@mushi-mushi/core 1.15.0 → 1.16.0

package/CONTRIBUTING.md

@@ -58,9 +58,9 @@ packages/
   react-native/  React Native SDK (MIT)
   cli/           CLI tool (MIT)
   mcp/           MCP server for coding agents (MIT)
-  server/        Supabase Edge Functions (BSL)
-  agents/        Agentic fix pipeline (BSL)
-  verify/        Fix verification (BSL)
+  server/        Supabase Edge Functions (AGPLv3)
+  agents/        Agentic fix pipeline (AGPLv3)
+  verify/        Fix verification (AGPLv3)
 apps/
   admin/         Admin dashboard (React + Tailwind)
   docs/          Documentation site (Nextra — apps/docs)
@@ -97,8 +97,10 @@ Guardrails (run locally before pushing):
 pnpm check:docs-stats          # root README stat badges
 pnpm check:sdk-version-matrix  # apps/docs/content/sdks/index.mdx versions
 pnpm check:internal-doc-links  # dead /foo links in MDX
+pnpm check:onboarding-drift    # phantom MCP env vars / stale tool names
 pnpm check:bundle-docs         # @mushi-mushi/web size-limit vs README
 pnpm gen:llms-txt              # regenerate apps/docs/public/llms.txt after nav changes
+pnpm gen:mcp-tools-doc         # regenerate sdks/mcp-tools.generated.mdx from catalog.ts
 ```
 
 README changes on npm packages only appear on [npmjs.com](https://www.npmjs.com) after the next **Changesets publish**.
@@ -115,13 +117,30 @@ Select the affected packages, the semver bump type, and write a summary. The cha
 
 ## Release flow
 
-Releases are fully automated. Maintainers don't run `npm publish` by hand.
+Releases are fully automated once the version PR is merged. Maintainers don't run
+`npm publish` by hand for routine bumps. See **[`docs/DEPLOYMENT.md`](docs/DEPLOYMENT.md)**
+for the full production runbook (edge functions, admin SPA, docs site, migrations).
 
 1. PRs land on `master` with one or more changeset files in `.changeset/`.
-2. `release.yml` runs on every push to `master`. It opens (or updates) a `chore: version packages` PR that bumps every affected `package.json`, rolls up the changelogs, and deletes the consumed changesets.
-3. Merging that "Version Packages" PR re-fires `release.yml`. The publish step authenticates to npm via **OpenID Connect (OIDC) Trusted Publishers** — no long-lived `NPM_TOKEN` is exchanged — and every tarball ships with a **Sigstore provenance attestation** uploaded to the public transparency log.
+   Orphaned changesets (only ignored packages) fail `pnpm check:changeset-orphans`.
+2. `release.yml` runs on every push to `master`. It opens (or updates) a
+   **`chore: version packages`** PR on `changeset-release/master` that bumps
+   affected `package.json` files, rolls up changelogs, and deletes consumed
+   changesets.
+3. **Wait for CI on the version PR.** If checks don't appear (bot-branch
+   suppression), push an empty commit to `changeset-release/master`. If
+   `check:sdk-version-matrix` fails, run `pnpm gen:sdk-version-matrix` on that
+   branch and commit `apps/docs/content/sdks/index.mdx`.
+4. Merge the version PR. The publish step uses **OIDC Trusted Publishers** +
+   Sigstore provenance (with `NPM_TOKEN` only for brand-new package bootstrap).
+5. **Manually dispatch Release** unless a run starts within ~2 minutes:
+   **Actions → Release → Run workflow → `master`**. Squash-merges attributed to
+   `github-actions[bot]` usually suppress the auto `push` trigger — manual
+   dispatch is the normal path, not a fallback of last resort.
 
-If GitHub's anti-loop protection suppresses the auto re-fire (the squash merge can be attributed to `github-actions[bot]`), trigger the workflow manually: **Actions → release → Run workflow → master**.
