@buoy-gg/shared-ui 7.0.79 → 7.0.81

package/lib/module/utils/persistentStorage.web.js

@@ -1 +1 @@
-"use strict";import{devToolsStorageKeys as o}from"../storage/devToolsStorageKeys.js";import{notifyStorageWrite as c}from"./storageWrites.js";const r=new Map;function a(){try{return typeof window==="undefined"?null:window.localStorage}catch{return null}}export const persistentStorage={async getItem(t){if(r.has(t))return r.get(t)??null;try{return a()?.getItem(t)??null}catch{return null}},async setItem(t,e){r.set(t,e);try{const n=a();if(n){n.setItem(t,e);r.delete(t)}}catch{}c(t,e)},async removeItem(t){r.set(t,null);try{const e=a();if(e){e.removeItem(t);r.delete(t)}}catch{}c(t,null)},async getAllKeys(){const t=new Set;try{const e=a();if(e)for(let n=0;n<e.length;n++){const s=e.key(n);if(s?.startsWith(o.base))t.add(s)}}catch{}for(const[e,n]of r){if(!e.startsWith(o.base))continue;if(n===null)t.delete(e);else t.add(e)}return[...t]},async multiGet(t){return Promise.all(t.map(async e=>[e,await persistentStorage.getItem(e)]))},async multiRemove(t){await Promise.all(t.map(e=>persistentStorage.removeItem(e)))},async clear(){await persistentStorage.multiRemove(await persistentStorage.getAllKeys())}};export async function isUsingPersistentStorage(){return a()!==null}export async function getStorageBackendType(){return a()?"localstorage":"memory"}
+"use strict";import{devToolsStorageKeys as s}from"../storage/devToolsStorageKeys.js";import{notifyStorageWrite as c}from"./storageWrites.js";const a=new Map;function r(){try{return typeof window==="undefined"?null:window.localStorage}catch{return null}}export const persistentStorage={async getItem(t){if(a.has(t))return a.get(t)??null;try{return r()?.getItem(t)??null}catch{return null}},async setItem(t,e){a.set(t,e);try{const n=r();if(n){n.setItem(t,e);a.delete(t)}}catch{}c(t,e)},async removeItem(t){a.set(t,null);try{const e=r();if(e){e.removeItem(t);a.delete(t)}}catch{}c(t,null)},async getAllKeys(){const t=new Set;try{const e=r();if(e)for(let n=0;n<e.length;n++){const o=e.key(n);if(o?.startsWith(s.base))t.add(o)}}catch{}for(const[e,n]of a){if(!e.startsWith(s.base))continue;if(n===null)t.delete(e);else t.add(e)}return[...t]},async multiGet(t){return Promise.all(t.map(async e=>[e,await persistentStorage.getItem(e)]))},async multiRemove(t){await Promise.all(t.map(e=>persistentStorage.removeItem(e)))},async clear(){await persistentStorage.multiRemove(await persistentStorage.getAllKeys())}};export async function isUsingPersistentStorage(){return r()!==null}export async function getStorageBackendType(){return r()?"localstorage":"memory"}export async function setItemChecked(t,e,n){await persistentStorage.setItem(t,e);try{return r()?.getItem(t)===e}catch{return false}}export async function getItemChecked(t){const e=r();if(!e)return a.get(t)??null;return e.getItem(t)}export async function storageIsMemoryOnly(){return r()===null}

package/lib/module/utils/realAppState.d.js

@@ -0,0 +1 @@
+"use strict";export{};

package/lib/module/utils/realNow.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/reloadApp.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/reloadPlatform.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/renderCaptureRegistry.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/safeExpoRouter.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/safeStringify.d.js

@@ -0,0 +1 @@
+"use strict";export{};

package/lib/module/utils/snapshotProviderKit.d.js

@@ -0,0 +1 @@
+"use strict";export{};

package/lib/module/utils/stateSnapshotRegistry.d.js

@@ -0,0 +1 @@
+"use strict";export{};

package/lib/module/utils/stateTools.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/storageWrites.d.js

@@ -0,0 +1 @@
+"use strict";export{};

package/lib/module/utils/subscribable.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/subscriberCountNotifier.d.js

@@ -0,0 +1 @@
+"use strict";export{};

package/lib/module/utils/time/RelativeTime.d.js

@@ -0,0 +1 @@
+"use strict";export{};

package/lib/module/utils/time/TickContext.d.js

@@ -0,0 +1 @@
+"use strict";export{};

package/lib/module/utils/time/formatRelativeTime.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/time/index.d.js

@@ -0,0 +1 @@
+"use strict";export{formatRelativeTime}from"./formatRelativeTime.js";export{useRelativeTime}from"./useRelativeTime.js";export{RelativeTime}from"./RelativeTime.js";export{TickProvider,useTick}from"./TickContext.js";

package/lib/module/utils/time/useRelativeTime.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/toolModules.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/typeHelpers.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/module/utils/valueFormatting.d.js

