create-feedbax 0.2.1 → 0.2.2

package/template/src/components/follow-post-button.tsx

@@ -8,7 +8,7 @@ import { followQuery, participationRequest } from "../participation-client";
 
 export function FollowPostButton({ slug }: { slug: string }) {
   const identity = useConnectedIdentity();
-  if (!identity.enabled) return null;
+  if (!identity.enabled || !identity.displayName) return null;
   return <ConnectedFollowPostButton slug={slug} />;
 }
 function ConnectedFollowPostButton({ slug }: { slug: string }) {
@@ -20,18 +20,7 @@ function ConnectedFollowPostButton({ slug }: { slug: string }) {
   });
   const [pending, setPending] = useState(false);
   const [error, setError] = useState<string>();
-  if (!identity.enabled) return null;
-  if (!identity.displayName)
-    return (
-      <Button
-        variant="outline"
-        size="sm"
-        nativeButton={false}
-        render={<a href="/internal/identity/start" />}
-      >
-        Sign in to follow
-      </Button>
-    );
+  if (!identity.enabled || !identity.displayName) return null;
   async function toggle() {
     setPending(true);
     setError(undefined);

package/template/src/components/post-history.tsx

@@ -0,0 +1,101 @@
+import type { ObservedHistoryPage } from "@feedbax/feedback";
+import { useInfiniteQuery, useQueryClient } from "@tanstack/react-query";
+import { Button } from "@feedbax/ui/components/button";
+import { Skeleton } from "@feedbax/ui/components/skeleton";
+import { formatPublicDate } from "../public-date";
+
+export function PostHistory({ slug }: { slug: string }) {
+  const client = useQueryClient();
+  const clearPublicPost = () => {
+    client.setQueryData(["public-post", slug], null);
+    client.setQueryData(["public-post-comments", slug], {
+      pages: [{ items: [] }],
+      pageParams: [undefined],
+    });
+    void client.invalidateQueries({ queryKey: ["public-post-roadmap"] });
+  };
+  const query = useInfiniteQuery({
+    queryKey: ["public-post-history", slug],
+    initialPageParam: undefined as string | undefined,
+    queryFn: async ({ pageParam }) => {
+      const params = new URLSearchParams({
+        slug,
+        ...(pageParam ? { cursor: pageParam } : {}),
+      });
+      try {
+        const response = await fetch(`/internal/post-history?${params}`, {
+          cache: "no-store",
+        });
+        if (!response.ok) throw Error("Progress history is unavailable.");
+        const page = (await response.json()) as ObservedHistoryPage;
+        if (!page.available) clearPublicPost();
+        return page;
+      } catch (error) {
+        clearPublicPost();
+        throw error;
+      }
+    },
+    getNextPageParam: (page) => page.nextCursor,
+    staleTime: 0,
+    retry: false,
+  });
+  const events = query.isError
+    ? []
+    : (query.data?.pages.flatMap((page) => page.items) ?? []);
+  return (
+    <section className="space-y-3" aria-label="Activities">
+      <h2 className="sr-only">Activities</h2>
+      {query.isPending ? (
+        <Skeleton className="h-12 w-full" />
+      ) : query.isError ? (
+        <div role="alert" className="space-y-2">
+          <p className="text-sm">
+            Progress history is temporarily unavailable.
+          </p>
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => void query.refetch()}
+          >
+            Retry history
+          </Button>
+        </div>
+      ) : events.length ? (
+        <ol className="space-y-4 border-l pl-4">
+          {events.map((event) => (
+            <li key={event.id} className="space-y-1 text-sm">
+              <time
+                dateTime={new Date(event.observedAt).toISOString()}
+                className="text-xs text-muted-foreground"
+              >
+                Observed {formatPublicDate(new Date(event.observedAt))}
+              </time>
+              {event.kind === "status" ? (
+                <p>
+                  Moved to <span className="font-medium">{event.status}</span>
+                </p>
+              ) : (
+                <>
+                  <p className="font-medium">Product Team update</p>
+                  <p className="whitespace-pre-wrap">{event.body}</p>
+                </>
+              )}
+            </li>
+          ))}
+        </ol>
+      ) : (
+        <p className="text-sm text-muted-foreground">No activities yet.</p>
+      )}
+      {query.hasNextPage && !query.isError ? (
+        <Button
+          variant="outline"
+          size="sm"
+          disabled={query.isFetchingNextPage}
+          onClick={() => void query.fetchNextPage()}
+        >
+          {query.isFetchingNextPage ? "Loading history…" : "More history"}
+        </Button>
+      ) : null}
+    </section>
+  );
+}

