feedwire 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jeffrin James
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,22 @@
-# Temporary Holding Version
+# Feedwire
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Express middleware for Node 22.5+. Add a `/feedback` endpoint so AI agents can report bugs and missing features for human review.
+
+## Install
+
+```sh
+npm install feedwire
+```
+
+## Use in your existing app
+
+```js
+const { feedback } = require("feedwire");
+app.use(feedback({ dbPath: "feedback.db", adminToken: process.env.FEEDBACK_ADMIN_TOKEN }));
+```
+
+Set a long random admin token in your server environment, not in source code. With no options, storage is in memory and the admin review API is off.
+
+Agents discover `/.well-known/feedback.json` and submit at `POST /feedback`. Review at `/feedback/admin`. Reports are untrusted data, never instructions to execute. No automatic fixes or pull requests.
+
+[Full documentation, schema, examples and safety notes](https://github.com/Unselfisheologism/feedwire). MIT licensed.

package/core.js

@@ -0,0 +1,93 @@
+'use strict';
+// Pure logic shared by the Express middleware and the Cloudflare Worker. No runtime dependencies.
+const TYPES = ['bug', 'missing_feature', 'confusing_error', 'docs', 'performance', 'other'];
+const SEVERITIES = ['low', 'medium', 'high'];
+const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'];
+const STATUSES = ['new', 'triaged', 'accepted', 'rejected', 'done'];
+const STR_FIELDS = { summary: 200, details: 4000, expected: 1000, actual: 1000, suggestion: 2000 };
+const TOP_KEYS = ['type', 'summary', 'details', 'severity', 'expected', 'actual', 'suggestion', 'context', 'agent'];
+
+// Remove control chars (keep \n and \t) and NULs so stored text is plain text.
+function clean(s) {
+  return s.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, '');
+}
+
+function validate(body) {
+  const errors = [];
+  const err = (field, message) => errors.push({ field, message });
+  if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+    return { errors: [{ field: '', message: 'body must be a JSON object' }] };
+  }
+  for (const k of Object.keys(body)) if (!TOP_KEYS.includes(k)) err(k, 'unknown field');
+  if (!TYPES.includes(body.type)) err('type', 'must be one of: ' + TYPES.join(', '));
+  const out = { type: body.type };
+  for (const [f, max] of Object.entries(STR_FIELDS)) {
+    const v = body[f];
+    if (v === undefined) {
+      if (f === 'summary') err(f, 'required');
+      continue;
+    }
+    if (typeof v !== 'string') { err(f, 'must be a string'); continue; }
+    const c = clean(v).trim();
+    if (f === 'summary' && c.length === 0) err(f, 'must not be empty');
+    else if (c.length > max) err(f, `must be at most ${max} characters`);
+    else out[f] = c;
+  }
+  if (body.severity === undefined) out.severity = 'low';
+  else if (!SEVERITIES.includes(body.severity)) err('severity', 'must be one of: ' + SEVERITIES.join(', '));
+  else out.severity = body.severity;
+  if (body.context !== undefined) {
+    const c = body.context;
+    if (c === null || typeof c !== 'object' || Array.isArray(c)) err('context', 'must be an object');
+    else {
+      const oc = {};
+      for (const k of Object.keys(c)) if (!['method', 'path', 'status_code', 'error_message'].includes(k)) err('context.' + k, 'unknown field');
+      if (c.method !== undefined) { if (!METHODS.includes(c.method)) err('context.method', 'must be one of: ' + METHODS.join(', ')); else oc.method = c.method; }
+      if (c.path !== undefined) { if (typeof c.path !== 'string' || c.path.length > 300) err('context.path', 'must be a string of at most 300 characters'); else oc.path = clean(c.path); }
+      if (c.status_code !== undefined) { if (!Number.isInteger(c.status_code) || c.status_code < 100 || c.status_code > 599) err('context.status_code', 'must be an integer from 100 to 599'); else oc.status_code = c.status_code; }
+      if (c.error_message !== undefined) { if (typeof c.error_message !== 'string' || c.error_message.length > 1000) err('context.error_message', 'must be a string of at most 1000 characters'); else oc.error_message = clean(c.error_message); }
+      out.context = oc;
+    }
