@verbumia/feedback 0.1.0 → 0.2.0

package/CONTRACT.md

@@ -1,10 +1,29 @@
-# `@verbumia/feedback` — wire contract (v4 — task 616: tosVersion = SDK build-time constant)
+# `@verbumia/feedback` — wire contract (v6 — task 618: optional namespace filter)
 
 Canonical reference for what the widget SDK sends and what the Verbumia
 backend accepts. Entry points `/react`, `/native`, `/vue`, `/svelte`,
 `/core` are interface-only differences; the WIRE shape (§1–§5) is
 identical for all. Backend source-of-truth: `docs/feedback-api-contract.md`.
-Supersedes the v3 artifact `b6324d39` (v2 `c8e86de1`, v1 `e614b48b`).
+Supersedes the v5 artifact `eb35149e` (v4 `7980e3d4`, v3 `b6324d39`,
+v2 `c8e86de1`, v1 `e614b48b`).
+
+**v6 change (task 618) — wire byte-identical to v5; ADDITIVE +
+backward-compatible.** A new OPTIONAL `namespace?: string | string[]`
+on the trigger/config of every UI entry (and the `/core`
+`resolveKeys(explicit?, namespace?)` + exported `filterByNamespace`).
+See §0d. Default (unset/empty) is identical to v5. No request field,
+endpoint, or response shape changes. `@verbumia/react-i18next` is
+unaffected (feedback-only change).
+
+**v5 change (task 617) — wire byte-identical to v4; SDK behavior
+clarified + made NORMATIVE.** The widget lists ONLY the translation
+strings RENDERED on the current screen/page (spec ltm 373), via the
+i18n SDK's on-screen key registry (§0c). Explicit `keys` is a FALLBACK
+for non-i18n strings — it is NOT "pass everything". Integrations and
+demos MUST NOT prefetch/pass the whole project key set. No request
+field, endpoint, or response shape changes (`GET /v1/feedback/strings`
+already takes the optional `keys` filter). The producer of the registry
+is the i18n SDK: **`@verbumia/react-i18next` >= 0.7.0**.
 
 **v4 change (task 616):** `tosVersion` is NO LONGER an integrator config
 field. It is a BUILD-TIME constant baked into the package
@@ -39,6 +58,66 @@ controller, server-minted sessionId (no client `groupingKey`).
 `vue` / `svelte` are OPTIONAL peer deps (only the respective entry needs
 them). The wire contract (§1–§5) is byte-identical to v2.
 
+## 0c. On-screen key scoping (task 617 — NORMATIVE)
+
+The panel shows the strings the host actually RENDERED on the current
+view, not the whole project. Resolution order (`/core` `resolveKeys`,
+used by every entry: react panel, native modal, vue, svelte):
+
+1. **Explicit `keys`** (plugin/config `keys?: DeclaredKey[]`) — wins when
+   non-empty. Reserved for non-i18n strings the host wants reviewed
+   (e.g. server-rendered copy). NOT a place to dump every project key.
+2. **i18n on-screen registry** — `globalThis.__verbumia_key_registry__`,
+   a tiny global the `@verbumia/*-i18n` SDK publishes:
+
+   ```ts
+   globalThis.__verbumia_key_registry__ = {
+     snapshot(): { namespace: string; key: string }[]; // mounted-and-rendered
+     reset(): void;                                     // escape hatch
+   }
+   ```
+
+   `@verbumia/react-i18next` (>= 0.7.0) tracks every key resolved by a
+   mounted `useTranslation`/`Trans`; a component unmounting (navigation)
+   drops its keys, so `snapshot()` is exactly "what is on screen now".
+   No router wiring required. With react-i18next < 0.7.0 the plugin slot
+   still works but the global is absent → step 3.
+3. **Empty** → the widget shows "no strings on this view" (it must NOT
+   fall back to fetching all project strings).
+
+`GET /v1/feedback/strings` is called with `keys=` set to the resolved
+set; only when the set is empty is `keys` omitted. Any framework port of
+the i18n SDK MAY implement the same global to get auto-scoping; the
+shape above is the entire contract between the two packages.
+
+## 0d. Optional namespace filter (task 618 — ADDITIVE, customer feature)
+
+Every UI entry's trigger/config accepts an optional **`namespace`**:
+
+```ts
+namespace?: string | string[]
+```
+
+- `/react`, `/native`: `feedbackPlugin({ …, namespace })`.
+- `/vue`, `/svelte`: `createFeedback({ …, namespace })`.
+- `/core`: `resolveKeys(explicit?, namespace?)`; also a standalone
+  `filterByNamespace(keys, namespace?)` is exported.
+
+Semantics: the filter is applied AFTER the §0c resolution (explicit
+keys OR rendered registry), i.e. it composes as **`resolved ∩
+namespace`**. When set to a single namespace or a list, only resolved
+keys whose `namespace` is in the filter are shown; the trimmed,
+empty-stripped list is matched exactly. **Unset, `""`, or `[]` ⇒
+no filter** — behaviour is byte-identical to v5 (all resolved keys).
+If the intersection is empty the panel shows "no strings on this view"
+(it never falls back to the whole project — §0c rule holds).
+
+Purpose: a host that renders multiple namespaces on one screen can
+scope the feedback widget to the namespace the customer cares about
+(e.g. `namespace: "quiz"`), without changing rendered-scoping or the
+wire. Backward-compatible: existing integrations that omit `namespace`
+are unaffected.
+
 ## 0. Integration architecture (task 599)
 
 `@verbumia/feedback` is a **plugin of the `@verbumia/*-i18n`

package/dist/{chunk-OX4RJD5H.js → chunk-GKDUJ2DM.js}

@@ -15,7 +15,7 @@ var SDK_TOS_VERSION = "2026-05-18";
 
 // src/core/client.ts
 var SDK_LIB = "@verbumia/feedback";
-var SDK_VER = "0.1.0";
+var SDK_VER = "0.2.0";
 var FeedbackClient = class {
   cfg;
   fetchImpl;
@@ -213,11 +213,15 @@ function getRegistry() {
 function hasKeyRegistry() {
   return getRegistry() !== null;
 }
-function resolveKeys(explicit) {
-  if (explicit && explicit.length) return dedupe(explicit);
-  const reg = getRegistry();
-  if (reg) return dedupe(reg.snapshot());
-  return [];
+function resolveKeys(explicit, namespace) {
+  const base = explicit && explicit.length ? dedupe(explicit) : getRegistry() ? dedupe(getRegistry().snapshot()) : [];
+  return filterByNamespace(base, namespace);
+}
+function filterByNamespace(keys, namespace) {
+  const list = (Array.isArray(namespace) ? namespace : namespace ? [namespace] : []).map((n) => n.trim()).filter(Boolean);
+  if (!list.length) return keys;
+  const allow = new Set(list);
+  return keys.filter((k) => allow.has(k.namespace));
 }
 function dedupe(keys) {
   const seen = /* @__PURE__ */ new Set();
@@ -237,6 +241,7 @@ export {
   SDK_TOS_VERSION,
   FeedbackClient,
   hasKeyRegistry,
-  resolveKeys
+  resolveKeys,
+  filterByNamespace
 };
-//# sourceMappingURL=chunk-OX4RJD5H.js.map
+//# sourceMappingURL=chunk-GKDUJ2DM.js.map