@@ -0,0 +1 @@
+"use strict";

package/lib/typescript/commonjs/bugCase/appInfo.d.ts

@@ -0,0 +1,17 @@
+export interface BugCaseAppInfo {
+    /** Bundle id (iOS) or package name (Android). */
+    id?: string;
+    /** The version people see, like "4.2.0". */
+    version?: string;
+    /** The build number, like "4210". */
+    build?: string;
+}
+type Modules = {
+    application?: unknown;
+    constants?: unknown;
+};
+/** Tests pass stand-ins for expo-application and expo-constants (undefined: not installed). */
+export declare function setAppInfoModulesForTests(modules: Modules | null): void;
+export declare function bugCaseAppInfo(): BugCaseAppInfo;
+export {};
+//# sourceMappingURL=appInfo.d.ts.map

package/lib/typescript/commonjs/bugCase/appInfo.web.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The web build's app facts: none. A browser page has no bundle id or build
+ * number to read, and the native modules appInfo.ts reads don't exist here
+ * (the web build refuses them). The case leaves these fields out.
+ */
+export interface BugCaseAppInfo {
+    id?: string;
+    version?: string;
+    build?: string;
+}
+export declare function bugCaseAppInfo(): BugCaseAppInfo;
+/** The same test hook as the native file, so shared tests import either. */
+export declare function setAppInfoModulesForTests(_modules: unknown): void;
+//# sourceMappingURL=appInfo.web.d.ts.map

package/lib/typescript/commonjs/bugCase/format.d.ts

@@ -10,6 +10,7 @@ import type { BugCase, BugCaseNetworkCall } from "./types";
 export declare function isFailedCall(call: BugCaseNetworkCall): boolean;
 export declare function formatBugCase(kase: BugCase, options?: {
     link?: string;
-    maxCalls?: number;
+    maxCalls?: number; /** Saved picture files, in picture order (MCP). */
+    pictureFiles?: readonly string[];
 }): string;
 //# sourceMappingURL=format.d.ts.map

package/lib/typescript/commonjs/bugCase/index.d.ts

@@ -1,3 +1,5 @@
+export { bugCaseAppInfo } from "./appInfo";
+export type { BugCaseAppInfo } from "./appInfo";
 export { captureBugCase, DEFAULT_BUG_CASE_BUDGET } from "./capture";
 export type { BugCaseBudget, CaptureBugCaseOptions } from "./capture";
 export { base64UrlDecode, base64UrlEncode, BUG_CASE_LOCK_FORMAT, bugCaseHeader, BugCaseLockError, bugLinkUrl, lockBugCase, MAX_BUG_CASE_BYTES, parseBugLink, readBugCaseHeader, unlockBugCase, webCaseCrypto, } from "./lock";
@@ -6,10 +8,14 @@ export { bugCaseRecorderStatus, startBugCaseRecorder, stopBugCaseRecorder } from
 export type { BugCaseRecorderStatus } from "./recorder";
 export { formatBugCase, isFailedCall } from "./format";
 export { BugCaseShapeError, validateBugCase } from "./validate";
+export { addDroppedWhy, base64Bytes, cleanDroppedWhy, DEFAULT_MEDIA_BUDGET, describeDroppedWhy, DROPPED_NOT_JPEG, DROPPED_TO_FIT, fitBugCaseMedia, frameSteps, validateBugCaseMedia, } from "./media";
+export type { BugCaseFrame, BugCaseFrameKind, BugCaseMedia, BugCaseMediaBudget, BugCaseMediaSettings } from "./media";
 export { classifyKey, keyWords, REMOVED_MARK, removedMark, ScrubLimitError, scrubBugCase } from "./scrub";
 export type { ScrubbedItem, ScrubKind, ScrubResult, ScrubRules } from "./scrub";
 export { bugCaseSteps, formatBugCaseSteps, safeTouch } from "./steps";
 export type { BugCaseRouteVisit, BugCaseStep, BugCaseTouch } from "./steps";
 export { BUG_CASE_VERSION } from "./types";
 export type { BugCase, BugCaseConsoleLine, BugCaseMissing, BugCaseNetworkCall, BugCaseScreenElement, } from "./types";
+export { blobSha256, deviceCode, deviceCommit, newDeviceNonce, DEVICE_NONCE_BYTES, fitCard, keyProof, keyProofHash, kitId, kitKey, lockSecret, makeKit, MAX_CARD_JSON_BYTES, newCaseKeyParts, openCard, openKitForDevice, openSecret, pairBytes, pairFrom, checkPair, parseKit, parseWrap, rootLockAad, sealCard, sealKitForDevice, signRecord, teamKeyIdOf, TeamKeyError, unwrapCaseKey, verifyRecord, versionLockAad, webTeamKeyCrypto, wrapCaseKey, WRAP_SUITE, } from "./teamKey";
+export type { BugCard, BugCardFields, BugWrap, CaseKeyParts, KitKind, P256Pair, TeamKeyCrypto, TeamKeyErrorCode, TeamKeyRecord } from "./teamKey";
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/commonjs/bugCase/lock.d.ts

