITE_PROVIDER` in `.env.local` to `supabase`, `firebase`, or `aws` to switch backends.
+
 ---
 
 ## License

package/dist/aws-CkWYvUhs.mjs

@@ -0,0 +1,134 @@
+var h = Object.defineProperty;
+var u = (c, t, e) => t in c ? h(c, t, { enumerable: !0, configurable: !0, writable: !0, value: e }) : c[t] = e;
+var l = (c, t, e) => u(c, typeof t != "symbol" ? t + "" : t, e);
+class g {
+  constructor(t) {
+    l(this, "cfg");
+    l(this, "_s3", null);
+    this.cfg = t;
+  }
+  async s3() {
+    if (this._s3) return this._s3;
+    const [{ S3Client: t }, { fromCognitoIdentityPool: e }] = await Promise.all([
+      import("./index-B-1NC_TX.mjs").then((s) => s.j),
+      import("./index-ClYqXfVs.mjs")
+    ]);
+    return this._s3 = new t({
+      region: this.cfg.region,
+      credentials: e({
+        identityPoolId: this.cfg.identityPoolId,
+        clientConfig: { region: this.cfg.region }
+      })
+    }), this._s3;
+  }
+  async pageHash(t) {
+    const e = new TextEncoder().encode(t), s = await crypto.subtle.digest("SHA-256", e);
+    return Array.from(new Uint8Array(s)).map((n) => n.toString(16).padStart(2, "0")).join("").slice(0, 16);
+  }
+  async put(t, e, s) {
+    const { PutObjectCommand: n } = await import("./index-B-1NC_TX.mjs").then((i) => i.j);
+    await (await this.s3()).send(new n({
+      Bucket: this.cfg.bucket,
+      Key: t,
+      Body: e,
+      ContentType: s
+    }));
+  }
+  async getJson(t) {
+    const { GetObjectCommand: e } = await import("./index-B-1NC_TX.mjs").then((i) => i.j), o = await (await (await this.s3()).send(new e({ Bucket: this.cfg.bucket, Key: t }))).Body.transformToString();
+    return JSON.parse(o);
+  }
+  async listKeys(t) {
+    const { ListObjectsV2Command: e } = await import("./index-B-1NC_TX.mjs").then((i) => i.j), s = await this.s3(), n = [];
+    let o;
+    do {
+      const i = await s.send(new e({
+        Bucket: this.cfg.bucket,
+        Prefix: t,
+        ContinuationToken: o
+      }));
+      for (const a of i.Contents ?? [])
+        a.Key && n.push(a.Key);
+      o = i.NextContinuationToken;
+    } while (o);
+    return n;
+  }
+  indexKey(t) {
+    return `ufp/_index/${t}.json`;
+  }
+  async lookupComment(t) {
+    const { p: e, h: s } = await this.getJson(this.indexKey(t));
+    return { key: `ufp/${e}/${s}/comments/${t}.json` };
+  }
+  async addComment(t) {
+    const e = await this.pageHash(t.pageUrl), s = crypto.randomUUID();
+    return await Promise.all([
+      this.put(
+        `ufp/${t.projectKey}/${e}/comments/${s}.json`,
+        JSON.stringify({ id: s, ...t }),
+        "application/json"
+      ),
+      this.put(
+        this.indexKey(s),
+        JSON.stringify({ p: t.projectKey, h: e }),
+        "application/json"
+      )
+    ]), s;
+  }
+  async getComments(t, e) {