package/dist/{chunk-OX4RJD5H.js.map → chunk-GKDUJ2DM.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/types.ts","../src/core/tos.ts","../src/core/client.ts","../src/core/keys.ts"],"sourcesContent":["/**\n * Wire types for the Verbumia End-User Translation Evaluation API.\n * Canonical reference: ./CONTRACT.md (frozen). Backend task 591.\n */\n\nexport interface FeedbackConfig {\n  /** API base, no trailing slash needed. e.g. https://api.verbumia.ca */\n  apiBase: string;\n  /** Public project UUID the widget targets. */\n  projectId: string;\n  /**\n   * sessionId / grouping_key is MINTED SERVER-SIDE by the Verbumia\n   * backend at POST /v1/feedback/tos and returned in the token bundle\n   * (`TokenBundle.grouping_key`). The widget receives + sends it; it\n   * MUST NOT self-generate it. There is intentionally no client config\n   * field for it.\n   */\n  /**\n   * NOTE: there is intentionally NO `tosVersion` field. The ToS version\n   * is a BUILD-TIME constant baked into @verbumia/feedback at release\n   * (`SDK_TOS_VERSION`, task 616) — integrators do not set it; the SDK\n   * sends it automatically.\n   */\n  /** Optional opaque end-user id; server generates one when absent. */\n  endUserId?: string;\n  /** BCP-47 language the widget rates strings in (e.g. \"fr\"). */\n  language: string;\n  /** Optional locale tag stored for analytics. */\n  locale?: string;\n  /** Debounce window (ms) before a queued batch is flushed. Default 1500. */\n  flushDebounceMs?: number;\n  /** Max queued items before an immediate flush. Default 20. */\n  maxBatch?: number;\n  /** Injected fetch (tests / RN polyfills). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface TokenBundle {\n  access_token: string;\n  token_type: \"Bearer\";\n  expires_in: number;\n  refresh_token: string;\n  refresh_expires_in: number;\n  end_user_id: string;\n  tos_version: string;\n  grouping_key: string;\n}\n\nexport interface FeedbackString {\n  namespace: string;\n  key: string;\n  key_uuid: string;\n  language_uuid: string;\n  value: string;\n  translation_hash: string;\n  avg_stars: number | null;\n  ratings_count: number;\n  my_rating: number | null;\n}\n\nexport interface StringsResponse {\n  project_id: string;\n  language: string;\n  strings: FeedbackString[];\n}\n\n/** A 5-star rating queued for a rendered string variant. */\nexport interface RatingInput {\n  namespace: string;\n  key: string;\n  language: string;\n  translation_hash: string;\n  stars: number; // 1..5\n}\n\n/** A suggested alternative translation queued for moderation. */\nexport interface SuggestionInput {\n  namespace: string;\n  key: string;\n  language: string;\n  translation_hash: string;\n  suggested_text: string;\n  comment?: string;\n}\n\nexport interface BatchResponse {\n  accepted: number;\n  rejected: number;\n  items: Array<Record<string, unknown>>;\n}\n\n/** A key the host app declares as on-screen. */\nexport interface DeclaredKey {\n  namespace: string;\n  key: string;\n}\n\nexport class FeedbackError extends Error {\n  constructor(\n    message: string,\n    readonly status?: number,\n    readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"FeedbackError\";\n  }\n}\n","/**\n * BUILD-TIME ToS version constant (task 616, human decision option B).\n *\n * This is baked into the @verbumia/feedback PACKAGE at release. It is\n * NOT an integrator-set config field and NOT server-driven: a stale\n * (e.g. native) app must record consent to the ToS version IT shipped\n * and displayed, for legal correctness — never backend-latest.\n *\n * Releasing a ToS-TEXT change ⇒ bump this constant + cut a new\n * @verbumia/feedback release (per the human/real-CI publish handoff).\n * The backend accepts any version in its acceptable set and records it.\n */\nexport const SDK_TOS_VERSION = \"2026-05-18\";\n","/**\n * Framework-agnostic Verbumia feedback client.\n *\n * Responsibilities:\n *  - versioned-ToS acceptance -> scoped end-user JWT bootstrap\n *  - transparent access-token refresh (rotating refresh token)\n *  - fetch on-screen strings for the widget\n *  - debounced + size-capped batched POST of ratings / suggestions,\n *    mirroring the missing-handler transport contract (ltm 280):\n *    best-effort, never throws into the host app render path.\n *\n * The React and React Native entry points are thin UI shells over this.\n */\n\nimport {\n  type BatchResponse,\n  type FeedbackConfig,\n  FeedbackError,\n  type RatingInput,\n  type StringsResponse,\n  type SuggestionInput,\n  type TokenBundle,\n} from \"./types\";\nimport { SDK_TOS_VERSION } from \"./tos\";\n\nconst SDK_LIB = \"@verbumia/feedback\";\nconst SDK_VER = \"0.1.0\";\n\ntype QueueItem =\n  | { kind: \"rating\"; payload: RatingInput }\n  | { kind: \"suggestion\"; payload: SuggestionInput };\n\nexport class FeedbackClient {\n  private cfg: Required<\n    Pick<FeedbackConfig, \"flushDebounceMs\" | \"maxBatch\">\n  > &\n    FeedbackConfig;\n  private fetchImpl: typeof fetch;\n  private tokens: TokenBundle | null = null;\n  private queue: QueueItem[] = [];\n  private timer: ReturnType<typeof setTimeout> | null = null;\n  private bootstrapping: Promise<TokenBundle> | null = null;\n\n  constructor(config: FeedbackConfig) {\n    this.cfg = {\n      flushDebounceMs: 1500,\n      maxBatch: 20,\n      ...config,\n    };\n    const f = config.fetchImpl ?? globalThis.fetch;\n    if (!f) {\n      throw new FeedbackError(\n        \"no fetch implementation available; pass config.fetchImpl\",\n      );\n    }\n    this.fetchImpl = f.bind(globalThis);\n  }\n\n  private base(): string {\n    return this.cfg.apiBase.replace(/\\/+$/, \"\");\n  }\n\n  get endUserId(): string | undefined {\n    return this.tokens?.end_user_id ?? this.cfg.endUserId;\n  }\n\n  get hasConsented(): boolean {\n    return this.tokens !== null;\n  }\n\n  /** Server-minted sessionId / grouping_key (from the token bundle).\n   * Available only after `acceptTos()`; never client-generated. */\n  get sessionId(): string | undefined {\n    return this.tokens?.grouping_key;\n  }\n\n  /** BCP-47 language the widget is rating strings in. */\n  get language(): string {\n    return this.cfg.language;\n  }\n\n  /** ToS version the end user is asked to accept — the SDK's\n   * build-time constant (task 616). NOT integrator/server set. */\n  get tosVersion(): string {\n    return SDK_TOS_VERSION;\n  }\n\n  /**\n   * Accept the ToS and bootstrap a scoped token. Idempotent: a second call\n   * returns the in-flight / existing bundle rather than re-accepting.\n   */\n  async acceptTos(): Promise<TokenBundle> {\n    if (this.tokens) return this.tokens;\n    if (this.bootstrapping) return this.bootstrapping;\n    this.bootstrapping = (async () => {\n      const res = await this.fetchImpl(`${this.base()}/v1/feedback/tos`, {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({\n          // NO grouping_key: server-minted (task 599). It comes back in\n          // the token bundle and is bound into the JWT server-side.\n          project_id: this.cfg.projectId,\n          end_user_id: this.cfg.endUserId,\n          tos_version: SDK_TOS_VERSION,\n          locale: this.cfg.locale,\n        }),\n      });\n      if (!res.ok) throw await this.problem(res, \"tos acceptance failed\");\n      this.tokens = (await res.json()) as TokenBundle;\n      return this.tokens;\n    })();\n    try {\n      return await this.bootstrapping;\n    } finally {\n      this.bootstrapping = null;\n    }\n  }\n\n  private async refresh(): Promise<void> {\n    if (!this.tokens) throw new FeedbackError(\"not consented\");\n    const res = await this.fetchImpl(\n      `${this.base()}/v1/feedback/token/refresh`,\n      {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ refresh_token: this.tokens.refresh_token }),\n      },\n    );\n    if (!res.ok) {\n      this.tokens = null; // force a fresh ToS step\n      throw await this.problem(res, \"token refresh failed\");\n    }\n    this.tokens = (await res.json()) as TokenBundle;\n  }\n\n  /** Authenticated fetch with a single transparent refresh-on-401 retry. */\n  private async authed(\n    path: string,\n    init: RequestInit,\n    retry = true,\n  ): Promise<Response> {\n    if (!this.tokens) await this.acceptTos();\n    const res = await this.fetchImpl(`${this.base()}${path}`, {\n      ...init,\n      headers: {\n        ...(init.headers ?? {}),\n        Authorization: `Bearer ${this.tokens!.access_token}`,\n      },\n    });\n    if (res.status === 401 && retry) {\n      await this.refresh();\n      return this.authed(path, init, false);\n    }\n    return res;\n  }\n\n  /** Strings rendered on the current view, with this end user's prior rating. */\n  async getStrings(opts?: {\n    keys?: Array<{ namespace: string; key: string }>;\n    namespace?: string;\n    limit?: number;\n  }): Promise<StringsResponse> {\n    const qs = new URLSearchParams({ language: this.cfg.language });\n    if (opts?.keys?.length) {\n      qs.set(\"keys\", opts.keys.map((k) => `${k.namespace}:${k.key}`).join(\",\"));\n    }\n    if (opts?.namespace) qs.set(\"namespace\", opts.namespace);\n    if (opts?.limit) qs.set(\"limit\", String(opts.limit));\n    const res = await this.authed(`/v1/feedback/strings?${qs}`, {\n      method: \"GET\",\n    });\n    if (!res.ok) throw await this.problem(res, \"failed to load strings\");\n    return (await res.json()) as StringsResponse;\n  }\n\n  /** Queue a rating; flushed on debounce or when the batch fills. */\n  rate(payload: RatingInput): void {\n    this.enqueue({ kind: \"rating\", payload });\n  }\n\n  /** Queue a suggestion; flushed on debounce or when the batch fills. */\n  suggest(payload: SuggestionInput): void {\n    this.enqueue({ kind: \"suggestion\", payload });\n  }\n\n  private enqueue(item: QueueItem): void {\n    this.queue.push(item);\n    if (this.queue.length >= this.cfg.maxBatch) {\n      void this.flush();\n      return;\n    }\n    if (this.timer) clearTimeout(this.timer);\n    this.timer = setTimeout(() => void this.flush(), this.cfg.flushDebounceMs);\n  }\n\n  /**\n   * Flush queued items. Best-effort: a transport/auth failure re-queues the\n   * batch once and swallows the error so the host app never sees a throw.\n   */\n  async flush(): Promise<void> {\n    if (this.timer) {\n      clearTimeout(this.timer);\n      this.timer = null;\n    }\n    if (!this.queue.length) return;\n    const batch = this.queue;\n    this.queue = [];\n    const ratings = batch\n      .filter((b) => b.kind === \"rating\")\n      .map((b) => b.payload as RatingInput);\n    const suggestions = batch\n      .filter((b) => b.kind === \"suggestion\")\n      .map((b) => b.payload as SuggestionInput);\n    try {\n      if (ratings.length) {\n        await this.postBatch(\"/v1/feedback/ratings\", { ratings });\n      }\n      if (suggestions.length) {\n        await this.postBatch(\"/v1/feedback/suggestions\", { suggestions });\n      }\n    } catch {\n      // Re-queue once; feedback must never break the host app.\n      this.queue.unshift(...batch);\n    }\n  }\n\n  private async postBatch(\n    path: string,\n    body: unknown,\n  ): Promise<BatchResponse> {\n    const res = await this.authed(path, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\", \"X-SDK\": `${SDK_LIB}@${SDK_VER}` },\n      body: JSON.stringify(body),\n    });\n    if (!res.ok) throw await this.problem(res, \"batch post failed\");\n    return (await res.json()) as BatchResponse;\n  }\n\n  private async problem(res: Response, fallback: string): Promise<FeedbackError> {\n    let code: string | undefined;\n    let detail = fallback;\n    try {\n      const body = (await res.json()) as { code?: string; detail?: string };\n      code = body.code;\n      if (body.detail) detail = body.detail;\n    } catch {\n      /* non-JSON body */\n    }\n    return new FeedbackError(detail, res.status, code);\n  }\n}\n","/**\n * On-screen key discovery.\n *\n * Preferred source: the `@verbumia/*-i18n` SDK exposes a lightweight key\n * registry of keys it has rendered. When that registry is present on the\n * global (the i18n SDK publishes `globalThis.__verbumia_key_registry__`),\n * we read the keys touched on the current view. Otherwise the host app\n * passes an explicit `keys` list — the always-available fallback.\n *\n * The registry contract is intentionally tiny so any framework port of the\n * i18n SDK can implement it without depending on this package.\n */\n\nimport type { DeclaredKey } from \"./types\";\n\nconst REGISTRY_GLOBAL = \"__verbumia_key_registry__\";\n\ninterface KeyRegistry {\n  /** Returns the keys rendered since the last `reset()` (or ever). */\n  snapshot(): DeclaredKey[];\n  reset?(): void;\n}\n\nfunction getRegistry(): KeyRegistry | null {\n  const g = globalThis as Record<string, unknown>;\n  const reg = g[REGISTRY_GLOBAL];\n  if (\n    reg &&\n    typeof (reg as KeyRegistry).snapshot === \"function\"\n  ) {\n    return reg as KeyRegistry;\n  }\n  return null;\n}\n\n/** True when a compatible `@verbumia/*-i18n` registry is detectable. */\nexport function hasKeyRegistry(): boolean {\n  return getRegistry() !== null;\n}\n\n/**\n * Resolve the on-screen keys: explicit `keys` prop always wins (it is the\n * customer's authoritative declaration); otherwise fall back to the i18n\n * registry snapshot; otherwise an empty list (widget shows \"no strings\").\n */\nexport function resolveKeys(explicit?: DeclaredKey[]): DeclaredKey[] {\n  if (explicit && explicit.length) return dedupe(explicit);\n  const reg = getRegistry();\n  if (reg) return dedupe(reg.snapshot());\n  return [];\n}\n\nfunction dedupe(keys: DeclaredKey[]): DeclaredKey[] {\n  const seen = new Set<string>();\n  const out: DeclaredKey[] = [];\n  for (const k of keys) {\n    const id = `${k.namespace}:${k.key}`;\n    if (!seen.has(id)) {\n      seen.add(id);\n      out.push(k);\n    }\n  }\n  return out;\n}\n"],"mappings":";AAiGO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YACE,SACS,QACA,MACT;AACA,UAAM,OAAO;AAHJ;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAKb;;;AC9FO,IAAM,kBAAkB;;;ACa/B,IAAM,UAAU;AAChB,IAAM,UAAU;AAMT,IAAM,iBAAN,MAAqB;AAAA,EAClB;AAAA,EAIA;AAAA,EACA,SAA6B;AAAA,EAC7B,QAAqB,CAAC;AAAA,EACtB,QAA8C;AAAA,EAC9C,gBAA6C;AAAA,EAErD,YAAY,QAAwB;AAClC,SAAK,MAAM;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,UAAM,IAAI,OAAO,aAAa,WAAW;AACzC,QAAI,CAAC,GAAG;AACN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,YAAY,EAAE,KAAK,UAAU;AAAA,EACpC;AAAA,EAEQ,OAAe;AACrB,WAAO,KAAK,IAAI,QAAQ,QAAQ,QAAQ,EAAE;AAAA,EAC5C;AAAA,EAEA,IAAI,YAAgC;AAClC,WAAO,KAAK,QAAQ,eAAe,KAAK,IAAI;AAAA,EAC9C;AAAA,EAEA,IAAI,eAAwB;AAC1B,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA;AAAA,EAIA,IAAI,YAAgC;AAClC,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA,EAGA,IAAI,WAAmB;AACrB,WAAO,KAAK,IAAI;AAAA,EAClB;AAAA;AAAA;AAAA,EAIA,IAAI,aAAqB;AACvB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAkC;AACtC,QAAI,KAAK,OAAQ,QAAO,KAAK;AAC7B,QAAI,KAAK,cAAe,QAAO,KAAK;AACpC,SAAK,iBAAiB,YAAY;AAChC,YAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,CAAC,oBAAoB;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA;AAAA;AAAA,UAGnB,YAAY,KAAK,IAAI;AAAA,UACrB,aAAa,KAAK,IAAI;AAAA,UACtB,aAAa;AAAA,UACb,QAAQ,KAAK,IAAI;AAAA,QACnB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,uBAAuB;AAClE,WAAK,SAAU,MAAM,IAAI,KAAK;AAC9B,aAAO,KAAK;AAAA,IACd,GAAG;AACH,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,gBAAgB;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAc,UAAyB;AACrC,QAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,cAAc,eAAe;AACzD,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB,GAAG,KAAK,KAAK,CAAC;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,eAAe,KAAK,OAAO,cAAc,CAAC;AAAA,MACnE;AAAA,IACF;AACA,QAAI,CAAC,IAAI,IAAI;AACX,WAAK,SAAS;AACd,YAAM,MAAM,KAAK,QAAQ,KAAK,sBAAsB;AAAA,IACtD;AACA,SAAK,SAAU,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA;AAAA,EAGA,MAAc,OACZ,MACA,MACA,QAAQ,MACW;AACnB,QAAI,CAAC,KAAK,OAAQ,OAAM,KAAK,UAAU;AACvC,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI;AAAA,MACxD,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAI,KAAK,WAAW,CAAC;AAAA,QACrB,eAAe,UAAU,KAAK,OAAQ,YAAY;AAAA,MACpD;AAAA,IACF,CAAC;AACD,QAAI,IAAI,WAAW,OAAO,OAAO;AAC/B,YAAM,KAAK,QAAQ;AACnB,aAAO,KAAK,OAAO,MAAM,MAAM,KAAK;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,WAAW,MAIY;AAC3B,UAAM,KAAK,IAAI,gBAAgB,EAAE,UAAU,KAAK,IAAI,SAAS,CAAC;AAC9D,QAAI,MAAM,MAAM,QAAQ;AACtB,SAAG,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,IAC1E;AACA,QAAI,MAAM,UAAW,IAAG,IAAI,aAAa,KAAK,SAAS;AACvD,QAAI,MAAM,MAAO,IAAG,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AACnD,UAAM,MAAM,MAAM,KAAK,OAAO,wBAAwB,EAAE,IAAI;AAAA,MAC1D,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,wBAAwB;AACnE,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA;AAAA,EAGA,KAAK,SAA4B;AAC/B,SAAK,QAAQ,EAAE,MAAM,UAAU,QAAQ,CAAC;AAAA,EAC1C;AAAA;AAAA,EAGA,QAAQ,SAAgC;AACtC,SAAK,QAAQ,EAAE,MAAM,cAAc,QAAQ,CAAC;AAAA,EAC9C;AAAA,EAEQ,QAAQ,MAAuB;AACrC,SAAK,MAAM,KAAK,IAAI;AACpB,QAAI,KAAK,MAAM,UAAU,KAAK,IAAI,UAAU;AAC1C,WAAK,KAAK,MAAM;AAChB;AAAA,IACF;AACA,QAAI,KAAK,MAAO,cAAa,KAAK,KAAK;AACvC,SAAK,QAAQ,WAAW,MAAM,KAAK,KAAK,MAAM,GAAG,KAAK,IAAI,eAAe;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAuB;AAC3B,QAAI,KAAK,OAAO;AACd,mBAAa,KAAK,KAAK;AACvB,WAAK,QAAQ;AAAA,IACf;AACA,QAAI,CAAC,KAAK,MAAM,OAAQ;AACxB,UAAM,QAAQ,KAAK;AACnB,SAAK,QAAQ,CAAC;AACd,UAAM,UAAU,MACb,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,EACjC,IAAI,CAAC,MAAM,EAAE,OAAsB;AACtC,UAAM,cAAc,MACjB,OAAO,CAAC,MAAM,EAAE,SAAS,YAAY,EACrC,IAAI,CAAC,MAAM,EAAE,OAA0B;AAC1C,QAAI;AACF,UAAI,QAAQ,QAAQ;AAClB,cAAM,KAAK,UAAU,wBAAwB,EAAE,QAAQ,CAAC;AAAA,MAC1D;AACA,UAAI,YAAY,QAAQ;AACtB,cAAM,KAAK,UAAU,4BAA4B,EAAE,YAAY,CAAC;AAAA,MAClE;AAAA,IACF,QAAQ;AAEN,WAAK,MAAM,QAAQ,GAAG,KAAK;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAc,UACZ,MACA,MACwB;AACxB,UAAM,MAAM,MAAM,KAAK,OAAO,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,SAAS,GAAG,OAAO,IAAI,OAAO,GAAG;AAAA,MAChF,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,mBAAmB;AAC9D,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,MAAc,QAAQ,KAAe,UAA0C;AAC7E,QAAI;AACJ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,aAAO,KAAK;AACZ,UAAI,KAAK,OAAQ,UAAS,KAAK;AAAA,IACjC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,cAAc,QAAQ,IAAI,QAAQ,IAAI;AAAA,EACnD;AACF;;;AC5OA,IAAM,kBAAkB;AAQxB,SAAS,cAAkC;AACzC,QAAM,IAAI;AACV,QAAM,MAAM,EAAE,eAAe;AAC7B,MACE,OACA,OAAQ,IAAoB,aAAa,YACzC;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,iBAA0B;AACxC,SAAO,YAAY,MAAM;AAC3B;AAOO,SAAS,YAAY,UAAyC;AACnE,MAAI,YAAY,SAAS,OAAQ,QAAO,OAAO,QAAQ;AACvD,QAAM,MAAM,YAAY;AACxB,MAAI,IAAK,QAAO,OAAO,IAAI,SAAS,CAAC;AACrC,SAAO,CAAC;AACV;AAEA,SAAS,OAAO,MAAoC;AAClD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAqB,CAAC;AAC5B,aAAW,KAAK,MAAM;AACpB,UAAM,KAAK,GAAG,EAAE,SAAS,IAAI,EAAE,GAAG;AAClC,QAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,WAAK,IAAI,EAAE;AACX,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/core/types.ts","../src/core/tos.ts","../src/core/client.ts","../src/core/keys.ts"],"sourcesContent":["/**\n * Wire types for the Verbumia End-User Translation Evaluation API.\n * Canonical reference: ./CONTRACT.md (frozen). Backend task 591.\n */\n\nexport interface FeedbackConfig {\n  /** API base, no trailing slash needed. e.g. https://api.verbumia.ca */\n  apiBase: string;\n  /** Public project UUID the widget targets. */\n  projectId: string;\n  /**\n   * sessionId / grouping_key is MINTED SERVER-SIDE by the Verbumia\n   * backend at POST /v1/feedback/tos and returned in the token bundle\n   * (`TokenBundle.grouping_key`). The widget receives + sends it; it\n   * MUST NOT self-generate it. There is intentionally no client config\n   * field for it.