+  }
+  if (body.agent !== undefined) {
+    const a = body.agent;
+    if (a === null || typeof a !== 'object' || Array.isArray(a)) err('agent', 'must be an object');
+    else {
+      const oa = {};
+      for (const k of Object.keys(a)) if (!['name', 'version'].includes(k)) err('agent.' + k, 'unknown field');
+      if (a.name !== undefined) { if (typeof a.name !== 'string' || a.name.length > 100) err('agent.name', 'must be a string of at most 100 characters'); else oa.name = clean(a.name); }
+      if (a.version !== undefined) { if (typeof a.version !== 'string' || a.version.length > 50) err('agent.version', 'must be a string of at most 50 characters'); else oa.version = clean(a.version); }
+      out.agent = oa;
+    }
+  }
+  return errors.length ? { errors } : { value: out };
+}
+
+const top = (m, n = 10) => [...m.entries()].sort((a, b) => b[1] - a[1] || String(a[0]).localeCompare(String(b[0]))).slice(0, n).map(([key, count]) => ({ key, count }));
+const bump = (m, k) => m.set(k, (m.get(k) || 0) + 1);
+
+// What are agents struggling with? Aggregates over rows from the last `days` days.
+function stats(rows, days) {
+  const by = { type: new Map(), severity: new Map(), status: new Map(), endpoint: new Map(), agent: new Map(), day: new Map() };
+  const struggles = new Map();
+  for (const r of rows) {
+    bump(by.type, r.type); bump(by.severity, r.severity); bump(by.status, r.status);
+    bump(by.day, r.created_at.slice(0, 10));
+    const c = r.payload.context;
+    if (c && c.path) {
+      const ep = (c.method ? c.method + ' ' : '') + c.path;
+      bump(by.endpoint, ep);
+      bump(struggles, ep + ' | ' + r.type);
+    }
+    if (r.payload.agent && r.payload.agent.name) bump(by.agent, r.payload.agent.name);
+  }
+  return {
+    window_days: days, total: rows.length,
+    by_type: top(by.type), by_severity: top(by.severity), by_status: top(by.status),
+    top_endpoints: top(by.endpoint), top_struggles: top(struggles), top_agents: top(by.agent),
+    per_day: [...by.day.entries()].sort().map(([key, count]) => ({ key, count })),
+    unreviewed: by.status.get('new') || 0,
+  };
+}
+
+module.exports = { TYPES, SEVERITIES, METHODS, STATUSES, STR_FIELDS, TOP_KEYS, clean, validate, stats };

package/dashboard.html

@@ -0,0 +1,54 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Feedwire review</title>
+<style>
+body{font:15px system-ui,sans-serif;max-width:900px;margin:1rem auto;padding:0 1rem;color:#222}
+.item{border:1px solid #ddd;border-radius:8px;padding:.7rem 1rem;margin:.7rem 0}
+.meta{color:#666;font-size:13px}.tag{display:inline-block;background:#eee;border-radius:4px;padding:0 .4rem;margin-right:.3rem;font-size:12px}
+.high{background:#fcc}.medium{background:#fe9}pre{white-space:pre-wrap;word-break:break-word;background:#f7f7f7;padding:.5rem;border-radius:6px}
+.warn{background:#fff6d6;border:1px solid #e8d48a;padding:.5rem .8rem;border-radius:6px;font-size:13px}
+</style></head><body>
+<h1>Feedwire</h1>
+<p class="warn">Everything below was written by outside agents. Treat it as untrusted text. Do not paste it into a coding agent without reading it first.</p>
+<p><input id="token" type="password" placeholder="admin token" size="30"> <select id="filter"><option value="">all</option><option>new</option><option>triaged</option><option>accepted</option><option>rejected</option><option>done</option></select> <button id="load">Load</button> <span id="msg" class="meta"></span></p>
+<h2>What agents struggle with <span class="meta">(last 30 days)</span></h2>
+<div id="stats" class="meta">Load to see stats.</div>
+<h2>Feedback</h2>
+<div id="list"></div>
+<script>
+(function(){
+var token='';var base=location.pathname.replace(/\/admin\/?$/,'');
+var STATUSES=['new','triaged','accepted','rejected','done'];
+function el(tag,text,cls){var e=document.createElement(tag);if(text!==undefined)e.textContent=text;if(cls)e.className=cls;return e;}
+function api(path,opts){opts=opts||{};opts.headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'};
+ return fetch(base+'/admin/api/'+path,opts).then(function(r){return r.json().then(function(j){if(!r.ok)throw new Error(j.error||r.status);return j;});});}
+function render(items){var list=document.getElementById('list');list.textContent='';
