@buoy-gg/time-machine 7.0.36 → 7.0.38

package/lib/module/store/sourceIds.js

@@ -0,0 +1,5 @@
+"use strict";
+
+/** Id of the route "source": a device capability, not a snapshot provider. */
+export const ROUTE_SOURCE_ID = "route";
+//# sourceMappingURL=sourceIds.js.map

package/lib/module/store/sourceSettings.js

@@ -0,0 +1,69 @@
+"use strict";
+
+/**
+ * Which sources Time Machine is allowed to touch.
+ *
+ * A source switched off here is left out of every capture and every restore,
+ * from the tool, the bar, the desktop and MCP alike: "off" has to mean off
+ * everywhere, or the one path that forgets it is the one that breaks the app.
+ * The case this exists for is a store whose full replace the app cannot
+ * survive (a Zustand store holding live handles, say): leave it off and the
+ * rest of the state still round-trips.
+ *
+ * Persisted as the set of ids that are OFF, so a source that registers for
+ * the first time tomorrow starts on, and the default is "everything".
+ */
+import { definePersistedSetting, devToolsStorageKeys } from "@buoy-gg/shared-ui";
+const setting = definePersistedSetting(devToolsStorageKeys.timeMachine.disabledSources(), [], {
+  sanitize: value => Array.isArray(value) ? value.filter(v => typeof v === "string") : []
+});
+let disabled = new Set();
+let loaded = false;
+let loadPromise = null;
+const listeners = new Set();
+const notify = () => listeners.forEach(listener => listener());
+export function ensureSourceSettingsLoaded() {
+  if (loaded) return Promise.resolve();
+  if (!loadPromise) {
+    loadPromise = setting.load().then(ids => {
+      // A toggle made while the read was in flight wins over the disk copy.
+      if (disabled.size === 0) {
+        disabled = new Set(ids);
+        notify();
+      }
+    }).finally(() => {
+      loaded = true;
+    });
+  }
+  return loadPromise;
+}
+export function subscribeSourceSettings(listener) {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}
+
+/** Stable across renders until something changes, for useSyncExternalStore. */
+export function getDisabledSources() {
+  return disabled;
+}
+export function isSourceEnabled(id) {
+  return !disabled.has(id);
+}
+export function setSourceEnabled(id, enabled) {
+  if (enabled === !disabled.has(id)) return;
+  const next = new Set(disabled);
+  if (enabled) next.delete(id);else next.add(id);
+  disabled = next;
+  notify();
+  void setting.save([...next]);
+}
+
+/** Test seam: forget everything without touching storage. */
+export function resetSourceSettingsForTests() {
+  disabled = new Set();
+  loaded = false;
+  loadPromise = null;
+}
+//# sourceMappingURL=sourceSettings.js.map

package/lib/module/store/timeMachineStore.js

@@ -20,6 +20,8 @@ import { getStateSnapshotProvider, getStateSnapshotProviders, scheduleReloadApp,
 import { objectDiff } from "@buoy-gg/shared-ui/dataViewer";
 import { deleteSnapshot, duplicateSnapshot, loadIndex, loadSnapshot, markSnapshotRestored, readSnapshot, renameSnapshot, restoreDeletedSnapshot, saveSnapshot, setSnapshotRestoreRoute, setSnapshotScope, setSnapshotExclusions } from "./snapshotVault";
 import { captureCurrentRoute, navigateToRoute, savePendingRoute } from "./routeRestore";
+import { ensureSourceSettingsLoaded, isSourceEnabled } from "./sourceSettings";
+import { ROUTE_SOURCE_ID } from "./sourceIds";
 export const RESTORE_ORDER = ["storage", "redux", "zustand", "jotai", "query"];
 /**
  * What to call a capture nobody named. The screen you were on plus the time
@@ -30,7 +32,22 @@ export const RESTORE_ORDER = ["storage", "redux", "zustand", "jotai", "query"];
 function defaultSnapshotName(route) {
   const now = new Date();
   const clock = `${String(now.getHours()).padStart(2, "0")}:${String(now.getMinutes()).padStart(2, "0")}`;
-  return route ? `${route.pathname} · ${clock}` : `Snapshot · ${clock}`;
+  const screen = route ? route.pathname === "/" ? "Home" : route.pathname : null;
+  return screen ? `${screen} · ${clock}` : `Snapshot · ${clock}`;
+}
+
+/**
+ * Two captures in the same minute on the same screen would get the same
+ * default name and be told apart by nothing. Number the repeats.
+ */
+function dedupeName(name, existing) {
+  const taken = new Set(existing.map(m => m.name));
+  if (!taken.has(name)) return name;
+  for (let n = 2; n < 1000; n++) {
+    const candidate = `${name} (${n})`;
+    if (!taken.has(candidate)) return candidate;
+  }
+  return name;
 }
 