\n   */\n  /**\n   * NOTE: there is intentionally NO `tosVersion` field. The ToS version\n   * is a BUILD-TIME constant baked into @verbumia/feedback at release\n   * (`SDK_TOS_VERSION`, task 616) — integrators do not set it; the SDK\n   * sends it automatically.\n   */\n  /** Optional opaque end-user id; server generates one when absent. */\n  endUserId?: string;\n  /** BCP-47 language the widget rates strings in (e.g. \"fr\"). */\n  language: string;\n  /** Optional locale tag stored for analytics. */\n  locale?: string;\n  /** Debounce window (ms) before a queued batch is flushed. Default 1500. */\n  flushDebounceMs?: number;\n  /** Max queued items before an immediate flush. Default 20. */\n  maxBatch?: number;\n  /** Injected fetch (tests / RN polyfills). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface TokenBundle {\n  access_token: string;\n  token_type: \"Bearer\";\n  expires_in: number;\n  refresh_token: string;\n  refresh_expires_in: number;\n  end_user_id: string;\n  tos_version: string;\n  grouping_key: string;\n}\n\nexport interface FeedbackString {\n  namespace: string;\n  key: string;\n  key_uuid: string;\n  language_uuid: string;\n  value: string;\n  translation_hash: string;\n  avg_stars: number | null;\n  ratings_count: number;\n  my_rating: number | null;\n}\n\nexport interface StringsResponse {\n  project_id: string;\n  language: string;\n  strings: FeedbackString[];\n}\n\n/** A 5-star rating queued for a rendered string variant. */\nexport interface RatingInput {\n  namespace: string;\n  key: string;\n  language: string;\n  translation_hash: string;\n  stars: number; // 1..5\n}\n\n/** A suggested alternative translation queued for moderation. */\nexport interface SuggestionInput {\n  namespace: string;\n  key: string;\n  language: string;\n  translation_hash: string;\n  suggested_text: string;\n  comment?: string;\n}\n\nexport interface BatchResponse {\n  accepted: number;\n  rejected: number;\n  items: Array<Record<string, unknown>>;\n}\n\n/** A key the host app declares as on-screen. */\nexport interface DeclaredKey {\n  namespace: string;\n  key: string;\n}\n\nexport class FeedbackError extends Error {\n  constructor(\n    message: string,\n    readonly status?: number,\n    readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"FeedbackError\";\n  }\n}\n","/**\n * BUILD-TIME ToS version constant (task 616, human decision option B).\n *\n * This is baked into the @verbumia/feedback PACKAGE at release. It is\n * NOT an integrator-set config field and NOT server-driven: a stale\n * (e.g. native) app must record consent to the ToS version IT shipped\n * and displayed, for legal correctness — never backend-latest.\n *\n * Releasing a ToS-TEXT change ⇒ bump this constant + cut a new\n * @verbumia/feedback release (per the human/real-CI publish handoff).\n * The backend accepts any version in its acceptable set and records it.\n */\nexport const SDK_TOS_VERSION = \"2026-05-18\";\n","/**\n * Framework-agnostic Verbumia feedback client.\n *\n * Responsibilities:\n *  - versioned-ToS acceptance -> scoped end-user JWT bootstrap\n *  - transparent access-token refresh (rotating refresh token)\n *  - fetch on-screen strings for the widget\n *  - debounced + size-capped batched POST of ratings / suggestions,\n *    mirroring the missing-handler transport contract (ltm 280):\n *    best-effort, never throws into the host app render path.\n *\n * The React and React Native entry points are thin UI shells over this.\n */\n\nimport {\n  type BatchResponse,\n  type FeedbackConfig,\n  FeedbackError,\n  type RatingInput,\n  type StringsResponse,\n  type SuggestionInput,\n  type TokenBundle,\n} from \"./types\";\nimport { SDK_TOS_VERSION } from \"./tos\";\n\nconst SDK_LIB = \"@verbumia/feedback\";\nconst SDK_VER = \"0.2.0\";\n\ntype QueueItem =\n  | { kind: \"rating\"; payload: RatingInput }\n  | { kind: \"suggestion\"; payload: SuggestionInput };\n\nexport class FeedbackClient {\n  private cfg: Required<\n    Pick<FeedbackConfig, \"flushDebounceMs\" | \"maxBatch\">\n  > &\n    FeedbackConfig;\n  private fetchImpl: typeof fetch;\n  private tokens: TokenBundle | null = null;\n  private queue: QueueItem[] = [];\n  private timer: ReturnType<typeof setTimeout> | null = null;\n  private bootstrapping: Promise<TokenBundle> | null = null;\n\n  constructor(config: FeedbackConfig) {\n    this.cfg = {\n      flushDebounceMs: 1500,\n      maxBatch: 20,\n      ...config,\n    };\n    const f = config.fetchImpl ?? globalThis.fetch;\n    if (!f) {\n      throw new FeedbackError(\n        \"no fetch implementation available; pass config.fetchImpl\",\n      );\n    }\n    this.fetchImpl = f.bind(globalThis);\n  }\n\n  private base(): string {\n    return this.cfg.apiBase.replace(/\\/+$/, \"\");\n  }\n\n  get endUserId(): string | undefined {\n    return this.tokens?.end_user_id ?? this.cfg.endUserId;\n  }\n\n  get hasConsented(): boolean {\n    return this.tokens !== null;\n  }\n\n  /** Server-minted sessionId / grouping_key (from the token bundle).\n   * Available only after `acceptTos()`; never client-generated. */\n  get sessionId(): string | undefined {\n    return this.tokens?.grouping_key;\n  }\n\n  /** BCP-47 language the widget is rating strings in. */\n  get language(): string {\n    return this.cfg.language;\n  }\n\n  /** ToS version the end user is asked to accept — the SDK's\n   * build-time constant (task 616). NOT integrator/server set. */\n  get tosVersion(): string {\n    return SDK_TOS_VERSION;\n  }\n\n  /**\n   * Accept the ToS and bootstrap a scoped token. Idempotent: a second call\n   * returns the in-flight / existing bundle rather than re-accepting.\n   */\n  async acceptTos(): Promise<TokenBundle> {\n    if (this.tokens) return this.tokens;\n    if (this.bootstrapping) return this.bootstrapping;\n    this.bootstrapping = (async () => {\n      const res = await this.fetchImpl(`${this.base()}/v1/feedback/tos`, {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({\n          // NO grouping_key: server-minted (task 599). It comes back in\n          // the token bundle and is bound into the JWT server-side.\n          project_id: this.cfg.projectId,\n          end_user_id: this.cfg.endUserId,\n          tos_version: SDK_TOS_VERSION,\n          locale: this.cfg.locale,\n        }),\n      });\n      if (!res.ok) throw await this.problem(res, \"tos acceptance failed\");\n      this.tokens = (await res.json()) as TokenBundle;\n      return this.tokens;\n    })();\n    try {\n      return await this.bootstrapping;\n    } finally {\n      this.bootstrapping = null;\n    }\n  }\n\n  private async refresh(): Promise<void> {\n    if (!this.tokens) throw new FeedbackError(\"not consented\");\n    const res = await this.fetchImpl(\n      `${this.base()}/v1/feedback/token/refresh`,\n      {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ refresh_token: this.tokens.refresh_token }),\n      },\n    );\n    if (!res.ok) {\n      this.tokens = null; // force a fresh ToS step\n      throw await this.problem(res, \"token refresh failed\");\n    }\n    this.tokens = (await res.json()) as TokenBundle;\n  }\n\n  /** Authenticated fetch with a single transparent refresh-on-401 retry. */\n  private async authed(\n    path: string,\n    init: RequestInit,\n    retry = true,\n  ): Promise<Response> {\n    if (!this.tokens) await this.acceptTos();\n    const res = await this.fetchImpl(`${this.base()}${path}`, {\n      ...init,\n      headers: {\n        ...(init.headers ?? {}),\n        Authorization: `Bearer ${this.tokens!.access_token}`,\n      },\n    });\n    if (res.status === 401 && retry) {\n      await this.refresh();\n      return this.authed(path, init, false);\n    }\n    return res;\n  }\n\n  /** Strings rendered on the current view, with this end user's prior rating. */\n  async getStrings(opts?: {\n    keys?: Array<{ namespace: string; key: string }>;\n    namespace?: string;\n    limit?: number;\n  }): Promise<StringsResponse> {\n    const qs = new URLSearchParams({ language: this.cfg.language });\n    if (opts?.keys?.length) {\n      qs.set(\"keys\", opts.keys.map((k) => `${k.namespace}:${k.key}`).join(\",\"));\n    }\n    if (opts?.namespace) qs.set(\"namespace\", opts.namespace);\n    if (opts?.limit) qs.set(\"limit\", String(opts.limit));\n    const res = await this.authed(`/v1/feedback/strings?${qs}`, {\n      method: \"GET\",\n    });\n    if (!res.ok) throw await this.problem(res, \"failed to load strings\");\n    return (await res.json()) as StringsResponse;\n  }\n\n  /** Queue a rating; flushed on debounce or when the batch fills. */\n  rate(payload: RatingInput): void {\n    this.enqueue({ kind: \"rating\", payload });\n  }\n\n  /** Queue a suggestion; flushed on debounce or when the batch fills. */\n  suggest(payload: SuggestionInput): void {\n    this.enqueue({ kind: \"suggestion\", payload });\n  }\n\n  private enqueue(item: QueueItem): void {\n    this.queue.push(item);\n    if (this.queue.length >= this.cfg.maxBatch) {\n      void this.flush();\n      return;\n    }\n    if (this.timer) clearTimeout(this.timer);\n    this.timer = setTimeout(() => void this.flush(), this.cfg.flushDebounceMs);\n  }\n\n  /**\n   * Flush queued items. Best-effort: a transport/auth failure re-queues the\n   * batch once and swallows the error so the host app never sees a throw.\n   */\n  async flush(): Promise<void> {\n    if (this.timer) {\n      clearTimeout(this.timer);\n      this.timer = null;\n    }\n    if (!this.queue.length) return;\n    const batch = this.queue;\n    this.queue = [];\n    const ratings = batch\n      .filter((b) => b.kind === \"rating\")\n      .map((b) => b.payload as RatingInput);\n    const suggestions = batch\n      .filter((b) => b.kind === \"suggestion\")\n      .map((b) => b.payload as SuggestionInput);\n    try {\n      if (ratings.length) {\n        await this.postBatch(\"/v1/feedback/ratings\", { ratings });\n      }\n      if (suggestions.length) {\n        await this.postBatch(\"/v1/feedback/suggestions\", { suggestions });\n      }\n    } catch {\n      // Re-queue once; feedback must never break the host app.\n      this.queue.unshift(...batch);\n    }\n  }\n\n  private async postBatch(\n    path: string,\n    body: unknown,\n  ): Promise<BatchResponse> {\n    const res = await this.authed(path, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\", \"X-SDK\": `${SDK_LIB}@${SDK_VER}` },\n      body: JSON.stringify(body),\n    });\n    if (!res.ok) throw await this.problem(res, \"batch post failed\");\n    return (await res.json()) as BatchResponse;\n  }\n\n  private async problem(res: Response, fallback: string): Promise<FeedbackError> {\n    let code: string | undefined;\n    let detail = fallback;\n    try {\n      const body = (await res.json()) as { code?: string; detail?: string };\n      code = body.code;\n      if (body.detail) detail = body.detail;\n    } catch {\n      /* non-JSON body */\n    }\n    return new FeedbackError(detail, res.status, code);\n  }\n}\n","/**\n * On-screen key discovery.\n *\n * Preferred source: the `@verbumia/*-i18n` SDK exposes a lightweight key\n * registry of keys it has rendered. When that registry is present on the\n * global (the i18n SDK publishes `globalThis.__verbumia_key_registry__`),\n * we read the keys touched on the current view. Otherwise the host app\n * passes an explicit `keys` list — the always-available fallback.\n *\n * The registry contract is intentionally tiny so any framework port of the\n * i18n SDK can implement it without depending on this package.\n */\n\nimport type { DeclaredKey } from \"./types\";\n\nconst REGISTRY_GLOBAL = \"__verbumia_key_registry__\";\n\ninterface KeyRegistry {\n  /** Returns the keys rendered since the last `reset()` (or ever). */\n  snapshot(): DeclaredKey[];\n  reset?(): void;\n}\n\nfunction getRegistry(): KeyRegistry | null {\n  const g = globalThis as Record<string, unknown>;\n  const reg = g[REGISTRY_GLOBAL];\n  if (\n    reg &&\n    typeof (reg as KeyRegistry).snapshot === \"function\"\n  ) {\n    return reg as KeyRegistry;\n  }\n  return null;\n}\n\n/** True when a compatible `@verbumia/*-i18n` registry is detectable. */\nexport function hasKeyRegistry(): boolean {\n  return getRegistry() !== null;\n}\n\n/**\n * Resolve the on-screen keys: explicit `keys` prop always wins (it is the\n * customer's authoritative declaration); otherwise fall back to the i18n\n * registry snapshot; otherwise an empty list (widget shows \"no strings\").\n *\n * Optional `namespace` filter (task 618, CONTRACT v6 — ADDITIVE): when\n * set (a single namespace or a list), the resolved set is narrowed to\n * keys whose `namespace` is in the filter. The filter is applied AFTER\n * resolution, so it composes with v5 rendered-scoping as\n * `rendered ∩ namespace`. UNSET / empty ⇒ unchanged v5 behaviour (all\n * resolved keys). Backward-compatible: `resolveKeys(keys)` is unaffected.\n */\nexport function resolveKeys(\n  explicit?: DeclaredKey[],\n  namespace?: string | string[],\n): DeclaredKey[] {\n  const base =\n    explicit && explicit.length\n      ? dedupe(explicit)\n      : getRegistry()\n        ? dedupe(getRegistry()!.snapshot())\n        : [];\n  return filterByNamespace(base, namespace);\n}\n\n/** Narrow keys to those whose namespace is in `namespace`. An undefined\n *  filter, an empty string, or an empty list means \"no filter\" (the\n *  additive default — identical to v5). Exported so non-panel callers\n *  (e.g. a custom /core integration) can apply the same semantics. */\nexport function filterByNamespace(\n  keys: DeclaredKey[],\n  namespace?: string | string[],\n): DeclaredKey[] {\n  const list = (Array.isArray(namespace) ? namespace : namespace ? [namespace] : [])\n    .map((n) => n.trim())\n    .filter(Boolean);\n  if (!list.length) return keys;\n  const allow = new Set(list);\n  return keys.filter((k) => allow.has(k.namespace));\n}\n\nfunction dedupe(keys: DeclaredKey[]): DeclaredKey[] {\n  const seen = new Set<string>();\n  const out: DeclaredKey[] = [];\n  for (const k of keys) {\n    const id = `${k.namespace}:${k.key}`;\n    if (!seen.has(id)) {\n      seen.add(id);\n      out.push(k);\n    }\n  }\n  return out;\n}\n"],"mappings":";AAiGO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YACE,SACS,QACA,MACT;AACA,UAAM,OAAO;AAHJ;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAKb;;;AC9FO,IAAM,kBAAkB;;;ACa/B,IAAM,UAAU;AAChB,IAAM,UAAU;AAMT,IAAM,iBAAN,MAAqB;AAAA,EAClB;AAAA,EAIA;AAAA,EACA,SAA6B;AAAA,EAC7B,QAAqB,CAAC;AAAA,EACtB,QAA8C;AAAA,EAC9C,gBAA6C;AAAA,EAErD,YAAY,QAAwB;AAClC,SAAK,MAAM;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,UAAM,IAAI,OAAO,aAAa,WAAW;AACzC,QAAI,CAAC,GAAG;AACN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,YAAY,EAAE,KAAK,UAAU;AAAA,EACpC;AAAA,EAEQ,OAAe;AACrB,WAAO,KAAK,IAAI,QAAQ,QAAQ,QAAQ,EAAE;AAAA,EAC5C;AAAA,EAEA,IAAI,YAAgC;AAClC,WAAO,KAAK,QAAQ,eAAe,KAAK,IAAI;AAAA,EAC9C;AAAA,EAEA,IAAI,eAAwB;AAC1B,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA;AAAA,EAIA,IAAI,YAAgC;AAClC,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA,EAGA,IAAI,WAAmB;AACrB,WAAO,KAAK,IAAI;AAAA,EAClB;AAAA;AAAA;AAAA,EAIA,IAAI,aAAqB;AACvB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAkC;AACtC,QAAI,KAAK,OAAQ,QAAO,KAAK;AAC7B,QAAI,KAAK,cAAe,QAAO,KAAK;AACpC,SAAK,iBAAiB,YAAY;AAChC,YAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,CAAC,oBAAoB;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA;AAAA;AAAA,UAGnB,YAAY,KAAK,IAAI;AAAA,UACrB,aAAa,KAAK,IAAI;AAAA,UACtB,aAAa;AAAA,UACb,QAAQ,KAAK,IAAI;AAAA,QACnB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,uBAAuB;AAClE,WAAK,SAAU,MAAM,IAAI,KAAK;AAC9B,aAAO,KAAK;AAAA,IACd,GAAG;AACH,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,gBAAgB;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAc,UAAyB;AACrC,QAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,cAAc,eAAe;AACzD,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB,GAAG,KAAK,KAAK,CAAC;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,eAAe,KAAK,OAAO,cAAc,CAAC;AAAA,MACnE;AAAA,IACF;AACA,QAAI,CAAC,IAAI,IAAI;AACX,WAAK,SAAS;AACd,YAAM,MAAM,KAAK,QAAQ,KAAK,sBAAsB;AAAA,IACtD;AACA,SAAK,SAAU,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA;AAAA,EAGA,MAAc,OACZ,MACA,MACA,QAAQ,MACW;AACnB,QAAI,CAAC,KAAK,OAAQ,OAAM,KAAK,UAAU;AACvC,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI;AAAA,MACxD,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAI,KAAK,WAAW,CAAC;AAAA,QACrB,eAAe,UAAU,KAAK,OAAQ,YAAY;AAAA,MACpD;AAAA,IACF,CAAC;AACD,QAAI,IAAI,WAAW,OAAO,OAAO;AAC/B,YAAM,KAAK,QAAQ;AACnB,aAAO,KAAK,OAAO,MAAM,MAAM,KAAK;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,WAAW,MAIY;AAC3B,UAAM,KAAK,IAAI,gBAAgB,EAAE,UAAU,KAAK,IAAI,SAAS,CAAC;AAC9D,QAAI,MAAM,MAAM,QAAQ;AACtB,SAAG,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,IAC1E;AACA,QAAI,MAAM,UAAW,IAAG,IAAI,aAAa,KAAK,SAAS;AACvD,QAAI,MAAM,MAAO,IAAG,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AACnD,UAAM,MAAM,MAAM,KAAK,OAAO,wBAAwB,EAAE,IAAI;AAAA,MAC1D,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,wBAAwB;AACnE,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA;AAAA,EAGA,KAAK,SAA4B;AAC/B,SAAK,QAAQ,EAAE,MAAM,UAAU,QAAQ,CAAC;AAAA,EAC1C;AAAA;AAAA,EAGA,QAAQ,SAAgC;AACtC,SAAK,QAAQ,EAAE,MAAM,cAAc,QAAQ,CAAC;AAAA,EAC9C;AAAA,EAEQ,QAAQ,MAAuB;AACrC,SAAK,MAAM,KAAK,IAAI;AACpB,QAAI,KAAK,MAAM,UAAU,KAAK,IAAI,UAAU;AAC1C,WAAK,KAAK,MAAM;AAChB;AAAA,IACF;AACA,QAAI,KAAK,MAAO,cAAa,KAAK,KAAK;AACvC,SAAK,QAAQ,WAAW,MAAM,KAAK,KAAK,MAAM,GAAG,KAAK,IAAI,eAAe;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAuB;AAC3B,QAAI,KAAK,OAAO;AACd,mBAAa,KAAK,KAAK;AACvB,WAAK,QAAQ;AAAA,IACf;AACA,QAAI,CAAC,KAAK,MAAM,OAAQ;AACxB,UAAM,QAAQ,KAAK;AACnB,SAAK,QAAQ,CAAC;AACd,UAAM,UAAU,MACb,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,EACjC,IAAI,CAAC,MAAM,EAAE,OAAsB;AACtC,UAAM,cAAc,MACjB,OAAO,CAAC,MAAM,EAAE,SAAS,YAAY,EACrC,IAAI,CAAC,MAAM,EAAE,OAA0B;AAC1C,QAAI;AACF,UAAI,QAAQ,QAAQ;AAClB,cAAM,KAAK,UAAU,wBAAwB,EAAE,QAAQ,CAAC;AAAA,MAC1D;AACA,UAAI,YAAY,QAAQ;AACtB,cAAM,KAAK,UAAU,4BAA4B,EAAE,YAAY,CAAC;AAAA,MAClE;AAAA,IACF,QAAQ;AAEN,WAAK,MAAM,QAAQ,GAAG,KAAK;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAc,UACZ,MACA,MACwB;AACxB,UAAM,MAAM,MAAM,KAAK,OAAO,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,SAAS,GAAG,OAAO,IAAI,OAAO,GAAG;AAAA,MAChF,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,mBAAmB;AAC9D,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,MAAc,QAAQ,KAAe,UAA0C;AAC7E,QAAI;AACJ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,aAAO,KAAK;AACZ,UAAI,KAAK,OAAQ,UAAS,KAAK;AAAA,IACjC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,cAAc,QAAQ,IAAI,QAAQ,IAAI;AAAA,EACnD;AACF;;;AC5OA,IAAM,kBAAkB;AAQxB,SAAS,cAAkC;AACzC,QAAM,IAAI;AACV,QAAM,MAAM,EAAE,eAAe;AAC7B,MACE,OACA,OAAQ,IAAoB,aAAa,YACzC;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,iBAA0B;AACxC,SAAO,YAAY,MAAM;AAC3B;AAcO,SAAS,YACd,UACA,WACe;AACf,QAAM,OACJ,YAAY,SAAS,SACjB,OAAO,QAAQ,IACf,YAAY,IACV,OAAO,YAAY,EAAG,SAAS,CAAC,IAChC,CAAC;AACT,SAAO,kBAAkB,MAAM,SAAS;AAC1C;AAMO,SAAS,kBACd,MACA,WACe;AACf,QAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI,YAAY,YAAY,CAAC,SAAS,IAAI,CAAC,GAC7E,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACjB,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,QAAM,QAAQ,IAAI,IAAI,IAAI;AAC1B,SAAO,KAAK,OAAO,CAAC,MAAM,MAAM,IAAI,EAAE,SAAS,CAAC;AAClD;AAEA,SAAS,OAAO,MAAoC;AAClD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAqB,CAAC;AAC5B,aAAW,KAAK,MAAM;AACpB,UAAM,KAAK,GAAG,EAAE,SAAS,IAAI,EAAE,GAAG;AAClC,QAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,WAAK,IAAI,EAAE;AACX,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/core/index.cjs