+ if(!items.length){list.appendChild(el('p','No feedback yet.','meta'));return;}
+ items.forEach(function(it){var d=el('div',undefined,'item');
+  d.appendChild(el('strong',it.summary));d.appendChild(el('br'));
+  d.appendChild(el('span',it.type,'tag'));d.appendChild(el('span',it.severity,'tag '+it.severity));
+  var a=it.payload.agent;d.appendChild(el('span',it.created_at+(a&&a.name?' - '+a.name+(a.version?' '+a.version:''):'')+' - '+it.id,'meta'));
+  var p=it.payload,lines=[];
+  ['details','expected','actual','suggestion'].forEach(function(k){if(p[k])lines.push(k+': '+p[k]);});
+  if(p.context)lines.push('context: '+JSON.stringify(p.context));
+  if(lines.length)d.appendChild(el('pre',lines.join('\n')));
+  var sel=el('select');STATUSES.forEach(function(s){var o=el('option',s);if(s===it.status)o.selected=true;sel.appendChild(o);});
+  var note=el('input');note.value=it.note||'';note.placeholder='note';note.size=30;
+  var save=el('button','Save');save.onclick=function(){api('items/'+encodeURIComponent(it.id),{method:'PATCH',body:JSON.stringify({status:sel.value,note:note.value})}).then(function(){msg('Saved');}).catch(function(e){msg(e.message);});};
+  d.appendChild(sel);d.appendChild(document.createTextNode(' '));d.appendChild(note);d.appendChild(document.createTextNode(' '));d.appendChild(save);
+  list.appendChild(d);});}
+function bars(title,arr){var d=el('div');d.appendChild(el('strong',title));
+ if(!arr.length){d.appendChild(el('div','none','meta'));return d;}
+ var max=arr[0].count;arr.forEach(function(x){var r=el('div');var b=el('span','','bar');b.style.cssText='display:inline-block;height:10px;background:#79c;margin-right:6px;width:'+Math.max(4,Math.round(120*x.count/max))+'px';r.appendChild(b);r.appendChild(document.createTextNode(x.count+'  '+x.key));d.appendChild(r);});return d;}
+function renderStats(s){var box=document.getElementById('stats');box.textContent='';
+ box.appendChild(el('p',s.total+' reports, '+s.unreviewed+' not yet reviewed'));
+ var g=el('div');g.style.cssText='display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:1rem';
+ g.appendChild(bars('Top struggles (endpoint | type)',s.top_struggles));g.appendChild(bars('By type',s.by_type));
+ g.appendChild(bars('Top endpoints',s.top_endpoints));g.appendChild(bars('By severity',s.by_severity));
+ g.appendChild(bars('Top agents',s.top_agents));g.appendChild(bars('Per day',s.per_day));box.appendChild(g);}
+function msg(t){document.getElementById('msg').textContent=t;}
+document.getElementById('load').onclick=function(){token=document.getElementById('token').value.trim();var f=document.getElementById('filter').value;
+ api('stats').then(renderStats).catch(function(e){msg(e.message);});
+ api('items'+(f?'?status='+f:'')).then(function(j){msg(j.items.length+' items');render(j.items);}).catch(function(e){msg(e.message);});};
+})();
+</script></body></html>

package/feedback.schema.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Feedwire submission v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["type", "summary"],
+  "properties": {
+    "type": { "enum": ["bug", "missing_feature", "confusing_error", "docs", "performance", "other"] },
+    "summary": { "type": "string", "minLength": 1, "maxLength": 200 },
+    "details": { "type": "string", "maxLength": 4000 },
+    "severity": { "enum": ["low", "medium", "high"], "default": "low" },
+    "expected": { "type": "string", "maxLength": 1000 },
+    "actual": { "type": "string", "maxLength": 1000 },
+    "suggestion": { "type": "string", "maxLength": 2000 },
+    "context": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "method": { "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"] },
+        "path": { "type": "string", "maxLength": 300 },
+        "status_code": { "type": "integer", "minimum": 100, "maximum": 599 },
+        "error_message": { "type": "string", "maxLength": 1000 }
+      }
+    },
+    "agent": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string", "maxLength": 100 },
+        "version": { "type": "string", "maxLength": 50 }
+      }
+    }
+  }
+}

package/index.js

@@ -0,0 +1,205 @@
+'use strict';
+// Feedwire middleware for Express (or any connect-style server).