+```bash
+gh workflow run release.yml --ref master
+```
 
 ### Adding a brand-new publishable package
 
@@ -168,7 +187,7 @@ chore: bump dependencies
 ## License
 
 - SDK packages are MIT — your contributions will be MIT-licensed
-- Server/agents/verify are BSL 1.1 — contributions to those packages fall under BSL
+- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3
 
 ## Questions?
 

package/dist/index.cjs

@@ -43,6 +43,7 @@ function formatBytes(n) {
 }
 
 // src/api-client.ts
+var MUSHI_USER_TOKEN_HEADER = "X-Mushi-User-Token";
 var DEFAULT_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
 var MUSHI_INTERNAL_HEADER = "X-Mushi-Internal";
 var MUSHI_INTERNAL_INIT_MARKER = "__mushiInternal";
@@ -54,13 +55,15 @@ function createApiClient(options) {
     apiKey,
     apiEndpoint = DEFAULT_API_ENDPOINT,
     timeout = DEFAULT_TIMEOUT,
-    maxRetries = DEFAULT_MAX_RETRIES
+    maxRetries = DEFAULT_MAX_RETRIES,
+    getUserToken
   } = options;
   let baseUrl = apiEndpoint.replace(/\/$/, "");
   async function request(method, path, body, retries = maxRetries, internalKind, extraHeaders) {
     const url = `${baseUrl}${path}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeout);
+    const userToken = getUserToken?.() ?? null;
     try {
       const response = await fetch(url, {
         method,
@@ -68,6 +71,7 @@ function createApiClient(options) {
           "Content-Type": "application/json",
           "X-Mushi-Api-Key": apiKey,
           "X-Mushi-Project": projectId,
+          ...userToken ? { [MUSHI_USER_TOKEN_HEADER]: userToken } : {},
           ...internalKind ? { [MUSHI_INTERNAL_HEADER]: internalKind } : {},
           ...extraHeaders
         },
@@ -170,6 +174,19 @@ function createApiClient(options) {
     async getSdkConfig() {
       return request("GET", "/v1/sdk/config", void 0, maxRetries, "sdk-config");
     },
+    async askAssistant(input) {
+      return request(
+        "POST",
+        "/v1/sdk/assistant",
+        {
+          message: input.message,
+          threadId: input.threadId ?? null,
+          context: input.context ?? null
+        },
+        1,
+        "community"
+      );
+    },
     async getLatestSdkVersion(packageName) {
       const query = new URLSearchParams({ package: packageName }).toString();
       return request("GET", `/v1/sdk/latest-version?${query}`, void 0, maxRetries, "sdk-config");
@@ -447,6 +464,60 @@ function writeCache(storage, projectId, entry) {
   }
 }
 
+// src/env-config.ts
+function first(...values) {
+  return values.find((v) => v !== void 0 && v !== "");
+}
+function tryImportMetaEnv(key) {
+  try {
+    const env = undefined;
+    return typeof env === "object" && env !== null ? env[key] : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readProcessEnv(read) {
+  try {
+    return read();
+  } catch {
+    return void 0;
+  }
+}
+function resolveEnvConfig() {
+  const projectId = first(
+    tryImportMetaEnv("VITE_MUSHI_PROJECT_ID"),
+    tryImportMetaEnv("NEXT_PUBLIC_MUSHI_PROJECT_ID"),
+    tryImportMetaEnv("NUXT_PUBLIC_MUSHI_PROJECT_ID"),
+    tryImportMetaEnv("EXPO_PUBLIC_MUSHI_PROJECT_ID"),
+    readProcessEnv(() => process.env.NEXT_PUBLIC_MUSHI_PROJECT_ID),
+    readProcessEnv(() => process.env.EXPO_PUBLIC_MUSHI_PROJECT_ID),
+    readProcessEnv(() => process.env.MUSHI_PROJECT_ID)
+  );
+  const apiKey = first(
+    tryImportMetaEnv("VITE_MUSHI_API_KEY"),
+    tryImportMetaEnv("NEXT_PUBLIC_MUSHI_API_KEY"),
+    tryImportMetaEnv("NUXT_PUBLIC_MUSHI_API_KEY"),