@@ -39,6 +39,13 @@ export interface BugCaseHeader {
     errors: number;
     removed: number;
     missing: number;
+    /**
+     * 16 random bytes, base64url. The team wrap and the card are bound to it.
+     * Optional: blobs from before team keys have none, and still open.
+     */
+    caseTag?: string;
+    /** SHA-256 of the key proof (teamKey.ts `keyProof`), base64url. Comes with `caseTag`. */
+    keyProofHash?: string;
 }
 export interface LockedBugCase {
     blob: Uint8Array;
@@ -74,9 +81,15 @@ export declare function bugCaseHeader(kase: BugCase, bytes: number): BugCaseHead
  * `options.key` locks under an existing link's key (with a fresh nonce), so a
  * case can be replaced, say to add a note, and the link people already have
  * keeps working.
+ *
+ * `caseTag` and `keyProofHash` (teamKey.ts `newCaseKeyParts`) go in the plain
+ * header for team keys. A note edit passes the first tag again, so it never
+ * changes.
  */
 export declare function lockBugCase(kase: BugCase, crypto?: BugCaseCrypto, options?: {
     key?: string;
+    caseTag?: string;
+    keyProofHash?: string;
 }): Promise<LockedBugCase>;
 /** For the server: the plain header, read without the key. */
 export declare function readBugCaseHeader(blob: Uint8Array): BugCaseHeader;

package/lib/typescript/commonjs/bugCase/media.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Frames in a bug case: pictures and video
+ * (research/bug-links-2026-10/media/SPEC.md, rules C1 to C5).
+ *
+ * A frame is a boxed JPEG from the phone. The boxes went on in native code
+ * before the frame was kept (H1), so nothing here looks inside the pixels.
+ * The text scrubber never sees `jpeg` either (C4): capture adds media after
+ * the scrub.
+ */
+export type BugCaseFrameKind = "last" | "tap" | "video";
+export interface BugCaseFrame {
+    /** Steady clock, ms (F10). Frames, taps, errors and calls share it. */
+    t: number;
+    /** Wall time, ms since 1970, for people. */
+    wall?: number;
+    /** "last" is the app just before Buoy opened (F8). */
+    kind: BugCaseFrameKind;
+    /** The touch's seq, for kind "tap". */
+    tap?: number;
+    /** Size in points. */
+    w: number;
+    h: number;
+    /** Base64 JPEG. */
+    jpeg: string;
+    /** How many parts were boxed. */
+    boxes: number;
+}
+export interface BugCaseMediaSettings {
+    maskAllText: boolean;
+    maskAllImages: boolean;
+    maskAllInputs: boolean;
+}
+export interface BugCaseMedia {
+    frames: BugCaseFrame[];
+    /** "Bug here" marks on the steady clock (C2a). */
+    marks: number[];
+    settings: BugCaseMediaSettings;
+    /** How many frames C2 left out, so the viewer can say so. */
+    dropped: number;
+    /** Why they were left out, as short reasons with a count each (C5). Old cases have none. */
+    droppedWhy?: Record<string, number>;
+}
+export interface BugCaseMediaBudget {
+    frames: number;
+    bytes: number;
+}
+/** C2. */
+export declare const DEFAULT_MEDIA_BUDGET: BugCaseMediaBudget;
+/** Bytes a base64 string decodes to. */
+export declare function base64Bytes(b64: string): number;
+/**
+ * C2: keep the frames that matter most, inside the budget. In order: the
+ * "last" frame, tap frames (newest first), video frames near a mark (closest
+ * first), then the other video frames spread across the clip.
+ */
+export declare function fitBugCaseMedia(frames: BugCaseFrame[], marks: number[], budget?: BugCaseMediaBudget): {
+    frames: BugCaseFrame[];
+    dropped: number;
+};
+/** Reasons the case itself adds when it leaves frames out. */
+export declare const DROPPED_TO_FIT = "left out to fit the case";
+export declare const DROPPED_NOT_JPEG = "not a picture Buoy can show";
+/** Adds `n` to one reason, keeping the list short and every reason plain. */
+export declare function addDroppedWhy(why: Record<string, number>, reason: string, n: number): Record<string, number>;
+/** The phone's reasons, kept only when each is plain words with a whole count. */
+export declare function cleanDroppedWhy(raw: unknown): Record<string, number>;
+/**
+ * Which step each frame belongs to (V1): a tap frame goes with the step its
+ * tap made. A frame with no tap link has no step.
+ */
+export declare function frameSteps(frames: readonly BugCaseFrame[], touches: readonly {
+    seq?: number;
+    t: number;
+}[], steps: readonly {
+    t: number;
+    taps?: number[];
+}[]): (number | null)[];
+/** "4 the screen was moving, 1 left out to fit the case", biggest first. */
+export declare function describeDroppedWhy(why: Record<string, number> | undefined): string;
+/**
+ * 0..n-1 in an order where every start of the list is spread across the
+ * range: the two ends, then the middle, then the quarters, and so on.
+ */
+export declare function spreadOrder(n: number): number[];
+/**
+ * C3: keep `media` only with frames that are JPEGs. A bad frame is dropped,
+ * not the case. Then C2 again, since a hand-made case can hold anything.
+ */
+export declare function validateBugCaseMedia(raw: unknown): BugCaseMedia | undefined;
+//# sourceMappingURL=media.d.ts.map

