@mushi-mushi/core 1.20.2 → 1.22.0

package/dist/index.d.cts

@@ -2,6 +2,22 @@ interface MushiConfig {
     projectId: string;
     apiKey: string;
     apiEndpoint?: string;
+    /** Per-request timeout in ms (default 10000). Raise on slow mobile networks. */
+    timeout?: number;
+    /** Max retries for transient (network / 5xx) failures (default 2). */
+    maxRetries?: number;
+    /**
+     * Endpoint circuit breaker. After `threshold` consecutive unreachable
+     * failures the client fast-fails for `cooldownMs` (then half-opens) instead
+     * of hammering a down endpoint; fast-failed reports still hit the offline
+     * queue. Set `enabled: false` to opt out. Defaults: enabled, threshold 4,
+     * cooldown 30000ms.
+     */
+    circuitBreaker?: {
+        enabled?: boolean;
+        threshold?: number;
+        cooldownMs?: number;
+    };
     /** Opinionated defaults for common environments. Explicit config wins. */
     preset?: MushiPreset;
     /**
@@ -23,6 +39,13 @@ interface MushiConfig {
     assistant?: MushiAssistantConfig;
     debug?: boolean;
     enabled?: boolean;
+    /**
+     * Host app release identifier stored on `reports.app_version` at ingest.
+     * Pairs with `environment.buildId` (from `<meta name="mushi:build">`) for
+     * deploy-level provenance. Falls back to `integrations.vercel.analyticsId`
+     * when omitted (legacy Vercel Analytics wiring).
+     */
+    appVersion?: string;
     /** Hook called before a report is sent. Return null to cancel, or return the (possibly modified) report. */
     beforeSendFeedback?: (report: MushiReport) => MushiReport | null | Promise<MushiReport | null>;
     /** Called once if the app crashed during the previous session. */
@@ -851,6 +874,16 @@ interface MushiEnvironment {
      */
     route?: string;
     nearestTestid?: string;
+    /**
+     * Native-shell detection (best-effort, present only when a native bridge is
+     * detected). Lets triage distinguish a Capacitor/Cordova/React-Native WebView
+     * report from a plain browser one, and lets the SDK gate DOM-only behaviour.
+     */
+    native?: {
+        capacitor?: boolean;
+        cordova?: boolean;
+        reactNative?: boolean;
+    };
     /**
      * SDK boost (2026-05-07): richer per-report context so the Triage LLM
      * and the admin /reports detail drawer have something to reason about
@@ -1504,6 +1537,8 @@ interface MushiRuntimeSdkConfig {
         triggerMode?: 'shake' | 'button' | 'both' | 'none';
         minDescriptionLength?: number;
     };
+    /** When false, the widget skips background reporter-inbox polling. Default true. */
+    reporterNotificationsEnabled?: boolean;
 }
 interface MushiSdkVersionInfo {
     package: string;
@@ -1606,6 +1641,19 @@ interface ApiClientOptions {
     apiEndpoint?: string;
     timeout?: number;
     maxRetries?: number;
+    /**
+     * Circuit breaker for the endpoint. After `threshold` consecutive
+     * unreachable failures (network errors / exhausted 5xx) the client
+     * fast-fails for `cooldownMs` instead of hammering a down endpoint, then
+     * half-opens (one trial request). Fast-failed requests return a transient
+     * error so the offline queue still captures the report. Set
+     * `enabled: false` to opt out. Defaults: enabled, threshold 4, cooldown 30s.
+     */
+    circuitBreaker?: {
+        enabled?: boolean;
+        threshold?: number;
+        cooldownMs?: number;
+    };
     /** When set, sent on every request so heartbeats record the running SDK version. */
     sdkPackage?: string;
     sdkVersion?: string;
@@ -1620,6 +1668,8 @@ declare const DEFAULT_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/f
 declare const MUSHI_INTERNAL_HEADER = "X-Mushi-Internal";
 declare const MUSHI_INTERNAL_INIT_MARKER = "__mushiInternal";
 type MushiInternalRequestKind = 'sdk-config' | 'report-submit' | 'report-status' | 'reporter-poll' | 'diagnose' | 'discovery' | 'community';
+declare const DEFAULT_TIMEOUT = 10000;
+declare const DEFAULT_MAX_RETRIES = 2;
 declare function createApiClient(options: ApiClientOptions): MushiApiClient;
 
