Upgrade Feedback and migrate caller-owned ingestion

.env.example

@@ -3,4 +3,4 @@
 
 FREE_AI_API_KEY=
 FREE_AI_GATEWAY_URL=
-VITE_SAASMAKER_API_KEY=
+VITE_FEEDBACK_INGESTION_URL=

PROJECT_STATUS.md

@@ -1,6 +1,6 @@
 # Chess Coach — PROJECT STATUS
 
-Last updated: 2026-07-29
+Last updated: 2026-08-06
 
 > Deep context lives in [`docs/`](docs/index.md). Update this file when durable
 > current or shipped product truth changes.
@@ -12,10 +12,15 @@ plain-language AI coaching. Personal learning project under Significant Hobbies.
 
 ## Dependencies
 
-- Stockfish WASM, Vite, Cloudflare Pages, and optional AI coaching providers.
+- Stockfish WASM, Vite, Cloudflare Pages, optional local AI coaching providers,
+  and the optional `@saas-maker/feedback` client with a caller-owned ingestion
+  endpoint.
 
 ## Timeline
 
+- **2026-08-06:** Migrated the optional feedback widget to the package's
+  caller-owned ingestion URL contract and removed the retired hosted API-key
+  integration.
 - **2026-08-01:** Retired the dormant Vercel deployment path and hosted LLM
   proxy, removed its build dependency, and limited AI coaching to the local
   authenticated CLI bridge. The active Cloudflare Pages product is unchanged.
@@ -38,7 +43,7 @@ plain-language AI coaching. Personal learning project under Significant Hobbies.
 - Optional AI coaching through the local authenticated CLI bridge in
   development; the active Cloudflare Pages deploy remains static.
 - Agent/crawler surfaces (llms.txt, /api/ai, sitemap, robots, IndexNow, FAQ +
-  JSON-LD). SaaS Maker widgets + PostHog analytics.
+  JSON-LD), PostHog analytics, and an optional caller-owned feedback widget.
 - Cloudflare Pages deploy (manual dispatch).
 - Tracked Cloudflare Pages COEP/COOP headers required by Stockfish WASM.
 - Owned editorial product changelog at `/changelog`.

README.md

@@ -10,7 +10,8 @@ Play chess against Stockfish in the browser and request plain-language coaching
 - Configurable chess clocks and automatic local game-state persistence.
 - Optional streaming coaching through supported local CLI tools during
   development. The live static Pages target does not serve a hosted AI proxy.
-- Responsive React interface with direct PostHog analytics and the SaaS Maker feedback widget.
+- Responsive React interface with direct PostHog analytics and an optional
+  caller-owned SaaS Maker feedback widget.
 
 ## Local development
 

docs/architecture/overview.md

@@ -24,15 +24,14 @@ src/
     ChessClock.tsx              # Countdown timer per player
     DifficultyPicker.tsx        # 6-level difficulty selector (Beginner → Max)
     AIConfig.tsx                # Modal: local CLI provider and model
-    saasmaker-feedback.tsx      # SaaSMaker feedback/testimonials/changelog widgets
+    saasmaker-feedback.tsx      # Optional caller-owned feedback widget
     posthog-provider.tsx        # PostHog analytics provider
     PageViewTracker.tsx         # Page view tracking
   hooks/
     useAI.ts                    # AI provider abstraction + SSE streaming
   lib/
     stockfish.ts                # StockfishEngine — Web Worker wrapper with queue
     ai-prompts.ts               # System + per-move coaching prompt builder
-    saasmaker.ts                # SaaSMaker SDK client init
 server/                         # git SUBMODULE — Express CLI bridge (dev only)
 public/
   stockfish.js + .wasm          # engine assets served statically

docs/development/conventions.md

@@ -50,8 +50,9 @@ which perspective they want and convert explicitly.
 ## Config / secrets
 
 - No secrets in code or env-committed files. `.env*` and `*.local` are gitignored.
-- `foundry.json` contains the SaaS Maker feedback **project key** (public-prefix,
-  low risk) and is committed intentionally.
+- The optional feedback widget accepts only a caller-owned
+  `VITE_FEEDBACK_INGESTION_URL`; it has no bundled credential or hosted SaaS
+  Maker API fallback.
 - The husky pre-push hook scans for common secret patterns; respect its excludes
   (tests, fixtures, `.example`).
 

docs/development/setup.md

@@ -49,15 +49,13 @@ Docs-only commands (Blume is not a dependency; scripts fetch it on demand):
 ## Environment variables
 
 ```bash
-# .env.local (gitignored). Only PostHog vars are documented in .env.example:
+# .env.local (gitignored):
 VITE_POSTHOG_KEY=          # PostHog analytics key
 VITE_POSTHOG_HOST=https://us.i.posthog.com
 
-# Also read by the SaaSMaker widgets (src/lib/saasmaker.ts,
-# saasmaker-feedback.tsx) but NOT listed in .env.example. The committed
-# foundry.json already carries the SaaSMaker project key (public pk_ prefix),
-# so this is optional for local runs:
-VITE_SAASMAKER_API_KEY=
+# Optional caller-owned endpoint for the feedback widget. The widget stays
+# hidden when no endpoint is configured:
+VITE_FEEDBACK_INGESTION_URL=
 ```
 
 Hosted cloud-provider coaching is retired. The AI Config modal selects only a

docs/operations/security-audit.md

@@ -14,8 +14,9 @@ description: Security audit of the chess repo — hosted proxy retirement and lo
 None found. No `.env`, `.pem`, `.key`, or service-account files in any commit.
 
 ## Credentials on Disk
-`.env.local` contains `VITE_SAASMAKER_API_KEY=pk_...` (public key prefix -- low risk).
-`.gitignore` covers `*.local` so this file is not tracked. No other credential files found.
+The optional feedback widget reads a caller-owned ingestion URL and does not
+ship a SaaS Maker API key. `.gitignore` covers `*.local` so local configuration
+is not tracked. No other credential files were found during the audit.
 
 ## Deployment
 The active Cloudflare Pages workflow uploads only the Vite `dist/` directory.

docs/product/overview.md

@@ -29,8 +29,8 @@ human-readable move explanations — closer to a coach than a raw eval bar.
 - On-demand streaming AI coaching through supported local CLI tools (Claude
   Code, Codex, Gemini CLI) during development.
 - Automatic local game-state persistence across reloads (`localStorage`).
-- Responsive desktop + mobile layout, direct PostHog analytics, and the SaaS
-  Maker feedback widget.
+- Responsive desktop + mobile layout, direct PostHog analytics, and an optional
+  caller-owned SaaS Maker feedback widget.
 - Agent- and crawler-facing surfaces: `llms.txt`, `llms-full.txt`, `/api/ai`,
   `index.md`, `sitemap.xml`, `robots.txt`, IndexNow key, FAQ page with
   `FAQPage` JSON-LD. See [operations/agent-indexing](../operations/agent-indexing.md).

package.json

@@ -18,7 +18,7 @@
     "knip:strict": "knip --reporter symbols"
   },
   "dependencies": {
-    "@saas-maker/feedback": "^0.2.1",
+    "@saas-maker/feedback": "^0.4.0",
     "chess.js": "1.4.0",
     "lucide-react": "1.27.0",
     "posthog-js": "^1.407.3",