@@ -23,6 +23,7 @@ __export(core_exports, {
   FeedbackClient: () => FeedbackClient,
   FeedbackError: () => FeedbackError,
   SDK_TOS_VERSION: () => SDK_TOS_VERSION,
+  filterByNamespace: () => filterByNamespace,
   hasKeyRegistry: () => hasKeyRegistry,
   resolveKeys: () => resolveKeys
 });
@@ -45,7 +46,7 @@ var SDK_TOS_VERSION = "2026-05-18";
 
 // src/core/client.ts
 var SDK_LIB = "@verbumia/feedback";
-var SDK_VER = "0.1.0";
+var SDK_VER = "0.2.0";
 var FeedbackClient = class {
   cfg;
   fetchImpl;
@@ -243,11 +244,15 @@ function getRegistry() {
 function hasKeyRegistry() {
   return getRegistry() !== null;
 }
-function resolveKeys(explicit) {
-  if (explicit && explicit.length) return dedupe(explicit);
-  const reg = getRegistry();
-  if (reg) return dedupe(reg.snapshot());
-  return [];
+function resolveKeys(explicit, namespace) {
+  const base = explicit && explicit.length ? dedupe(explicit) : getRegistry() ? dedupe(getRegistry().snapshot()) : [];
+  return filterByNamespace(base, namespace);
+}
+function filterByNamespace(keys, namespace) {
+  const list = (Array.isArray(namespace) ? namespace : namespace ? [namespace] : []).map((n) => n.trim()).filter(Boolean);
+  if (!list.length) return keys;
+  const allow = new Set(list);
+  return keys.filter((k) => allow.has(k.namespace));
 }
 function dedupe(keys) {
   const seen = /* @__PURE__ */ new Set();
@@ -266,6 +271,7 @@ function dedupe(keys) {
   FeedbackClient,
   FeedbackError,
   SDK_TOS_VERSION,
+  filterByNamespace,
   hasKeyRegistry,
   resolveKeys
 });