 /**
@@ -1730,7 +1780,59 @@ declare function createOfflineQueue(config?: MushiOfflineConfig): OfflineQueue;
  */
 declare function captureEnvironment(): MushiEnvironment;
 
-declare function getReporterToken(): string;
+/**
+ * FILE: reporter-token.ts
+ * PURPOSE: Stable, project-scoped anonymous reporter identity for the My Reports inbox.
+ *
+ * OVERVIEW:
+ * - Each Mushi project gets its own localStorage key so multi-project hosts on the
+ *   same origin (e.g. kensaur.us/glot-it vs /other-app) never share a token.
+ * - One-time migration copies the legacy global `mushi_reporter_token` into the
+ *   first projectId requested, preserving existing inbox history for that project.
+ *
+ * USAGE:
+ * - `getReporterToken(projectId)` from web/RN/Capacitor SDK before submit or inbox calls.
+ */
+/**
+ * Return a stable reporter token scoped to `projectId`.
+ * Legacy callers without a projectId still work but should migrate — the global
+ * key is read once and re-homed into the namespaced slot.
+ */
+declare function getReporterToken(projectId?: string): string;
+
+/**
+ * FILE: packages/core/src/digest.ts
+ * PURPOSE: SHA-256 and HMAC-SHA-256 helpers that work in every JS runtime —
+ *          including Hermes (React Native) which has no global `crypto` object.
+ *
+ * OVERVIEW:
+ * Fast path: when `globalThis.crypto?.subtle` is available (browser, Deno,
+ * Bun, Node ≥ 20 where Web Crypto is exposed globally, React Native with a
+ * crypto polyfill) we delegate to the native Web Crypto API which is
+ * hardware-accelerated and produces identical output.
+ *
+ * Fallback: `@noble/hashes` — pure-JS, audited, zero-dependency implementation
+ * of SHA-256 and HMAC used when native crypto is absent (Hermes cold start
+ * before any polyfill loads, worker environments without crypto, SSR edge runtimes).
+ *
+ * Both paths are spec-identical (same test vectors) and are exercised by
+ * `digest.test.ts`.
+ *
+ * USAGE:
+ *   import { sha256Hex, hmacSha256Hex } from './digest';
+ *   const hash = await sha256Hex('hello');
+ *   const sig  = await hmacSha256Hex('secret', 'message');
+ */
+/**
+ * SHA-256 of `value`, returned as a lowercase hex string.
+ * Uses Web Crypto when available, falls back to @noble/hashes.
+ */
+declare function sha256Hex(value: string): Promise<string>;
+/**
+ * HMAC-SHA-256 of `value` with `secret`, returned as a lowercase hex string.
+ * Uses Web Crypto when available, falls back to @noble/hashes.
+ */
+declare function hmacSha256Hex(secret: string, value: string): Promise<string>;
 
