@pixelatlarge/peanut-gallery-relay 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Anna Poirier
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,18 @@
-# Temporary Holding Version
+# @pixelatlarge/peanut-gallery-relay
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A tiny serverless function that turns [Peanut Gallery](https://github.com/PixelAtLarge/peanut-gallery) widget submissions into GitHub issues, so reviewers don't need a GitHub account. It validates the payload, checks the origin and creates the issue with your token. The token never reaches the browser.
+
+```ts
+// api/peanut-gallery.ts (Vercel)
+import { createRelayHandler } from '@pixelatlarge/peanut-gallery-relay';
+
+export default createRelayHandler({
+  githubToken: process.env.PEANUT_GALLERY_TOKEN!, // fine-grained token: Issues read/write on one repo
+  repo: process.env.PEANUT_GALLERY_REPO!,
+  allowedOrigins: ['https://proto.example.com'],
+});
+```
+
+Templates for Cloudflare Workers, Netlify Functions and plain Node are in `templates/`. Then set `data-relay-url` on the widget.
+
+MIT licensed.

package/dist/chunk-RS5CY75G.js

@@ -0,0 +1,100 @@
+// src/index.ts
+import { sessionToIssue, LABELS } from "@pixelatlarge/peanut-gallery-core";
+function createRelayHandler(opts) {
+  if (!opts.githubToken) throw new Error("relay: githubToken is required");
+  if (!/^[\w.-]+\/[\w.-]+$/.test(opts.repo)) throw new Error('relay: repo must be "owner/name"');
+  const f = opts.fetch ?? fetch;
+  const apiBase = (opts.apiBase ?? "https://api.github.com").replace(/\/$/, "");
+  const allowed = opts.allowedOrigins ?? ["*"];
+  const max = opts.maxAnnotations ?? 100;
+  const cors = (origin) => {
+    const ok = allowed.includes("*") || origin !== null && allowed.includes(origin);
+    return {
+      ok,
+      headers: {
+        "access-control-allow-origin": ok ? allowed.includes("*") ? "*" : origin : "null",
+        "access-control-allow-methods": "POST, OPTIONS",
+        "access-control-allow-headers": "content-type, x-peanut-gallery-key",
+        "access-control-max-age": "86400",
+        vary: "origin"
+      }
+    };
+  };
+  const baseLabels = opts.labels ?? [LABELS.root, LABELS.feedback];
+  const permitted = /* @__PURE__ */ new Set([...baseLabels, ...opts.allowedLabels ?? []]);
+  return async function handle(req) {
+    try {
+      return await handleInner(req);
+    } catch (err) {
+      const c = cors(req.headers.get("origin"));
+      return new Response(JSON.stringify({ error: "relay error", detail: String(err?.message ?? err).slice(0, 200) }), {
+        status: 500,
+        headers: { "content-type": "application/json", ...c.headers }
+      });
+    }
+  };
+  async function handleInner(req) {
+    const origin = req.headers.get("origin");
+    const c = cors(origin);
+    const json = (status, body2) => new Response(JSON.stringify(body2), { status, headers: { "content-type": "application/json", ...c.headers } });
+    if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: c.headers });
+    if (req.method !== "POST") return json(405, { error: "method not allowed" });
+    if (!c.ok) return json(403, { error: "origin not allowed" });
+    if (opts.sharedKey && req.headers.get("x-peanut-gallery-key") !== opts.sharedKey) return json(401, { error: "bad key" });
+    let payload;
+    try {
+      payload = await req.json();
+    } catch {
+      return json(400, { error: "invalid json" });
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return json(400, { error: "expected a JSON object" });
+    const session = payload.session;
+    const problem = validate(session, max);
+    if (problem) return json(400, { error: problem });
+    const { title, body } = sessionToIssue(session);
+    const asked = Array.isArray(payload.labels) ? payload.labels.filter((l) => typeof l === "string") : [];
+    const labels = Array.from(/* @__PURE__ */ new Set([...baseLabels, ...asked.filter((l) => permitted.has(l))]));
+    let res;
+    try {
+      res = await f(`${apiBase}/repos/${opts.repo}/issues`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${opts.githubToken}`,
+          accept: "application/vnd.github+json",
+          "content-type": "application/json",
+          "user-agent": "peanut-gallery-relay",
+          "x-github-api-version": "2022-11-28"
+        },
+        body: JSON.stringify({ title, body, labels })
+      });
+    } catch (err) {
+      return json(502, { error: "could not reach GitHub", detail: String(err?.message ?? err).slice(0, 200) });
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      return json(502, { error: `github ${res.status}`, detail: text.slice(0, 500) });
+    }
+    const issue = await res.json();
+    const result = { issueUrl: issue.html_url, issueNumber: issue.number };
+    return json(201, result);
+  }
+}
+function validate(s, max) {
+  if (!s || typeof s !== "object") return "missing session";
+  if (typeof s.id !== "string" || typeof s.prototypeUrl !== "string") return "malformed session";
+  if (!Array.isArray(s.annotations) || s.annotations.length === 0) return "no annotations";
+  if (s.annotations.length > max) return `too many annotations (max ${max})`;
+  for (const a of s.annotations) {
+    if (!a || typeof a !== "object") return "annotation invalid";
+    if (typeof a.text !== "string" || a.text.length === 0 || a.text.length > 5e3) return "annotation text invalid";
+    if (!a.anchor || typeof a.anchor.selector !== "string" || a.anchor.selector.length > 2e3) return "anchor invalid";
+    if (typeof a.pageUrl !== "string" || a.pageUrl.length > 2e3) return "pageUrl invalid";
+    if (a.steps !== void 0 && (!Array.isArray(a.steps) || a.steps.length > 10 || a.steps.some((st) => !st || typeof st.selector !== "string" || st.selector.length > 2e3))) return "steps invalid";
+    if (a.viewport !== void 0 && (typeof a.viewport !== "object" || !Number.isFinite(a.viewport?.width) || !Number.isFinite(a.viewport?.height))) return "viewport invalid";
+  }
+  return null;
+}
+
+export {
+  createRelayHandler
+};