 /**
@@ -44,6 +61,8 @@ export function willRestoreRoute(meta) {
 
 /** Extra knobs a restore accepts beyond mode + exclusions. */
 
+export const SAFETY_SNAPSHOT_NAME = "Before last restore";
+
 /** Provider capability row as mirrored to a remote dashboard. */
 
 /** One side of a preview comparison. */
@@ -135,7 +154,7 @@ class TimeMachineStore {
   }
 
   /** Capture all capturable sources (or a subset) into a named snapshot. */
-  async capture(name, sourceIds) {
+  async capture(name, sourceIds, options) {
     if (remoteHandler) {
       const result = await remoteHandler("capture", {
         name,
@@ -144,11 +163,12 @@ class TimeMachineStore {
       return result.snapshot;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
     this.setState({
       busy: "capture"
     });
     try {
-      const providers = getStateSnapshotProviders().filter(p => p.status().canCapture && (!sourceIds || sourceIds.includes(p.id)));
+      const providers = getStateSnapshotProviders().filter(p => p.status().canCapture && isSourceEnabled(p.id) && (!sourceIds || sourceIds.includes(p.id)));
       const data = {};
       const sources = {};
       for (const provider of providers) {
@@ -165,21 +185,31 @@ class TimeMachineStore {
         }
       }
       // Where the app was when this state was true — restoring can return here.
-      const route = captureCurrentRoute();
+      const route = isSourceEnabled(ROUTE_SOURCE_ID) ? captureCurrentRoute() : null;
+      // The safety slot is rolling: the previous one goes before this one lands.
+      let current = this.state.snapshots;
+      if (options?.safety) {
+        for (const stale of current.filter(m => m.safety)) {
+          current = await deleteSnapshot(stale.id, current);
+        }
+      }
       const snapshot = {
         meta: {
           id: nextId(),
-          name: name.trim() || defaultSnapshotName(route),
+          name: options?.safety ? SAFETY_SNAPSHOT_NAME : dedupeName(name.trim() || defaultSnapshotName(route), current),
           createdAt: Date.now(),
           sizeBytes: 0,
           ...(route ? {
             route
           } : {}),
+          ...(options?.safety ? {
+            safety: true
+          } : {}),
           sources
         },
         data
       };
-      const snapshots = await saveSnapshot(snapshot, this.state.snapshots);
+      const snapshots = await saveSnapshot(snapshot, current);
       this.setState({
         snapshots
       });
@@ -202,6 +232,7 @@ class TimeMachineStore {
       return result.snapshot;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
     const snapshot = {
       meta: {
         id: nextId(),
@@ -239,6 +270,16 @@ class TimeMachineStore {
       return outcome;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
+    // The way back from a mis-tap: capture what is about to be replaced.
+    // Restoring the safety slot itself never rolls it, or Undo would eat
+    // its own target.
+    let safetySnapshotId;
+    if (options?.safetyCapture && !this.state.snapshots.find(m => m.id === id)?.safety) {
+      safetySnapshotId = (await this.capture(SAFETY_SNAPSHOT_NAME, undefined, {
+        safety: true
+      })).id;
+    }
     this.setState({
       busy: "restore"
     });
@@ -251,7 +292,10 @@ class TimeMachineStore {
         mode,
         at: Date.now(),
         willReload: false,
-        results: {}
+        results: {},
+        ...(safetySnapshotId ? {
+          safetySnapshotId
+        } : {})
       };
       if (stored.meta.baseline) {
         // Fresh install: wipe every clearable source, then reload so all
@@ -299,10 +343,10 @@ class TimeMachineStore {
       // No prompt any more: the point carries its own answer, and having a
       // route means wanting it back unless you said otherwise. An explicit
       // option still wins, so MCP and the desktop can force either way.
-      const wantsRoute = options?.restoreRoute ?? willRestoreRoute(stored.meta);