package/template/src/components/profile-menu.tsx

@@ -33,6 +33,13 @@ export function ProfileMenu() {
         </Button>
         {identity.displayName ? (
           <>
+            <Button
+              nativeButton={false}
+              variant="ghost"
+              render={<a href="/my-feedback" />}
+            >
+              My feedback
+            </Button>
             <span>{identity.displayName}</span>
             <Button variant="outline" onClick={() => void identity.signOut()}>
               Sign out

package/template/src/configured-feedback.test.ts

@@ -0,0 +1,82 @@
+import { afterEach, expect, it } from "vitest";
+import { Miniflare } from "miniflare";
+import { readFile, readdir } from "node:fs/promises";
+import { resolve } from "node:path";
+import { createContentFeedbackModule } from "./configured-feedback";
+import type { FeedbaxConfig } from "@feedbax/config";
+
+let runtime: Miniflare | undefined;
+afterEach(async () => {
+  await runtime?.dispose();
+});
+it("runs a GitHub-only portal without Notion or verified identity and requires D1", async () => {
+  const config: FeedbaxConfig = {
+    provider: "github",
+    product: {
+      name: "Acme",
+      description: "Feedback",
+      logo: "/logo.svg",
+      siteUrl: "https://portal.example",
+    },
+    theme: { preset: "lyra-neutral" },
+    github: {
+      installationId: "portal-acme",
+      serviceUrl: "https://service.example",
+      repository: { id: 123, owner: "acme", name: "feedback" },
+      botUserId: 456,
+    },
+    features: { voting: true, comments: true, changelog: false },
+    submissions: {
+      moderation: "required",
+      maxTitleLength: 160,
+      maxDescriptionLength: 5000,
+    },
+    turnstile: { enabled: false },
+  };
+  expect(() => createContentFeedbackModule(config, {})).toThrow("FEEDBAX_DB");
+  runtime = new Miniflare({
+    modules: true,
+    script: "export default { fetch() { return new Response('ok') } }",
+    d1Databases: ["DB"],
+    compatibilityDate: "2026-07-30",
+  });
+  const database = await runtime.getD1Database("DB");
+  const directory = resolve(import.meta.dirname, "../migrations");
+  for (const file of (await readdir(directory)).sort())
+    await database.exec(
+      (await readFile(resolve(directory, file), "utf8"))
+        .replace(/--[^\n]*/g, "")
+        .replace(/\s+/g, " "),
+    );
+  const urls: string[] = [];
+  const feedback = createContentFeedbackModule(
+    config,
+    { FEEDBAX_DB: database, GITHUB_SERVICE_SECRET: "p".repeat(40) },
+    async (input, init) => {
+      const request =
+        input instanceof Request ? input : new Request(input, init);
+      urls.push(request.url);
+      if (request.url === "https://service.example/v1/token") {
+        expect(request.headers.get("X-Feedbax-Installation")).toBe(
+          "portal-acme",
+        );
+        expect(request.headers.get("X-Feedbax-Signature")).toMatch(
+          /^[a-f0-9]{64}$/,
+        );
+        return Response.json({
+          token: "scoped-access",
+          expiresAt: new Date(Date.now() + 3600_000).toISOString(),
+          repositoryId: 123,
+          botUserId: 456,
+        });
+      }
+      expect(request.headers.get("Authorization")).toBe("Bearer scoped-access");
+      if (request.url === "https://api.github.com/repos/acme/feedback")
+        return Response.json({ id: 123 });
+      return Response.json([]);
+    },
+  );
+  expect(await feedback.listPublicPosts()).toMatchObject({ items: [] });
+  expect(urls.some((url) => url.includes("notion"))).toBe(false);
+  expect(urls).toContain("https://service.example/v1/token");
+});