package/lib/typescript/commonjs/bugCase/scrub.d.ts

@@ -22,8 +22,8 @@
  *   NO "LOOKS RANDOM" RULE. Entropy caught nothing the rules above missed and
  *   broke order ids, hashes and commit SHAs. It was dropped on the evidence.
  *
- * Removed values become `[removed:secret]` / `[removed:pii]` so the loader can
- * graft the teammate's own value back into the same spot (see graft.ts).
+ * Removed values become `[removed:secret]` / `[removed:pii]`. A load writes
+ * the marks as they are; Restore puts the teammate's own values back.
  *
  * Pure and synchronous so it can be argued with in a unit test. Callers on a
  * phone run it after the capture has been shown as done, off the tap.

package/lib/typescript/commonjs/bugCase/steps.d.ts

@@ -14,6 +14,8 @@ export interface BugCaseTouch {
     /** Capture order. Wins over `t`, which moves when the app clock is faked. */
     seq?: number;
     t: number;
+    /** Real time, which Buoy's clock tool never moves. Tap pictures are matched by it. Old cases have none. */
+    wall?: number;
     kind: "press" | "longPress" | "text" | "toggle" | "slider";
     target: {
         name: string;
@@ -32,6 +34,8 @@ export interface BugCaseRouteVisit {
 export interface BugCaseStep {
     t: number;
     text: string;
+    /** The touches (by seq) this step stands for, so a tap picture finds its step. Old cases have none. */
+    taps?: number[];
 }
 /**
  * A tap on React Native's own dev chrome (the LogBox warning banners and

