@mushi-mushi/core 1.20.0 → 1.21.0

package/dist/index.d.cts

@@ -23,6 +23,13 @@ interface MushiConfig {
     assistant?: MushiAssistantConfig;
     debug?: boolean;
     enabled?: boolean;
+    /**
+     * Host app release identifier stored on `reports.app_version` at ingest.
+     * Pairs with `environment.buildId` (from `<meta name="mushi:build">`) for
+     * deploy-level provenance. Falls back to `integrations.vercel.analyticsId`
+     * when omitted (legacy Vercel Analytics wiring).
+     */
+    appVersion?: string;
     /** Hook called before a report is sent. Return null to cancel, or return the (possibly modified) report. */
     beforeSendFeedback?: (report: MushiReport) => MushiReport | null | Promise<MushiReport | null>;
     /** Called once if the app crashed during the previous session. */
@@ -1504,6 +1511,8 @@ interface MushiRuntimeSdkConfig {
         triggerMode?: 'shake' | 'button' | 'both' | 'none';
         minDescriptionLength?: number;
     };
+    /** When false, the widget skips background reporter-inbox polling. Default true. */
+    reporterNotificationsEnabled?: boolean;
 }
 interface MushiSdkVersionInfo {
     package: string;
@@ -1730,7 +1739,59 @@ declare function createOfflineQueue(config?: MushiOfflineConfig): OfflineQueue;
  */
 declare function captureEnvironment(): MushiEnvironment;
 
-declare function getReporterToken(): string;
+/**
+ * FILE: reporter-token.ts
+ * PURPOSE: Stable, project-scoped anonymous reporter identity for the My Reports inbox.
+ *
+ * OVERVIEW:
+ * - Each Mushi project gets its own localStorage key so multi-project hosts on the
+ *   same origin (e.g. kensaur.us/glot-it vs /other-app) never share a token.
+ * - One-time migration copies the legacy global `mushi_reporter_token` into the
+ *   first projectId requested, preserving existing inbox history for that project.
+ *
+ * USAGE:
+ * - `getReporterToken(projectId)` from web/RN/Capacitor SDK before submit or inbox calls.
+ */
+/**
+ * Return a stable reporter token scoped to `projectId`.
+ * Legacy callers without a projectId still work but should migrate — the global
+ * key is read once and re-homed into the namespaced slot.
+ */
+declare function getReporterToken(projectId?: string): string;
+
+/**
+ * FILE: packages/core/src/digest.ts
+ * PURPOSE: SHA-256 and HMAC-SHA-256 helpers that work in every JS runtime —
+ *          including Hermes (React Native) which has no global `crypto` object.
+ *
+ * OVERVIEW:
+ * Fast path: when `globalThis.crypto?.subtle` is available (browser, Deno,
+ * Bun, Node ≥ 20 where Web Crypto is exposed globally, React Native with a
+ * crypto polyfill) we delegate to the native Web Crypto API which is
+ * hardware-accelerated and produces identical output.
+ *
+ * Fallback: `@noble/hashes` — pure-JS, audited, zero-dependency implementation
+ * of SHA-256 and HMAC used when native crypto is absent (Hermes cold start
+ * before any polyfill loads, worker environments without crypto, SSR edge runtimes).
+ *
+ * Both paths are spec-identical (same test vectors) and are exercised by
+ * `digest.test.ts`.
+ *
+ * USAGE:
+ *   import { sha256Hex, hmacSha256Hex } from './digest';
+ *   const hash = await sha256Hex('hello');
+ *   const sig  = await hmacSha256Hex('secret', 'message');
+ */
+/**
+ * SHA-256 of `value`, returned as a lowercase hex string.
+ * Uses Web Crypto when available, falls back to @noble/hashes.
+ */
+declare function sha256Hex(value: string): Promise<string>;
+/**
+ * HMAC-SHA-256 of `value` with `secret`, returned as a lowercase hex string.
+ * Uses Web Crypto when available, falls back to @noble/hashes.
+ */
+declare function hmacSha256Hex(secret: string, value: string): Promise<string>;
 