+// Storage: node:sqlite (built into Node >= 22.5). No runtime dependencies.
+const { DatabaseSync } = require('node:sqlite');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { STATUSES, clean, validate, stats } = require('./core');
+const SCHEMA = JSON.parse(fs.readFileSync(path.join(__dirname, 'feedback.schema.json'), 'utf8'));
+const DASHBOARD = fs.readFileSync(path.join(__dirname, 'dashboard.html'), 'utf8');
+
+function send(res, status, obj, headers) {
+  const body = JSON.stringify(obj);
+  res.writeHead(status, Object.assign({
+    'Content-Type': 'application/json; charset=utf-8',
+    'Content-Length': Buffer.byteLength(body),
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+  }, headers));
+  res.end(body);
+}
+
+function readBody(req, limit) {
+  return new Promise((resolve, reject) => {
+    const declared = Number(req.headers['content-length']);
+    if (declared > limit) return reject(Object.assign(new Error('too large'), { code: 'TOO_LARGE' }));
+    const chunks = [];
+    let size = 0;
+    req.on('data', (c) => {
+      size += c.length;
+      if (size > limit) { req.destroy(); return reject(Object.assign(new Error('too large'), { code: 'TOO_LARGE' })); }
+      chunks.push(c);
+    });
+    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+    req.on('error', reject);
+  });
+}
+
+function safeEqual(a, b) {
+  const ha = crypto.createHash('sha256').update(String(a)).digest();
+  const hb = crypto.createHash('sha256').update(String(b)).digest();
+  return crypto.timingSafeEqual(ha, hb);
+}
+
+/**
+ * @param {object} opts
+ * @param {string} [opts.dbPath=':memory:']  SQLite file path
+ * @param {string} [opts.adminToken]         Bearer token for the review API. Unset = review API disabled.
+ * @param {string} [opts.basePath='/feedback']
+ * @param {number} [opts.maxBodyBytes=16384]
+ * @param {number} [opts.rateLimitPerMinute=30]  per client IP
+ * @param {number} [opts.maxRows=50000]      new submissions are refused (503) past this
+ * @param {boolean} [opts.trustProxy=false]  use X-Forwarded-For for rate limiting
+ */
+function feedback(opts = {}) {
+  const base = (opts.basePath || '/feedback').replace(/\/+$/, '');
+  const maxBody = opts.maxBodyBytes || 16384;
+  const perMin = opts.rateLimitPerMinute || 30;
+  const maxRows = opts.maxRows || 50000;
+  const db = new DatabaseSync(opts.dbPath || ':memory:');
+  db.exec(`CREATE TABLE IF NOT EXISTS feedback (
+    id TEXT PRIMARY KEY,
+    created_at TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'new',
+    type TEXT NOT NULL,
+    severity TEXT NOT NULL,
+    summary TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    note TEXT NOT NULL DEFAULT ''
+  )`);
+  const insert = db.prepare('INSERT INTO feedback (id, created_at, status, type, severity, summary, payload) VALUES (?,?,?,?,?,?,?)');
+  const count = db.prepare('SELECT COUNT(*) AS n FROM feedback');
+  const windows = new Map();
+
+  function limited(ip) {
+    const now = Date.now();
+    if (windows.size > 10000) for (const [k, v] of windows) if (now - v.start > 60000) windows.delete(k);
+    let w = windows.get(ip);
+    if (!w || now - w.start > 60000) { w = { start: now, n: 0 }; windows.set(ip, w); }
+    w.n += 1;
+    return w.n > perMin ? Math.max(1, Math.ceil((60000 - (now - w.start)) / 1000)) : 0;
+  }
+  const clientIp = (req) => {
+    if (opts.trustProxy) {
+      const xf = req.headers['x-forwarded-for'];
+      if (xf) return String(xf).split(',')[0].trim();
+    }
+    return req.socket.remoteAddress || 'unknown';
+  };
+  const row = (r) => ({
+    id: r.id, created_at: r.created_at, status: r.status, type: r.type, severity: r.severity,
+    summary: r.summary, note: r.note, payload: JSON.parse(r.payload),