package/dist/index.cjs

@@ -0,0 +1,124 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  createRelayHandler: () => createRelayHandler
+});
+module.exports = __toCommonJS(index_exports);
+var import_peanut_gallery_core = require("@pixelatlarge/peanut-gallery-core");
+function createRelayHandler(opts) {
+  if (!opts.githubToken) throw new Error("relay: githubToken is required");
+  if (!/^[\w.-]+\/[\w.-]+$/.test(opts.repo)) throw new Error('relay: repo must be "owner/name"');
+  const f = opts.fetch ?? fetch;
+  const apiBase = (opts.apiBase ?? "https://api.github.com").replace(/\/$/, "");
+  const allowed = opts.allowedOrigins ?? ["*"];
+  const max = opts.maxAnnotations ?? 100;
+  const cors = (origin) => {
+    const ok = allowed.includes("*") || origin !== null && allowed.includes(origin);
+    return {
+      ok,
+      headers: {
+        "access-control-allow-origin": ok ? allowed.includes("*") ? "*" : origin : "null",
+        "access-control-allow-methods": "POST, OPTIONS",
+        "access-control-allow-headers": "content-type, x-peanut-gallery-key",
+        "access-control-max-age": "86400",
+        vary: "origin"
+      }
+    };
+  };
+  const baseLabels = opts.labels ?? [import_peanut_gallery_core.LABELS.root, import_peanut_gallery_core.LABELS.feedback];
+  const permitted = /* @__PURE__ */ new Set([...baseLabels, ...opts.allowedLabels ?? []]);
+  return async function handle(req) {
+    try {
+      return await handleInner(req);
+    } catch (err) {
+      const c = cors(req.headers.get("origin"));
+      return new Response(JSON.stringify({ error: "relay error", detail: String(err?.message ?? err).slice(0, 200) }), {
+        status: 500,
+        headers: { "content-type": "application/json", ...c.headers }
+      });
+    }
+  };
+  async function handleInner(req) {
+    const origin = req.headers.get("origin");
+    const c = cors(origin);
+    const json = (status, body2) => new Response(JSON.stringify(body2), { status, headers: { "content-type": "application/json", ...c.headers } });
+    if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: c.headers });
+    if (req.method !== "POST") return json(405, { error: "method not allowed" });
+    if (!c.ok) return json(403, { error: "origin not allowed" });
+    if (opts.sharedKey && req.headers.get("x-peanut-gallery-key") !== opts.sharedKey) return json(401, { error: "bad key" });
+    let payload;
+    try {
+      payload = await req.json();
+    } catch {
+      return json(400, { error: "invalid json" });
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return json(400, { error: "expected a JSON object" });
+    const session = payload.session;
+    const problem = validate(session, max);
+    if (problem) return json(400, { error: problem });
+    const { title, body } = (0, import_peanut_gallery_core.sessionToIssue)(session);
+    const asked = Array.isArray(payload.labels) ? payload.labels.filter((l) => typeof l === "string") : [];
+    const labels = Array.from(/* @__PURE__ */ new Set([...baseLabels, ...asked.filter((l) => permitted.has(l))]));
+    let res;
+    try {
+      res = await f(`${apiBase}/repos/${opts.repo}/issues`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${opts.githubToken}`,
+          accept: "application/vnd.github+json",
+          "content-type": "application/json",
+          "user-agent": "peanut-gallery-relay",
+          "x-github-api-version": "2022-11-28"
+        },
+        body: JSON.stringify({ title, body, labels })
+      });
+    } catch (err) {
+      return json(502, { error: "could not reach GitHub", detail: String(err?.message ?? err).slice(0, 200) });
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      return json(502, { error: `github ${res.status}`, detail: text.slice(0, 500) });
+    }
+    const issue = await res.json();
+    const result = { issueUrl: issue.html_url, issueNumber: issue.number };
+    return json(201, result);
+  }
+}
+function validate(s, max) {
+  if (!s || typeof s !== "object") return "missing session";
+  if (typeof s.id !== "string" || typeof s.prototypeUrl !== "string") return "malformed session";
+  if (!Array.isArray(s.annotations) || s.annotations.length === 0) return "no annotations";
+  if (s.annotations.length > max) return `too many annotations (max ${max})`;
+  for (const a of s.annotations) {
+    if (!a || typeof a !== "object") return "annotation invalid";
+    if (typeof a.text !== "string" || a.text.length === 0 || a.text.length > 5e3) return "annotation text invalid";
+    if (!a.anchor || typeof a.anchor.selector !== "string" || a.anchor.selector.length > 2e3) return "anchor invalid";
+    if (typeof a.pageUrl !== "string" || a.pageUrl.length > 2e3) return "pageUrl invalid";
+    if (a.steps !== void 0 && (!Array.isArray(a.steps) || a.steps.length > 10 || a.steps.some((st) => !st || typeof st.selector !== "string" || st.selector.length > 2e3))) return "steps invalid";
+    if (a.viewport !== void 0 && (typeof a.viewport !== "object" || !Number.isFinite(a.viewport?.width) || !Number.isFinite(a.viewport?.height))) return "viewport invalid";
+  }
+  return null;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createRelayHandler
+});

package/dist/index.d.cts

@@ -0,0 +1,36 @@
+interface RelayOptions {
+    /** Fine-grained PAT or GitHub App installation token with Issues: write on the repo. */
+    githubToken: string;
+    /** "owner/name". The relay only ever writes to this repo. */
+    repo: string;
+    /** Origins allowed to call the relay (the hosted prototype). "*" allows any. */
+    allowedOrigins?: string[];
+    /** Optional shared secret; widget must send `x-peanut-gallery-key`. Use when the prototype is public. */
+    sharedKey?: string;
+    /** Labels always applied. Defaults to peanut-gallery + peanut-gallery:feedback. */
+    labels?: string[];
+    /**
+     * Extra labels a submission may ask for (the widget's `labels` option). Anything else the
+     * client sends is dropped, so the public endpoint can't set workflow labels such as
+     * peanut-gallery:accepted or create junk labels. Default: none beyond `labels`.
+     */
+    allowedLabels?: string[];
+    /** Max annotations accepted in one submission. */
+    maxAnnotations?: number;
+    /** Override fetch (tests). */
+    fetch?: typeof fetch;
+    /** GitHub API base (GHES). */
+    apiBase?: string;
+}
+interface RelayResult {
+    issueUrl: string;
+    issueNumber: number;
+}
+/**
+ * Returns a Web-standard `(request: Request) => Promise<Response>` handler.
+ * Works as-is on Cloudflare Workers, Vercel Edge/Node (web runtime), Deno, Bun, Netlify.
+ * For Node's http module, see `@pixelatlarge/peanut-gallery-relay/node`.
+ */
+declare function createRelayHandler(opts: RelayOptions): (req: Request) => Promise<Response>;
+
+export { type RelayOptions, type RelayResult, createRelayHandler };

