Can I vibe code Rating-Widget?

Build an open-source star rating microservice and embeddable widget using Node.js (Fastify), PostgreSQL, Prisma, and a Vanilla JS Web Component.

1. DATA MODEL & BACKEND:
- Model `Target`: id, domain, target_external_id (string, e.g., product SKU), total_votes (int), rating_sum (int), average_rating (float).
- Model `Vote`: id, target_id, rating (int 1-5), ip_hash (string), user_agent_hash (string), created_at.
- Implement a POST `/api/v1/vote` endpoint accepting `{ target_id, rating }`. Calculate IP hash on the server using SHA-256 for privacy. Throttling: limit to 1 vote per IP per target every 24 hours using Redis rate limiting.
- Implement a GET `/api/v1/ratings` endpoint accepting `target_id`. Return `{ total_votes, average_rating, schema_json_ld }` where `schema_json_ld` is valid Schema.org AggregateRating structured data.

2. FRONTEND EMBED (Web Component):
- Create a zero-dependency Shadow DOM Web Component `<custom-star-rating>` with attributes `api-url` and `target-id`.
- Render 5 interactive SVGs for star icons with dynamic hover effects and half-star fractional filling support for display mode.
- On mount, fetch summary data from `/api/v1/ratings` and update star state. Inject the returned Schema.org JSON-LD dynamically into document head.
- On user star click, issue a POST request to `/api/v1/vote`, update local state optimistically, disable further voting in UI, and set a local storage flag.

3. FAILURE MODES & SECURITY:
- Handle bot attacks: return HTTP 429 when vote threshold per IP is exceeded.
- Gracefully fall back if third-party cookies or localStorage are disabled.
- Sanitize all input fields and apply CORS origin checking to match the target domain.

4. OUT OF SCOPE:
- Rich text reviews, media uploads, multi-tenant administrative portal, user login auth.

$ each button prefixes agent-specific run instructions · build your own product, never copy proprietary code, trademarks or designs