+      const wantsRoute = isSourceEnabled(ROUTE_SOURCE_ID) && (options?.restoreRoute ?? willRestoreRoute(stored.meta));
       if (mode === "reload") {
         // Storage only; everything in-memory rebuilds after the reload.
-        if (stored.data.storage && (!includeBySource || includeBySource.has("storage"))) {
+        if (stored.data.storage && isSourceEnabled("storage") && (!includeBySource || includeBySource.has("storage"))) {
           outcome.results.storage = await this.restoreSource("storage", stored.data.storage, excludeBySource.get("storage"), includeBySource?.get("storage"));
         }
         // Hand the route to the NEXT boot — this realm is about to die, so the
@@ -334,6 +378,17 @@ class TimeMachineStore {
       for (const sid of sourceIds) {
         // Sources entirely outside the scope are untouched and unreported.
         if (includeBySource && !includeBySource.has(sid)) continue;
+        // A source switched off in Sources is left exactly as it is. Reported
+        // as a warning, not a failure: this is what you asked for.
+        if (!isSourceEnabled(sid)) {
+          outcome.results[sid] = {
+            ok: true,
+            applied: 0,
+            skipped: [],
+            warnings: ["Switched off in Sources; left as it is"]
+          };
+          continue;
+        }
         outcome.results[sid] = await this.restoreSource(sid, stored.data[sid], excludeBySource.get(sid), includeBySource?.get(sid));
       }
       // Navigate LAST — the screen we land on should read the restored state.
@@ -400,6 +455,7 @@ class TimeMachineStore {
       return;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
     const stored = await readSnapshot(id);
     const snapshots = await deleteSnapshot(id, this.state.snapshots);
     this.setState({
@@ -439,6 +495,7 @@ class TimeMachineStore {
       return;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
     const snapshots = await setSnapshotRestoreRoute(id, restoreRoute, this.state.snapshots);
     this.setState({
       snapshots
@@ -454,6 +511,7 @@ class TimeMachineStore {
       return result?.snapshot ?? null;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
     const source = this.state.snapshots.find(s => s.id === id);
     if (!source) return null;
     const result = await duplicateSnapshot(id, `${source.name} copy`, this.state.snapshots);
@@ -472,6 +530,7 @@ class TimeMachineStore {
       return;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
     const snapshots = await renameSnapshot(id, name, this.state.snapshots);
     this.setState({
       snapshots
@@ -492,6 +551,7 @@ class TimeMachineStore {
       return;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
     const snapshots = await setSnapshotScope(id, scope, this.state.snapshots);
     this.setState({
       snapshots
@@ -512,6 +572,7 @@ class TimeMachineStore {
       return;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
     const snapshots = await setSnapshotExclusions(id, excludedKeys, this.state.snapshots);
     this.setState({
       snapshots
@@ -629,6 +690,7 @@ class TimeMachineStore {
       return;
     }
     await this.ensureLoaded();
+    await ensureSourceSettingsLoaded();
     const runId = ++this.previewRunId;
     this.setState({
       preview: {
@@ -660,6 +722,9 @@ class TimeMachineStore {
       const sourceIds = isBaseline ? getStateSnapshotProviders().filter(p => p.clear).map(p => p.id) : [...RESTORE_ORDER.filter(sid => sid in rightData), ...Object.keys(rightData).filter(sid => !RESTORE_ORDER.includes(sid))];
       const sources = [];
       for (const sid of sourceIds) {
+        // Off in Sources: a restore will not touch it, so there is nothing
+        // to preview.
+        if (!isSourceEnabled(sid)) continue;
         // Yield a frame between sources — verdict passes are bounded but a
         // five-source build shouldn't run as one synchronous block.
         await new Promise(r => setTimeout(r, 0));