package/dist/index.d.ts

@@ -0,0 +1,36 @@
+interface RelayOptions {
+    /** Fine-grained PAT or GitHub App installation token with Issues: write on the repo. */
+    githubToken: string;
+    /** "owner/name". The relay only ever writes to this repo. */
+    repo: string;
+    /** Origins allowed to call the relay (the hosted prototype). "*" allows any. */
+    allowedOrigins?: string[];
+    /** Optional shared secret; widget must send `x-peanut-gallery-key`. Use when the prototype is public. */
+    sharedKey?: string;
+    /** Labels always applied. Defaults to peanut-gallery + peanut-gallery:feedback. */
+    labels?: string[];
+    /**
+     * Extra labels a submission may ask for (the widget's `labels` option). Anything else the
+     * client sends is dropped, so the public endpoint can't set workflow labels such as
+     * peanut-gallery:accepted or create junk labels. Default: none beyond `labels`.
+     */
+    allowedLabels?: string[];
+    /** Max annotations accepted in one submission. */
+    maxAnnotations?: number;
+    /** Override fetch (tests). */
+    fetch?: typeof fetch;
+    /** GitHub API base (GHES). */
+    apiBase?: string;
+}
+interface RelayResult {
+    issueUrl: string;
+    issueNumber: number;
+}
+/**
+ * Returns a Web-standard `(request: Request) => Promise<Response>` handler.
+ * Works as-is on Cloudflare Workers, Vercel Edge/Node (web runtime), Deno, Bun, Netlify.
+ * For Node's http module, see `@pixelatlarge/peanut-gallery-relay/node`.
+ */
+declare function createRelayHandler(opts: RelayOptions): (req: Request) => Promise<Response>;
+
+export { type RelayOptions, type RelayResult, createRelayHandler };

package/dist/index.js

@@ -0,0 +1,6 @@
+import {
+  createRelayHandler
+} from "./chunk-RS5CY75G.js";
+export {
+  createRelayHandler
+};