 /**
  * RFC-4122 v4 UUID generator with a capability ladder so it works in every
@@ -1996,8 +2057,8 @@ declare const noopLogger: Logger;
  *
  * Colour values mirror the historical washi/vermillion palette previously
  * inlined in `@mushi-mushi/web`'s styles.ts so the visual identity is
- * unchanged; the difference is that RN and Capacitor now share the exact
- * same constants instead of re-deriving their own.
+ * unchanged; `@mushi-mushi/web` imports mushiPalette() + MUSHI_* here
+ * instead of duplicating hex literals.
  */
 type MushiThemeMode = 'light' | 'dark';
 interface MushiColorPalette {
@@ -2032,6 +2093,41 @@ interface MushiColorPalette {
 declare const MUSHI_COLORS_LIGHT: MushiColorPalette;
 /** Dark-mode palette. */
 declare const MUSHI_COLORS_DARK: MushiColorPalette;
+/** Reward tier accent colours — editorial palette, not Tailwind defaults. */
+declare const MUSHI_TIER_COLORS: {
+    readonly free: string;
+    readonly explorer: "#2563EB";
+    readonly contributor: "#7C3AED";
+    readonly champion: "#D97706";
+    readonly default: string;
+};
+/** Neon beta banner — web `.mushi-banner.neon` + RN sheet header parity. */
+declare const MUSHI_BANNER_NEON: {
+    readonly bg: "#0FFF50";
+    readonly fg: "#0a1a0a";
+    readonly border: "#00C43A";
+};
+/** On-accent button text (hanko stamp, submit CTA). */
+declare const MUSHI_ON_ACCENT = "#FAF7F0";
+/** Pure white for assistant bubbles on accent backgrounds. */
+declare const MUSHI_INVERSE = "#ffffff";
+/** Submit-button depth shadow (accent ink, mode-specific). */
+declare const MUSHI_ACCENT_SHADOW: {
+    readonly light: "#9A2A1E";
+    readonly dark: "#7A1F15";
+};
+/** Brand banner border under vermillion strip. */
+declare const MUSHI_BANNER_BRAND_BORDER: {
+    readonly light: "#B52F1F";
+    readonly dark: "#C4321E";
+};
+/** Reporter inbox status chip colours (fg / bg / border). */
+interface MushiReporterStatusTone {
+    fg: string;
+    bg: string;
+    border: string;
+}
+declare const MUSHI_REPORTER_STATUS: Record<MushiThemeMode, Record<'sent' | 'review' | 'fixing' | 'fixed', MushiReporterStatusTone>>;
 /** Resolve the palette for a theme mode. */
 declare function mushiPalette(mode: MushiThemeMode): MushiColorPalette;
 /**
@@ -2093,20 +2189,35 @@ declare const MUSHI_MOTION: {
 declare const MUSHI_GEOMETRY: {
     readonly bannerHeight: 36;
     readonly fabSize: 52;
-    readonly edgeTabWidth: 28;
+    /** edge-tab launcher width (px) */
+    readonly edgeTabWidth: 32;
     /** default gutter from the screen edge (added on top of safe-area insets) */
     readonly gutter: 24;
-    readonly panelWidth: 384;
+    /** Web panel width (px) — matches shipped Shadow DOM widget */
+    readonly panelWidth: 360;
+    /** max panel height before keyboard inset (px) */
+    readonly panelMaxHeight: 480;
     /** below this viewport width the panel becomes a full-width bottom sheet */
     readonly panelSheetBreakpoint: 480;
 };
+/** Safe hex validator for user-supplied accent overrides (Shadow DOM CSS injection guard). */
+declare function safeWidgetHex(v: string): string;
+/**
+ * Resolve widget accent colours, honouring optional host overrides while
+ * falling back to the canonical palette from mushiPalette().
+ */
+declare function resolveWidgetAccent(mode: MushiThemeMode, accent?: string, accentText?: string): {
+    accent: string;
+    accentWash: string;
+    accentInk: string;
+};
 /**
  * Default user-facing copy. Centralised so apps stop drifting on the banner
  * label / CTA wording (seen as inconsistent across the four host apps).
  */
 declare const MUSHI_COPY: {
     readonly bannerLabel: "Beta";
-    readonly bannerMessage: "Help us improve — your feedback shapes what we ship.";
+    readonly bannerMessage: "Found a bug? Tap to report it.";
     readonly bugCta: "Report a bug";
     readonly featureCta: "Feature request";
     readonly triggerText: "🐛";
@@ -2233,4 +2344,4 @@ declare function projectInitialsThemeIndex(projectId: string): number;
  */
 declare function readPageFaviconHref(): string | null;
 