package/lib/typescript/commonjs/bugCase/teamKey.d.ts

@@ -0,0 +1,185 @@
+/** A P-256 key pair: the 32-byte private scalar and the 65-byte uncompressed public point. */
+export interface P256Pair {
+    d: Uint8Array;
+    pub: Uint8Array;
+}
+export interface TeamKeyCrypto {
+    randomBytes(length: number): Uint8Array;
+    sha256(data: Uint8Array): Promise<Uint8Array>;
+    hmacSha256(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+    /** AES-GCM with a 16- or 32-byte key; returns ciphertext with the tag at the end. */
+    seal(key: Uint8Array, nonce: Uint8Array, data: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
+    /** Throws when the key is wrong or a byte changed. */
+    open(key: Uint8Array, nonce: Uint8Array, sealed: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
+    p256Generate(): Promise<P256Pair>;
+    /** The shared x coordinate (32 bytes). Throws on a point that isn't on the curve. */
+    p256Ecdh(own: P256Pair, peerPub: Uint8Array): Promise<Uint8Array>;
+    /** ECDSA over SHA-256 of `message`; 64 bytes, r then s. */
+    p256Sign(own: P256Pair, message: Uint8Array): Promise<Uint8Array>;
+    /** Takes high-S signatures too: WebCrypto makes them. */
+    p256Verify(pub: Uint8Array, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
+}
+export type TeamKeyErrorCode = 
+/** A kit that isn't a kit, or the wrong kind. */
+"bad_kit"
+/** The kit is fine but doesn't open this lock. */
+ | "wrong_kit"
+/** A record, wrap or card that isn't the right shape. */
+ | "bad_shape"
+/** A signature or a key id that doesn't check out. */
+ | "untrusted"
+/** Won't open: the wrong key, or a byte changed. */
+ | "locked" | "too_big";
+export declare class TeamKeyError extends Error {
+    readonly code: TeamKeyErrorCode;
+    constructor(code: TeamKeyErrorCode, message: string);
+}
+export declare function concatBytes(...parts: Uint8Array[]): Uint8Array;
+export declare function hkdfExtract(c: TeamKeyCrypto, salt: Uint8Array, ikm: Uint8Array): Promise<Uint8Array>;
+export declare function hkdfExpand(c: TeamKeyCrypto, prk: Uint8Array, info: Uint8Array, length: number): Promise<Uint8Array>;
+export declare function hkdf(c: TeamKeyCrypto, ikm: Uint8Array, info: string, length?: number): Promise<Uint8Array>;
+export declare const HPKE_AES128_GCM = 1;
+export declare const HPKE_AES256_GCM = 2;
+/** Exposed for the RFC vector test. */
+export declare function hpkeKeySchedule(c: TeamKeyCrypto, sharedSecret: Uint8Array, info: Uint8Array, aeadId: number): Promise<{
+    key: Uint8Array<ArrayBufferLike>;
+    baseNonce: Uint8Array<ArrayBufferLike>;
+}>;
+/**
+ * One message to `pkR` (sequence 0). `ephemeral` is for test vectors only;
+ * a real seal always makes a fresh one.
+ */
+export declare function hpkeSeal(c: TeamKeyCrypto, pkR: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array, options?: {
+    aeadId?: number;
+    ephemeral?: P256Pair;
+}): Promise<{
+    enc: Uint8Array;
+    ct: Uint8Array;
+    sharedSecret: Uint8Array;
+}>;
+export declare function hpkeOpen(c: TeamKeyCrypto, skR: P256Pair, encapped: Uint8Array, info: Uint8Array, aad: Uint8Array, ct: Uint8Array, aeadId?: number): Promise<Uint8Array>;
+export type KitKind = "team" | "admin";
+/** A new kit as text, like `buoy-team-7F3Q-K2M9-…`. Shown once; never sent to Buoy. */
+export declare function makeKit(c: TeamKeyCrypto, kind: KitKind): string;
+export declare function formatKit(kind: KitKind, bytes: Uint8Array): string;
+/** Reads a pasted kit. Spaces, dashes and case don't matter; O reads as 0 and I or L as 1. */
+export declare function parseKit(text: string, kind: KitKind): Uint8Array;
+/** The kit's lock key. */
+export declare function kitKey(c: TeamKeyCrypto, kit: Uint8Array, kind: KitKind): Promise<Uint8Array>;
+/** A short id for a kit, so the server can say which kit locked a key. It can't open anything. */
+export declare function kitId(c: TeamKeyCrypto, kit: Uint8Array, kind: KitKind): Promise<string>;
+/** `nonce | sealed`, as base64url. */
+export declare function lockSecret(c: TeamKeyCrypto, key: Uint8Array, aad: string, secret: Uint8Array): Promise<string>;
+export declare function openSecret(c: TeamKeyCrypto, key: Uint8Array, aad: string, locked: string): Promise<Uint8Array>;
+export declare const rootLockAad: (owner: string, teamKeyId: string) => string;
+export declare const versionLockAad: (owner: string, teamKeyId: string, keyVersion: number) => string;
+/** A private key and its public key, as stored inside a lock. */
+export declare const pairBytes: (pair: P256Pair) => Uint8Array<ArrayBufferLike>;
+export declare function pairFrom(bytes: Uint8Array, expectPub?: Uint8Array): P256Pair;
+/**
+ * Checks a private key really belongs to its public key: a pair that doesn't
+ * would make wraps no one can open. ECDH with itself and with a fresh key
+ * from each side must agree.
+ */
+export declare function checkPair(c: TeamKeyCrypto, pair: P256Pair): Promise<void>;
+/** A root's id: the SHA-256 of its public key. Apps can pin it. */
+export declare function teamKeyIdOf(c: TeamKeyCrypto, rootPub: Uint8Array): Promise<string>;
+export interface TeamKeyRecord {
+    owner: string;
+    teamKeyId: string;
+    keyVersion: number;
+    /** The version's ECDH public key, base64url. */
+    pub: string;
+    /** The root's signature over `recordMessage`, base64url. */
+    sig: string;
+}
+export declare function recordMessage(owner: string, teamKeyId: string, keyVersion: number, pub: string): Uint8Array;
+export declare function signRecord(c: TeamKeyCrypto, root: P256Pair, owner: string, keyVersion: number, versionPub: Uint8Array): Promise<TeamKeyRecord>;
+/** Throws unless `record` is signed by `rootPub` and names that root. Returns the version's public key. */
+export declare function verifyRecord(c: TeamKeyCrypto, rootPub: Uint8Array, record: TeamKeyRecord): Promise<Uint8Array>;
+export interface CaseKeyParts {
+    /** The link's key, base64url (32 bytes). */
+    key: string;
+    /** 16 random bytes, base64url: goes in the blob's plain header. */
+    caseTag: string;
+    /** SHA-256 of the key proof, base64url: goes in the blob's plain header. */
+    keyProofHash: string;
+}
+export declare function newCaseTag(c: TeamKeyCrypto): string;
+export declare const isCaseTag: (text: unknown) => text is string;
+export declare const isKeyHash: (text: unknown) => text is string;
+/**
+ * Proof that someone holds a case's key, without showing the key. The blob's
+ * header has its hash, so the server can check a late wrap comes from someone
+ * who can open the case.
+ */
+export declare function keyProof(c: TeamKeyCrypto, caseKey: string): Promise<string>;
+export declare function keyProofHash(c: TeamKeyCrypto, proof: string): Promise<string>;
+/** A fresh key, a fresh tag, and the key proof's hash, for a new case. */
+export declare function newCaseKeyParts(c: TeamKeyCrypto, existing?: {
+    key?: string;
+    caseTag?: string;
+}): Promise<CaseKeyParts>;
+export declare const WRAP_SUITE = "P256-SHA256-A256GCM";
+export interface BugWrap {
+    v: 1;
+    suite: typeof WRAP_SUITE;
+    teamKeyId: string;
+    keyVersion: number;
+    /** The HPKE key share, base64url (65 bytes). */
+    enc: string;
+    /** The sealed case key, base64url (48 bytes). */
+    ct: string;
+}
+export declare const wrapInfo: (owner: string, teamKeyId: string, keyVersion: number, caseTag: string) => Uint8Array<ArrayBufferLike>;
+export declare function wrapCaseKey(c: TeamKeyCrypto, target: {
+    owner: string;
+    teamKeyId: string;
+    keyVersion: number;
+    pub: Uint8Array;
+}, caseKey: string, caseTag: string): Promise<BugWrap>;
+export declare function unwrapCaseKey(c: TeamKeyCrypto, wrap: BugWrap, owner: string, versionKey: P256Pair, caseTag: string): Promise<string>;
+/** Rebuilt field by field from untrusted JSON. */
+export declare function parseWrap(raw: unknown): BugWrap;
+export interface BugCardFields {
+    note?: string;
+    app?: string;
+    version?: string;
+    build?: string;
+    route?: string;
+    error?: string;
+    sender?: string;
+}
+export interface BugCard extends BugCardFields {
+    v: 1;
+    caseTag: string;
+    /** SHA-256 of the blob this card goes with, base64url. */
+    blobSha256: string;
+}
+/** The whole card as JSON stays under this, so the locked card fits in 4 KB. */
+export declare const MAX_CARD_JSON_BYTES = 3800;
+/** Cuts text to at most `maxBytes` of UTF-8, at a whole letter, with "…" when cut. */
+export declare function cutUtf8(text: string, maxBytes: number): string;
+/** Caps each field, then trims the note, the error and the route until the JSON fits. */
+export declare function fitCard(card: BugCard): BugCard;
+export declare function blobSha256(c: TeamKeyCrypto, blob: Uint8Array): Promise<string>;
+/** `nonce | sealed`, as base64url. */
+export declare function sealCard(c: TeamKeyCrypto, caseKey: string, caseTag: string, cardRevision: number, fields: BugCardFields, blob: Uint8Array): Promise<string>;
+export declare function openCard(c: TeamKeyCrypto, caseKey: string, caseTag: string, cardRevision: number, sealed: string): Promise<BugCard>;
+export declare const DEVICE_NONCE_BYTES = 16;
+export declare function newDeviceNonce(c: TeamKeyCrypto): string;
+/** What the new device sends first: a hash of its key and nonce. */
+export declare function deviceCommit(c: TeamKeyCrypto, devicePub: Uint8Array, deviceNonce: string): Promise<string>;
+/** The code both screens show. If they match, no one swapped the device's key. */
+export declare function deviceCode(c: TeamKeyCrypto, check: {
+    owner: string;
+    requestId: string;
+    devicePub: Uint8Array;
+    deviceNonce: string;
+    approverNonce: string;
+}): Promise<string>;
+/** The approving device seals the team kit to the new device's public key. */
+export declare function sealKitForDevice(c: TeamKeyCrypto, owner: string, requestId: string, devicePub: Uint8Array, kit: Uint8Array): Promise<string>;
+export declare function openKitForDevice(c: TeamKeyCrypto, owner: string, requestId: string, device: P256Pair, sealed: string): Promise<Uint8Array>;
+export declare function webTeamKeyCrypto(): TeamKeyCrypto;
+//# sourceMappingURL=teamKey.d.ts.map