+    const s = await this.pageHash(t), n = await this.listKeys(`ufp/${e}/${s}/comments/`);
+    return (await Promise.all(
+      n.map(
+        (i) => this.getJson(i).catch(() => null)
+      )
+    )).filter((i) => i !== null && !i.deleted).sort((i, a) => a.createdAt - i.createdAt);
+  }
+  async updateComment(t, e) {
+    const { key: s } = await this.lookupComment(t), n = await this.getJson(s);
+    await this.put(s, JSON.stringify({ ...n, ...e }), "application/json");
+  }
+  async deleteComment(t) {
+    const { key: e } = await this.lookupComment(t), s = await this.getJson(e);
+    await this.put(e, JSON.stringify({ ...s, deleted: !0 }), "application/json");
+  }
+  async addReply(t) {
+    const e = crypto.randomUUID();
+    return await this.put(
+      `ufp/replies/${t.commentId}/${e}.json`,
+      JSON.stringify({ id: e, ...t }),
+      "application/json"
+    ), e;
+  }
+  async getReplies(t) {
+    const e = await this.listKeys(`ufp/replies/${t}/`);
+    return (await Promise.all(
+      e.map((n) => this.getJson(n).catch(() => null))
+    )).filter((n) => n !== null).sort((n, o) => n.createdAt - o.createdAt);
+  }
+  subscribeToComments(t, e, s) {
+    let n = !0;
+    const o = this.cfg.pollInterval ?? 5e3, i = async () => {
+      if (n) {
+        try {
+          const a = await this.getComments(t, e);
+          n && s(a);
+        } catch (a) {
+          console.error("[ui-feedback-plugin] AWS poll error:", a);
+        }
+        n && setTimeout(i, o);
+      }
+    };
+    return i(), () => {
+      n = !1;
+    };
+  }
+  async uploadScreenshot(t, e) {
+    const { p: s, h: n } = await this.getJson(this.indexKey(t)), o = `ufp/${s}/${n}/screenshots/${t}.png`, i = e.split(",")[1], a = atob(i), p = new Uint8Array(a.length);
+    for (let r = 0; r < a.length; r++) p[r] = a.charCodeAt(r);
+    return await this.put(o, p, "image/png"), `https://${this.cfg.bucket}.s3.${this.cfg.region}.amazonaws.com/${o}`;
+  }
+}
+export {
+  g as AWSAdapter
+};
+//# sourceMappingURL=aws-CkWYvUhs.mjs.map

package/dist/aws-CkWYvUhs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-CkWYvUhs.mjs","sources":["../src/adapters/aws.ts"],"sourcesContent":["// AWS Cognito Identity Pool adapter — browser talks directly to S3, no backend required.\n// Requires @aws-sdk/client-s3 and @aws-sdk/credential-providers (both in devDependencies).\n//\n// ── AWS SETUP ────────────────────────────────────────────────────────────────────\n//\n// 1. CREATE S3 BUCKET\n//    - Keep \"Block all public access\" ON (we'll add a narrow public policy for screenshots).\n//    - Enable versioning (optional, helpful for recovery).