-export { type ApiClientOptions, type BreadcrumbBuffer, type BreadcrumbBufferOptions, DEFAULT_API_ENDPOINT, type LogEntry, type LogFormat, type LogLevel, type Logger, type LoggerOptions, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_MOTION, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, type MushiActivityEvent, type MushiApiCascadeConfig, type MushiApiClient, type MushiApiResponse, type MushiAssistantConfig, type MushiAssistantReply, type MushiAssistantStep, type MushiBannerConfig, type MushiBannerLink, type MushiBetaChangelogEntry, type MushiBetaModeConfig, type MushiBreadcrumb, type MushiCaptureConfig, type MushiCaptureEventInput, type MushiCaptureExceptionOptions, type MushiColorPalette, type MushiConfig, type MushiConsoleEntry, type MushiCooldownConfig, type MushiCrossAppReport, type MushiCustomCategory, type MushiDiagnosticsResult, type MushiDiscoverInventoryConfig, type MushiDiscoveryEventPayload, type MushiEnvironment, type MushiEventHandler, type MushiEventType, type MushiHallOfFameEntry, type MushiIdentityClaims, type MushiIntegrationsConfig, type MushiInternalRequestKind, type MushiLeaderboardEntry, type MushiNetworkEntry, type MushiOfflineConfig, type MushiOnDeviceClassifier, type MushiOnDeviceClassifierInput, type MushiOnDeviceClassifierResult, type MushiPageContext, type MushiPerformanceMetrics, type MushiPreFilterConfig, type MushiPreset, type MushiPrivacyConfig, type MushiProactiveConfig, type MushiRegion, type MushiReport, type MushiReportBuilder, type MushiReportCategory, type MushiReportStatus, type MushiReporterComment, type MushiReporterReport, type MushiReputationResult, type MushiRewardsConfig, type MushiRuntimeSdkConfig, type MushiSDKInstance, type MushiSdkVersionInfo, type MushiSelectedElement, type MushiSentryConfig, type MushiSentryContext, type MushiTesterReputation, type MushiThemeMode, type MushiTierResult, type MushiTimelineEntry, type MushiTimelineKind, type MushiTokenSnapshot, type MushiTracePropagationConfig, type MushiUrlMatcher, type MushiWidgetAnchor, type MushiWidgetConfig, type NormalisedException, type OfflineQueue, type PayloadGuardResult, type PiiScrubberConfig, type PreFilterResult, type ProjectFaviconSource, REGION_ENDPOINTS, type RateLimiter, type RateLimiterConfig, type ResolvedEnvConfig, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, scrubPii };
+export { type ApiClientOptions, type BreadcrumbBuffer, type BreadcrumbBufferOptions, DEFAULT_API_ENDPOINT, type LogEntry, type LogFormat, type LogLevel, type Logger, type LoggerOptions, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_ACCENT_SHADOW, MUSHI_BANNER_BRAND_BORDER, MUSHI_BANNER_NEON, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_INVERSE, MUSHI_MOTION, MUSHI_ON_ACCENT, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_REPORTER_STATUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TIER_COLORS, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, type MushiActivityEvent, type MushiApiCascadeConfig, type MushiApiClient, type MushiApiResponse, type MushiAssistantConfig, type MushiAssistantReply, type MushiAssistantStep, type MushiBannerConfig, type MushiBannerLink, type MushiBetaChangelogEntry, type MushiBetaModeConfig, type MushiBreadcrumb, type MushiCaptureConfig, type MushiCaptureEventInput, type MushiCaptureExceptionOptions, type MushiColorPalette, type MushiConfig, type MushiConsoleEntry, type MushiCooldownConfig, type MushiCrossAppReport, type MushiCustomCategory, type MushiDiagnosticsResult, type MushiDiscoverInventoryConfig, type MushiDiscoveryEventPayload, type MushiEnvironment, type MushiEventHandler, type MushiEventType, type MushiHallOfFameEntry, type MushiIdentityClaims, type MushiIntegrationsConfig, type MushiInternalRequestKind, type MushiLeaderboardEntry, type MushiNetworkEntry, type MushiOfflineConfig, type MushiOnDeviceClassifier, type MushiOnDeviceClassifierInput, type MushiOnDeviceClassifierResult, type MushiPageContext, type MushiPerformanceMetrics, type MushiPreFilterConfig, type MushiPreset, type MushiPrivacyConfig, type MushiProactiveConfig, type MushiRegion, type MushiReport, type MushiReportBuilder, type MushiReportCategory, type MushiReportStatus, type MushiReporterComment, type MushiReporterReport, type MushiReputationResult, type MushiRewardsConfig, type MushiRuntimeSdkConfig, type MushiSDKInstance, type MushiSdkVersionInfo, type MushiSelectedElement, type MushiSentryConfig, type MushiSentryContext, type MushiTesterReputation, type MushiThemeMode, type MushiTierResult, type MushiTimelineEntry, type MushiTimelineKind, type MushiTokenSnapshot, type MushiTracePropagationConfig, type MushiUrlMatcher, type MushiWidgetAnchor, type MushiWidgetConfig, type NormalisedException, type OfflineQueue, type PayloadGuardResult, type PiiScrubberConfig, type PreFilterResult, type ProjectFaviconSource, REGION_ENDPOINTS, type RateLimiter, type RateLimiterConfig, type ResolvedEnvConfig, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, hmacSha256Hex, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, resolveWidgetAccent, safeWidgetHex, scrubPii, sha256Hex };