package/lib/typescript/commonjs/bugCase/types.d.ts

@@ -6,6 +6,7 @@
 import type { SuperJSONResult } from "../utils/minimalSuperJSON";
 import type { ScrubbedItem } from "./scrub";
 import type { BugCaseStep, BugCaseTouch } from "./steps";
+import type { BugCaseMedia } from "./media";
 export declare const BUG_CASE_VERSION = 1;
 export interface BugCaseNetworkCall {
     t: number;
@@ -19,6 +20,8 @@ export interface BugCaseNetworkCall {
     requestData?: unknown;
     responseHeaders?: Record<string, string>;
     responseData?: unknown;
+    /** The answer was parsed from JSON text, so a string was a JSON string. Missing in older cases. */
+    responseJson?: boolean;
     /** True when a body was over the case budget and left out. */
     bodyOmitted?: boolean;
 }
@@ -48,6 +51,11 @@ export interface BugCase {
     app: {
         platform: string;
         os: string;
+        /** Bundle id or package name, when the app could say. */
+        id?: string;
+        /** The version people see ("4.2.0") and the build number ("4210"), so a load on another build can say so. */
+        version?: string;
+        build?: string;
         appearance?: string;
         locale?: string;
         timeZone?: string;
@@ -82,6 +90,8 @@ export interface BugCase {
     /** B2: newest first, with answers for replay. */
     network: BugCaseNetworkCall[];
     console: BugCaseConsoleLine[];
+    /** Pictures and video, boxed on the phone (media/SPEC.md C1). Old cases and old phones have none. */
+    media?: BugCaseMedia;
     missing: BugCaseMissing[];
     scrub: {
         removed: number;

package/lib/typescript/commonjs/clipboard/autoDetectClipboard.d.ts

@@ -15,7 +15,7 @@
  * - Metro sees static imports only
  * - Works with any Metro version
  */
-export { clipboardFunction, clipboardType, isClipboardAvailable, type ClipboardFunction, } from "./clipboard-impl";
+export { clipboardFunction, clipboardType, isClipboardAvailable, readClipboardText, type ClipboardFunction, } from "./clipboard-impl";
 import { clipboardFunction } from "./clipboard-impl";
 /**
  * Attempts to auto-detect and return a clipboard implementation.