package/dist/core/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/index.ts","../../src/core/types.ts","../../src/core/tos.ts","../../src/core/client.ts","../../src/core/keys.ts"],"sourcesContent":["export { FeedbackClient } from \"./client\";\nexport { SDK_TOS_VERSION } from \"./tos\";\nexport { hasKeyRegistry, resolveKeys } from \"./keys\";\nexport {\n  type BatchResponse,\n  type DeclaredKey,\n  type FeedbackConfig,\n  FeedbackError,\n  type FeedbackString,\n  type RatingInput,\n  type StringsResponse,\n  type SuggestionInput,\n  type TokenBundle,\n} from \"./types\";\n","/**\n * Wire types for the Verbumia End-User Translation Evaluation API.\n * Canonical reference: ./CONTRACT.md (frozen). Backend task 591.\n */\n\nexport interface FeedbackConfig {\n  /** API base, no trailing slash needed. e.g. https://api.verbumia.ca */\n  apiBase: string;\n  /** Public project UUID the widget targets. */\n  projectId: string;\n  /**\n   * sessionId / grouping_key is MINTED SERVER-SIDE by the Verbumia\n   * backend at POST /v1/feedback/tos and returned in the token bundle\n   * (`TokenBundle.grouping_key`). The widget receives + sends it; it\n   * MUST NOT self-generate it. There is intentionally no client config\n   * field for it.\n   */\n  /**\n   * NOTE: there is intentionally NO `tosVersion` field. The ToS version\n   * is a BUILD-TIME constant baked into @verbumia/feedback at release\n   * (`SDK_TOS_VERSION`, task 616) — integrators do not set it; the SDK\n   * sends it automatically.\n   */\n  /** Optional opaque end-user id; server generates one when absent. */\n  endUserId?: string;\n  /** BCP-47 language the widget rates strings in (e.g. \"fr\"). */\n  language: string;\n  /** Optional locale tag stored for analytics. */\n  locale?: string;\n  /** Debounce window (ms) before a queued batch is flushed. Default 1500. */\n  flushDebounceMs?: number;\n  /** Max queued items before an immediate flush. Default 20. */\n  maxBatch?: number;\n  /** Injected fetch (tests / RN polyfills). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface TokenBundle {\n  access_token: string;\n  token_type: \"Bearer\";\n  expires_in: number;\n  refresh_token: string;\n  refresh_expires_in: number;\n  end_user_id: string;\n  tos_version: string;\n  grouping_key: string;\n}\n\nexport interface FeedbackString {\n  namespace: string;\n  key: string;\n  key_uuid: string;\n  language_uuid: string;\n  value: string;\n  translation_hash: string;\n  avg_stars: number | null;\n  ratings_count: number;\n  my_rating: number | null;\n}\n\nexport interface StringsResponse {\n  project_id: string;\n  language: string;\n  strings: FeedbackString[];\n}\n\n/** A 5-star rating queued for a rendered string variant. */\nexport interface RatingInput {\n  namespace: string;\n  key: string;\n  language: string;\n  translation_hash: string;\n  stars: number; // 1..5\n}\n\n/** A suggested alternative translation queued for moderation. */\nexport interface SuggestionInput {\n  namespace: string;\n  key: string;\n  language: string;\n  translation_hash: string;\n  suggested_text: string;\n  comment?: string;\n}\n\nexport interface BatchResponse {\n  accepted: number;\n  rejected: number;\n  items: Array<Record<string, unknown>>;\n}\n\n/** A key the host app declares as on-screen. */\nexport interface DeclaredKey {\n  namespace: string;\n  key: string;\n}\n\nexport class FeedbackError extends Error {\n  constructor(\n    message: string,\n    readonly status?: number,\n    readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"FeedbackError\";\n  }\n}\n","/**\n * BUILD-TIME ToS version constant (task 616, human decision option B).\n *\n * This is baked into the @verbumia/feedback PACKAGE at release. It is\n * NOT an integrator-set config field and NOT server-driven: a stale\n * (e.g. native) app must record consent to the ToS version IT shipped\n * and displayed, for legal correctness — never backend-latest.\n *\n * Releasing a ToS-TEXT change ⇒ bump this constant + cut a new\n * @verbumia/feedback release (per the human/real-CI publish handoff).\n * The backend accepts any version in its acceptable set and records it.\n */\nexport const SDK_TOS_VERSION = \"2026-05-18\";\n","/**\n * Framework-agnostic Verbumia feedback client.\n *\n * Responsibilities:\n *  - versioned-ToS acceptance -> scoped end-user JWT bootstrap\n *  - transparent access-token refresh (rotating refresh token)\n *  - fetch on-screen strings for the widget\n *  - debounced + size-capped batched POST of ratings / suggestions,\n *    mirroring the missing-handler transport contract (ltm 280):\n *    best-effort, never throws into the host app render path.\n *\n * The React and React Native entry points are thin UI shells over this.\n */\n\nimport {\n  type BatchResponse,\n  type FeedbackConfig,\n  FeedbackError,\n  type RatingInput,\n  type StringsResponse,\n  type SuggestionInput,\n  type TokenBundle,\n} from \"./types\";\nimport { SDK_TOS_VERSION } from \"./tos\";\n\nconst SDK_LIB = \"@verbumia/feedback\";\nconst SDK_VER = \"0.1.0\";\n\ntype QueueItem =\n  | { kind: \"rating\"; payload: RatingInput }\n  | { kind: \"suggestion\"; payload: SuggestionInput };\n\nexport class FeedbackClient {\n  private cfg: Required<\n    Pick<FeedbackConfig, \"flushDebounceMs\" | \"maxBatch\">\n  > &\n    FeedbackConfig;\n  private fetchImpl: typeof fetch;\n  private tokens: TokenBundle | null = null;\n  private queue: QueueItem[] = [];\n  private timer: ReturnType<typeof setTimeout> | null = null;\n  private bootstrapping: Promise<TokenBundle> | null = null;\n\n  constructor(config: FeedbackConfig) {\n    this.cfg = {\n      flushDebounceMs: 1500,\n      maxBatch: 20,\n      ...config,\n    };\n    const f = config.fetchImpl ?? globalThis.fetch;\n    if (!f) {\n      throw new FeedbackError(\n        \"no fetch implementation available; pass config.fetchImpl\",\n      );\n    }\n    this.fetchImpl = f.bind(globalThis);\n  }\n\n  private base(): string {\n    return this.cfg.apiBase.replace(/\\/+$/, \"\");\n  }\n\n  get endUserId(): string | undefined {\n    return this.tokens?.end_user_id ?? this.cfg.endUserId;\n  }\n\n  get hasConsented(): boolean {\n    return this.tokens !== null;\n  }\n\n  /** Server-minted sessionId / grouping_key (from the token bundle).\n   * Available only after `acceptTos()`; never client-generated. */\n  get sessionId(): string | undefined {\n    return this.tokens?.grouping_key;\n  }\n\n  /** BCP-47 language the widget is rating strings in. */\n  get language(): string {\n    return this.cfg.language;\n  }\n\n  /** ToS version the end user is asked to accept — the SDK's\n   * build-time constant (task 616). NOT integrator/server set. */\n  get tosVersion(): string {\n    return SDK_TOS_VERSION;\n  }\n\n  /**\n   * Accept the ToS and bootstrap a scoped token. Idempotent: a second call\n   * returns the in-flight / existing bundle rather than re-accepting.\n   */\n  async acceptTos(): Promise<TokenBundle> {\n    if (this.tokens) return this.tokens;\n    if (this.bootstrapping) return this.bootstrapping;\n    this.bootstrapping = (async () => {\n      const res = await this.fetchImpl(`${this.base()}/v1/feedback/tos`, {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({\n          // NO grouping_key: server-minted (task 599). It comes back in\n          // the token bundle and is bound into the JWT server-side.\n          project_id: this.cfg.projectId,\n          end_user_id: this.cfg.endUserId,\n          tos_version: SDK_TOS_VERSION,\n          locale: this.cfg.locale,\n        }),\n      });\n      if (!res.ok) throw await this.problem(res, \"tos acceptance failed\");\n      this.tokens = (await res.json()) as TokenBundle;\n      return this.tokens;\n    })();\n    try {\n      return await this.bootstrapping;\n    } finally {\n      this.bootstrapping = null;\n    }\n  }\n\n  private async refresh(): Promise<void> {\n    if (!this.tokens) throw new FeedbackError(\"not consented\");\n    const res = await this.fetchImpl(\n      `${this.base()}/v1/feedback/token/refresh`,\n      {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ refresh_token: this.tokens.refresh_token }),\n      },\n    );\n    if (!res.ok) {\n      this.tokens = null; // force a fresh ToS step\n      throw await this.problem(res, \"token refresh failed\");\n    }\n    this.tokens = (await res.json()) as TokenBundle;\n  }\n\n  /** Authenticated fetch with a single transparent refresh-on-401 retry. */\n  private async authed(\n    path: string,\n    init: RequestInit,\n    retry = true,\n  ): Promise<Response> {\n    if (!this.tokens) await this.acceptTos();\n    const res = await this.fetchImpl(`${this.base()}${path}`, {\n      ...init,\n      headers: {\n        ...(init.headers ?? {}),\n        Authorization: `Bearer ${this.tokens!.access_token}`,\n      },\n    });\n    if (res.status === 401 && retry) {\n      await this.refresh();\n      return this.authed(path, init, false);\n    }\n    return res;\n  }\n\n  /** Strings rendered on the current view, with this end user's prior rating. */\n  async getStrings(opts?: {\n    keys?: Array<{ namespace: string; key: string }>;\n    namespace?: string;\n    limit?: number;\n  }): Promise<StringsResponse> {\n    const qs = new URLSearchParams({ language: this.cfg.language });\n    if (opts?.keys?.length) {\n      qs.set(\"keys\", opts.keys.map((k) => `${k.namespace}:${k.key}`).join(\",\"));\n    }\n    if (opts?.namespace) qs.set(\"namespace\", opts.namespace);\n    if (opts?.limit) qs.set(\"limit\", String(opts.limit));\n    const res = await this.authed(`/v1/feedback/strings?${qs}`, {\n      method: \"GET\",\n    });\n    if (!res.ok) throw await this.problem(res, \"failed to load strings\");\n    return (await res.json()) as StringsResponse;\n  }\n\n  /** Queue a rating; flushed on debounce or when the batch fills. */\n  rate(payload: RatingInput): void {\n    this.enqueue({ kind: \"rating\", payload });\n  }\n\n  /** Queue a suggestion; flushed on debounce or when the batch fills. */\n  suggest(payload: SuggestionInput): void {\n    this.enqueue({ kind: \"suggestion\", payload });\n  }\n\n  private enqueue(item: QueueItem): void {\n    this.queue.push(item);\n    if (this.queue.length >= this.cfg.maxBatch) {\n      void this.flush();\n      return;\n    }\n    if (this.timer) clearTimeout(this.timer);\n    this.timer = setTimeout(() => void this.flush(), this.cfg.flushDebounceMs);\n  }\n\n  /**\n   * Flush queued items. Best-effort: a transport/auth failure re-queues the\n   * batch once and swallows the error so the host app never sees a throw.\n   */\n  async flush(): Promise<void> {\n    if (this.timer) {\n      clearTimeout(this.timer);\n      this.timer = null;\n    }\n    if (!this.queue.length) return;\n    const batch = this.queue;\n    this.queue = [];\n    const ratings = batch\n      .filter((b) => b.kind === \"rating\")\n      .map((b) => b.payload as RatingInput);\n    const suggestions = batch\n      .filter((b) => b.kind === \"suggestion\")\n      .map((b) => b.payload as SuggestionInput);\n    try {\n      if (ratings.length) {\n        await this.postBatch(\"/v1/feedback/ratings\", { ratings });\n      }\n      if (suggestions.length) {\n        await this.postBatch(\"/v1/feedback/suggestions\", { suggestions });\n      }\n    } catch {\n      // Re-queue once; feedback must never break the host app.\n      this.queue.unshift(...batch);\n    }\n  }\n\n  private async postBatch(\n    path: string,\n    body: unknown,\n  ): Promise<BatchResponse> {\n    const res = await this.authed(path, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\", \"X-SDK\": `${SDK_LIB}@${SDK_VER}` },\n      body: JSON.stringify(body),\n    });\n    if (!res.ok) throw await this.problem(res, \"batch post failed\");\n    return (await res.json()) as BatchResponse;\n  }\n\n  private async problem(res: Response, fallback: string): Promise<FeedbackError> {\n    let code: string | undefined;\n    let detail = fallback;\n    try {\n      const body = (await res.json()) as { code?: string; detail?: string };\n      code = body.code;\n      if (body.detail) detail = body.detail;\n    } catch {\n      /* non-JSON body */\n    }\n    return new FeedbackError(detail, res.status, code);\n  }\n}\n","/**\n * On-screen key discovery.\n *\n * Preferred source: the `@verbumia/*-i18n` SDK exposes a lightweight key\n * registry of keys it has rendered. When that registry is present on the\n * global (the i18n SDK publishes `globalThis.__verbumia_key_registry__`),\n * we read the keys touched on the current view. Otherwise the host app\n * passes an explicit `keys` list — the always-available fallback.\n *\n * The registry contract is intentionally tiny so any framework port of the\n * i18n SDK can implement it without depending on this package.\n */\n\nimport type { DeclaredKey } from \"./types\";\n\nconst REGISTRY_GLOBAL = \"__verbumia_key_registry__\";\n\ninterface KeyRegistry {\n  /** Returns the keys rendered since the last `reset()` (or ever). */\n  snapshot(): DeclaredKey[];\n  reset?(): void;\n}\n\nfunction getRegistry(): KeyRegistry | null {\n  const g = globalThis as Record<string, unknown>;\n  const reg = g[REGISTRY_GLOBAL];\n  if (\n    reg &&\n    typeof (reg as KeyRegistry).snapshot === \"function\"\n  ) {\n    return reg as KeyRegistry;\n  }\n  return null;\n}\n\n/** True when a compatible `@verbumia/*-i18n` registry is detectable. */\nexport function hasKeyRegistry(): boolean {\n  return getRegistry() !