\n//\n// 2. CONFIGURE CORS (required for browser access)\n//    Go to Bucket → Permissions → CORS and paste:\n//    [\n//      {\n//        \"AllowedOrigins\": [\"https://your-domain.com\"],\n//        \"AllowedMethods\": [\"GET\", \"PUT\", \"HEAD\"],\n//        \"AllowedHeaders\": [\"*\"],\n//        \"ExposeHeaders\": [\"ETag\"],\n//        \"MaxAgeSeconds\": 3000\n//      }\n//    ]\n//    Use \"*\" for AllowedOrigins during local dev, restrict to real domains in production.\n//\n// 3. ADD BUCKET POLICY (public read for screenshots only)\n//    Go to Bucket → Permissions → Bucket policy and paste (replace YOUR_BUCKET):\n//    {\n//      \"Version\": \"2012-10-17\",\n//      \"Statement\": [{\n//        \"Sid\": \"PublicReadScreenshots\",\n//        \"Effect\": \"Allow\",\n//        \"Principal\": \"*\",\n//        \"Action\": \"s3:GetObject\",\n//        \"Resource\": \"arn:aws:s3:::YOUR_BUCKET/ufp/*/screenshots/*\"\n//      }]\n//    }\n//    Comments and replies remain private (only accessible via Cognito credentials).\n//\n// 4. CREATE IAM POLICY (least privilege — see README for full JSON)\n//    Allows:\n//      - s3:PutObject on ufp/*/comments/*.json   (max 50 KB)\n//      - s3:PutObject on ufp/replies/*/*.json    (max 50 KB)\n//      - s3:PutObject on ufp/_index/*.json       (max 50 KB)\n//      - s3:PutObject on ufp/*/screenshots/*.png (max 3 MB)\n//      - s3:GetObject on ufp/*\n//      - s3:ListBucket on the bucket with prefix ufp/*\n//    NO s3:DeleteObject — soft delete is used instead.\n//\n// 5. CREATE IAM ROLE\n//    - Trusted entity: Web Identity\n//    - Identity provider: Amazon Cognito\n//    - Attach the policy from step 4\n//\n// 6. CREATE COGNITO IDENTITY POOL\n//    - Enable unauthenticated identities\n//    - Unauthenticated role: the IAM role from step 5\n//    - Authenticated role: none (or a different role)\n//    - Copy the Identity Pool ID (format: us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)\n//\n// 7. CONFIGURE THE PLUGIN\n//    initFeedbackPlugin({\n//      backend: {\n//        provider: 'aws',\n//        region: 'us-east-1',\n//        bucket: 'your-bucket-name',\n//        identityPoolId: 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',\n//      },\n//      projectKey: 'my-project',\n//    })\n//\n// ── DATA LAYOUT IN S3 ────────────────────────────────────────────────────────────\n//\n//   ufp/{projectKey}/{pageHash}/comments/{commentId}.json\n//   ufp/{projectKey}/{pageHash}/screenshots/{commentId}.png  ← publicly readable\n//   ufp/replies/{commentId}/{replyId}.json\n//   ufp/_index/{commentId}.json  ← { \"p\": projectKey, \"h\": pageHash }\n//\n// ── SOFT DELETE ──────────────────────────────────────────────────────────────────\n//   deleteComment overwrites the comment JSON with { ...comment, deleted: true }.\n//   The file stays in S3 but is filtered out on read. No s3:DeleteObject needed.\n//\n// ── REAL-TIME ────────────────────────────────────────────────────────────────────\n//   S3 has no push. subscribeToComments polls on a configurable interval (default 5s).