package/dist/index.d.ts

@@ -23,6 +23,13 @@ interface MushiConfig {
     assistant?: MushiAssistantConfig;
     debug?: boolean;
     enabled?: boolean;
+    /**
+     * Host app release identifier stored on `reports.app_version` at ingest.
+     * Pairs with `environment.buildId` (from `<meta name="mushi:build">`) for
+     * deploy-level provenance. Falls back to `integrations.vercel.analyticsId`
+     * when omitted (legacy Vercel Analytics wiring).
+     */
+    appVersion?: string;
     /** Hook called before a report is sent. Return null to cancel, or return the (possibly modified) report. */
     beforeSendFeedback?: (report: MushiReport) => MushiReport | null | Promise<MushiReport | null>;
     /** Called once if the app crashed during the previous session. */
@@ -1504,6 +1511,8 @@ interface MushiRuntimeSdkConfig {
         triggerMode?: 'shake' | 'button' | 'both' | 'none';
         minDescriptionLength?: number;
     };
+    /** When false, the widget skips background reporter-inbox polling. Default true. */
+    reporterNotificationsEnabled?: boolean;
 }
 interface MushiSdkVersionInfo {
     package: string;
@@ -1730,7 +1739,59 @@ declare function createOfflineQueue(config?: MushiOfflineConfig): OfflineQueue;
  */
 declare function captureEnvironment(): MushiEnvironment;
 
-declare function getReporterToken(): string;
+/**
+ * FILE: reporter-token.ts
+ * PURPOSE: Stable, project-scoped anonymous reporter identity for the My Reports inbox.
+ *
+ * OVERVIEW:
+ * - Each Mushi project gets its own localStorage key so multi-project hosts on the
+ *   same origin (e.g. kensaur.us/glot-it vs /other-app) never share a token.
+ * - One-time migration copies the legacy global `mushi_reporter_token` into the
+ *   first projectId requested, preserving existing inbox history for that project.
+ *
+ * USAGE:
+ * - `getReporterToken(projectId)` from web/RN/Capacitor SDK before submit or inbox calls.
+ */
+/**
+ * Return a stable reporter token scoped to `projectId`.
+ * Legacy callers without a projectId still work but should migrate — the global
+ * key is read once and re-homed into the namespaced slot.
+ */
+declare function getReporterToken(projectId?: string): string;
+
+/**
+ * FILE: packages/core/src/digest.ts
+ * PURPOSE: SHA-256 and HMAC-SHA-256 helpers that work in every JS runtime —
+ *          including Hermes (React Native) which has no global `crypto` object.
+ *
+ * OVERVIEW:
+ * Fast path: when `globalThis.crypto?.subtle` is available (browser, Deno,
+ * Bun, Node ≥ 20 where Web Crypto is exposed globally, React Native with a
+ * crypto polyfill) we delegate to the native Web Crypto API which is
+ * hardware-accelerated and produces identical output.
+ *
+ * Fallback: `@noble/hashes` — pure-JS, audited, zero-dependency implementation
+ * of SHA-256 and HMAC used when native crypto is absent (Hermes cold start
+ * before any polyfill loads, worker environments without crypto, SSR edge runtimes).
+ *
+ * Both paths are spec-identical (same test vectors) and are exercised by
+ * `digest.test.ts`.
+ *
+ * USAGE:
+ *   import { sha256Hex, hmacSha256Hex } from './digest';
+ *   const hash = await sha256Hex('hello');
+ *   const sig  = await hmacSha256Hex('secret', 'message');
+ */
+/**
+ * SHA-256 of `value`, returned as a lowercase hex string.
+ * Uses Web Crypto when available, falls back to @noble/hashes.
+ */
+declare function sha256Hex(value: string): Promise<string>;
+/**
+ * HMAC-SHA-256 of `value` with `secret`, returned as a lowercase hex string.
+ * Uses Web Crypto when available, falls back to @noble/hashes.
+ */
+declare function hmacSha256Hex(secret: string, value: string): Promise<string>;
 