package/dist/node.cjs

@@ -0,0 +1,168 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/node.ts
+var node_exports = {};
+__export(node_exports, {
+  createNodeHandler: () => createNodeHandler,
+  optionsFromEnv: () => optionsFromEnv,
+  serve: () => serve
+});
+module.exports = __toCommonJS(node_exports);
+var import_node_http = require("http");
+
+// src/index.ts
+var import_peanut_gallery_core = require("@pixelatlarge/peanut-gallery-core");
+function createRelayHandler(opts) {
+  if (!opts.githubToken) throw new Error("relay: githubToken is required");
+  if (!/^[\w.-]+\/[\w.-]+$/.test(opts.repo)) throw new Error('relay: repo must be "owner/name"');
+  const f = opts.fetch ?? fetch;
+  const apiBase = (opts.apiBase ?? "https://api.github.com").replace(/\/$/, "");
+  const allowed = opts.allowedOrigins ?? ["*"];
+  const max = opts.maxAnnotations ?? 100;
+  const cors = (origin) => {
+    const ok = allowed.includes("*") || origin !== null && allowed.includes(origin);
+    return {
+      ok,
+      headers: {
+        "access-control-allow-origin": ok ? allowed.includes("*") ? "*" : origin : "null",
+        "access-control-allow-methods": "POST, OPTIONS",
+        "access-control-allow-headers": "content-type, x-peanut-gallery-key",
+        "access-control-max-age": "86400",
+        vary: "origin"
+      }
+    };
+  };
+  const baseLabels = opts.labels ?? [import_peanut_gallery_core.LABELS.root, import_peanut_gallery_core.LABELS.feedback];
+  const permitted = /* @__PURE__ */ new Set([...baseLabels, ...opts.allowedLabels ?? []]);
+  return async function handle(req) {
+    try {
+      return await handleInner(req);
+    } catch (err) {
+      const c = cors(req.headers.get("origin"));
+      return new Response(JSON.stringify({ error: "relay error", detail: String(err?.message ?? err).slice(0, 200) }), {
+        status: 500,
+        headers: { "content-type": "application/json", ...c.headers }
+      });
+    }
+  };
+  async function handleInner(req) {
+    const origin = req.headers.get("origin");
+    const c = cors(origin);
+    const json = (status, body2) => new Response(JSON.stringify(body2), { status, headers: { "content-type": "application/json", ...c.headers } });
+    if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: c.headers });
+    if (req.method !== "POST") return json(405, { error: "method not allowed" });
+    if (!c.ok) return json(403, { error: "origin not allowed" });
+    if (opts.sharedKey && req.headers.get("x-peanut-gallery-key") !== opts.sharedKey) return json(401, { error: "bad key" });
+    let payload;
+    try {
+      payload = await req.json();
+    } catch {
+      return json(400, { error: "invalid json" });
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return json(400, { error: "expected a JSON object" });
+    const session = payload.session;
+    const problem = validate(session, max);
+    if (problem) return json(400, { error: problem });
+    const { title, body } = (0, import_peanut_gallery_core.sessionToIssue)(session);
+    const asked = Array.isArray(payload.labels) ? payload.labels.filter((l) => typeof l === "string") : [];
+    const labels = Array.from(/* @__PURE__ */ new Set([...baseLabels, ...asked.filter((l) => permitted.has(l))]));
+    let res;
+    try {
+      res = await f(`${apiBase}/repos/${opts.repo}/issues`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${opts.githubToken}`,