package/lib/typescript/commonjs/clipboard/clipboard-impl.d.ts

@@ -21,4 +21,10 @@ export type ClipboardFunction = (text: string) => Promise<boolean>;
 export declare const clipboardType: () => "expo" | "react-native" | "web" | null;
 export declare const isClipboardAvailable: () => boolean;
 export declare const clipboardFunction: ClipboardFunction;
+/**
+ * The clipboard's text, for a Paste button. Only ever called from a tap: iOS
+ * shows its "pasted from" banner for each read, and a silent read on open
+ * would show it for nothing (the bug links panels ruled that out).
+ */
+export declare const readClipboardText: () => Promise<string | null>;
 //# sourceMappingURL=clipboard-impl.d.ts.map

package/lib/typescript/commonjs/clipboard/clipboard-impl.web.d.ts

@@ -2,4 +2,6 @@ export type ClipboardFunction = (text: string) => Promise<boolean>;
 export declare const isClipboardAvailable: () => boolean;
 export declare const clipboardType: () => "web" | null;
 export declare const clipboardFunction: ClipboardFunction;
+/** The clipboard's text, for a Paste button. Only ever called from a tap. */
+export declare const readClipboardText: () => Promise<string | null>;
 //# sourceMappingURL=clipboard-impl.web.d.ts.map

package/lib/typescript/commonjs/clipboard/index.d.ts

@@ -1,4 +1,4 @@
 export { copyToClipboard } from "./copyToClipboard";
-export { createAutoDetectedClipboard, getAutoDetectedClipboard, } from "./autoDetectClipboard";
+export { createAutoDetectedClipboard, getAutoDetectedClipboard, readClipboardText, } from "./autoDetectClipboard";
 export type { ClipboardFunction } from "./autoDetectClipboard";
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/commonjs/hooks/safe-area-impl.d.ts

@@ -1,7 +1,7 @@
 /**
  * Auto-generated safe area implementation
  * Detected: none
- * Generated at: 2026-10-23T09:29:26.900Z
+ * Generated at: 2026-10-31T23:26:31.819Z
  *
  * DO NOT EDIT - This file is generated by scripts/detect-safe-area.js
  *