package/template/src/configured-feedback.ts

@@ -0,0 +1,61 @@
+import { assertRuntimeBindings, type FeedbaxConfig } from "@feedbax/config";
+import {
+  createGitHubFeedbackModule,
+  createGitHubServiceAccess,
+  createNotionFeedbackModule,
+  type ConnectedDatabase,
+  type VerifiedParticipant,
+  createPostOwnership,
+} from "@feedbax/feedback";
+
+export function createContentFeedbackModule(
+  config: FeedbaxConfig,
+  environment: {
+    FEEDBAX_DB?: ConnectedDatabase;
+    NOTION_TOKEN?: string;
+    GITHUB_SERVICE_SECRET?: string;
+    getGitHubServiceSecret?: () => Promise<string>;
+  },
+  request: typeof fetch = fetch,
+  participant?: VerifiedParticipant,
+) {
+  assertRuntimeBindings(config, environment);
+  const features = {
+    votingEnabled: config.features.voting,
+    commentsEnabled: config.features.comments,
+    ...(config.connected && participant && environment.FEEDBAX_DB
+      ? { ownership: createPostOwnership(environment.FEEDBAX_DB, participant) }
+      : {}),
+  };
+  if (config.provider === "github") {
+    if (
+      !environment.getGitHubServiceSecret &&
+      (!environment.GITHUB_SERVICE_SECRET ||
+        environment.GITHUB_SERVICE_SECRET.length < 32)
+    )
+      throw new Error(
+        "GitHub requires GITHUB_SERVICE_SECRET. Pair this portal with the GitHub App service.",
+      );
+    return createGitHubFeedbackModule({
+      ...features,
+      ...config.github,
+      database: environment.FEEDBAX_DB!,
+      request,
+      getToken: createGitHubServiceAccess({
+        config: config.github,
+        secret: environment.GITHUB_SERVICE_SECRET,
+        getSecret: environment.getGitHubServiceSecret,
+        request,
+      }),
+    });
+  }
+  if (!environment.NOTION_TOKEN)
+    throw new Error("Notion requires NOTION_TOKEN.");
+  return createNotionFeedbackModule({
+    ...features,
+    token: environment.NOTION_TOKEN,
+    dataSourceId: config.notion.dataSourceId,
+    propertyIds: config.notion.properties,
+    request,
+  });
+}

package/template/src/connected-identity.test.ts

@@ -112,9 +112,13 @@ it("exchanges a browser-bound handoff once, keeps identity private, and revokes
       });
     const response = await handler(sessionRequest());
     expect(response.headers.get("cache-control")).toBe("no-store");
-    expect(await response.json()).toEqual({
-      participant: { displayName: "Alice" },
-    });
+    const identity = (await response.json()) as {
+      participant: { displayName: string; sessionKey: string };
+    };
+    expect(identity.participant.displayName).toBe("Alice");
+    expect(identity.participant.sessionKey).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(JSON.stringify(identity)).not.toContain("private-subject");
+    expect(JSON.stringify(identity)).not.toContain(session.split("=")[1]);
     expect(
       (
         await handler(

package/template/src/connected-identity.ts

@@ -89,7 +89,12 @@ export function createConnectedIdentityHandler(options: {
           : undefined;
         return json({
           participant: participant
-            ? { displayName: participant.displayName }
+            ? {
+                displayName: participant.displayName,
+                sessionKey: createHash("sha256")
+                  .update(`feedbax-ui-session-v1:${token}`)
+                  .digest("base64url"),
+              }
             : null,
         });
       }