+          accept: "application/vnd.github+json",
+          "content-type": "application/json",
+          "user-agent": "peanut-gallery-relay",
+          "x-github-api-version": "2022-11-28"
+        },
+        body: JSON.stringify({ title, body, labels })
+      });
+    } catch (err) {
+      return json(502, { error: "could not reach GitHub", detail: String(err?.message ?? err).slice(0, 200) });
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      return json(502, { error: `github ${res.status}`, detail: text.slice(0, 500) });
+    }
+    const issue = await res.json();
+    const result = { issueUrl: issue.html_url, issueNumber: issue.number };
+    return json(201, result);
+  }
+}
+function validate(s, max) {
+  if (!s || typeof s !== "object") return "missing session";
+  if (typeof s.id !== "string" || typeof s.prototypeUrl !== "string") return "malformed session";
+  if (!Array.isArray(s.annotations) || s.annotations.length === 0) return "no annotations";
+  if (s.annotations.length > max) return `too many annotations (max ${max})`;
+  for (const a of s.annotations) {
+    if (!a || typeof a !== "object") return "annotation invalid";
+    if (typeof a.text !== "string" || a.text.length === 0 || a.text.length > 5e3) return "annotation text invalid";
+    if (!a.anchor || typeof a.anchor.selector !== "string" || a.anchor.selector.length > 2e3) return "anchor invalid";
+    if (typeof a.pageUrl !== "string" || a.pageUrl.length > 2e3) return "pageUrl invalid";
+    if (a.steps !== void 0 && (!Array.isArray(a.steps) || a.steps.length > 10 || a.steps.some((st) => !st || typeof st.selector !== "string" || st.selector.length > 2e3))) return "steps invalid";
+    if (a.viewport !== void 0 && (typeof a.viewport !== "object" || !Number.isFinite(a.viewport?.width) || !Number.isFinite(a.viewport?.height))) return "viewport invalid";
+  }
+  return null;
+}
+
+// src/node.ts
+function createNodeHandler(opts) {
+  const handle = createRelayHandler(opts);
+  return async (req, res) => {
+    const chunks = [];
+    for await (const c of req) chunks.push(c);
+    const url = `http://${req.headers.host ?? "localhost"}${req.url ?? "/"}`;
+    const headers = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) if (typeof v === "string") headers.set(k, v);
+    const request = new Request(url, {
+      method: req.method,
+      headers,
+      body: req.method === "GET" || req.method === "HEAD" ? void 0 : Buffer.concat(chunks)
+    });
+    const response = await handle(request);
+    res.statusCode = response.status;
+    response.headers.forEach((v, k) => res.setHeader(k, v));
+    res.end(Buffer.from(await response.arrayBuffer()));
+  };
+}
+function serve(opts) {
+  const server = (0, import_node_http.createServer)(createNodeHandler(opts));
+  const port = opts.port ?? Number(process.env.PORT ?? 8787);
+  server.listen(port, () => console.log(`peanut-gallery relay listening on :${port} \u2192 ${opts.repo}`));
+  return server;
+}
+function optionsFromEnv(env = process.env) {
+  const githubToken = env.PEANUT_GALLERY_TOKEN ?? env.GITHUB_TOKEN ?? "";
+  const repo = env.PEANUT_GALLERY_REPO ?? "";
+  return {
+    githubToken,
+    repo,
+    allowedOrigins: env.PEANUT_GALLERY_ORIGINS?.split(",").map((s) => s.trim()),
+    sharedKey: env.PEANUT_GALLERY_KEY
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createNodeHandler,
+  optionsFromEnv,
+  serve
+});