 /**
  * RFC-4122 v4 UUID generator with a capability ladder so it works in every
@@ -1996,8 +2057,8 @@ declare const noopLogger: Logger;
  *
  * Colour values mirror the historical washi/vermillion palette previously
  * inlined in `@mushi-mushi/web`'s styles.ts so the visual identity is
- * unchanged; the difference is that RN and Capacitor now share the exact
- * same constants instead of re-deriving their own.
+ * unchanged; `@mushi-mushi/web` imports mushiPalette() + MUSHI_* here
+ * instead of duplicating hex literals.
  */
 type MushiThemeMode = 'light' | 'dark';
 interface MushiColorPalette {
@@ -2032,6 +2093,41 @@ interface MushiColorPalette {
 declare const MUSHI_COLORS_LIGHT: MushiColorPalette;
 /** Dark-mode palette. */
 declare const MUSHI_COLORS_DARK: MushiColorPalette;
+/** Reward tier accent colours — editorial palette, not Tailwind defaults. */
+declare const MUSHI_TIER_COLORS: {
+    readonly free: string;
+    readonly explorer: "#2563EB";
+    readonly contributor: "#7C3AED";
+    readonly champion: "#D97706";
+    readonly default: string;
+};
+/** Neon beta banner — web `.mushi-banner.neon` + RN sheet header parity. */
+declare const MUSHI_BANNER_NEON: {
+    readonly bg: "#0FFF50";
+    readonly fg: "#0a1a0a";
+    readonly border: "#00C43A";
+};
+/** On-accent button text (hanko stamp, submit CTA). */
+declare const MUSHI_ON_ACCENT = "#FAF7F0";
+/** Pure white for assistant bubbles on accent backgrounds. */
+declare const MUSHI_INVERSE = "#ffffff";
+/** Submit-button depth shadow (accent ink, mode-specific). */
+declare const MUSHI_ACCENT_SHADOW: {
+    readonly light: "#9A2A1E";
+    readonly dark: "#7A1F15";
+};
+/** Brand banner border under vermillion strip. */
+declare const MUSHI_BANNER_BRAND_BORDER: {
+    readonly light: "#B52F1F";
+    readonly dark: "#C4321E";
+};
+/** Reporter inbox status chip colours (fg / bg / border). */
+interface MushiReporterStatusTone {
+    fg: string;
+    bg: string;
+    border: string;
+}
+declare const MUSHI_REPORTER_STATUS: Record<MushiThemeMode, Record<'sent' | 'review' | 'fixing' | 'fixed', MushiReporterStatusTone>>;
 /** Resolve the palette for a theme mode. */
 declare function mushiPalette(mode: MushiThemeMode): MushiColorPalette;
 /**
@@ -2093,20 +2189,35 @@ declare const MUSHI_MOTION: {
 declare const MUSHI_GEOMETRY: {
     readonly bannerHeight: 36;
     readonly fabSize: 52;
-    readonly edgeTabWidth: 28;
+    /** edge-tab launcher width (px) */
+    readonly edgeTabWidth: 32;
     /** default gutter from the screen edge (added on top of safe-area insets) */
     readonly gutter: 24;
-    readonly panelWidth: 384;
+    /** Web panel width (px) — matches shipped Shadow DOM widget */
+    readonly panelWidth: 360;
+    /** max panel height before keyboard inset (px) */
+    readonly panelMaxHeight: 480;
     /** below this viewport width the panel becomes a full-width bottom sheet */
     readonly panelSheetBreakpoint: 480;
 };
+/** Safe hex validator for user-supplied accent overrides (Shadow DOM CSS injection guard). */
+declare function safeWidgetHex(v: string): string;
+/**
+ * Resolve widget accent colours, honouring optional host overrides while
+ * falling back to the canonical palette from mushiPalette().
+ */
+declare function resolveWidgetAccent(mode: MushiThemeMode, accent?: string, accentText?: string): {
+    accent: string;
+    accentWash: string;
+    accentInk: string;
+};
 /**
  * Default user-facing copy. Centralised so apps stop drifting on the banner
  * label / CTA wording (seen as inconsistent across the four host apps).
  */
 declare const MUSHI_COPY: {
     readonly bannerLabel: "Beta";
-    readonly bannerMessage: "Help us improve — your feedback shapes what we ship.";
+    readonly bannerMessage: "Found a bug? Tap to report it.";
     readonly bugCta: "Report a bug";
     readonly featureCta: "Feature request";
     readonly triggerText: "🐛";
@@ -2233,4 +2344,4 @@ declare function projectInitialsThemeIndex(projectId: string): number;
  */
 declare function readPageFaviconHref(): string | null;
 