== null;\n}\n\n/**\n * Resolve the on-screen keys: explicit `keys` prop always wins (it is the\n * customer's authoritative declaration); otherwise fall back to the i18n\n * registry snapshot; otherwise an empty list (widget shows \"no strings\").\n */\nexport function resolveKeys(explicit?: DeclaredKey[]): DeclaredKey[] {\n  if (explicit && explicit.length) return dedupe(explicit);\n  const reg = getRegistry();\n  if (reg) return dedupe(reg.snapshot());\n  return [];\n}\n\nfunction dedupe(keys: DeclaredKey[]): DeclaredKey[] {\n  const seen = new Set<string>();\n  const out: DeclaredKey[] = [];\n  for (const k of keys) {\n    const id = `${k.namespace}:${k.key}`;\n    if (!seen.has(id)) {\n      seen.add(id);\n      out.push(k);\n    }\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACiGO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YACE,SACS,QACA,MACT;AACA,UAAM,OAAO;AAHJ;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAKb;;;AC9FO,IAAM,kBAAkB;;;ACa/B,IAAM,UAAU;AAChB,IAAM,UAAU;AAMT,IAAM,iBAAN,MAAqB;AAAA,EAClB;AAAA,EAIA;AAAA,EACA,SAA6B;AAAA,EAC7B,QAAqB,CAAC;AAAA,EACtB,QAA8C;AAAA,EAC9C,gBAA6C;AAAA,EAErD,YAAY,QAAwB;AAClC,SAAK,MAAM;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,UAAM,IAAI,OAAO,aAAa,WAAW;AACzC,QAAI,CAAC,GAAG;AACN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,YAAY,EAAE,KAAK,UAAU;AAAA,EACpC;AAAA,EAEQ,OAAe;AACrB,WAAO,KAAK,IAAI,QAAQ,QAAQ,QAAQ,EAAE;AAAA,EAC5C;AAAA,EAEA,IAAI,YAAgC;AAClC,WAAO,KAAK,QAAQ,eAAe,KAAK,IAAI;AAAA,EAC9C;AAAA,EAEA,IAAI,eAAwB;AAC1B,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA;AAAA,EAIA,IAAI,YAAgC;AAClC,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA,EAGA,IAAI,WAAmB;AACrB,WAAO,KAAK,IAAI;AAAA,EAClB;AAAA;AAAA;AAAA,EAIA,IAAI,aAAqB;AACvB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAkC;AACtC,QAAI,KAAK,OAAQ,QAAO,KAAK;AAC7B,QAAI,KAAK,cAAe,QAAO,KAAK;AACpC,SAAK,iBAAiB,YAAY;AAChC,YAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,CAAC,oBAAoB;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA;AAAA;AAAA,UAGnB,YAAY,KAAK,IAAI;AAAA,UACrB,aAAa,KAAK,IAAI;AAAA,UACtB,aAAa;AAAA,UACb,QAAQ,KAAK,IAAI;AAAA,QACnB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,uBAAuB;AAClE,WAAK,SAAU,MAAM,IAAI,KAAK;AAC9B,aAAO,KAAK;AAAA,IACd,GAAG;AACH,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,gBAAgB;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAc,UAAyB;AACrC,QAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,cAAc,eAAe;AACzD,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB,GAAG,KAAK,KAAK,CAAC;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,eAAe,KAAK,OAAO,cAAc,CAAC;AAAA,MACnE;AAAA,IACF;AACA,QAAI,CAAC,IAAI,IAAI;AACX,WAAK,SAAS;AACd,YAAM,MAAM,KAAK,QAAQ,KAAK,sBAAsB;AAAA,IACtD;AACA,SAAK,SAAU,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA;AAAA,EAGA,MAAc,OACZ,MACA,MACA,QAAQ,MACW;AACnB,QAAI,CAAC,KAAK,OAAQ,OAAM,KAAK,UAAU;AACvC,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI;AAAA,MACxD,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAI,KAAK,WAAW,CAAC;AAAA,QACrB,eAAe,UAAU,KAAK,OAAQ,YAAY;AAAA,MACpD;AAAA,IACF,CAAC;AACD,QAAI,IAAI,WAAW,OAAO,OAAO;AAC/B,YAAM,KAAK,QAAQ;AACnB,aAAO,KAAK,OAAO,MAAM,MAAM,KAAK;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,WAAW,MAIY;AAC3B,UAAM,KAAK,IAAI,gBAAgB,EAAE,UAAU,KAAK,IAAI,SAAS,CAAC;AAC9D,QAAI,MAAM,MAAM,QAAQ;AACtB,SAAG,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,IAC1E;AACA,QAAI,MAAM,UAAW,IAAG,IAAI,aAAa,KAAK,SAAS;AACvD,QAAI,MAAM,MAAO,IAAG,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AACnD,UAAM,MAAM,MAAM,KAAK,OAAO,wBAAwB,EAAE,IAAI;AAAA,MAC1D,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,wBAAwB;AACnE,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA;AAAA,EAGA,KAAK,SAA4B;AAC/B,SAAK,QAAQ,EAAE,MAAM,UAAU,QAAQ,CAAC;AAAA,EAC1C;AAAA;AAAA,EAGA,QAAQ,SAAgC;AACtC,SAAK,QAAQ,EAAE,MAAM,cAAc,QAAQ,CAAC;AAAA,EAC9C;AAAA,EAEQ,QAAQ,MAAuB;AACrC,SAAK,MAAM,KAAK,IAAI;AACpB,QAAI,KAAK,MAAM,UAAU,KAAK,IAAI,UAAU;AAC1C,WAAK,KAAK,MAAM;AAChB;AAAA,IACF;AACA,QAAI,KAAK,MAAO,cAAa,KAAK,KAAK;AACvC,SAAK,QAAQ,WAAW,MAAM,KAAK,KAAK,MAAM,GAAG,KAAK,IAAI,eAAe;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAuB;AAC3B,QAAI,KAAK,OAAO;AACd,mBAAa,KAAK,KAAK;AACvB,WAAK,QAAQ;AAAA,IACf;AACA,QAAI,CAAC,KAAK,MAAM,OAAQ;AACxB,UAAM,QAAQ,KAAK;AACnB,SAAK,QAAQ,CAAC;AACd,UAAM,UAAU,MACb,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,EACjC,IAAI,CAAC,MAAM,EAAE,OAAsB;AACtC,UAAM,cAAc,MACjB,OAAO,CAAC,MAAM,EAAE,SAAS,YAAY,EACrC,IAAI,CAAC,MAAM,EAAE,OAA0B;AAC1C,QAAI;AACF,UAAI,QAAQ,QAAQ;AAClB,cAAM,KAAK,UAAU,wBAAwB,EAAE,QAAQ,CAAC;AAAA,MAC1D;AACA,UAAI,YAAY,QAAQ;AACtB,cAAM,KAAK,UAAU,4BAA4B,EAAE,YAAY,CAAC;AAAA,MAClE;AAAA,IACF,QAAQ;AAEN,WAAK,MAAM,QAAQ,GAAG,KAAK;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAc,UACZ,MACA,MACwB;AACxB,UAAM,MAAM,MAAM,KAAK,OAAO,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,SAAS,GAAG,OAAO,IAAI,OAAO,GAAG;AAAA,MAChF,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,mBAAmB;AAC9D,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,MAAc,QAAQ,KAAe,UAA0C;AAC7E,QAAI;AACJ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,aAAO,KAAK;AACZ,UAAI,KAAK,OAAQ,UAAS,KAAK;AAAA,IACjC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,cAAc,QAAQ,IAAI,QAAQ,IAAI;AAAA,EACnD;AACF;;;AC5OA,IAAM,kBAAkB;AAQxB,SAAS,cAAkC;AACzC,QAAM,IAAI;AACV,QAAM,MAAM,EAAE,eAAe;AAC7B,MACE,OACA,OAAQ,IAAoB,aAAa,YACzC;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,iBAA0B;AACxC,SAAO,YAAY,MAAM;AAC3B;AAOO,SAAS,YAAY,UAAyC;AACnE,MAAI,YAAY,SAAS,OAAQ,QAAO,OAAO,QAAQ;AACvD,QAAM,MAAM,YAAY;AACxB,MAAI,IAAK,QAAO,OAAO,IAAI,SAAS,CAAC;AACrC,SAAO,CAAC;AACV;AAEA,SAAS,OAAO,MAAoC;AAClD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAqB,CAAC;AAC5B,aAAW,KAAK,MAAM;AACpB,UAAM,KAAK,GAAG,EAAE,SAAS,IAAI,EAAE,GAAG;AAClC,QAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,WAAK,IAAI,EAAE;AACX,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/core/index.ts","../../src/core/types.ts","../../src/core/tos.ts","../../src/core/client.ts","../../src/core/keys.ts"],"sourcesContent":["export { FeedbackClient } from \"./client\";\nexport { SDK_TOS_VERSION } from \"./tos\";\nexport { filterByNamespace, hasKeyRegistry, resolveKeys } from \"./keys\";\nexport {\n  type BatchResponse,\n  type DeclaredKey,\n  type FeedbackConfig,\n  FeedbackError,\n  type FeedbackString,\n  type RatingInput,\n  type StringsResponse,\n  type SuggestionInput,\n  type TokenBundle,\n} from \"./types\";\n","/**\n * Wire types for the Verbumia End-User Translation Evaluation API.\n * Canonical reference: ./CONTRACT.md (frozen). Backend task 591.\n */\n\nexport interface FeedbackConfig {\n  /** API base, no trailing slash needed. e.g. https://api.verbumia.ca */\n  apiBase: string;\n  /** Public project UUID the widget targets. */\n  projectId: string;\n  /**\n   * sessionId / grouping_key is MINTED SERVER-SIDE by the Verbumia\n   * backend at POST /v1/feedback/tos and returned in the token bundle\n   * (`TokenBundle.grouping_key`). The widget receives + sends it; it\n   * MUST NOT self-generate it. There is intentionally no client config\n   * field for it.\n   */\n  /**\n   * NOTE: there is intentionally NO `tosVersion` field. The ToS version\n   * is a BUILD-TIME constant baked into @verbumia/feedback at release\n   * (`SDK_TOS_VERSION`, task 616) — integrators do not set it; the SDK\n   * sends it automatically.\n   */\n  /** Optional opaque end-user id; server generates one when absent. */\n  endUserId?: string;\n  /** BCP-47 language the widget rates strings in (e.g. \"fr\"). */\n  language: string;\n  /** Optional locale tag stored for analytics. */\n  locale?: string;\n  /** Debounce window (ms) before a queued batch is flushed. Default 1500. */\n  flushDebounceMs?: number;\n  /** Max queued items before an immediate flush. Default 20. */\n  maxBatch?: number;\n  /** Injected fetch (tests / RN polyfills). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface TokenBundle {\n  access_token: string;\n  token_type: \"Bearer\";\n  expires_in: number;\n  refresh_token: string;\n  refresh_expires_in: number;\n  end_user_id: string;\n  tos_version: string;\n  grouping_key: string;\n}\n\nexport interface FeedbackString {\n  namespace: string;\n  key: string;\n  key_uuid: string;\n  language_uuid: string;\n  value: string;\n  translation_hash: string;\n  avg_stars: number | null;\n  ratings_count: number;\n  my_rating: number | null;\n}\n\nexport interface StringsResponse {\n  project_id: string;\n  language: string;\n  strings: FeedbackString[];\n}\n\n/** A 5-star rating queued for a rendered string variant. */\nexport interface RatingInput {\n  namespace: string;\n  key: string;\n  language: string;\n  translation_hash: string;\n  stars: number; // 1..5\n}\n\n/** A suggested alternative translation queued for moderation. */\nexport interface SuggestionInput {\n  namespace: string;\n  key: string;\n  language: string;\n  translation_hash: string;\n  suggested_text: string;\n  comment?: string;\n}\n\nexport interface BatchResponse {\n  accepted: number;\n  rejected: number;\n  items: Array<Record<string, unknown>>;\n}\n\n/** A key the host app declares as on-screen. */\nexport interface DeclaredKey {\n  namespace: string;\n  key: string;\n}\n\nexport class FeedbackError extends Error {\n  constructor(\n    message: string,\n    readonly status?: number,\n    readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"FeedbackError\";\n  }\n}\n","/**\n * BUILD-TIME ToS version constant (task 616, human decision option B).\n *\n * This is baked into the @verbumia/feedback PACKAGE at release. It is\n * NOT an integrator-set config field and NOT server-driven: a stale\n * (e.g. native) app must record consent to the ToS version IT shipped\n * and displayed, for legal correctness — never backend-latest.\n *\n * Releasing a ToS-TEXT change ⇒ bump this constant + cut a new\n * @verbumia/feedback release (per the human/real-CI publish handoff).\n * The backend accepts any version in its acceptable set and records it.\n */\nexport const SDK_TOS_VERSION = \"2026-05-18\";\n","/**\n * Framework-agnostic Verbumia feedback client.\n *\n * Responsibilities:\n *  - versioned-ToS acceptance -> scoped end-user JWT bootstrap\n *  - transparent access-token refresh (rotating refresh token)\n *  - fetch on-screen strings for the widget\n *  - debounced + size-capped batched POST of ratings / suggestions,\n *    mirroring the missing-handler transport contract (ltm 280):\n *    best-effort, never throws into the host app render path.\n *\n * The React and React Native entry points are thin UI shells over this.\n */\n\nimport {\n  type BatchResponse,\n  type FeedbackConfig,\n  FeedbackError,\n  type RatingInput,\n  type StringsResponse,\n  type SuggestionInput,\n  type TokenBundle,\n} from \"./types\";\nimport { SDK_TOS_VERSION } from \"./tos\";\n\nconst SDK_LIB = \"@verbumia/feedback\";\nconst SDK_VER = \"0.2.0\";\n\ntype QueueItem =\n  | { kind: \"rating\"; payload: RatingInput }\n  | { kind: \"suggestion\"; payload: SuggestionInput };\n\nexport class FeedbackClient {\n  private cfg: Required<\n    Pick<FeedbackConfig, \"flushDebounceMs\" | \"maxBatch\">\n  > &\n    FeedbackConfig;\n  private fetchImpl: typeof fetch;\n  private tokens: TokenBundle | null = null;\n  private queue: QueueItem[] = [];\n  private timer: ReturnType<typeof setTimeout> | null = null;\n  private bootstrapping: Promise<TokenBundle> | null = null;\n\n  constructor(config: FeedbackConfig) {\n    this.cfg = {\n      flushDebounceMs: 1500,\n      maxBatch: 20,\n      ...config,\n    };\n    const f = config.fetchImpl ?? globalThis.fetch;\n    if (!f) {\n      throw new FeedbackError(\n        \"no fetch implementation available; pass config.fetchImpl\",\n      );\n    }\n    this.fetchImpl = f.bind(globalThis);\n  }\n\n  private base(): string {\n    return this.cfg.apiBase.replace(/\\/+$/, \"\");\n  }\n\n  get endUserId(): string | undefined {\n    return this.tokens?.end_user_id ?? this.cfg.endUserId;\n  }\n\n  get hasConsented(): boolean {\n    return this.tokens !== null;\n  }\n\n  /** Server-minted sessionId / grouping_key (from the token bundle).\n   * Available only after `acceptTos()`; never client-generated. */\n  get sessionId(): string | undefined {\n    return this.tokens?.grouping_key;\n  }\n\n  /** BCP-47 language the widget is rating strings in. */\n  get language(): string {\n    return this.cfg.language;\n  }\n\n  /** ToS version the end user is asked to accept — the SDK's\n   * build-time constant (task 616). NOT integrator/server set. */\n  get tosVersion(): string {\n    return SDK_TOS_VERSION;\n  }\n\n  /**\n   * Accept the ToS and bootstrap a scoped token. Idempotent: a second call\n   * returns the in-flight / existing bundle rather than re-accepting.\n   */\n  async acceptTos(): Promise<TokenBundle> {\n    if (this.tokens) return this.tokens;\n    if (this.bootstrapping) return this.bootstrapping;\n    this.bootstrapping = (async () => {\n      const res = await this.fetchImpl(`${this.base()}/v1/feedback/tos`, {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({\n          // NO grouping_key: server-minted (task 599). It comes back in\n          // the token bundle and is bound into the JWT server-side.