package/template/src/connected-runtime.test.ts

@@ -219,8 +219,11 @@ it("requires a valid session and same-origin mutations, and ignores browser-supp
       }),
     );
     expect(sessionRead?.status).toBe(200);
-    expect(await sessionRead?.json()).toEqual({
-      participant: { displayName: "Alice" },
+    expect(await sessionRead?.json()).toMatchObject({
+      participant: {
+        displayName: "Alice",
+        sessionKey: expect.stringMatching(/^[A-Za-z0-9_-]{43}$/),
+      },
     });
     const unavailable = createConnectedRequestHandler({
       ...options,

package/template/src/feedback-cache-invalidation.ts

@@ -47,6 +47,8 @@ export function createInvalidatingFeedbackModule({
   invalidator: PublicCacheInvalidator;
 }): FeedbackModule {
   return {
+    getParticipantPost: (id) => feedback.getParticipantPost(id),
+    claimDraftPost: (input) => feedback.claimDraftPost(input),
     getAttachmentPostState: (slug) => feedback.getAttachmentPostState(slug),
     editComment: (input) => feedback.editComment(input),
     deleteComment: (input) => feedback.deleteComment(input),

package/template/src/feedback-runtime.ts

@@ -4,8 +4,8 @@ import {
   createNotionImageReviewWriter,
   createConnectedStore,
   createConnectedFeedbackModule,
+  createObservedHistoryModule,
   type VerifiedParticipant,
-  createNotionFeedbackModule,
 } from "@feedbax/feedback";
 import { cache, env } from "cloudflare:workers";
 
@@ -14,27 +14,45 @@ import {
   createPublicCacheInvalidator,
 } from "./feedback-cache-invalidation";
 import feedbax from "./feedbax";
+import { createContentFeedbackModule } from "./configured-feedback";
+import { createPortalIntegration } from "./integration-runtime";
+import { createPublicReleaseFeedbackModule } from "./public-release-links";
+import { createConfiguredChangelogModule } from "./changelog-runtime";
 
 export const feedbackSubmissionLimits = {
   maxTitleLength: feedbax.submissions.maxTitleLength,
   maxDescriptionLength: feedbax.submissions.maxDescriptionLength,
 } as const;
 
-export function createConfiguredNotionFeedbackModule() {
-  configuredFeedback ??= createNotionFeedbackModule({
-    votingEnabled: feedbax.features.voting,
-    commentsEnabled: feedbax.features.comments,
-    token: requiredEnvironmentValue("NOTION_TOKEN"),
-    dataSourceId: feedbax.notion.dataSourceId,
-    propertyIds: feedbax.notion.properties,
-  });
-  return configuredFeedback;
+export function createConfiguredContentFeedbackModule(
+  participant?: VerifiedParticipant,
+) {
+  return createContentFeedbackModule(
+    feedbax,
+    {
+      FEEDBAX_DB: env.FEEDBAX_DB,
+      NOTION_TOKEN: process.env.NOTION_TOKEN,
+      GITHUB_SERVICE_SECRET: env.GITHUB_SERVICE_SECRET,
+      ...(feedbax.provider === "github" && env.FEEDBAX_DB
+        ? {
+            getGitHubServiceSecret: () =>
+              configuredIntegration().portalSecret(),
+          }
+        : {}),
+    },
+    fetch,
+    participant,
+  );
 }
 