-export { type ApiClientOptions, type BreadcrumbBuffer, type BreadcrumbBufferOptions, DEFAULT_API_ENDPOINT, type LogEntry, type LogFormat, type LogLevel, type Logger, type LoggerOptions, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_MOTION, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, type MushiActivityEvent, type MushiApiCascadeConfig, type MushiApiClient, type MushiApiResponse, type MushiAssistantConfig, type MushiAssistantReply, type MushiAssistantStep, type MushiBannerConfig, type MushiBannerLink, type MushiBetaChangelogEntry, type MushiBetaModeConfig, type MushiBreadcrumb, type MushiCaptureConfig, type MushiCaptureEventInput, type MushiCaptureExceptionOptions, type MushiColorPalette, type MushiConfig, type MushiConsoleEntry, type MushiCooldownConfig, type MushiCrossAppReport, type MushiCustomCategory, type MushiDiagnosticsResult, type MushiDiscoverInventoryConfig, type MushiDiscoveryEventPayload, type MushiEnvironment, type MushiEventHandler, type MushiEventType, type MushiHallOfFameEntry, type MushiIdentityClaims, type MushiIntegrationsConfig, type MushiInternalRequestKind, type MushiLeaderboardEntry, type MushiNetworkEntry, type MushiOfflineConfig, type MushiOnDeviceClassifier, type MushiOnDeviceClassifierInput, type MushiOnDeviceClassifierResult, type MushiPageContext, type MushiPerformanceMetrics, type MushiPreFilterConfig, type MushiPreset, type MushiPrivacyConfig, type MushiProactiveConfig, type MushiRegion, type MushiReport, type MushiReportBuilder, type MushiReportCategory, type MushiReportStatus, type MushiReporterComment, type MushiReporterReport, type MushiReputationResult, type MushiRewardsConfig, type MushiRuntimeSdkConfig, type MushiSDKInstance, type MushiSdkVersionInfo, type MushiSelectedElement, type MushiSentryConfig, type MushiSentryContext, type MushiTesterReputation, type MushiThemeMode, type MushiTierResult, type MushiTimelineEntry, type MushiTimelineKind, type MushiTokenSnapshot, type MushiTracePropagationConfig, type MushiUrlMatcher, type MushiWidgetAnchor, type MushiWidgetConfig, type NormalisedException, type OfflineQueue, type PayloadGuardResult, type PiiScrubberConfig, type PreFilterResult, type ProjectFaviconSource, REGION_ENDPOINTS, type RateLimiter, type RateLimiterConfig, type ResolvedEnvConfig, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, scrubPii };
+export { type ApiClientOptions, type BreadcrumbBuffer, type BreadcrumbBufferOptions, DEFAULT_API_ENDPOINT, type LogEntry, type LogFormat, type LogLevel, type Logger, type LoggerOptions, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_ACCENT_SHADOW, MUSHI_BANNER_BRAND_BORDER, MUSHI_BANNER_NEON, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_INVERSE, MUSHI_MOTION, MUSHI_ON_ACCENT, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_REPORTER_STATUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TIER_COLORS, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, type MushiActivityEvent, type MushiApiCascadeConfig, type MushiApiClient, type MushiApiResponse, type MushiAssistantConfig, type MushiAssistantReply, type MushiAssistantStep, type MushiBannerConfig, type MushiBannerLink, type MushiBetaChangelogEntry, type MushiBetaModeConfig, type MushiBreadcrumb, type MushiCaptureConfig, type MushiCaptureEventInput, type MushiCaptureExceptionOptions, type MushiColorPalette, type MushiConfig, type MushiConsoleEntry, type MushiCooldownConfig, type MushiCrossAppReport, type MushiCustomCategory, type MushiDiagnosticsResult, type MushiDiscoverInventoryConfig, type MushiDiscoveryEventPayload, type MushiEnvironment, type MushiEventHandler, type MushiEventType, type MushiHallOfFameEntry, type MushiIdentityClaims, type MushiIntegrationsConfig, type MushiInternalRequestKind, type MushiLeaderboardEntry, type MushiNetworkEntry, type MushiOfflineConfig, type MushiOnDeviceClassifier, type MushiOnDeviceClassifierInput, type MushiOnDeviceClassifierResult, type MushiPageContext, type MushiPerformanceMetrics, type MushiPreFilterConfig, type MushiPreset, type MushiPrivacyConfig, type MushiProactiveConfig, type MushiRegion, type MushiReport, type MushiReportBuilder, type MushiReportCategory, type MushiReportStatus, type MushiReporterComment, type MushiReporterReport, type MushiReputationResult, type MushiRewardsConfig, type MushiRuntimeSdkConfig, type MushiSDKInstance, type MushiSdkVersionInfo, type MushiSelectedElement, type MushiSentryConfig, type MushiSentryContext, type MushiTesterReputation, type MushiThemeMode, type MushiTierResult, type MushiTimelineEntry, type MushiTimelineKind, type MushiTokenSnapshot, type MushiTracePropagationConfig, type MushiUrlMatcher, type MushiWidgetAnchor, type MushiWidgetConfig, type NormalisedException, type OfflineQueue, type PayloadGuardResult, type PiiScrubberConfig, type PreFilterResult, type ProjectFaviconSource, REGION_ENDPOINTS, type RateLimiter, type RateLimiterConfig, type ResolvedEnvConfig, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, hmacSha256Hex, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, resolveWidgetAccent, safeWidgetHex, scrubPii, sha256Hex };