+    tryImportMetaEnv("EXPO_PUBLIC_MUSHI_API_KEY"),
+    readProcessEnv(() => process.env.NEXT_PUBLIC_MUSHI_API_KEY),
+    readProcessEnv(() => process.env.EXPO_PUBLIC_MUSHI_API_KEY),
+    readProcessEnv(() => process.env.MUSHI_API_KEY)
+  );
+  const apiEndpoint = first(
+    tryImportMetaEnv("VITE_MUSHI_API_ENDPOINT"),
+    tryImportMetaEnv("NEXT_PUBLIC_MUSHI_API_ENDPOINT"),
+    tryImportMetaEnv("NUXT_PUBLIC_MUSHI_API_ENDPOINT"),
+    tryImportMetaEnv("EXPO_PUBLIC_MUSHI_API_ENDPOINT"),
+    readProcessEnv(() => process.env.NEXT_PUBLIC_MUSHI_API_ENDPOINT),
+    readProcessEnv(() => process.env.EXPO_PUBLIC_MUSHI_API_ENDPOINT),
+    readProcessEnv(() => process.env.MUSHI_API_ENDPOINT)
+  );
+  const result = {};
+  if (projectId) result.projectId = projectId;
+  if (apiKey) result.apiKey = apiKey;
+  if (apiEndpoint) result.apiEndpoint = apiEndpoint;
+  return result;
+}
+
 // src/pre-filter.ts
 var DEFAULT_MIN_LENGTH = 10;
 var DEFAULT_MAX_LENGTH = 2e3;
@@ -1502,12 +1573,176 @@ function normaliseThrown(thrown) {
   return { name: "Error", message: String(thrown) };
 }
 
+// src/design-tokens.ts
+var MUSHI_COLORS_LIGHT = {
+  paper: "#F8F4ED",
+  paperRaised: "#FFFFFF",
+  ink: "#0E0D0B",
+  inkMuted: "#5C5852",
+  inkFaint: "#9A9489",
+  inkDim: "#6E6760",
+  rule: "rgba(14,13,11,0.10)",
+  ruleStrong: "rgba(14,13,11,0.16)",
+  accent: "#E03C2C",
+  accentWash: "rgba(224,60,44,0.08)",
+  accentInk: "#7A1F15",
+  ok: "#16A34A",
+  danger: "#DC2626"
+};
+var MUSHI_COLORS_DARK = {
+  paper: "#0F0E0C",
+  paperRaised: "#1A1815",
+  ink: "#F2EBDD",
+  inkMuted: "#928B7E",
+  inkFaint: "#5A5650",
+  inkDim: "#7A7268",
+  rule: "rgba(242,235,221,0.10)",
+  ruleStrong: "rgba(242,235,221,0.18)",
+  accent: "#FF5A47",
+  accentWash: "rgba(255,90,71,0.12)",
+  accentInk: "#FFE5E0",
+  ok: "#4ADE80",
+  danger: "#F87171"
+};
+function mushiPalette(mode) {
+  return mode === "dark" ? MUSHI_COLORS_DARK : MUSHI_COLORS_LIGHT;
+}
+var MUSHI_SPACING = {
+  hairline: 2,
+  tight: 4,
+  snug: 8,
+  comfy: 12,
+  roomy: 16,
+  lounge: 20,
+  open: 24,
+  wide: 32
+};
+var MUSHI_RADIUS = {
+  none: 0,
+  control: 4,
+  card: 10,
+  sheet: 16,
+  pill: 999
+};
+var MUSHI_TYPE = {
+  fontDisplay: `'Iowan Old Style', 'Palatino Linotype', 'Palatino', 'Book Antiqua', 'Cambria', Georgia, 'Times New Roman', serif`,
+  fontBody: `system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI Variable Display', 'Segoe UI', sans-serif`,
+  fontMono: `ui-monospace, 'SF Mono', 'JetBrains Mono', Menlo, Consolas, 'Liberation Mono', monospace`,
+  sizeBody: 14,
+  sizeLabel: 12,
+  sizeTitle: 16,
+  lineBody: 1.55
+};
+var MUSHI_Z = {
+  base: 99999,
+  /** banner sits one below the trigger so an open FAB overlaps it */
+  banner: 99998,
+  /** report/assistant panel sits one above the trigger */
+  panel: 1e5,
+  /** element-selector overlay — always on top */
+  overlay: 2147483647
+};
+var MUSHI_MOTION = {
+  easeStamp: "cubic-bezier(0.22, 1, 0.36, 1)",
+  durationFast: 200,
+  durationPanel: 300
+};
+var MUSHI_GEOMETRY = {
+  bannerHeight: 36,
+  fabSize: 52,
+  edgeTabWidth: 28,
+  /** default gutter from the screen edge (added on top of safe-area insets) */
+  gutter: 24,
+  panelWidth: 384,
+  /** below this viewport width the panel becomes a full-width bottom sheet */
+  panelSheetBreakpoint: 480
+};
+var MUSHI_COPY = {
+  bannerLabel: "Beta",
+  bannerMessage: "Help us improve \u2014 your feedback shapes what we ship.",
+  bugCta: "Report a bug",
+  featureCta: "Feature request",
+  triggerText: "\u{1F41B}",