package/lib/module/sync/timeMachineSyncAdapter.js

@@ -18,6 +18,8 @@ import { jsonLikelyLargerThan } from "@buoy-gg/shared-ui/dataViewer";
 import { timeMachineStore } from "../store/timeMachineStore";
 import { loadSnapshot } from "../store/snapshotVault";
 import { canNavigate, currentRoute } from "../store/routeRestore";
+import { isSourceEnabled } from "../store/sourceSettings";
+import { ROUTE_SOURCE_ID } from "../store/sourceIds";
 function providerStatuses() {
   return getStateSnapshotProviders().map(p => {
     const s = p.status();
@@ -26,7 +28,8 @@ function providerStatuses() {
       label: p.label,
       canCapture: s.canCapture,
       canRestore: s.canRestore,
-      detail: s.detail
+      detail: s.detail,
+      enabled: isSourceEnabled(p.id)
     };
   });
 }
@@ -46,6 +49,7 @@ function metadata() {
     // a dashboard has no router of its own to probe, so it's mirrored here.
     route: {
       available: canNavigate(),
+      enabled: isSourceEnabled(ROUTE_SOURCE_ID),
       ...(current ? {
         current: current.href
       } : {})

package/lib/module/ui/SwipeActionsRow.js

@@ -91,11 +91,20 @@ export function SwipeActionsRow({
   useEffect(() => () => {
     if (closeOpenRow === close) closeOpenRow = null;
   }, [close]);
+
+  // The row is glass now, so the actions can't hide under it: they fade in
+  // with the first points of the drag instead of sitting there at rest.
+  const actionOpacity = translateX.interpolate({
+    inputRange: [-24, 0],
+    outputRange: [1, 0],
+    extrapolate: "clamp"
+  });
   return /*#__PURE__*/_jsxs(View, {
     style: styles.clip,
-    children: [/*#__PURE__*/_jsx(View, {
+    children: [/*#__PURE__*/_jsx(Animated.View, {
       style: [styles.actionLayer, {
-        width: openWidth
+        width: openWidth,
+        opacity: actionOpacity
       }],
       children: actions.map(action => /*#__PURE__*/_jsx(TouchableOpacity, {
         style: [styles.action, action.background ? {
@@ -154,7 +163,9 @@ const styles = StyleSheet.create({
     fontWeight: "600",
     letterSpacing: tm.tracking.control
   },
-  // Opaque so the red action never bleeds through the row it sits under.
+  // Glass, like the card it sits in. The actions underneath are faded out
+  // at rest (see actionOpacity), which is what keeps them from bleeding
+  // through a translucent row.
   content: {
     backgroundColor: tm.color.group
   }

package/lib/module/ui/primitives.js

@@ -139,6 +139,8 @@ const styles = StyleSheet.create({
     marginHorizontal: tm.gutter,
     backgroundColor: tm.color.group,
     borderRadius: tm.radius.group,
+    borderWidth: 1,
+    borderColor: tm.color.groupBorder,
     overflow: "hidden"
   },
   separator: {

package/lib/module/ui/tmTheme.js

@@ -4,7 +4,7 @@
  * Time Machine design tokens — the "modern" surface language.
  *
  * A grouped-inset list system (iOS Settings shape): one dark sheet, rounded
- * grouped cards holding hairline-separated rows, uppercase section labels
+ * glass cards holding hairline-separated rows, uppercase section labels
  * outside the cards, and explanatory footnotes under them.
  *
  * COLOR COMES FROM the shared `night` palette (ui/night/nightTheme.ts) — not
@@ -35,15 +35,28 @@ export const tm = {
      * without the list reading through the CTA.
      */
     sheet: "rgba(5, 5, 5, 0.92)",
-    /** A grouped card. */
-    group: night.color.surface,
+    /**
+     * A grouped card: night glass, so the star field behind the sheet shows
+     * through every card the way it does through the header chips. Cards
+     * take `groupBorder` as a hairline, or the glass reads as a smudge.
+     */
+    group: night.color.glass,
+    groupBorder: night.color.glassBorder,
     /** Row press / hover wash on top of a group. */
-    rowPressed: night.color.surfaceElevated,
+    rowPressed: night.color.glassElevated,
     /** Hairline between rows, inset from the left like iOS. */
     separator: night.color.separator,
     /** Neutral control fill (icon discs, chips, round buttons). */
-    fill: night.color.surfaceElevated,
+    fill: night.color.glassElevated,
     fillStrong: night.color.fillTertiary,
+    /** Opaque ring around a badge on a glass card (the sheet's own color). */
+    ring: night.color.bg,
+    /**
+     * Opaque disc behind a Buoy icon. The icons paint their knock-outs in
+     * the color they are handed, so a translucent fill turns a floppy disk
+     * into a yellow square. Stays solid on purpose.
+     */
+    disc: night.color.surfaceElevated,
     label: night.color.text,
     labelSecondary: night.color.textSecondary,
     labelTertiary: night.color.textTertiary,