package/dist/index.js

@@ -40,6 +40,47 @@ function formatBytes(n) {
   return `${(n / (1024 * 1024)).toFixed(2)} MB`;
 }
 
+// src/digest.ts
+function getSubtle() {
+  try {
+    const g = globalThis;
+    const crypto2 = g["crypto"];
+    if (crypto2?.subtle) return crypto2.subtle;
+  } catch {
+  }
+  return null;
+}
+function bytesToHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(value) {
+  const subtle = getSubtle();
+  if (subtle) {
+    const buffer = await subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return bytesToHex(new Uint8Array(buffer));
+  }
+  const { sha256 } = await import('@noble/hashes/sha2.js');
+  return bytesToHex(sha256(new TextEncoder().encode(value)));
+}
+async function hmacSha256Hex(secret, value) {
+  const subtle = getSubtle();
+  if (subtle) {
+    const key = await subtle.importKey(
+      "raw",
+      new TextEncoder().encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const buffer = await subtle.sign("HMAC", key, new TextEncoder().encode(value));
+    return bytesToHex(new Uint8Array(buffer));
+  }
+  const { hmac } = await import('@noble/hashes/hmac.js');
+  const { sha256 } = await import('@noble/hashes/sha2.js');
+  const result = hmac(sha256, new TextEncoder().encode(secret), new TextEncoder().encode(value));
+  return bytesToHex(result);
+}
+
 // src/api-client.ts
 var _credWarningEmitted = false;
 var MUSHI_USER_TOKEN_HEADER = "X-Mushi-User-Token";
@@ -409,21 +450,6 @@ function createApiClient(options) {
     }
   };
 }
-async function sha256Hex(value) {
-  const buffer = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function hmacSha256Hex(secret, value) {
-  const key = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const buffer = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value));
-  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -1379,20 +1405,9 @@ function capturePageLoadTiming(win) {
 }
 
 // src/reporter-token.ts
-var STORAGE_KEY = "mushi_reporter_token";
-function getReporterToken() {
-  if (typeof localStorage !== "undefined") {
-    const existing = localStorage.getItem(STORAGE_KEY);
-    if (existing) return existing;
-  }
-  const token = generateToken();
-  if (typeof localStorage !== "undefined") {
-    try {
-      localStorage.setItem(STORAGE_KEY, token);
-    } catch {
-    }
-  }
-  return token;
+var LEGACY_STORAGE_KEY = "mushi_reporter_token";
+function storageKey(projectId) {
+  return `mushi:reporter-token:${projectId}`;
 }
 function generateToken() {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
@@ -1409,6 +1424,38 @@ function generateToken() {
   const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
   return `mushi_${hex}`;
 }
+function readStoredToken(key) {
+  if (typeof localStorage === "undefined") return null;
+  try {
+    const existing = localStorage.getItem(key);
+    return existing && existing.length > 0 ? existing : null;
+  } catch {
+    return null;
+  }
+}
+function writeStoredToken(key, token) {
+  if (typeof localStorage === "undefined") return;
+  try {
+    localStorage.setItem(key, token);
+  } catch {
+  }
+}
+function getReporterToken(projectId) {
+  if (!projectId) {
+    const legacy2 = readStoredToken(LEGACY_STORAGE_KEY);
+    if (legacy2) return legacy2;
+    const token2 = generateToken();
+    writeStoredToken(LEGACY_STORAGE_KEY, token2);
+    return token2;
+  }
+  const key = storageKey(projectId);
+  const scoped = readStoredToken(key);
+  if (scoped) return scoped;
+  const legacy = readStoredToken(LEGACY_STORAGE_KEY);
+  const token = legacy ?? generateToken();
+  writeStoredToken(key, token);
+  return token;
+}
 