package/lib/typescript/commonjs/index.d.ts

@@ -14,10 +14,11 @@ export * from "./tools/defineTool";
 export * from "./sync/toolActionRegistry";
 export * from "./sync/toolUiBridge";
 export * from "./sync/toolScreenHeader";
-export { absoluteFill, displayValue, parseDisplayValue, getSafeAreaInsets, persistentStorage, setItemChecked, isUsingPersistentStorage, getStorageBackendType, safeStringify, getValueType, isPrimitive, isJsonSerializable, isValidJson, getConstructorName, isEmpty, getValueSize, parseValue, formatValue, getTypeColor, truncateText, flattenObject, formatPath, loadOptionalModule, getCachedOptionalModule, setRenderCaptureProvider, getRenderCaptureProvider, type RenderCaptureProvider, type RenderCaptureSummary, type RenderCaptureTopComponent, type RenderCauseCounts, registerStateSnapshotProvider, getStateSnapshotProviders, getStateSnapshotProvider, subscribeToStateSnapshotProviders, type StateSnapshotProvider, type StateSnapshotProviderStatus, type StateSnapshotCapture, type StateSnapshotRestoreResult, type StateSnapshotPreview, type StateSnapshotPreviewItem, type StateSnapshotPreviewVerdict, superJsonSerialize, superJsonDeserialize, type SuperJSONResult, realNow, getRealAppState, subscribeRealAppState, BUOY_SYNTHETIC_MARK, countBuoyListener, type RealAppState, reloadApp, scheduleReloadApp, resolveReloadStrategy, REMOTE_RELOAD_DELAY_MS, type ReloadStrategy, type ResolvedReloadStrategy, getDevServerOrigin, Subscribable, type SubscribableListener, subscriberCountNotifier, subscribeToSubscriberCountChanges, notifySubscriberCountChange, useSafeRouter, useSafePathname, useSafeSegments, useSafeGlobalSearchParams, getSafeRouter, getSafeCurrentPathname, getSafeCurrentRoute, isExpoRouterAvailable, } from "./utils";
+export { absoluteFill, displayValue, parseDisplayValue, getSafeAreaInsets, persistentStorage, setItemChecked, getItemChecked, storageIsMemoryOnly, isUsingPersistentStorage, getStorageBackendType, safeStringify, getValueType, isPrimitive, isJsonSerializable, isValidJson, getConstructorName, isEmpty, getValueSize, parseValue, formatValue, getTypeColor, truncateText, flattenObject, formatPath, loadOptionalModule, getCachedOptionalModule, setRenderCaptureProvider, getRenderCaptureProvider, type RenderCaptureProvider, type RenderCaptureSummary, type RenderCaptureTopComponent, type RenderCauseCounts, registerStateSnapshotProvider, getStateSnapshotProviders, getStateSnapshotProvider, subscribeToStateSnapshotProviders, type StateSnapshotProvider, type StateSnapshotProviderStatus, type StateSnapshotCapture, type StateSnapshotRestoreResult, type StateSnapshotPreview, type StateSnapshotPreviewItem, type StateSnapshotPreviewVerdict, superJsonSerialize, superJsonDeserialize, type SuperJSONResult, realNow, getRealAppState, subscribeRealAppState, BUOY_SYNTHETIC_MARK, countBuoyListener, type RealAppState, reloadApp, scheduleReloadApp, resolveReloadStrategy, REMOTE_RELOAD_DELAY_MS, type ReloadStrategy, type ResolvedReloadStrategy, getDevServerOrigin, Subscribable, type SubscribableListener, subscriberCountNotifier, subscribeToSubscriberCountChanges, notifySubscriberCountChange, useSafeRouter, useSafePathname, useSafeSegments, useSafeGlobalSearchParams, getSafeRouter, getSafeCurrentPathname, getSafeCurrentRoute, isExpoRouterAvailable, } from "./utils";
 export type { SafeRouteLocation } from "./utils";
 export * from "./utils/toolModules";
 export { subscribeStorageWrites } from "./utils/storageWrites";
+export { FiberRootAnchor, getAnchoredFiberRoots } from "./utils/fiberRootAnchor";
 export { registerBrowserRouter, browserRouter, subscribeBrowserNavigation } from "./utils/browserNavigation";
 export { PREVIEW_ITEM_RENDER_BYTE_LIMIT, createRestoreScope, emptyRestoreResult, failedRestore, skippedRestore, classifyPreviewItem, wontApply, unionKeys, type RestoreScope, type RestoreScopeOptions, type ClassifyOptions, type ClassifyInput, } from "./utils/snapshotProviderKit";
 export { entityColor, formatValuePreview, shallowDiffSummary, type ValuePreviewOptions, type ShallowDiffSummary, } from "./utils/stateTools";

package/lib/typescript/commonjs/utils/fiberRootAnchor.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The app's React roots, found without React DevTools.
+ *
+ * Highlight Updates finds roots through `__REACT_DEVTOOLS_GLOBAL_HOOK__`. React
+ * Native sets that hook up only in dev builds, so in a release build Bug Links
+ * got no taps and no screen text. A class component's instance holds its own
+ * fiber (`_reactInternals`) in every React build. Walking up from it reaches
+ * the root it is mounted in. FloatingDevTools mounts one inside the app's tree.
+ */
+import { Component } from "react";
+/** Renders nothing. While mounted, its root shows in `getAnchoredFiberRoots()`. */
+export declare class FiberRootAnchor extends Component {
+    componentDidMount(): void;
+    componentWillUnmount(): void;
+    render(): null;
+}
+/** The FiberRoot (with `.current`) of every mounted anchor, once each. */
+export declare function getAnchoredFiberRoots(): any[];
+//# sourceMappingURL=fiberRootAnchor.d.ts.map

package/lib/typescript/commonjs/utils/index.d.ts

@@ -1,7 +1,7 @@
 export { absoluteFill } from "./absoluteFill";
 export { displayValue, parseDisplayValue } from "./displayValue";
 export { getSafeAreaInsets } from "./getSafeAreaInsets";
-export { persistentStorage, setItemChecked, isUsingPersistentStorage, getStorageBackendType, type DevToolsStorage, } from "./persistentStorage";
+export { persistentStorage, setItemChecked, getItemChecked, storageIsMemoryOnly, isUsingPersistentStorage, getStorageBackendType, type DevToolsStorage, } from "./persistentStorage";
 export { safeStringify } from "./safeStringify";
 export { getValueType, isPrimitive, isJsonSerializable, isValidJson, getConstructorName, isEmpty, getValueSize, } from "./typeHelpers";
 export { parseValue, formatValue, getTypeColor, truncateText, flattenObject, formatPath, } from "./valueFormatting";
@@ -21,4 +21,5 @@ export { browserRouter, getBrowserHref, getBrowserRouteURL, registerBrowserRoute
 export { isDOMElement, getDOMControlProps, getDOMFiber, getDOMNodeHandle, getDOMPublicInstance, resolveDOMEventEmitter } from "./domRuntime";
 export { registerToolModules, getRegisteredToolModule, getToolModuleVersion, type ToolModule } from "./toolModules";
 export { loadToolModule } from "./loadToolModule";
+export { FiberRootAnchor, getAnchoredFiberRoots } from "./fiberRootAnchor";
 //# sourceMappingURL=index.d.ts.map