Hand this to your agent

Add the Sir Chats-a-Lot (SCAL) AI chat widget to this site for customer support,
bug reports, and feature requests.

Context you need:
- PRODUCT: <YOUR PRODUCT NAME + one-line description>
- SUPPORT DESTINATION: <email address or ticket system reports should go to>

## 1. Install
- Core (public npm): sir-chats-a-lot@^0.7.1
- Optional Pro (private, GitHub Packages): @proticom/sir-chats-a-lot-pro@^0.4.0
  Pro adds server hardening (body validation, authorize), file attachments, and
  the animated eyes launcher. It requires an access token from Proticom.
  If you have one, create a repo-root .npmrc with exactly:
    @proticom:registry=https://npm.pkg.github.com
    //npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}
  Never write a literal token into any file. Locally, export
  NODE_AUTH_TOKEN=<token> before installing, and note in the deploy docs that
  the hosting provider's BUILD environment needs NODE_AUTH_TOKEN set (a GitHub
  PAT with read:packages) or installs will 401. Without Pro, skip this and use
  the core server helpers from sir-chats-a-lot/server.

## 2. Scaffold
Run: npx scal init --yes --provider anthropic
(This is a Next.js scaffolder; if this site is not Next.js, read the
manual-setup section of the package README instead and replicate the route
handler + mount by hand.) It generates app/api/scal/route.ts, a mount
component, lib/scal/{modes,system-prompt,knowledge-context}.ts, and adds a
"postbuild": "gnosys web build" script. Set ANTHROPIC_API_KEY in .env.local
(never commit). The model can be overridden later with the SCAL_MODEL env var.

## 3. Knowledge base
Put 4-8 markdown docs about the product in knowledge/ (what it is, how to
install/use it, pricing/plans if public, FAQ, troubleshooting). Run
"npx gnosys web build". The route's buildKnowledgeContext already consumes the
index; verify a question about the product gets a grounded answer.

## 4. Surfaces: support / bug / feature
Download the reference surface specs from the SCAL repo
(raw.githubusercontent.com, repo proticom/sir-chats-a-lot, path
examples/surface-specs/):
- mavenn/bug.spec.json and mavenn/feature.spec.json (best field design: bug
  collects email, area, what_happened + auto page_url/browser; feature
  collects request + underlying problem, email optional)
- proticom-ai/support.spec.json (support: name, email, urgency, issue)
Adapt them to this product: rewrite the routesTo strings to the SUPPORT
DESTINATION, adjust area/select options to this product's real surface areas,
keep required/optional/auto flags. Save under scal/specs/. Then run:
npx scal surface-spec generate scal/specs
(outputs to lib/scal/generated). Register the generated modes in the modes
registry used by BOTH the client mount and the API route (they must share one
registry). Write real, friendly greetings per mode — do not ship a placeholder.
If a generated single-select block has empty options, the CLI warns: inject
that mode's options at runtime or hardcode them in the spec.

## 5. Server hardening
In the route handler (createScalHandler if using Pro):
- authorize: allow only this site's production origins + localhost dev.
- attachments: enable (3 files, 5 MB) so bug reports can include screenshots
  (Pro only).
- Leave debug off in production.

## 6. Routing side effects
Generated modes include routingStubs (data only — nothing is delivered
automatically). Implement the actual delivery in the route handler's action
handling: when a bug/feature/support form action arrives, send it to the
SUPPORT DESTINATION (email or ticket API) with the mode's tag
(BUG/FEATURE/SUPPORT) in the subject, including the collected fields and any
attachments. Acknowledge in-widget with a response-time expectation.

## 7. Non-negotiables
- The widget must identify itself as an AI assistant in its greeting (keep the
  built-in AI self-identification; EU AI Act Art. 50).
- Do not log or persist chat content server-side beyond delivering the
  support/bug/feature submissions.
- Conventional commits; do not commit .env.local or any token.

## 8. Verify before finishing
npm ci (or pnpm install --frozen-lockfile), typecheck, and production build all
pass; then exercise each flow end-to-end in dev: ask a product question
(grounded answer with sources), file a bug (arrives at the destination with
fields), submit a feature request, and — if using Pro — confirm a request from
a disallowed origin gets 403. Report what was verified.