package/lib/typescript/components/HeaderActions.d.ts

@@ -0,0 +1,7 @@
+export declare function HeaderBarButton({ armId }: {
+    armId?: string;
+}): import("react").JSX.Element;
+export declare function TimeMachineHeaderActions({ armId }: {
+    armId?: string;
+}): import("react").JSX.Element;
+//# sourceMappingURL=HeaderActions.d.ts.map

package/lib/typescript/components/floating/NamePromptModal.d.ts

@@ -0,0 +1,9 @@
+export declare function NamePromptModal({ visible, summary, onCapture, onCancel, }: {
+    visible: boolean;
+    /** What the capture will take, e.g. "5 sources · /shop/bag". */
+    summary?: string;
+    /** Called with the trimmed name; empty means "use the default". */
+    onCapture: (name: string) => void;
+    onCancel: () => void;
+}): import("react").JSX.Element;
+//# sourceMappingURL=NamePromptModal.d.ts.map

package/lib/typescript/components/floating/TimeMachineFloatingTool.d.ts

@@ -0,0 +1,6 @@
+import { type FloatingToolRenderContext } from "@buoy-gg/shared-ui";
+export declare const TIME_MACHINE_FLOATING_TOOL_ID = "time-machine-restore";
+/** Open (or reveal) the restore bar, optionally arming a specific point. */
+export declare function openTimeMachineFloatingTool(armId?: string): void;
+export declare function TimeMachineFloatingTool({ id, revealToken, dismiss, }: FloatingToolRenderContext): import("react").JSX.Element;
+//# sourceMappingURL=TimeMachineFloatingTool.d.ts.map

package/lib/typescript/components/floating/armedPoint.d.ts

@@ -0,0 +1,14 @@
+import type { SnapshotMeta } from "../../store/snapshotVault";
+export declare function getPickedPointId(): string | null;
+export declare function subscribePickedPoint(listener: () => void): () => void;
+/** Read the saved pick once. Later calls return the same promise. */
+export declare function ensurePickedPointLoaded(): Promise<void>;
+export declare function setPickedPointId(id: string | null): void;
+/** Test seam: forget the pick and the load, without touching storage. */
+export declare function resetPickedPointForTests(): void;
+/**
+ * The point the bar restores: the saved pick if it still exists, else the
+ * most recently restored point, else the newest capture. Never a baseline.
+ */
+export declare function resolveArmedPoint(snapshots: readonly SnapshotMeta[], pickedId: string | null): SnapshotMeta | null;
+//# sourceMappingURL=armedPoint.d.ts.map

package/lib/typescript/components/floating/barSettings.d.ts

@@ -0,0 +1,7 @@
+export declare function getBarReloadMode(): boolean;
+export declare function subscribeBarSettings(listener: () => void): () => void;
+export declare function ensureBarSettingsLoaded(): Promise<void>;
+export declare function setBarReloadMode(on: boolean): void;
+/** Test seam. */
+export declare function resetBarSettingsForTests(): void;
+//# sourceMappingURL=barSettings.d.ts.map

package/lib/typescript/components/list/SnapshotRow.d.ts

@@ -1,12 +1,16 @@
 import type { SnapshotMeta } from "../../store/snapshotVault";
-export declare function SnapshotRow({ meta, busy, onOpen, onRestore, onDelete, onDuplicate, }: {
+export declare function SnapshotRow({ meta, busy, armed, onOpen, onRestore, onDelete, onDuplicate, onArm, }: {
     meta: SnapshotMeta;
     busy: boolean;
+    /** This point is the one the floating restore bar restores right now. */
+    armed?: boolean;
     /** Zero-arg: a data-taking `onPress` prop is invoked with the event by
      *  Buoy MCP's tap_element, which crashes the row. */
     onOpen: () => void;
     onRestore: () => void;
     onDelete: () => void;
     onDuplicate: () => void;
+    /** Put this point on the floating restore bar. */
+    onArm: () => void;
 }): import("react").JSX.Element;
 //# sourceMappingURL=SnapshotRow.d.ts.map