 export function createConfiguredFeedbackModule(
   participant?: VerifiedParticipant,
 ) {
-  const content = createConfiguredNotionFeedbackModule();
+  const source = createConfiguredContentFeedbackModule(participant);
+  const history = feedbax.history ? configuredHistory(source) : undefined;
+  const content = history
+    ? { ...source, getPublicPost: history.observe }
+    : source;
   const feedback = feedbax.connected
     ? createConnectedFeedbackModule(content, getConnectedStore(), participant)
     : content;
@@ -45,22 +63,37 @@ export function createConfiguredFeedbackModule(
     ? createImageFeedbackModule(
         feedback,
         images,
-        createNotionImageReviewWriter({
-          token: requiredEnvironmentValue("NOTION_TOKEN"),
-          reviewUrl: (id) => images.reviewUrl(id, feedbax.product.siteUrl!),
-        }),
+        feedbax.provider === "github"
+          ? undefined
+          : createNotionImageReviewWriter({
+              token: requiredEnvironmentValue("NOTION_TOKEN"),
+              reviewUrl: (id) => images.reviewUrl(id, feedbax.product.siteUrl!),
+            }),
       )
     : feedback;
   return createInvalidatingFeedbackModule({
-    feedback: withImages,
+    feedback: createPublicReleaseFeedbackModule({
+      feedback: withImages,
+      siteUrl: feedbax.product.siteUrl,
+      ...(feedbax.features.changelog && feedbax.changelog
+        ? { changelog: createConfiguredChangelogModule(true) }
+        : {}),
+    }),
     invalidator: createPublicCacheInvalidator({
       purge: (options) => cache.purge(options),
     }),
   });
 }
 
-let configuredFeedback:
-  ReturnType<typeof createInvalidatingFeedbackModule> | undefined;
+export function configuredHistory(
+  feedback = createConfiguredContentFeedbackModule(),
+) {
+  if (!feedbax.history || !env.FEEDBAX_DB)
+    throw new Error(
+      "Observed history requires explicit history configuration and FEEDBAX_DB.",
+    );
+  return createObservedHistoryModule({ database: env.FEEDBAX_DB, feedback });
+}
 
 export function requiredEnvironmentValue(name: string): string {
   const value = process.env[name];
@@ -103,3 +136,13 @@ export async function requestParticipant(request: Request) {
   const token = readSessionToken(request);
   return token ? getConnectedStore().session(sessionHash(token)) : undefined;
 }
+
+export function configuredIntegration() {
+  if (!env.FEEDBAX_DB)
+    throw new Error("GitHub requires the FEEDBAX_DB D1 binding.");
+  return createPortalIntegration({
+    config: feedbax,
+    database: env.FEEDBAX_DB,
+    pairingSecret: env.GITHUB_PAIRING_SECRET,
+  });
+}

package/template/src/feedbax/changelog/index.test.ts

@@ -8,6 +8,41 @@ import {
 } from ".";
 
 describe("Changelog module", () => {
+  it("puts newer same-day entries first and uses Slug for exact ties", async () => {
+    const changelog = createChangelogModule({
+      storage: createInMemoryChangelogStorage([
+        entry({ id: "a", slug: "older-creation", date: "2026-10-15" }),
+        entry({
+          id: "z",
+          slug: "a-newer-creation",
+          date: "2026-10-15",
+          createdAt: new Date("2026-10-15T12:00:00Z"),
+        }),
+        entry({
+          id: "b",
+          slug: "z-newer-creation",
+          date: "2026-10-15",
+          createdAt: new Date("2026-10-15T12:00:00Z"),
+        }),
+        entry({
+          id: "c",
+          slug: "older-release-date",
+          date: "2026-10-14",
+          createdAt: new Date("2026-10-16T12:00:00Z"),
+        }),
+      ]),
+    });
+
+    expect(
+      (await changelog.listPublishedEntries()).items.map(({ slug }) => slug),
+    ).toEqual([
+      "a-newer-creation",
+      "z-newer-creation",
+      "older-creation",
+      "older-release-date",
+    ]);
+  });
+
   it("returns only Published Changelog Entries in deterministic Date order", async () => {
     const changelog = createChangelogModule({
       storage: createInMemoryChangelogStorage([

package/template/src/feedbax/changelog/index.ts

@@ -160,7 +160,11 @@ function compareEntries(
   left: StoredChangelogEntry,
   right: StoredChangelogEntry,
 ): number {
-  return right.date.localeCompare(left.date) || left.id.localeCompare(right.id);
+  return (
+    right.date.localeCompare(left.date) ||
+    right.createdAt.getTime() - left.createdAt.getTime() ||
+    left.slug.localeCompare(right.slug)
+  );
 }
 