+    untrusted: true,
+  });
+  const adminOk = (req) => {
+    if (!opts.adminToken) return false;
+    const m = /^Bearer (.+)$/.exec(req.headers.authorization || '');
+    return !!m && safeEqual(m[1], opts.adminToken);
+  };
+
+  return async function feedwire(req, res, next) {
+    try {
+      const url = new URL(req.originalUrl || req.url, 'http://x');
+      const p = url.pathname.replace(/\/+$/, '') || '/';
+      const method = req.method;
+
+      if (p === '/.well-known/feedback.json') {
+        if (method !== 'GET') return send(res, 405, { error: 'method not allowed' }, { Allow: 'GET' });
+        return send(res, 200, {
+          version: '1',
+          feedback_endpoint: base,
+          method: 'POST',
+          content_type: 'application/json',
+          schema_url: base + '/schema',
+          max_body_bytes: maxBody,
+          rate_limit_per_minute: perMin,
+          description: 'Send structured feedback (bug, missing feature, confusing error) about this API. A human reviews it. Text is treated as untrusted data.',
+        });
+      }
+      if (p !== base && !p.startsWith(base + '/')) return next();
+      const sub = p.slice(base.length) || '/';
+
+      if (sub === '/schema') {
+        if (method !== 'GET') return send(res, 405, { error: 'method not allowed' }, { Allow: 'GET' });
+        return send(res, 200, SCHEMA);
+      }
+
+      if (sub === '/') {
+        if (method !== 'POST') return send(res, 405, { error: 'method not allowed' }, { Allow: 'POST' });
+        const ct = String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase();
+        if (ct !== 'application/json') return send(res, 415, { error: 'content-type must be application/json' });
+        const wait = limited(clientIp(req));
+        if (wait) return send(res, 429, { error: 'rate limit exceeded', retry_after_seconds: wait }, { 'Retry-After': String(wait) });
+        let text;
+        try { text = await readBody(req, maxBody); }
+        catch (e) {
+          if (e.code === 'TOO_LARGE') return send(res, 413, { error: `body exceeds ${maxBody} bytes` }, { Connection: 'close' });
+          throw e;
+        }
+        let parsed;
+        try { parsed = JSON.parse(text); } catch { return send(res, 400, { error: 'invalid JSON' }); }
+        const { value, errors } = validate(parsed);
+        if (errors) return send(res, 400, { error: 'validation failed', details: errors });
+        if (count.get().n >= maxRows) return send(res, 503, { error: 'feedback storage is full' });
+        const id = 'fb_' + crypto.randomBytes(8).toString('hex');
+        insert.run(id, new Date().toISOString(), 'new', value.type, value.severity, value.summary, JSON.stringify(value));
+        return send(res, 201, { id, status: 'received' });
+      }
+
+      if (sub === '/admin' && method === 'GET') {
+        res.writeHead(200, {
+          'Content-Type': 'text/html; charset=utf-8',
+          'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+          'X-Content-Type-Options': 'nosniff',
+          'Cache-Control': 'no-store',
+        });
+        return res.end(DASHBOARD);
+      }
+
+      if (sub === '/admin/api/stats') {
+        if (!adminOk(req)) return send(res, 401, { error: 'admin token required' }, { 'WWW-Authenticate': 'Bearer' });
+        if (method !== 'GET') return send(res, 405, { error: 'method not allowed' }, { Allow: 'GET' });
+        const days = Math.min(Math.max(parseInt(url.searchParams.get('days') || '30', 10) || 30, 1), 365);
+        const since = new Date(Date.now() - days * 86400000).toISOString();
+        const rows = db.prepare('SELECT created_at, status, type, severity, payload FROM feedback WHERE created_at >= ?').all(since);