 /**
  * RFC-4122 v4 UUID generator with a capability ladder so it works in every
@@ -1996,8 +2098,8 @@ declare const noopLogger: Logger;
  *
  * Colour values mirror the historical washi/vermillion palette previously
  * inlined in `@mushi-mushi/web`'s styles.ts so the visual identity is
- * unchanged; the difference is that RN and Capacitor now share the exact
- * same constants instead of re-deriving their own.
+ * unchanged; `@mushi-mushi/web` imports mushiPalette() + MUSHI_* here
+ * instead of duplicating hex literals.
  */
 type MushiThemeMode = 'light' | 'dark';
 interface MushiColorPalette {
@@ -2032,6 +2134,41 @@ interface MushiColorPalette {
 declare const MUSHI_COLORS_LIGHT: MushiColorPalette;
 /** Dark-mode palette. */
 declare const MUSHI_COLORS_DARK: MushiColorPalette;
+/** Reward tier accent colours — editorial palette, not Tailwind defaults. */
+declare const MUSHI_TIER_COLORS: {
+    readonly free: string;
+    readonly explorer: "#2563EB";
+    readonly contributor: "#7C3AED";
+    readonly champion: "#D97706";
+    readonly default: string;
+};
+/** Neon beta banner — web `.mushi-banner.neon` + RN sheet header parity. */
+declare const MUSHI_BANNER_NEON: {
+    readonly bg: "#0FFF50";
+    readonly fg: "#0a1a0a";
+    readonly border: "#00C43A";
+};
+/** On-accent button text (hanko stamp, submit CTA). */
+declare const MUSHI_ON_ACCENT = "#FAF7F0";
+/** Pure white for assistant bubbles on accent backgrounds. */
+declare const MUSHI_INVERSE = "#ffffff";
+/** Submit-button depth shadow (accent ink, mode-specific). */
+declare const MUSHI_ACCENT_SHADOW: {
+    readonly light: "#9A2A1E";
+    readonly dark: "#7A1F15";
+};
+/** Brand banner border under vermillion strip. */
+declare const MUSHI_BANNER_BRAND_BORDER: {
+    readonly light: "#B52F1F";
+    readonly dark: "#C4321E";
+};
+/** Reporter inbox status chip colours (fg / bg / border). */
+interface MushiReporterStatusTone {
+    fg: string;
+    bg: string;
+    border: string;
+}
+declare const MUSHI_REPORTER_STATUS: Record<MushiThemeMode, Record<'sent' | 'review' | 'fixing' | 'fixed', MushiReporterStatusTone>>;
 /** Resolve the palette for a theme mode. */
 declare function mushiPalette(mode: MushiThemeMode): MushiColorPalette;
 /**
@@ -2093,20 +2230,35 @@ declare const MUSHI_MOTION: {
 declare const MUSHI_GEOMETRY: {
     readonly bannerHeight: 36;
     readonly fabSize: 52;
-    readonly edgeTabWidth: 28;
+    /** edge-tab launcher width (px) */
+    readonly edgeTabWidth: 32;
     /** default gutter from the screen edge (added on top of safe-area insets) */
     readonly gutter: 24;
-    readonly panelWidth: 384;
+    /** Web panel width (px) — matches shipped Shadow DOM widget */
+    readonly panelWidth: 360;
+    /** max panel height before keyboard inset (px) */
+    readonly panelMaxHeight: 480;
     /** below this viewport width the panel becomes a full-width bottom sheet */
     readonly panelSheetBreakpoint: 480;
 };
+/** Safe hex validator for user-supplied accent overrides (Shadow DOM CSS injection guard). */
+declare function safeWidgetHex(v: string): string;
+/**
+ * Resolve widget accent colours, honouring optional host overrides while
+ * falling back to the canonical palette from mushiPalette().
+ */
+declare function resolveWidgetAccent(mode: MushiThemeMode, accent?: string, accentText?: string): {
+    accent: string;
+    accentWash: string;
+    accentInk: string;
+};
 /**
  * Default user-facing copy. Centralised so apps stop drifting on the banner
  * label / CTA wording (seen as inconsistent across the four host apps).
  */
 declare const MUSHI_COPY: {
     readonly bannerLabel: "Beta";
-    readonly bannerMessage: "Help us improve — your feedback shapes what we ship.";
+    readonly bannerMessage: "Found a bug? Tap to report it.";
     readonly bugCta: "Report a bug";
     readonly featureCta: "Feature request";
     readonly triggerText: "🐛";
@@ -2233,4 +2385,4 @@ declare function projectInitialsThemeIndex(projectId: string): number;
  */
 declare function readPageFaviconHref(): string | null;
 