\n\nimport type { FeedbackComment, Reply, DatabaseAdapter, ScreenshotAdapter, AWSProviderConfig } from '../core/types'\nimport type { S3Client as S3ClientType } from '@aws-sdk/client-s3'\n\nexport class AWSAdapter implements DatabaseAdapter, ScreenshotAdapter {\n  private cfg: AWSProviderConfig\n  private _s3: S3ClientType | null = null\n\n  constructor(config: AWSProviderConfig) {\n    this.cfg = config\n  }\n\n  private async s3(): Promise<S3ClientType> {\n    if (this._s3) return this._s3\n    const [{ S3Client }, { fromCognitoIdentityPool }] = await Promise.all([\n      import('@aws-sdk/client-s3'),\n      import('@aws-sdk/credential-provider-cognito-identity'),\n    ])\n    this._s3 = new S3Client({\n      region: this.cfg.region,\n      credentials: fromCognitoIdentityPool({\n        identityPoolId: this.cfg.identityPoolId,\n        clientConfig: { region: this.cfg.region },\n      }),\n    })\n    return this._s3\n  }\n\n  private async pageHash(url: string): Promise<string> {\n    const data = new TextEncoder().encode(url)\n    const buf = await crypto.subtle.digest('SHA-256', data)\n    return Array.from(new Uint8Array(buf))\n      .map(b => b.toString(16).padStart(2, '0'))\n      .join('')\n      .slice(0, 16)\n  }\n\n  private async put(key: string, body: string | Uint8Array, contentType: string): Promise<void> {\n    const { PutObjectCommand } = await import('@aws-sdk/client-s3')\n    const client = await this.s3()\n    await client.send(new PutObjectCommand({\n      Bucket: this.cfg.bucket,\n      Key: key,\n      Body: body,\n      ContentType: contentType,\n    }))\n  }\n\n  private async getJson<T>(key: string): Promise<T> {\n    const { GetObjectCommand } = await import('@aws-sdk/client-s3')\n    const client = await this.s3()\n    const res = await client.send(new GetObjectCommand({ Bucket: this.cfg.bucket, Key: key }))\n    const text = await res.Body!.transformToString()\n    return JSON.parse(text) as T\n  }\n\n  private async listKeys(prefix: string): Promise<string[]> {\n    const { ListObjectsV2Command } = await import('@aws-sdk/client-s3')\n    const client = await this.s3()\n    const keys: string[] = []\n    let token: string | undefined\n    do {\n      const res = await client.send(new ListObjectsV2Command({\n        Bucket: this.cfg.bucket,\n        Prefix: prefix,\n        ContinuationToken: token,\n      }))\n      for (const obj of res.Contents ?? []) {\n        if (obj.Key) keys.push(obj.Key)\n      }\n      token = res.NextContinuationToken\n    } while (token)\n    return keys\n  }\n\n  private indexKey(id: string) {\n    return `ufp/_index/${id}.json`\n  }\n\n  private async lookupComment(id: string): Promise<{ key: string }> {\n    const { p, h } = await this.getJson<{ p: string; h: string }>(this.indexKey(id))\n    return { key: `ufp/${p}/${h}/comments/${id}.json` }\n  }\n\n  async addComment(comment: Omit<FeedbackComment, 'id'>): Promise<string> {\n    const hash = await this.pageHash(comment.pageUrl)\n    const id = crypto.randomUUID()\n    await Promise.all([\n      this.put(\n        `ufp/${comment.projectKey}/${hash}/comments/${id}.json`,\n        JSON.stringify({ id, ...comment }),\n        'application/json'\n      ),\n      this.put(\n        this.indexKey(id),\n        JSON.stringify({ p: comment.projectKey, h: hash }),\n        'application/json'\n      ),\n    ])\n    return id\n  }\n\n  async getComments(pageUrl: string, projectKey: string): Promise<FeedbackComment[]> {\n    const hash = await this.pageHash(pageUrl)\n    const keys = await this.listKeys(`ufp/${projectKey}/${hash}/comments/`)\n    const rows = await Promise.all(\n      keys.map(k =>\n        this.getJson<FeedbackComment & { deleted?: boolean }>(k).catch(() => null)\n      )\n    )\n    return rows\n      .filter((r): r is FeedbackComment => r !== null && !r.deleted)\n      .sort((a, b) => b.createdAt - a.createdAt)\n  }\n\n  async updateComment(id: string, data: Partial<FeedbackComment>): Promise<void> {\n    const { key } = await this.lookupComment(id)\n    const existing = await this.getJson<FeedbackComment>(key)\n    await this.put(key, JSON.stringify({ ...existing, ...data }), 'application/json')\n  }\n\n  async deleteComment(id: string): Promise<void> {\n    const { key } = await this.lookupComment(id)\n    const existing = await this.getJson<FeedbackComment>(key)\n    // Soft delete — overwrite with deleted flag. No s3:DeleteObject permission needed.\n    await this.put(key, JSON.stringify({ ...existing, deleted: true }), 'application/json')\n  }\n\n  async addReply(reply: Omit<Reply, 'id'>): Promise<string> {\n    const id = crypto.randomUUID()\n    await this.put(\n      `ufp/replies/${reply.commentId}/${id}.json`,\n      JSON.stringify({ id, ...reply }),\n      'application/json'\n    )\n    return id\n  }\n\n  async getReplies(commentId: string): Promise<Reply[]> {\n    const keys = await this.listKeys(`ufp/replies/${commentId}/`)\n    const rows = await Promise.all(\n      keys.map(k => this.getJson<Reply>(k).catch(() => null))\n    )\n    return rows\n      .filter((r): r is Reply => r !== null)\n      .sort((a, b) => a.createdAt - b.createdAt)\n  }\n\n  subscribeToComments(\n    pageUrl: string,\n    projectKey: string,\n    callback: (comments: FeedbackComment[]) => void\n  ): () => void {\n    let active = true\n    const interval = this.cfg.pollInterval ?? 