package/lib/typescript/components/list/SourcesStrip.d.ts

@@ -1,5 +1,7 @@
 import { type SourceStatus } from "../sources";
-export declare function SourcesStrip({ sources }: {
+export declare function SourcesStrip({ sources, onToggle, }: {
     sources: SourceStatus[];
+    /** Flip a source on or off. Absent on the desktop mirror. */
+    onToggle?: (id: string, enabled: boolean) => void;
 }): import("react").JSX.Element;
 //# sourceMappingURL=SourcesStrip.d.ts.map

package/lib/typescript/components/sources.d.ts

@@ -8,11 +8,18 @@
  * same question as "will my Redux store come back".
  */
 import type { ComponentType } from "react";
+import { ROUTE_SOURCE_ID } from "../store/sourceIds";
+export { ROUTE_SOURCE_ID };
 export interface SourceStatus {
     id: string;
     label: string;
     canCapture: boolean;
     canRestore: boolean;
+    /**
+     * Switched on in the Sources strip. Off means every capture and restore
+     * leaves this source alone, whatever else it could do.
+     */
+    enabled: boolean;
     /** Why it is in this state — shown on the Sources screen. */
     detail?: string;
 }
@@ -28,8 +35,6 @@ export type SourceIcon = ComponentType<{
     bgColor?: string;
 }>;
 export declare function sourceIcon(id: string): SourceIcon;
-/** Id of the route tile — a device capability, not a snapshot provider. */
-export declare const ROUTE_SOURCE_ID = "route";
 export declare function useSourceStatuses(): SourceStatus[];
 /** A source is "attached" when a snapshot would actually pick it up. */
 export declare function isAttached(source: SourceStatus): boolean;

package/lib/typescript/index.d.ts

@@ -11,9 +11,11 @@
  */
 export { timeMachineToolPreset, createTimeMachineTool } from "./preset";
 export { TimeMachineModal, TimeMachineToolView, type TimeMachineModalProps, } from "./components/TimeMachineModal";
+export { openTimeMachineFloatingTool, TIME_MACHINE_FLOATING_TOOL_ID, } from "./components/floating/TimeMachineFloatingTool";
 export { timeMachineSyncAdapter } from "./sync/timeMachineSyncAdapter";
-export { timeMachineStore, RESTORE_ORDER, type RestoreMode, type RestoreOptions, type RestoreOutcome, type TimeMachineState, type RemoteProviderStatus, type PreviewSource, } from "./store/timeMachineStore";
+export { timeMachineStore, RESTORE_ORDER, SAFETY_SNAPSHOT_NAME, type RestoreMode, type RestoreOptions, type RestoreOutcome, type TimeMachineState, type RemoteProviderStatus, type PreviewSource, } from "./store/timeMachineStore";
 export { armPendingRouteRestore, captureCurrentRoute, navigateToRoute, canNavigate as canRestoreRoute, type SnapshotRoute, type RouteRestoreResult, type RouteRestoreStatus, } from "./store/routeRestore";
+export { isSourceEnabled, setSourceEnabled, subscribeSourceSettings, } from "./store/sourceSettings";
 export { setRemoteTimeMachineHandler, replaceTimeMachineFromSnapshot, } from "./store/timeMachineStore";
 export type { SnapshotMeta, SnapshotSourceMeta, StoredSnapshot, } from "./store/snapshotVault";
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/preset.d.ts