+        return send(res, 200, stats(rows.map((r) => Object.assign({}, r, { payload: JSON.parse(r.payload) })), days));
+      }
+
+      if (sub === '/admin/api/items' || sub.startsWith('/admin/api/items/')) {
+        if (!adminOk(req)) return send(res, 401, { error: 'admin token required' }, { 'WWW-Authenticate': 'Bearer' });
+        if (sub === '/admin/api/items') {
+          if (method !== 'GET') return send(res, 405, { error: 'method not allowed' }, { Allow: 'GET' });
+          const status = url.searchParams.get('status');
+          if (status && !STATUSES.includes(status)) return send(res, 400, { error: 'bad status filter' });
+          const limit = Math.min(Math.max(parseInt(url.searchParams.get('limit') || '100', 10) || 100, 1), 500);
+          const rows = status
+            ? db.prepare('SELECT * FROM feedback WHERE status = ? ORDER BY created_at DESC, rowid DESC LIMIT ?').all(status, limit)
+            : db.prepare('SELECT * FROM feedback ORDER BY created_at DESC, rowid DESC LIMIT ?').all(limit);
+          return send(res, 200, { items: rows.map(row) });
+        }
+        const id = decodeURIComponent(sub.slice('/admin/api/items/'.length));
+        const r = db.prepare('SELECT * FROM feedback WHERE id = ?').get(id);
+        if (!r) return send(res, 404, { error: 'not found' });
+        if (method === 'GET') return send(res, 200, row(r));
+        if (method === 'PATCH') {
+          let b;
+          try { b = JSON.parse(await readBody(req, maxBody)); } catch { return send(res, 400, { error: 'invalid JSON' }); }
+          if (b === null || typeof b !== 'object' || Array.isArray(b)) return send(res, 400, { error: 'body must be an object' });
+          if (b.status !== undefined && !STATUSES.includes(b.status)) return send(res, 400, { error: 'status must be one of: ' + STATUSES.join(', ') });
+          if (b.note !== undefined && (typeof b.note !== 'string' || b.note.length > 2000)) return send(res, 400, { error: 'note must be a string of at most 2000 characters' });
+          db.prepare('UPDATE feedback SET status = ?, note = ? WHERE id = ?').run(b.status ?? r.status, b.note !== undefined ? clean(b.note) : r.note, id);
+          return send(res, 200, row(db.prepare('SELECT * FROM feedback WHERE id = ?').get(id)));
+        }
+        return send(res, 405, { error: 'method not allowed' }, { Allow: 'GET, PATCH' });
+      }
+      return send(res, 404, { error: 'not found' });
+    } catch (e) {
+      if (typeof next === 'function' && !res.headersSent) return next(e);
+      if (!res.headersSent) send(res, 500, { error: 'internal error' });
+    }
+  };
+}
+
+module.exports = { feedback, validate, STATUSES };

package/package.json

@@ -1,6 +1,44 @@
 {
   "name": "feedwire",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "A /feedback endpoint for your API so AI agents can report bugs and missing features. Express middleware.",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "core.js",
+    "dashboard.html",
+    "feedback.schema.json",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.5"
+  },
+  "scripts": {
+    "test": "node --test --no-warnings test/*.test.js"
+  },
+  "license": "MIT",
+  "devDependencies": {
+    "express": "^4.21.2"
+  },
+  "homepage": "https://github.com/Unselfisheologism/feedwire#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Unselfisheologism/feedwire.git",
+    "directory": "node"
+  },
+  "bugs": {
+    "url": "https://github.com/Unselfisheologism/feedwire/issues"
+  },
+  "keywords": [
+    "feedback",
+    "ai",
+    "agents",
+    "express",
+    "api",
+    "middleware"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}