5000\n\n    const poll = async () => {\n      if (!active) return\n      try {\n        const comments = await this.getComments(pageUrl, projectKey)\n        if (active) callback(comments)\n      } catch (err) {\n        console.error('[ui-feedback-plugin] AWS poll error:', err)\n      }\n      if (active) setTimeout(poll, interval)\n    }\n\n    poll()\n    return () => { active = false }\n  }\n\n  async uploadScreenshot(commentId: string, dataUrl: string): Promise<string> {\n    const { p, h } = await this.getJson<{ p: string; h: string }>(this.indexKey(commentId))\n    const key = `ufp/${p}/${h}/screenshots/${commentId}.png`\n\n    const base64 = dataUrl.split(',')[1]\n    const binary = atob(base64)\n    const bytes = new Uint8Array(binary.length)\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)\n\n    await this.put(key, bytes, 'image/png')\n    return `https://${this.cfg.bucket}.s3.${this.cfg.region}.amazonaws.com/${key}`\n  }\n}\n"],"names":["AWSAdapter","config","__publicField","S3Client","fromCognitoIdentityPool","n","url","data","buf","b","key","body","contentType","PutObjectCommand","GetObjectCommand","text","prefix","ListObjectsV2Command","client","keys","token","res","obj","id","p","h","comment","hash","pageUrl","projectKey","k","r","a","existing","reply","commentId","callback","active","interval","poll","comments","err","dataUrl","base64","binary","bytes","i"],"mappings":";;;AAqFO,MAAMA,EAAyD;AAAA,EAIpE,YAAYC,GAA2B;AAH/B,IAAAC,EAAA;AACA,IAAAA,EAAA,aAA2B;AAGjC,SAAK,MAAMD;AAAA,EACb;AAAA,EAEA,MAAc,KAA4B;AACxC,QAAI,KAAK,IAAK,QAAO,KAAK;AAC1B,UAAM,CAAC,EAAE,UAAAE,KAAY,EAAE,yBAAAC,GAAyB,IAAI,MAAM,QAAQ,IAAI;AAAA,MACpE,OAAO,sBAAoB,EAAA,KAAA,CAAAC,MAAAA,EAAA,CAAA;AAAA,MAC3B,OAAO,sBAA+C;AAAA,IAAA,CACvD;AACD,gBAAK,MAAM,IAAIF,EAAS;AAAA,MACtB,QAAQ,KAAK,IAAI;AAAA,MACjB,aAAaC,EAAwB;AAAA,QACnC,gBAAgB,KAAK,IAAI;AAAA,QACzB,cAAc,EAAE,QAAQ,KAAK,IAAI,OAAA;AAAA,MAAO,CACzC;AAAA,IAAA,CACF,GACM,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,SAASE,GAA8B;AACnD,UAAMC,IAAO,IAAI,cAAc,OAAOD,CAAG,GACnCE,IAAM,MAAM,OAAO,OAAO,OAAO,WAAWD,CAAI;AACtD,WAAO,MAAM,KAAK,IAAI,WAAWC,CAAG,CAAC,EAClC,IAAI,CAAAC,MAAKA,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,EAAE,EACP,MAAM,GAAG,EAAE;AAAA,EAChB;AAAA,EAEA,MAAc,IAAIC,GAAaC,GAA2BC,GAAoC;AAC5F,UAAM,EAAE,kBAAAC,EAAA,IAAqB,MAAM,OAAO,sBAAoB,EAAA,KAAA,CAAAR,MAAAA,EAAA,CAAA;AAE9D,WADe,MAAM,KAAK,GAAA,GACb,KAAK,IAAIQ,EAAiB;AAAA,MACrC,QAAQ,KAAK,IAAI;AAAA,MACjB,KAAKH;AAAA,MACL,MAAMC;AAAA,MACN,aAAaC;AAAA,IAAA,CACd,CAAC;AAAA,EACJ;AAAA,EAEA,MAAc,QAAWF,GAAyB;AAChD,UAAM,EAAE,kBAAAI,EAAA,IAAqB,MAAM,OAAO,sBAAoB,EAAA,KAAA,CAAAT,MAAAA,EAAA,CAAA,GAGxDU,IAAO,OADD,OADG,MAAM,KAAK,GAAA,GACD,KAAK,IAAID,EAAiB,EAAE,QAAQ,KAAK,IAAI,QAAQ,KAAKJ,EAAA,CAAK,CAAC,GAClE,KAAM,kBAAA;AAC7B,WAAO,KAAK,MAAMK,CAAI;AAAA,EACxB;AAAA,EAEA,MAAc,SAASC,GAAmC;AACxD,UAAM,EAAE,sBAAAC,EAAA,IAAyB,MAAM,OAAO,sBAAoB,EAAA,KAAA,CAAAZ,MAAAA,EAAA,CAAA,GAC5Da,IAAS,MAAM,KAAK,GAAA,GACpBC,IAAiB,CAAA;AACvB,QAAIC;AACJ,OAAG;AACD,YAAMC,IAAM,MAAMH,EAAO,KAAK,IAAID,EAAqB;AAAA,QACrD,QAAQ,KAAK,IAAI;AAAA,QACjB,QAAQD;AAAA,QACR,mBAAmBI;AAAA,MAAA,CACpB,CAAC;AACF,iBAAWE,KAAOD,EAAI,YAAY,