package/dist/node.d.cts

@@ -0,0 +1,13 @@
+import * as http from 'http';
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { RelayOptions } from './index.cjs';
+
+/** Adapt the web handler to Node's http module (Express-compatible signature). */
+declare function createNodeHandler(opts: RelayOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+/** Standalone server: `PEANUT_GALLERY_TOKEN=... PEANUT_GALLERY_REPO=owner/name node -e "..."` */
+declare function serve(opts: RelayOptions & {
+    port?: number;
+}): http.Server<typeof IncomingMessage, typeof ServerResponse>;
+declare function optionsFromEnv(env?: NodeJS.ProcessEnv): RelayOptions;
+
+export { createNodeHandler, optionsFromEnv, serve };

package/dist/node.d.ts

@@ -0,0 +1,13 @@
+import * as http from 'http';
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { RelayOptions } from './index.js';
+
+/** Adapt the web handler to Node's http module (Express-compatible signature). */
+declare function createNodeHandler(opts: RelayOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+/** Standalone server: `PEANUT_GALLERY_TOKEN=... PEANUT_GALLERY_REPO=owner/name node -e "..."` */
+declare function serve(opts: RelayOptions & {
+    port?: number;
+}): http.Server<typeof IncomingMessage, typeof ServerResponse>;
+declare function optionsFromEnv(env?: NodeJS.ProcessEnv): RelayOptions;
+
+export { createNodeHandler, optionsFromEnv, serve };

package/dist/node.js

@@ -0,0 +1,46 @@
+import {
+  createRelayHandler
+} from "./chunk-RS5CY75G.js";
+
+// src/node.ts
+import { createServer } from "http";
+function createNodeHandler(opts) {
+  const handle = createRelayHandler(opts);
+  return async (req, res) => {
+    const chunks = [];
+    for await (const c of req) chunks.push(c);
+    const url = `http://${req.headers.host ?? "localhost"}${req.url ?? "/"}`;
+    const headers = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) if (typeof v === "string") headers.set(k, v);
+    const request = new Request(url, {
+      method: req.method,
+      headers,
+      body: req.method === "GET" || req.method === "HEAD" ? void 0 : Buffer.concat(chunks)
+    });
+    const response = await handle(request);
+    res.statusCode = response.status;
+    response.headers.forEach((v, k) => res.setHeader(k, v));
+    res.end(Buffer.from(await response.arrayBuffer()));
+  };
+}
+function serve(opts) {
+  const server = createServer(createNodeHandler(opts));
+  const port = opts.port ?? Number(process.env.PORT ?? 8787);
+  server.listen(port, () => console.log(`peanut-gallery relay listening on :${port} \u2192 ${opts.repo}`));
+  return server;
+}
+function optionsFromEnv(env = process.env) {
+  const githubToken = env.PEANUT_GALLERY_TOKEN ?? env.GITHUB_TOKEN ?? "";
+  const repo = env.PEANUT_GALLERY_REPO ?? "";
+  return {
+    githubToken,
+    repo,
+    allowedOrigins: env.PEANUT_GALLERY_ORIGINS?.split(",").map((s) => s.trim()),
+    sharedKey: env.PEANUT_GALLERY_KEY
+  };
+}
+export {
+  createNodeHandler,
+  optionsFromEnv,
+  serve
+};

