Changelog

0.3.0 — 2026-09-06

• Dashboard: new Live page — the last 15 minutes of widget activity: page loads, opens and reports per minute, referrers, countries on a world map, devices, top pages and a feed of what just happened. Counted in the API's memory only and dropped after 15 minutes: no cookies, no visitor ids, nothing written to the database.
• Widget 1.1.0: the page-load beacon carries the external referrer's hostname (never the full URL, never same-site). Bundle 12.2 KB gzipped.
• API: GET /v1/projects/{id}/live; POST /v1/event accepts ref.

0.2.1 — 2026-09-06

• API: Turnstile is enforced only on hostnames configured on the Cloudflare widget (TURNSTILE_HOSTNAMES). Other hosts get no site key from /v1/config, and a submission without a token from them is stored as skipped instead of spam. Previously every customer domain outside the widget's 10-hostname list would have had all its feedback filed as spam.
• API: the Turnstile widget's hostname list is now kept in sync with project domains through the Cloudflare API (CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID): on project create/update and hourly via run_jobs.py turnstile. Reserved hostnames come first, then projects in creation order, up to the plan's 10 slots. The live list also decides where Turnstile is enforced.
• API: SupabaseRepo was missing bump_stats and stat_rows, so the first live project's Install and Insights pages returned 500 and no widget stats were being recorded. Added, with a test that every Repo protocol method exists on the Supabase implementation with the same signature.
• Dashboard: the Install page reads the live release from cdn.backwire.io/index.json and shows a version-pinned tag with its integrity hash.
• Ops: live Supabase project BackWire carries both migrations; hosting refs recorded in STATUS.md and docs/env.md.

0.2.0 — 2026-09-06

Changed

Added

• Named: BackWire (backwire.io), tagline “Feedback that wires back to you.” Public surface renamed: data-backwire, window.backwire, bw_pk_ keys, @backwire/widget, __backwire_skip_net; hosts api. / cdn.backwire.io; sender feedback@backwire.io.
• Widget visuals reconciled with docs/widget-redesign.html: exact light/dark tokens, divided top row, boxed faces, outline icons, accent check circle, brand footer.
• Widget redesigned: a quiet 44 px pill in the card's surface colour, one 312 px card with a segmented Rate / Idea / Problem control, faces for ratings, a single-box mode, edge-tab and no-bubble positions, per-locale labels, accent with automatic contrast, corner radius, first-show delay, hide-on-scroll, footer link, and window.backwire.open/close/identify.
• Analytics are now cookieless daily aggregates (widget_stats) by page, UTM, country and device, fed by POST /v1/event; /v1/config no longer counts. Country comes from the CF-IPCountry header or an optional MaxMind lookup; the IP is discarded.
• Insights is a funnel: lowest-rated pages, campaigns bringing problem reports, then views → opens → submits by page, source, campaign, country and device.
• Settings preview runs the real widget bundle in an iframe with no network.
• Slack incoming webhook, daily 9am owner-local digest, 30-day retention job for the free plan, PATCH /v1/me timezone, public demo feed.
• Marketing site: home with the live widget, pricing, privacy, terms, changelog, demo inbox, docs.
• Password sign-in, account creation and password reset.

0.1.0 — 2026-09-05

Added

• Repo scaffold: command-center files, CI workflow, spec + M1/M2 plan under docs/.
• Supabase schema: all Phase 1 tables + Phase 2 stubs, RLS via private.* helper predicates, increment_impression RPC, new-user org trigger, pgTAP RLS checks, dev seed.
• FastAPI service: public /v1/config, /v1/submit, /v1/open, /v1/submit/{id}/contact with per-project CORS, origin allow-list (wildcards), honeypot, sliding-window rate limits, Turnstile verification, golden-tested redaction, 64 KB / 32 KB size limits, owner email notifications; private project/submission routes with audit events and the deterministic "Copy as agent prompt" renderer; in-memory repo for tests/dev and Supabase repo for prod.
• Widget: zero-dependency TypeScript IIFE (8.96 KB gz), closed shadow DOM, CSP-safe styling, rolling context buffer (console/network/errors/clicks, reversible, redacting), bubble → picker → form → thanks/contact nudge → done state machine, SPA route watching, lazy Turnstile, window.backwire.init, 20 KB size gate, Playwright fixtures for strict CSP / SPA / reset CSS.
• Docs: docs/embed.md.
• API: /v1/me, /v1/org (get, rename, delete), /v1/submissions/bulk, rating and has_contact filters.
• Dashboard (web/, Next.js 16): magic-link + Google sign-in via @supabase/ssr with a no-Supabase dev mode, onboarding, install page with framework snippets and the live "first load" check, inbox with filter chips, search, bulk actions and j/k/e/c keys, detail drawer with the merged "before the report" timeline, status changes, email replies with history, Copy as agent prompt + download, insights, project settings with preview and export, organisation settings; Playwright e2e against the real API.