 function toPublicEntry(entry: StoredChangelogEntry): PublicChangelogEntry {

package/template/src/feedbax/changelog/notion-changelog.test.ts

@@ -183,7 +183,7 @@ describe("Notion Changelog query contract", () => {
       },
       sorts: [
         { property: propertyIds.date, direction: "descending" },
-        { timestamp: "created_time", direction: "ascending" },
+        { timestamp: "created_time", direction: "descending" },
         { property: propertyIds.slug, direction: "ascending" },
       ],
     });

package/template/src/feedbax/changelog/notion-changelog.ts

@@ -168,7 +168,7 @@ export function createNotionChangelogStorage({
           },
           sorts: [
             { property: propertyIds.date, direction: "descending" },
-            { timestamp: "created_time", direction: "ascending" },
+            { timestamp: "created_time", direction: "descending" },
             { property: propertyIds.slug, direction: "ascending" },
           ],
         }),

package/template/src/feedbax/config/index.test.ts

@@ -1,10 +1,22 @@
 import { describe, expect, it } from "vitest";
 import {
+  assertRuntimeBindings,
   assertProductionConfiguration,
   defineFeedbax,
   type FeedbaxConfig,
 } from "./index";
 
+it("keeps observed history opt-in and requires explicitly provisioned D1 without enabling identity", () => {
+  expect(defineFeedbax(input).history).toBeUndefined();
+  const config = defineFeedbax({ ...input, history: true });
+  expect(config.connected).toBeUndefined();
+  expect(() => assertRuntimeBindings(config, {})).toThrow("FEEDBAX_DB");
+  expect(() => assertRuntimeBindings(config, { FEEDBAX_DB: {} })).not.toThrow();
+  expect(() =>
+    defineFeedbax({ ...input, history: "yes" } as unknown as FeedbaxConfig),
+  ).toThrow("history must be true or false");
+});
+
 const properties = Object.fromEntries(
   [
     "title",
@@ -24,7 +36,7 @@ const properties = Object.fromEntries(
     "createdAt",
     "updatedAt",
   ].map((key) => [key, `${key}-id`]),
-) as FeedbaxConfig["notion"]["properties"];
+) as NonNullable<FeedbaxConfig["notion"]>["properties"];
 const changelogProperties = Object.fromEntries(
   [
     "title",
@@ -63,6 +75,38 @@ const input: FeedbaxConfig = {
 };
 
 describe("Feedbax configuration", () => {
+  it("selects GitHub without Notion or verified identity and rejects mixed providers", () => {
+    const github = {
+      installationId: "portal-acme",
+      serviceUrl: "https://app.feedbax.example",
+      repository: { id: 123, owner: "acme", name: "feedback" },
+      botUserId: 456,
+    };
+    const configuration = {
+      ...input,
+      provider: "github",
+      notion: undefined,
+      changelog: undefined,
+      features: { ...input.features, changelog: false },
+      github,
+    };
+    const parsed = defineFeedbax(configuration as unknown as FeedbaxConfig);
+    expect(parsed).toMatchObject({ provider: "github", github });
+    expect(parsed.notion).toBeUndefined();
+    expect(parsed.connected).toBeUndefined();
+    expect(() =>
+      defineFeedbax({
+        ...configuration,
+        notion: input.notion,
+      } as unknown as FeedbaxConfig),
+    ).toThrow("one Content Provider");
+    expect(() =>
+      defineFeedbax({
+        ...configuration,
+        features: input.features,
+      } as unknown as FeedbaxConfig),
+    ).toThrow("disable Changelog");
+  });
   it("accepts the complete generated contract", () =>
     expect(defineFeedbax(input)).toEqual(input));
   it("requires enabled capability dependencies", () =>