-export { type ApiClientOptions, type BreadcrumbBuffer, type BreadcrumbBufferOptions, DEFAULT_API_ENDPOINT, type LogEntry, type LogFormat, type LogLevel, type Logger, type LoggerOptions, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_MOTION, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, type MushiActivityEvent, type MushiApiCascadeConfig, type MushiApiClient, type MushiApiResponse, type MushiAssistantConfig, type MushiAssistantReply, type MushiAssistantStep, type MushiBannerConfig, type MushiBannerLink, type MushiBetaChangelogEntry, type MushiBetaModeConfig, type MushiBreadcrumb, type MushiCaptureConfig, type MushiCaptureEventInput, type MushiCaptureExceptionOptions, type MushiColorPalette, type MushiConfig, type MushiConsoleEntry, type MushiCooldownConfig, type MushiCrossAppReport, type MushiCustomCategory, type MushiDiagnosticsResult, type MushiDiscoverInventoryConfig, type MushiDiscoveryEventPayload, type MushiEnvironment, type MushiEventHandler, type MushiEventType, type MushiHallOfFameEntry, type MushiIdentityClaims, type MushiIntegrationsConfig, type MushiInternalRequestKind, type MushiLeaderboardEntry, type MushiNetworkEntry, type MushiOfflineConfig, type MushiOnDeviceClassifier, type MushiOnDeviceClassifierInput, type MushiOnDeviceClassifierResult, type MushiPageContext, type MushiPerformanceMetrics, type MushiPreFilterConfig, type MushiPreset, type MushiPrivacyConfig, type MushiProactiveConfig, type MushiRegion, type MushiReport, type MushiReportBuilder, type MushiReportCategory, type MushiReportStatus, type MushiReporterComment, type MushiReporterReport, type MushiReputationResult, type MushiRewardsConfig, type MushiRuntimeSdkConfig, type MushiSDKInstance, type MushiSdkVersionInfo, type MushiSelectedElement, type MushiSentryConfig, type MushiSentryContext, type MushiTesterReputation, type MushiThemeMode, type MushiTierResult, type MushiTimelineEntry, type MushiTimelineKind, type MushiTokenSnapshot, type MushiTracePropagationConfig, type MushiUrlMatcher, type MushiWidgetAnchor, type MushiWidgetConfig, type NormalisedException, type OfflineQueue, type PayloadGuardResult, type PiiScrubberConfig, type PreFilterResult, type ProjectFaviconSource, REGION_ENDPOINTS, type RateLimiter, type RateLimiterConfig, type ResolvedEnvConfig, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, scrubPii };
+export { type ApiClientOptions, type BreadcrumbBuffer, type BreadcrumbBufferOptions, DEFAULT_API_ENDPOINT, DEFAULT_MAX_RETRIES, DEFAULT_TIMEOUT, type LogEntry, type LogFormat, type LogLevel, type Logger, type LoggerOptions, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_ACCENT_SHADOW, MUSHI_BANNER_BRAND_BORDER, MUSHI_BANNER_NEON, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_INVERSE, MUSHI_MOTION, MUSHI_ON_ACCENT, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_REPORTER_STATUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TIER_COLORS, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, type MushiActivityEvent, type MushiApiCascadeConfig, type MushiApiClient, type MushiApiResponse, type MushiAssistantConfig, type MushiAssistantReply, type MushiAssistantStep, type MushiBannerConfig, type MushiBannerLink, type MushiBetaChangelogEntry, type MushiBetaModeConfig, type MushiBreadcrumb, type MushiCaptureConfig, type MushiCaptureEventInput, type MushiCaptureExceptionOptions, type MushiColorPalette, type MushiConfig, type MushiConsoleEntry, type MushiCooldownConfig, type MushiCrossAppReport, type MushiCustomCategory, type MushiDiagnosticsResult, type MushiDiscoverInventoryConfig, type MushiDiscoveryEventPayload, type MushiEnvironment, type MushiEventHandler, type MushiEventType, type MushiHallOfFameEntry, type MushiIdentityClaims, type MushiIntegrationsConfig, type MushiInternalRequestKind, type MushiLeaderboardEntry, type MushiNetworkEntry, type MushiOfflineConfig, type MushiOnDeviceClassifier, type MushiOnDeviceClassifierInput, type MushiOnDeviceClassifierResult, type MushiPageContext, type MushiPerformanceMetrics, type MushiPreFilterConfig, type MushiPreset, type MushiPrivacyConfig, type MushiProactiveConfig, type MushiRegion, type MushiReport, type MushiReportBuilder, type MushiReportCategory, type MushiReportStatus, type MushiReporterComment, type MushiReporterReport, type MushiReputationResult, type MushiRewardsConfig, type MushiRuntimeSdkConfig, type MushiSDKInstance, type MushiSdkVersionInfo, type MushiSelectedElement, type MushiSentryConfig, type MushiSentryContext, type MushiTesterReputation, type MushiThemeMode, type MushiTierResult, type MushiTimelineEntry, type MushiTimelineKind, type MushiTokenSnapshot, type MushiTracePropagationConfig, type MushiUrlMatcher, type MushiWidgetAnchor, type MushiWidgetConfig, type NormalisedException, type OfflineQueue, type PayloadGuardResult, type PiiScrubberConfig, type PreFilterResult, type ProjectFaviconSource, REGION_ENDPOINTS, type RateLimiter, type RateLimiterConfig, type ResolvedEnvConfig, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, hmacSha256Hex, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, resolveWidgetAccent, safeWidgetHex, scrubPii, sha256Hex };