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@pixelatlarge/peanut-gallery-relay",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Tiny serverless relay that turns peanut-gallery widget submissions into GitHub Issues. Deploy to Vercel, Cloudflare, Netlify or Node.",
+  "keywords": [
+    "github-issues",
+    "serverless",
+    "prototype",
+    "feedback"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PixelAtLarge/peanut-gallery.git",
+    "directory": "packages/relay"
+  },
+  "homepage": "https://github.com/PixelAtLarge/peanut-gallery#readme",
+  "bugs": {
+    "url": "https://github.com/PixelAtLarge/peanut-gallery/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./node": {
+      "types": "./dist/node.d.ts",
+      "import": "./dist/node.js",
+      "require": "./dist/node.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "templates",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts src/node.ts --format esm,cjs --dts --clean",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@pixelatlarge/peanut-gallery-core": "0.1.1"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/templates/cloudflare-worker.ts

@@ -0,0 +1,16 @@
+// Cloudflare Workers: `wrangler secret put PEANUT_GALLERY_TOKEN`, set PEANUT_GALLERY_REPO etc. as vars.
+import { createRelayHandler } from '@pixelatlarge/peanut-gallery-relay';
+
+interface Env { PEANUT_GALLERY_TOKEN: string; PEANUT_GALLERY_REPO: string; PEANUT_GALLERY_ORIGINS?: string; PEANUT_GALLERY_KEY?: string }
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const handle = createRelayHandler({
+      githubToken: env.PEANUT_GALLERY_TOKEN,
+      repo: env.PEANUT_GALLERY_REPO,
+      allowedOrigins: env.PEANUT_GALLERY_ORIGINS?.split(','),
+      sharedKey: env.PEANUT_GALLERY_KEY,
+    });
+    return handle(request);
+  },
+};

package/templates/netlify-function.ts

@@ -0,0 +1,11 @@
+// Netlify Functions v2: copy to netlify/functions/peanut-gallery.ts
+import { createRelayHandler } from '@pixelatlarge/peanut-gallery-relay';
+
+const handle = createRelayHandler({
+  githubToken: process.env.PEANUT_GALLERY_TOKEN!,
+  repo: process.env.PEANUT_GALLERY_REPO!,
+  allowedOrigins: process.env.PEANUT_GALLERY_ORIGINS?.split(','),
+  sharedKey: process.env.PEANUT_GALLERY_KEY,
+});
+
+export default async (req: Request) => handle(req);

package/templates/node-server.mjs

@@ -0,0 +1,3 @@
+// Plain Node: PEANUT_GALLERY_TOKEN=ghp_x PEANUT_GALLERY_REPO=owner/name node node-server.mjs
+import { serve, optionsFromEnv } from '@pixelatlarge/peanut-gallery-relay/node';
+serve(optionsFromEnv());

package/templates/vercel-api-peanut-gallery.ts

@@ -0,0 +1,13 @@
+// Vercel: copy to api/peanut-gallery.ts. Set env PEANUT_GALLERY_TOKEN, PEANUT_GALLERY_REPO, PEANUT_GALLERY_ORIGINS, PEANUT_GALLERY_KEY.
+import { createRelayHandler } from '@pixelatlarge/peanut-gallery-relay';
+
+export const config = { runtime: 'edge' };
+
+const handle = createRelayHandler({
+  githubToken: process.env.PEANUT_GALLERY_TOKEN!,
+  repo: process.env.PEANUT_GALLERY_REPO!,
+  allowedOrigins: process.env.PEANUT_GALLERY_ORIGINS?.split(','),
+  sharedKey: process.env.PEANUT_GALLERY_KEY,
+});
+
+export default handle;