@@ -14,9 +14,10 @@ export declare const timeMachineToolPreset: {
     name: string;
     description: string;
     slot: "both";
-    icon: ({ size, color }: {
+    icon: ({ size, color, slot }: {
         size: number;
         color?: string;
+        slot?: string;
     }) => import("react").JSX.Element;
     component: typeof TimeMachineBody;
     modal: {
@@ -35,9 +36,10 @@ export declare function createTimeMachineTool(options?: {
     description: string;
     id: string;
     slot: "both";
-    icon: ({ size, color }: {
+    icon: ({ size, color, slot }: {
         size: number;
         color?: string;
+        slot?: string;
     }) => import("react").JSX.Element;
     component: typeof TimeMachineBody;
     modal: {

package/lib/typescript/store/snapshotVault.d.ts

@@ -65,6 +65,12 @@ export interface SnapshotMeta {
     restoreRoute?: boolean;
     /** When this point was last restored, for the "restored 4m ago" marker. */
     lastRestoredAt?: number;
+    /**
+     * The rolling "Before last restore" slot the restore bar writes before it
+     * restores, so a mis-tap has a way back. One exists at a time, it never
+     * counts against the tier cap, and the bar never arms it.
+     */
+    safety?: boolean;
     /** Source ids captured, with their capture warnings. */
     sources: Record<string, SnapshotSourceMeta>;
 }

package/lib/typescript/store/sourceIds.d.ts

@@ -0,0 +1,3 @@
+/** Id of the route "source": a device capability, not a snapshot provider. */
+export declare const ROUTE_SOURCE_ID = "route";
+//# sourceMappingURL=sourceIds.d.ts.map

package/lib/typescript/store/sourceSettings.d.ts

@@ -0,0 +1,9 @@
+export declare function ensureSourceSettingsLoaded(): Promise<void>;
+export declare function subscribeSourceSettings(listener: () => void): () => void;
+/** Stable across renders until something changes, for useSyncExternalStore. */
+export declare function getDisabledSources(): ReadonlySet<string>;
+export declare function isSourceEnabled(id: string): boolean;
+export declare function setSourceEnabled(id: string, enabled: boolean): void;
+/** Test seam: forget everything without touching storage. */
+export declare function resetSourceSettingsForTests(): void;
+//# sourceMappingURL=sourceSettings.d.ts.map

package/lib/typescript/store/timeMachineStore.d.ts

@@ -32,6 +32,8 @@ export interface RestoreOutcome {
      * "deferred" means the navigation is queued for the post-reload boot.
      */
     route?: RouteRestoreResult;
+    /** Set when the restore wrote a safety snapshot first (see RestoreOptions). */
+    safetySnapshotId?: string;
 }
 /**
  * Will restoring this point also navigate back to its route? Having a route
@@ -47,13 +49,22 @@ export interface RestoreOptions {
      * app's own start route).
      */
     restoreRoute?: boolean;
+    /**
+     * Capture the app's current state into the rolling "Before last restore"
+     * slot first, so this restore can be undone. The outcome carries its id as
+     * `safetySnapshotId`. Local only: the desktop mirror has no bar.
+     */
+    safetyCapture?: boolean;
 }
+export declare const SAFETY_SNAPSHOT_NAME = "Before last restore";
 /** Provider capability row as mirrored to a remote dashboard. */
 export interface RemoteProviderStatus {
     id: string;
     label: string;
     canCapture: boolean;
     canRestore: boolean;
+    /** False when the device has this source switched off in Sources. */
+    enabled?: boolean;
     detail?: string;
 }
 /** One side of a preview comparison. */
@@ -104,6 +115,8 @@ export interface TimeMachineState {
 /** Whether this device can capture and return to routes, and where it is now. */
 export interface RouteToolStatus {
     available: boolean;
+    /** False when the device has the route source switched off in Sources. */
+    enabled?: boolean;
     /** The route the app is on right now, when one can be read. */
     current?: string;
 }
@@ -128,7 +141,9 @@ declare class TimeMachineStore {
         route?: RouteToolStatus;
     }): void;
     /** Capture all capturable sources (or a subset) into a named snapshot. */
-    capture(name: string, sourceIds?: string[]): Promise<SnapshotMeta>;
+    capture(name: string, sourceIds?: string[], options?: {
+        safety?: boolean;
+    }): Promise<SnapshotMeta>;
     /**
      * Capture the fresh-install baseline: an EMPTY snapshot whose restore
      * wipes app state (clear + reload) — regardless of what state the app is