\n          project_id: this.cfg.projectId,\n          end_user_id: this.cfg.endUserId,\n          tos_version: SDK_TOS_VERSION,\n          locale: this.cfg.locale,\n        }),\n      });\n      if (!res.ok) throw await this.problem(res, \"tos acceptance failed\");\n      this.tokens = (await res.json()) as TokenBundle;\n      return this.tokens;\n    })();\n    try {\n      return await this.bootstrapping;\n    } finally {\n      this.bootstrapping = null;\n    }\n  }\n\n  private async refresh(): Promise<void> {\n    if (!this.tokens) throw new FeedbackError(\"not consented\");\n    const res = await this.fetchImpl(\n      `${this.base()}/v1/feedback/token/refresh`,\n      {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ refresh_token: this.tokens.refresh_token }),\n      },\n    );\n    if (!res.ok) {\n      this.tokens = null; // force a fresh ToS step\n      throw await this.problem(res, \"token refresh failed\");\n    }\n    this.tokens = (await res.json()) as TokenBundle;\n  }\n\n  /** Authenticated fetch with a single transparent refresh-on-401 retry. */\n  private async authed(\n    path: string,\n    init: RequestInit,\n    retry = true,\n  ): Promise<Response> {\n    if (!this.tokens) await this.acceptTos();\n    const res = await this.fetchImpl(`${this.base()}${path}`, {\n      ...init,\n      headers: {\n        ...(init.headers ?? {}),\n        Authorization: `Bearer ${this.tokens!.access_token}`,\n      },\n    });\n    if (res.status === 401 && retry) {\n      await this.refresh();\n      return this.authed(path, init, false);\n    }\n    return res;\n  }\n\n  /** Strings rendered on the current view, with this end user's prior rating. */\n  async getStrings(opts?: {\n    keys?: Array<{ namespace: string; key: string }>;\n    namespace?: string;\n    limit?: number;\n  }): Promise<StringsResponse> {\n    const qs = new URLSearchParams({ language: this.cfg.language });\n    if (opts?.keys?.length) {\n      qs.set(\"keys\", opts.keys.map((k) => `${k.namespace}:${k.key}`).join(\",\"));\n    }\n    if (opts?.namespace) qs.set(\"namespace\", opts.namespace);\n    if (opts?.limit) qs.set(\"limit\", String(opts.limit));\n    const res = await this.authed(`/v1/feedback/strings?${qs}`, {\n      method: \"GET\",\n    });\n    if (!res.ok) throw await this.problem(res, \"failed to load strings\");\n    return (await res.json()) as StringsResponse;\n  }\n\n  /** Queue a rating; flushed on debounce or when the batch fills. */\n  rate(payload: RatingInput): void {\n    this.enqueue({ kind: \"rating\", payload });\n  }\n\n  /** Queue a suggestion; flushed on debounce or when the batch fills. */\n  suggest(payload: SuggestionInput): void {\n    this.enqueue({ kind: \"suggestion\", payload });\n  }\n\n  private enqueue(item: QueueItem): void {\n    this.queue.push(item);\n    if (this.queue.length >= this.cfg.maxBatch) {\n      void this.flush();\n      return;\n    }\n    if (this.timer) clearTimeout(this.timer);\n    this.timer = setTimeout(() => void this.flush(), this.cfg.flushDebounceMs);\n  }\n\n  /**\n   * Flush queued items. Best-effort: a transport/auth failure re-queues the\n   * batch once and swallows the error so the host app never sees a throw.\n   */\n  async flush(): Promise<void> {\n    if (this.timer) {\n      clearTimeout(this.timer);\n      this.timer = null;\n    }\n    if (!this.queue.length) return;\n    const batch = this.queue;\n    this.queue = [];\n    const ratings = batch\n      .filter((b) => b.kind === \"rating\")\n      .map((b) => b.payload as RatingInput);\n    const suggestions = batch\n      .filter((b) => b.kind === \"suggestion\")\n      .map((b) => b.payload as SuggestionInput);\n    try {\n      if (ratings.length) {\n        await this.postBatch(\"/v1/feedback/ratings\", { ratings });\n      }\n      if (suggestions.length) {\n        await this.postBatch(\"/v1/feedback/suggestions\", { suggestions });\n      }\n    } catch {\n      // Re-queue once; feedback must never break the host app.\n      this.queue.unshift(...batch);\n    }\n  }\n\n  private async postBatch(\n    path: string,\n    body: unknown,\n  ): Promise<BatchResponse> {\n    const res = await this.authed(path, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\", \"X-SDK\": `${SDK_LIB}@${SDK_VER}` },\n      body: JSON.stringify(body),\n    });\n    if (!res.ok) throw await this.problem(res, \"batch post failed\");\n    return (await res.json()) as BatchResponse;\n  }\n\n  private async problem(res: Response, fallback: string): Promise<FeedbackError> {\n    let code: string | undefined;\n    let detail = fallback;\n    try {\n      const body = (await res.json()) as { code?: string; detail?: string };\n      code = body.code;\n      if (body.detail) detail = body.detail;\n    } catch {\n      /* non-JSON body */\n    }\n    return new FeedbackError(detail, res.status, code);\n  }\n}\n","/**\n * On-screen key discovery.\n *\n * Preferred source: the `@verbumia/*-i18n` SDK exposes a lightweight key\n * registry of keys it has rendered. When that registry is present on the\n * global (the i18n SDK publishes `globalThis.__verbumia_key_registry__`),\n * we read the keys touched on the current view. Otherwise the host app\n * passes an explicit `keys` list — the always-available fallback.\n *\n * The registry contract is intentionally tiny so any framework port of the\n * i18n SDK can implement it without depending on this package.\n */\n\nimport type { DeclaredKey } from \"./types\";\n\nconst REGISTRY_GLOBAL = \"__verbumia_key_registry__\";\n\ninterface KeyRegistry {\n  /** Returns the keys rendered since the last `reset()` (or ever). */\n  snapshot(): DeclaredKey[];\n  reset?(): void;\n}\n\nfunction getRegistry(): KeyRegistry | null {\n  const g = globalThis as Record<string, unknown>;\n  const reg = g[REGISTRY_GLOBAL];\n  if (\n    reg &&\n    typeof (reg as KeyRegistry).snapshot === \"function\"\n  ) {\n    return reg as KeyRegistry;\n  }\n  return null;\n}\n\n/** True when a compatible `@verbumia/*-i18n` registry is detectable. */\nexport function hasKeyRegistry(): boolean {\n  return getRegistry() !== null;\n}\n\n/**\n * Resolve the on-screen keys: explicit `keys` prop always wins (it is the\n * customer's authoritative declaration); otherwise fall back to the i18n\n * registry snapshot; otherwise an empty list (widget shows \"no strings\").\n *\n * Optional `namespace` filter (task 618, CONTRACT v6 — ADDITIVE): when\n * set (a single namespace or a list), the resolved set is narrowed to\n * keys whose `namespace` is in the filter. The filter is applied AFTER\n * resolution, so it composes with v5 rendered-scoping as\n * `rendered ∩ namespace`. UNSET / empty ⇒ unchanged v5 behaviour (all\n * resolved keys). Backward-compatible: `resolveKeys(keys)` is unaffected.\n */\nexport function resolveKeys(\n  explicit?: DeclaredKey[],\n  namespace?: string | string[],\n): DeclaredKey[] {\n  const base =\n    explicit && explicit.length\n      ? dedupe(explicit)\n      : getRegistry()\n        ? dedupe(getRegistry()!.snapshot())\n        : [];\n  return filterByNamespace(base, namespace);\n}\n\n/** Narrow keys to those whose namespace is in `namespace`. An undefined\n *  filter, an empty string, or an empty list means \"no filter\" (the\n *  additive default — identical to v5). Exported so non-panel callers\n *  (e.g. a custom /core integration) can apply the same semantics. */\nexport function filterByNamespace(\n  keys: DeclaredKey[],\n  namespace?: string | string[],\n): DeclaredKey[] {\n  const list = (Array.isArray(namespace) ? namespace : namespace ? [namespace] : [])\n    .map((n) => n.trim())\n    .filter(Boolean);\n  if (!list.length) return keys;\n  const allow = new Set(list);\n  return keys.filter((k) => allow.has(k.namespace));\n}\n\nfunction dedupe(keys: DeclaredKey[]): DeclaredKey[] {\n  const seen = new Set<string>();\n  const out: DeclaredKey[] = [];\n  for (const k of keys) {\n    const id = `${k.namespace}:${k.key}`;\n    if (!seen.has(id)) {\n      seen.add(id);\n      out.push(k);\n    }\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACiGO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YACE,SACS,QACA,MACT;AACA,UAAM,OAAO;AAHJ;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAKb;;;AC9FO,IAAM,kBAAkB;;;ACa/B,IAAM,UAAU;AAChB,IAAM,UAAU;AAMT,IAAM,iBAAN,MAAqB;AAAA,EAClB;AAAA,EAIA;AAAA,EACA,SAA6B;AAAA,EAC7B,QAAqB,CAAC;AAAA,EACtB,QAA8C;AAAA,EAC9C,gBAA6C;AAAA,EAErD,YAAY,QAAwB;AAClC,SAAK,MAAM;AAAA,MACT,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,UAAM,IAAI,OAAO,aAAa,WAAW;AACzC,QAAI,CAAC,GAAG;AACN,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,YAAY,EAAE,KAAK,UAAU;AAAA,EACpC;AAAA,EAEQ,OAAe;AACrB,WAAO,KAAK,IAAI,QAAQ,QAAQ,QAAQ,EAAE;AAAA,EAC5C;AAAA,EAEA,IAAI,YAAgC;AAClC,WAAO,KAAK,QAAQ,eAAe,KAAK,IAAI;AAAA,EAC9C;AAAA,EAEA,IAAI,eAAwB;AAC1B,WAAO,KAAK,WAAW;AAAA,EACzB;AAAA;AAAA;AAAA,EAIA,IAAI,YAAgC;AAClC,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA,EAGA,IAAI,WAAmB;AACrB,WAAO,KAAK,IAAI;AAAA,EAClB;AAAA;AAAA;AAAA,EAIA,IAAI,aAAqB;AACvB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAkC;AACtC,QAAI,KAAK,OAAQ,QAAO,KAAK;AAC7B,QAAI,KAAK,cAAe,QAAO,KAAK;AACpC,SAAK,iBAAiB,YAAY;AAChC,YAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,CAAC,oBAAoB;AAAA,QACjE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA;AAAA;AAAA,UAGnB,YAAY,KAAK,IAAI;AAAA,UACrB,aAAa,KAAK,IAAI;AAAA,UACtB,aAAa;AAAA,UACb,QAAQ,KAAK,IAAI;AAAA,QACnB,CAAC;AAAA,MACH,CAAC;AACD,UAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,uBAAuB;AAClE,WAAK,SAAU,MAAM,IAAI,KAAK;AAC9B,aAAO,KAAK;AAAA,IACd,GAAG;AACH,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,gBAAgB;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAc,UAAyB;AACrC,QAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,cAAc,eAAe;AACzD,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB,GAAG,KAAK,KAAK,CAAC;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,eAAe,KAAK,OAAO,cAAc,CAAC;AAAA,MACnE;AAAA,IACF;AACA,QAAI,CAAC,IAAI,IAAI;AACX,WAAK,SAAS;AACd,YAAM,MAAM,KAAK,QAAQ,KAAK,sBAAsB;AAAA,IACtD;AACA,SAAK,SAAU,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA;AAAA,EAGA,MAAc,OACZ,MACA,MACA,QAAQ,MACW;AACnB,QAAI,CAAC,KAAK,OAAQ,OAAM,KAAK,UAAU;AACvC,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI;AAAA,MACxD,GAAG;AAAA,MACH,SAAS;AAAA,QACP,GAAI,KAAK,WAAW,CAAC;AAAA,QACrB,eAAe,UAAU,KAAK,OAAQ,YAAY;AAAA,MACpD;AAAA,IACF,CAAC;AACD,QAAI,IAAI,WAAW,OAAO,OAAO;AAC/B,YAAM,KAAK,QAAQ;AACnB,aAAO,KAAK,OAAO,MAAM,MAAM,KAAK;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,WAAW,MAIY;AAC3B,UAAM,KAAK,IAAI,gBAAgB,EAAE,UAAU,KAAK,IAAI,SAAS,CAAC;AAC9D,QAAI,MAAM,MAAM,QAAQ;AACtB,SAAG,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,IAC1E;AACA,QAAI,MAAM,UAAW,IAAG,IAAI,aAAa,KAAK,SAAS;AACvD,QAAI,MAAM,MAAO,IAAG,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AACnD,UAAM,MAAM,MAAM,KAAK,OAAO,wBAAwB,EAAE,IAAI;AAAA,MAC1D,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,wBAAwB;AACnE,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA;AAAA,EAGA,KAAK,SAA4B;AAC/B,SAAK,QAAQ,EAAE,MAAM,UAAU,QAAQ,CAAC;AAAA,EAC1C;AAAA;AAAA,EAGA,QAAQ,SAAgC;AACtC,SAAK,QAAQ,EAAE,MAAM,cAAc,QAAQ,CAAC;AAAA,EAC9C;AAAA,EAEQ,QAAQ,MAAuB;AACrC,SAAK,MAAM,KAAK,IAAI;AACpB,QAAI,KAAK,MAAM,UAAU,KAAK,IAAI,UAAU;AAC1C,WAAK,KAAK,MAAM;AAChB;AAAA,IACF;AACA,QAAI,KAAK,MAAO,cAAa,KAAK,KAAK;AACvC,SAAK,QAAQ,WAAW,MAAM,KAAK,KAAK,MAAM,GAAG,KAAK,IAAI,eAAe;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAuB;AAC3B,QAAI,KAAK,OAAO;AACd,mBAAa,KAAK,KAAK;AACvB,WAAK,QAAQ;AAAA,IACf;AACA,QAAI,CAAC,KAAK,MAAM,OAAQ;AACxB,UAAM,QAAQ,KAAK;AACnB,SAAK,QAAQ,CAAC;AACd,UAAM,UAAU,MACb,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,EACjC,IAAI,CAAC,MAAM,EAAE,OAAsB;AACtC,UAAM,cAAc,MACjB,OAAO,CAAC,MAAM,EAAE,SAAS,YAAY,EACrC,IAAI,CAAC,MAAM,EAAE,OAA0B;AAC1C,QAAI;AACF,UAAI,QAAQ,QAAQ;AAClB,cAAM,KAAK,UAAU,wBAAwB,EAAE,QAAQ,CAAC;AAAA,MAC1D;AACA,UAAI,YAAY,QAAQ;AACtB,cAAM,KAAK,UAAU,4BAA4B,EAAE,YAAY,CAAC;AAAA,MAClE;AAAA,IACF,QAAQ;AAEN,WAAK,MAAM,QAAQ,GAAG,KAAK;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAc,UACZ,MACA,MACwB;AACxB,UAAM,MAAM,MAAM,KAAK,OAAO,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,SAAS,GAAG,OAAO,IAAI,OAAO,GAAG;AAAA,MAChF,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,KAAK,mBAAmB;AAC9D,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,MAAc,QAAQ,KAAe,UAA0C;AAC7E,QAAI;AACJ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,aAAO,KAAK;AACZ,UAAI,KAAK,OAAQ,UAAS,KAAK;AAAA,IACjC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,cAAc,QAAQ,IAAI,QAAQ,IAAI;AAAA,EACnD;AACF;;;AC5OA,IAAM,kBAAkB;AAQxB,SAAS,cAAkC;AACzC,QAAM,IAAI;AACV,QAAM,MAAM,EAAE,eAAe;AAC7B,MACE,OACA,OAAQ,IAAoB,aAAa,YACzC;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,iBAA0B;AACxC,SAAO,YAAY,MAAM;AAC3B;AAcO,SAAS,YACd,UACA,WACe;AACf,QAAM,OACJ,YAAY,SAAS,SACjB,OAAO,QAAQ,IACf,YAAY,IACV,OAAO,YAAY,EAAG,SAAS,CAAC,IAChC,CAAC;AACT,SAAO,kBAAkB,MAAM,SAAS;AAC1C;AAMO,SAAS,kBACd,MACA,WACe;AACf,QAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI,YAAY,YAAY,CAAC,SAAS,IAAI,CAAC,GAC7E,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACjB,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,QAAM,QAAQ,IAAI,IAAI,IAAI;AAC1B,SAAO,KAAK,OAAO,CAAC,MAAM,MAAM,IAAI,EAAE,SAAS,CAAC;AAClD;AAEA,SAAS,OAAO,MAAoC;AAClD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAqB,CAAC;AAC5B,aAAW,KAAK,MAAM;AACpB,UAAM,KAAK,GAAG,EAAE,SAAS,IAAI,EAAE,GAAG;AAClC,QAAI,CAAC,KAAK,IAAI,EAAE,GAAG;AACjB,WAAK,IAAI,EAAE;AACX,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/core/index.d.cts