 // src/uuid.ts
 function newUuid() {
@@ -1704,6 +1751,42 @@ var MUSHI_COLORS_DARK = {
   ok: "#4ADE80",
   danger: "#F87171"
 };
+var MUSHI_TIER_COLORS = {
+  free: MUSHI_COLORS_LIGHT.inkMuted,
+  explorer: "#2563EB",
+  contributor: "#7C3AED",
+  champion: "#D97706",
+  default: MUSHI_COLORS_LIGHT.accent
+};
+var MUSHI_BANNER_NEON = {
+  bg: "#0FFF50",
+  fg: "#0a1a0a",
+  border: "#00C43A"
+};
+var MUSHI_ON_ACCENT = "#FAF7F0";
+var MUSHI_INVERSE = "#ffffff";
+var MUSHI_ACCENT_SHADOW = {
+  light: "#9A2A1E",
+  dark: "#7A1F15"
+};
+var MUSHI_BANNER_BRAND_BORDER = {
+  light: "#B52F1F",
+  dark: "#C4321E"
+};
+var MUSHI_REPORTER_STATUS = {
+  light: {
+    sent: { fg: "#1E4A8C", bg: "rgba(30,74,140,0.08)", border: "rgba(30,74,140,0.16)" },
+    review: { fg: "#8A5A00", bg: "rgba(180,120,0,0.10)", border: "rgba(180,120,0,0.18)" },
+    fixing: { fg: "#9A3D12", bg: "rgba(224,60,44,0.10)", border: "rgba(224,60,44,0.18)" },
+    fixed: { fg: "#1F6B3A", bg: "rgba(31,107,58,0.10)", border: "rgba(31,107,58,0.18)" }
+  },
+  dark: {
+    sent: { fg: "#A8C4FF", bg: "rgba(120,160,255,0.12)", border: "rgba(120,160,255,0.22)" },
+    review: { fg: "#FFD27A", bg: "rgba(255,190,90,0.12)", border: "rgba(255,190,90,0.22)" },
+    fixing: { fg: "#FFB899", bg: "rgba(255,120,60,0.12)", border: "rgba(255,120,60,0.24)" },
+    fixed: { fg: "#8FE3B0", bg: "rgba(80,200,130,0.12)", border: "rgba(80,200,130,0.22)" }
+  }
+};
 function mushiPalette(mode) {
   return mode === "dark" ? MUSHI_COLORS_DARK : MUSHI_COLORS_LIGHT;
 }
@@ -1750,16 +1833,32 @@ var MUSHI_MOTION = {
 var MUSHI_GEOMETRY = {
   bannerHeight: 36,
   fabSize: 52,
-  edgeTabWidth: 28,
+  /** edge-tab launcher width (px) */
+  edgeTabWidth: 32,
   /** default gutter from the screen edge (added on top of safe-area insets) */
   gutter: 24,
-  panelWidth: 384,
+  /** Web panel width (px) — matches shipped Shadow DOM widget */
+  panelWidth: 360,
+  /** max panel height before keyboard inset (px) */
+  panelMaxHeight: 480,
   /** below this viewport width the panel becomes a full-width bottom sheet */
   panelSheetBreakpoint: 480
 };
+function safeWidgetHex(v) {
+  return /^#[0-9a-fA-F]{3,8}$/.test(v) ? v : "";
+}
+function resolveWidgetAccent(mode, accent = "", accentText = "") {
+  const pal = mushiPalette(mode);
+  const safeAccent = safeWidgetHex(accent);
+  const safeAccentText = safeWidgetHex(accentText);
+  const resolvedAccent = safeAccent || pal.accent;
+  const accentWash = safeAccent ? mode === "dark" ? `${resolvedAccent}1F` : `${resolvedAccent}14` : pal.accentWash;
+  const accentInk = safeAccentText || pal.accentInk;
+  return { accent: resolvedAccent, accentWash, accentInk };
+}
 var MUSHI_COPY = {
   bannerLabel: "Beta",
-  bannerMessage: "Help us improve \u2014 your feedback shapes what we ship.",
+  bannerMessage: "Found a bug? Tap to report it.",
   bugCta: "Report a bug",
   featureCta: "Feature request",
   triggerText: "\u{1F41B}",
@@ -2010,6 +2109,6 @@ function isSafeFaviconHref(href) {
   }
 }
 
-export { DEFAULT_API_ENDPOINT, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_MOTION, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, REGION_ENDPOINTS, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, scrubPii };
+export { DEFAULT_API_ENDPOINT, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_ACCENT_SHADOW, MUSHI_BANNER_BRAND_BORDER, MUSHI_BANNER_NEON, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_INVERSE, MUSHI_MOTION, MUSHI_ON_ACCENT, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_REPORTER_STATUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TIER_COLORS, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, REGION_ENDPOINTS, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, hmacSha256Hex, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, resolveWidgetAccent, safeWidgetHex, scrubPii, sha256Hex };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map