+  panelTitle: "Send feedback",
+  myReportsTab: "My reports",
+  assistantTab: "Ask"
+};
+function mushiTokens(mode) {
+  return {
+    mode,
+    colors: mushiPalette(mode),
+    spacing: MUSHI_SPACING,
+    radius: MUSHI_RADIUS,
+    type: MUSHI_TYPE,
+    z: MUSHI_Z,
+    motion: MUSHI_MOTION,
+    geometry: MUSHI_GEOMETRY,
+    copy: MUSHI_COPY
+  };
+}
+
+// src/identity.ts
+var MUSHI_IDENTITY_TOKEN_PREFIX = "mushi.identity";
+function buildIdentityClaims(input) {
+  const now = Math.floor(Date.now() / 1e3);
+  const ttl = input.ttlSeconds && input.ttlSeconds > 0 ? Math.min(input.ttlSeconds, 3600) : 600;
+  return {
+    projectId: input.projectId,
+    sub: input.userId,
+    ...input.email ? { email: input.email } : {},
+    ...input.name ? { name: input.name } : {},
+    iat: now,
+    exp: now + ttl
+  };
+}
+function base64UrlDecode(segment) {
+  const pad = segment.length % 4 === 0 ? "" : "=".repeat(4 - segment.length % 4);
+  const base64 = segment.replace(/-/g, "+").replace(/_/g, "/") + pad;
+  if (typeof atob === "function") return atob(base64);
+  const B = globalThis.Buffer;
+  if (B) return B.from(base64, "base64").toString("binary");
+  return "";
+}
+function parseIdentityToken(token) {
+  if (typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const json = base64UrlDecode(parts[1]);
+    const payload = JSON.parse(json);
+    const projectId = typeof payload.projectId === "string" ? payload.projectId : void 0;
+    const sub = typeof payload.sub === "string" ? payload.sub : void 0;
+    if (!projectId || !sub) return null;
+    return {
+      projectId,
+      sub,
+      ...typeof payload.email === "string" ? { email: payload.email } : {},
+      ...typeof payload.name === "string" ? { name: payload.name } : {},
+      ...typeof payload.iat === "number" ? { iat: payload.iat } : {},
+      ...typeof payload.exp === "number" ? { exp: payload.exp } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+
 exports.DEFAULT_API_ENDPOINT = DEFAULT_API_ENDPOINT;
 exports.MAX_REPORT_PAYLOAD_BYTES = MAX_REPORT_PAYLOAD_BYTES;
 exports.MAX_SCREENSHOT_DATA_URL_BYTES = MAX_SCREENSHOT_DATA_URL_BYTES;
+exports.MUSHI_COLORS_DARK = MUSHI_COLORS_DARK;
+exports.MUSHI_COLORS_LIGHT = MUSHI_COLORS_LIGHT;
+exports.MUSHI_COPY = MUSHI_COPY;
+exports.MUSHI_GEOMETRY = MUSHI_GEOMETRY;
+exports.MUSHI_IDENTITY_TOKEN_PREFIX = MUSHI_IDENTITY_TOKEN_PREFIX;
 exports.MUSHI_INTERNAL_HEADER = MUSHI_INTERNAL_HEADER;
 exports.MUSHI_INTERNAL_INIT_MARKER = MUSHI_INTERNAL_INIT_MARKER;
+exports.MUSHI_MOTION = MUSHI_MOTION;
+exports.MUSHI_RADIUS = MUSHI_RADIUS;
+exports.MUSHI_SPACING = MUSHI_SPACING;
+exports.MUSHI_TYPE = MUSHI_TYPE;
+exports.MUSHI_Z = MUSHI_Z;
 exports.REGION_ENDPOINTS = REGION_ENDPOINTS;
+exports.buildIdentityClaims = buildIdentityClaims;
 exports.captureEnvironment = captureEnvironment;
 exports.checkReportPayloadSize = checkReportPayloadSize;
 exports.createApiClient = createApiClient;
@@ -1522,9 +1757,13 @@ exports.formatBytes = formatBytes;
 exports.getDeviceFingerprintHash = getDeviceFingerprintHash;
 exports.getReporterToken = getReporterToken;
 exports.getSessionId = getSessionId;
+exports.mushiPalette = mushiPalette;
+exports.mushiTokens = mushiTokens;
 exports.newUuid = newUuid;
 exports.noopLogger = noopLogger;
 exports.normaliseThrown = normaliseThrown;
+exports.parseIdentityToken = parseIdentityToken;
+exports.resolveEnvConfig = resolveEnvConfig;
 exports.resolveRegionEndpoint = resolveRegionEndpoint;
 exports.scrubPii = scrubPii;
 //# sourceMappingURL=index.cjs.map