@@ -1,5 +1,5 @@
 export { B as BatchResponse, D as DeclaredKey, F as FeedbackClient, a as FeedbackConfig, b as FeedbackError, c as FeedbackString, R as RatingInput, S as StringsResponse, d as SuggestionInput, T as TokenBundle } from '../client-CPEcvn23.cjs';
-export { h as hasKeyRegistry, r as resolveKeys } from '../keys-Dg_nv16u.cjs';
+export { f as filterByNamespace, h as hasKeyRegistry, r as resolveKeys } from '../keys-BWY-Y8fc.cjs';
 
 /**
  * BUILD-TIME ToS version constant (task 616, human decision option B).

package/dist/core/index.d.ts

@@ -1,5 +1,5 @@
 export { B as BatchResponse, D as DeclaredKey, F as FeedbackClient, a as FeedbackConfig, b as FeedbackError, c as FeedbackString, R as RatingInput, S as StringsResponse, d as SuggestionInput, T as TokenBundle } from '../client-CPEcvn23.js';
-export { h as hasKeyRegistry, r as resolveKeys } from '../keys-BySe1O6V.js';
+export { f as filterByNamespace, h as hasKeyRegistry, r as resolveKeys } from '../keys-h1G0kA7o.js';
 
 /**
  * BUILD-TIME ToS version constant (task 616, human decision option B).

package/dist/core/index.js

@@ -3,13 +3,15 @@ import {
   FeedbackClient,
   FeedbackError,
   SDK_TOS_VERSION,
+  filterByNamespace,
   hasKeyRegistry,
   resolveKeys
-} from "../chunk-OX4RJD5H.js";
+} from "../chunk-GKDUJ2DM.js";
 export {
   FeedbackClient,
   FeedbackError,
   SDK_TOS_VERSION,
+  filterByNamespace,
   hasKeyRegistry,
   resolveKeys
 };

package/dist/keys-BWY-Y8fc.d.cts

@@ -0,0 +1,37 @@
+import { D as DeclaredKey } from './client-CPEcvn23.cjs';
+
+/**
+ * On-screen key discovery.
+ *
+ * Preferred source: the `@verbumia/*-i18n` SDK exposes a lightweight key
+ * registry of keys it has rendered. When that registry is present on the
+ * global (the i18n SDK publishes `globalThis.__verbumia_key_registry__`),
+ * we read the keys touched on the current view. Otherwise the host app
+ * passes an explicit `keys` list — the always-available fallback.
+ *
+ * The registry contract is intentionally tiny so any framework port of the
+ * i18n SDK can implement it without depending on this package.
+ */
+
+/** True when a compatible `@verbumia/*-i18n` registry is detectable. */
+declare function hasKeyRegistry(): boolean;
+/**
+ * Resolve the on-screen keys: explicit `keys` prop always wins (it is the
+ * customer's authoritative declaration); otherwise fall back to the i18n
+ * registry snapshot; otherwise an empty list (widget shows "no strings").
+ *
+ * Optional `namespace` filter (task 618, CONTRACT v6 — ADDITIVE): when
+ * set (a single namespace or a list), the resolved set is narrowed to
+ * keys whose `namespace` is in the filter. The filter is applied AFTER
+ * resolution, so it composes with v5 rendered-scoping as
+ * `rendered ∩ namespace`. UNSET / empty ⇒ unchanged v5 behaviour (all
+ * resolved keys). Backward-compatible: `resolveKeys(keys)` is unaffected.
+ */
+declare function resolveKeys(explicit?: DeclaredKey[], namespace?: string | string[]): DeclaredKey[];
+/** Narrow keys to those whose namespace is in `namespace`. An undefined
+ *  filter, an empty string, or an empty list means "no filter" (the
+ *  additive default — identical to v5). Exported so non-panel callers
+ *  (e.g. a custom /core integration) can apply the same semantics. */
+declare function filterByNamespace(keys: DeclaredKey[], namespace?: string | string[]): DeclaredKey[];
+
+export { filterByNamespace as f, hasKeyRegistry as h, resolveKeys as r };

package/dist/keys-h1G0kA7o.d.ts

@@ -0,0 +1,37 @@
+import { D as DeclaredKey } from './client-CPEcvn23.js';
+
+/**
+ * On-screen key discovery.
+ *
+ * Preferred source: the `@verbumia/*-i18n` SDK exposes a lightweight key
+ * registry of keys it has rendered. When that registry is present on the
+ * global (the i18n SDK publishes `globalThis.__verbumia_key_registry__`),
+ * we read the keys touched on the current view. Otherwise the host app
+ * passes an explicit `keys` list — the always-available fallback.
+ *
+ * The registry contract is intentionally tiny so any framework port of the
+ * i18n SDK can implement it without depending on this package.
+ */
+
+/** True when a compatible `@verbumia/*-i18n` registry is detectable. */
+declare function hasKeyRegistry(): boolean;
+/**
+ * Resolve the on-screen keys: explicit `keys` prop always wins (it is the
+ * customer's authoritative declaration); otherwise fall back to the i18n
+ * registry snapshot; otherwise an empty list (widget shows "no strings").
+ *
+ * Optional `namespace` filter (task 618, CONTRACT v6 — ADDITIVE): when
+ * set (a single namespace or a list), the resolved set is narrowed to
+ * keys whose `namespace` is in the filter. The filter is applied AFTER
+ * resolution, so it composes with v5 rendered-scoping as
+ * `rendered ∩ namespace`. UNSET / empty ⇒ unchanged v5 behaviour (all
+ * resolved keys). Backward-compatible: `resolveKeys(keys)` is unaffected.
+ */
+declare function resolveKeys(explicit?: DeclaredKey[], namespace?: string | string[]): DeclaredKey[];
+/** Narrow keys to those whose namespace is in `namespace`. An undefined
+ *  filter, an empty string, or an empty list means "no filter" (the
+ *  additive default — identical to v5). Exported so non-panel callers
+ *  (e.g. a custom /core integration) can apply the same semantics. */
+declare function filterByNamespace(keys: DeclaredKey[], namespace?: string | string[]): DeclaredKey[];
+
+export { filterByNamespace as f, hasKeyRegistry as h, resolveKeys as r };

package/dist/native/index.cjs

@@ -49,7 +49,7 @@ var SDK_TOS_VERSION = "2026-05-18";
 
 // src/core/client.ts
 var SDK_LIB = "@verbumia/feedback";
-var SDK_VER = "0.1.0";
+var SDK_VER = "0.2.0";
 var FeedbackClient = class {
   cfg;
   fetchImpl;
@@ -251,11 +251,15 @@ function getRegistry() {
 function hasKeyRegistry() {
   return getRegistry() !== null;
 }
-function resolveKeys(explicit) {
-  if (explicit && explicit.length) return dedupe(explicit);
-  const reg = getRegistry();
-  if (reg) return dedupe(reg.snapshot());
-  return [];
+function resolveKeys(explicit, namespace) {
+  const base = explicit && explicit.length ? dedupe(explicit) : getRegistry() ? dedupe(getRegistry().snapshot()) : [];
+  return filterByNamespace(base, namespace);
+}
+function filterByNamespace(keys, namespace) {
+  const list = (Array.isArray(namespace) ? namespace : namespace ? [namespace] : []).map((n) => n.trim()).filter(Boolean);
+  if (!list.length) return keys;
+  const allow = new Set(list);
+  return keys.filter((k) => allow.has(k.namespace));
 }
 function dedupe(keys) {
   const seen = /* @__PURE__ */ new Set();
@@ -282,7 +286,7 @@ var C = {
   emeraldSoft: "#34d399"
 };
 function FeedbackModal(props) {
-  const { client, visible, keys, onClose } = props;
+  const { client, visible, keys, namespace, onClose } = props;
   const [consented, setConsented] = (0, import_react.useState)(client.hasConsented);
   const [busy, setBusy] = (0, import_react.useState)(false);
   const [error, setError] = (0, import_react.useState)(null);
@@ -291,17 +295,19 @@ function FeedbackModal(props) {
     setBusy(true);
     setError(null);
     try {
-      const resolved = resolveKeys(keys);
-      const res = await client.getStrings({
-        keys: resolved.length ? resolved : void 0
-      });
+      const resolved = resolveKeys(keys, namespace);
+      if (!resolved.length) {
+        setStrings([]);
+        return;
+      }
+      const res = await client.getStrings({ keys: resolved });
       setStrings(res.strings);
     } catch (e) {
       setError(e instanceof Error ? e.message : "Failed to load strings");
     } finally {
       setBusy(false);
     }
-  }, [client, keys]);
+  }, [client, keys, namespace]);
   (0, import_react.useEffect)(() => {
     if (visible && consented) void loadStrings();
   }, [visible, consented, loadStrings]);
@@ -528,6 +534,7 @@ function feedbackPlugin(options) {
         client: c,
         visible: isOpen,
         keys: options.keys,
+        namespace: options.namespace,
         onClose: () => {
           store.set(false);
           void c.flush();