package/dist/index.d.ts

@@ -2,6 +2,22 @@ interface MushiConfig {
     projectId: string;
     apiKey: string;
     apiEndpoint?: string;
+    /** Per-request timeout in ms (default 10000). Raise on slow mobile networks. */
+    timeout?: number;
+    /** Max retries for transient (network / 5xx) failures (default 2). */
+    maxRetries?: number;
+    /**
+     * Endpoint circuit breaker. After `threshold` consecutive unreachable
+     * failures the client fast-fails for `cooldownMs` (then half-opens) instead
+     * of hammering a down endpoint; fast-failed reports still hit the offline
+     * queue. Set `enabled: false` to opt out. Defaults: enabled, threshold 4,
+     * cooldown 30000ms.
+     */
+    circuitBreaker?: {
+        enabled?: boolean;
+        threshold?: number;
+        cooldownMs?: number;
+    };
     /** Opinionated defaults for common environments. Explicit config wins. */
     preset?: MushiPreset;
     /**
@@ -23,6 +39,13 @@ interface MushiConfig {
     assistant?: MushiAssistantConfig;
     debug?: boolean;
     enabled?: boolean;
+    /**
+     * Host app release identifier stored on `reports.app_version` at ingest.
+     * Pairs with `environment.buildId` (from `<meta name="mushi:build">`) for
+     * deploy-level provenance. Falls back to `integrations.vercel.analyticsId`
+     * when omitted (legacy Vercel Analytics wiring).
+     */
+    appVersion?: string;
     /** Hook called before a report is sent. Return null to cancel, or return the (possibly modified) report. */
     beforeSendFeedback?: (report: MushiReport) => MushiReport | null | Promise<MushiReport | null>;
     /** Called once if the app crashed during the previous session. */
@@ -851,6 +874,16 @@ interface MushiEnvironment {
      */
     route?: string;
     nearestTestid?: string;
+    /**
+     * Native-shell detection (best-effort, present only when a native bridge is
+     * detected). Lets triage distinguish a Capacitor/Cordova/React-Native WebView
+     * report from a plain browser one, and lets the SDK gate DOM-only behaviour.
+     */
+    native?: {
+        capacitor?: boolean;
+        cordova?: boolean;
+        reactNative?: boolean;
+    };
     /**
      * SDK boost (2026-05-07): richer per-report context so the Triage LLM
      * and the admin /reports detail drawer have something to reason about
@@ -1504,6 +1537,8 @@ interface MushiRuntimeSdkConfig {
         triggerMode?: 'shake' | 'button' | 'both' | 'none';
         minDescriptionLength?: number;
     };
+    /** When false, the widget skips background reporter-inbox polling. Default true. */
+    reporterNotificationsEnabled?: boolean;
 }
 interface MushiSdkVersionInfo {
     package: string;
@@ -1606,6 +1641,19 @@ interface ApiClientOptions {
     apiEndpoint?: string;
     timeout?: number;
     maxRetries?: number;
+    /**
+     * Circuit breaker for the endpoint. After `threshold` consecutive
+     * unreachable failures (network errors / exhausted 5xx) the client
+     * fast-fails for `cooldownMs` instead of hammering a down endpoint, then
+     * half-opens (one trial request). Fast-failed requests return a transient
+     * error so the offline queue still captures the report. Set
+     * `enabled: false` to opt out. Defaults: enabled, threshold 4, cooldown 30s.
+     */
+    circuitBreaker?: {
+        enabled?: boolean;
+        threshold?: number;
+        cooldownMs?: number;
+    };
     /** When set, sent on every request so heartbeats record the running SDK version. */
     sdkPackage?: string;
     sdkVersion?: string;
@@ -1620,6 +1668,8 @@ declare const DEFAULT_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/f
 declare const MUSHI_INTERNAL_HEADER = "X-Mushi-Internal";
 declare const MUSHI_INTERNAL_INIT_MARKER = "__mushiInternal";
 type MushiInternalRequestKind = 'sdk-config' | 'report-submit' | 'report-status' | 'reporter-poll' | 'diagnose' | 'discovery' | 'community';
+declare const DEFAULT_TIMEOUT = 10000;
+declare const DEFAULT_MAX_RETRIES = 2;
 declare function createApiClient(options: ApiClientOptions): MushiApiClient;
 