CAAA;AAChC,QAAIC,EAAI,OAAKH,EAAK,KAAKG,EAAI,GAAG;AAEhC,MAAAF,IAAQC,EAAI;AAAA,IACd,SAASD;AACT,WAAOD;AAAA,EACT;AAAA,EAEQ,SAASI,GAAY;AAC3B,WAAO,cAAcA,CAAE;AAAA,EACzB;AAAA,EAEA,MAAc,cAAcA,GAAsC;AAChE,UAAM,EAAE,GAAAC,GAAG,GAAAC,EAAA,IAAM,MAAM,KAAK,QAAkC,KAAK,SAASF,CAAE,CAAC;AAC/E,WAAO,EAAE,KAAK,OAAOC,CAAC,IAAIC,CAAC,aAAaF,CAAE,QAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,WAAWG,GAAuD;AACtE,UAAMC,IAAO,MAAM,KAAK,SAASD,EAAQ,OAAO,GAC1CH,IAAK,OAAO,WAAA;AAClB,iBAAM,QAAQ,IAAI;AAAA,MAChB,KAAK;AAAA,QACH,OAAOG,EAAQ,UAAU,IAAIC,CAAI,aAAaJ,CAAE;AAAA,QAChD,KAAK,UAAU,EAAE,IAAAA,GAAI,GAAGG,GAAS;AAAA,QACjC;AAAA,MAAA;AAAA,MAEF,KAAK;AAAA,QACH,KAAK,SAASH,CAAE;AAAA,QAChB,KAAK,UAAU,EAAE,GAAGG,EAAQ,YAAY,GAAGC,GAAM;AAAA,QACjD;AAAA,MAAA;AAAA,IACF,CACD,GACMJ;AAAA,EACT;AAAA,EAEA,MAAM,YAAYK,GAAiBC,GAAgD;AACjF,UAAMF,IAAO,MAAM,KAAK,SAASC,CAAO,GAClCT,IAAO,MAAM,KAAK,SAAS,OAAOU,CAAU,IAAIF,CAAI,YAAY;AAMtE,YALa,MAAM,QAAQ;AAAA,MACzBR,EAAK;AAAA,QAAI,OACP,KAAK,QAAiDW,CAAC,EAAE,MAAM,MAAM,IAAI;AAAA,MAAA;AAAA,IAC3E,GAGC,OAAO,CAACC,MAA4BA,MAAM,QAAQ,CAACA,EAAE,OAAO,EAC5D,KAAK,CAACC,GAAGvB,MAAMA,EAAE,YAAYuB,EAAE,SAAS;AAAA,EAC7C;AAAA,EAEA,MAAM,cAAcT,GAAYhB,GAA+C;AAC7E,UAAM,EAAE,KAAAG,EAAA,IAAQ,MAAM,KAAK,cAAca,CAAE,GACrCU,IAAW,MAAM,KAAK,QAAyBvB,CAAG;AACxD,UAAM,KAAK,IAAIA,GAAK,KAAK,UAAU,EAAE,GAAGuB,GAAU,GAAG1B,EAAA,CAAM,GAAG,kBAAkB;AAAA,EAClF;AAAA,EAEA,MAAM,cAAcgB,GAA2B;AAC7C,UAAM,EAAE,KAAAb,EAAA,IAAQ,MAAM,KAAK,cAAca,CAAE,GACrCU,IAAW,MAAM,KAAK,QAAyBvB,CAAG;AAExD,UAAM,KAAK,IAAIA,GAAK,KAAK,UAAU,EAAE,GAAGuB,GAAU,SAAS,GAAA,CAAM,GAAG,kBAAkB;AAAA,EACxF;AAAA,EAEA,MAAM,SAASC,GAA2C;AACxD,UAAMX,IAAK,OAAO,WAAA;AAClB,iBAAM,KAAK;AAAA,MACT,eAAeW,EAAM,SAAS,IAAIX,CAAE;AAAA,MACpC,KAAK,UAAU,EAAE,IAAAA,GAAI,GAAGW,GAAO;AAAA,MAC/B;AAAA,IAAA,GAEKX;AAAA,EACT;AAAA,EAEA,MAAM,WAAWY,GAAqC;AACpD,UAAMhB,IAAO,MAAM,KAAK,SAAS,eAAegB,CAAS,GAAG;AAI5D,YAHa,MAAM,QAAQ;AAAA,MACzBhB,EAAK,IAAI,CAAAW,MAAK,KAAK,QAAeA,CAAC,EAAE,MAAM,MAAM,IAAI,CAAC;AAAA,IAAA,GAGrD,OAAO,CAACC,MAAkBA,MAAM,IAAI,EACpC,KAAK,CAACC,GAAGvB,MAAMuB,EAAE,YAAYvB,EAAE,SAAS;AAAA,EAC7C;AAAA,EAEA,oBACEmB,GACAC,GACAO,GACY;AACZ,QAAIC,IAAS;AACb,UAAMC,IAAW,KAAK,IAAI,gBAAgB,KAEpCC,IAAO,YAAY;AACvB,UAAKF,GACL;AAAA,YAAI;AACF,gBAAMG,IAAW,MAAM,KAAK,YAAYZ,GAASC,CAAU;AAC3D,UAAIQ,OAAiBG,CAAQ;AAAA,QAC/B,SAASC,GAAK;AACZ,kBAAQ,MAAM,wCAAwCA,CAAG;AAAA,QAC3D;AACA,QAAIJ,KAAQ,WAAWE,GAAMD,CAAQ;AAAA;AAAA,IACvC;AAEA,WAAAC,EAAA,GACO,MAAM;AAAE,MAAAF,IAAS;AAAA,IAAM;AAAA,EAChC;AAAA,EAEA,MAAM,iBAAiBF,GAAmBO,GAAkC;AAC1E,UAAM,EAAE,GAAAlB,GAAG,GAAAC,EAAA,IAAM,MAAM,KAAK,QAAkC,KAAK,SAASU,CAAS,CAAC,GAChFzB,IAAM,OAAOc,CAAC,IAAIC,CAAC,gBAAgBU,CAAS,QAE5CQ,IAASD,EAAQ,MAAM,GAAG,EAAE,CAAC,GAC7BE,IAAS,KAAKD,CAAM,GACpBE,IAAQ,IAAI,WAAWD,EAAO,MAAM;AAC1C,aAASE,IAAI,GAAGA,IAAIF,EAAO,QAAQE,IAAK,CAAAD,EAAMC,CAAC,IAAIF,EAAO,WAAWE,CAAC;AAEtE,iBAAM,KAAK,IAAIpC,GAAKmC,GAAO,WAAW,GAC/B,WAAW,KAAK,IAAI,MAAM,OAAO,KAAK,IAAI,MAAM,kBAAkBnC,CAAG;AAAA,EAC9E;AACF;"}