 /**
@@ -1730,7 +1780,59 @@ declare function createOfflineQueue(config?: MushiOfflineConfig): OfflineQueue;
  */
 declare function captureEnvironment(): MushiEnvironment;
 
-declare function getReporterToken(): string;
+/**
+ * FILE: reporter-token.ts
+ * PURPOSE: Stable, project-scoped anonymous reporter identity for the My Reports inbox.
+ *
+ * OVERVIEW:
+ * - Each Mushi project gets its own localStorage key so multi-project hosts on the
+ *   same origin (e.g. kensaur.us/glot-it vs /other-app) never share a token.
+ * - One-time migration copies the legacy global `mushi_reporter_token` into the
+ *   first projectId requested, preserving existing inbox history for that project.
+ *
+ * USAGE:
+ * - `getReporterToken(projectId)` from web/RN/Capacitor SDK before submit or inbox calls.
+ */
+/**
+ * Return a stable reporter token scoped to `projectId`.
+ * Legacy callers without a projectId still work but should migrate — the global
+ * key is read once and re-homed into the namespaced slot.
+ */
+declare function getReporterToken(projectId?: string): string;
+
+/**
+ * FILE: packages/core/src/digest.ts
+ * PURPOSE: SHA-256 and HMAC-SHA-256 helpers that work in every JS runtime —
+ *          including Hermes (React Native) which has no global `crypto` object.
+ *
+ * OVERVIEW:
+ * Fast path: when `globalThis.crypto?.subtle` is available (browser, Deno,
+ * Bun, Node ≥ 20 where Web Crypto is exposed globally, React Native with a
+ * crypto polyfill) we delegate to the native Web Crypto API which is
+ * hardware-accelerated and produces identical output.
+ *
+ * Fallback: `@noble/hashes` — pure-JS, audited, zero-dependency implementation
+ * of SHA-256 and HMAC used when native crypto is absent (Hermes cold start
+ * before any polyfill loads, worker environments without crypto, SSR edge runtimes).
+ *
+ * Both paths are spec-identical (same test vectors) and are exercised by
+ * `digest.test.ts`.
+ *
+ * USAGE:
+ *   import { sha256Hex, hmacSha256Hex } from './digest';
+ *   const hash = await sha256Hex('hello');
+ *   const sig  = await hmacSha256Hex('secret', 'message');
+ */
+/**
+ * SHA-256 of `value`, returned as a lowercase hex string.
+ * Uses Web Crypto when available, falls back to @noble/hashes.
+ */
+declare function sha256Hex(value: string): Promise<string>;
+/**
+ * HMAC-SHA-256 of `value` with `secret`, returned as a lowercase hex string.
+ * Uses Web Crypto when available, falls back to @noble/hashes.
+ */
+declare function hmacSha256Hex(secret: string, value: string): Promise<string>;
 
 /**
  * RFC-4122 v4 UUID generator with a capability ladder so it works in every
@@ -1996,8 +2098,8 @@ declare const noopLogger: Logger;
  *
  * Colour values mirror the historical washi/vermillion palette previously
  * inlined in `@mushi-mushi/web`'s styles.ts so the visual identity is
- * unchanged; the difference is that RN and Capacitor now share the exact
- * same constants instead of re-deriving their own.
+ * unchanged; `@mushi-mushi/web` imports mushiPalette() + MUSHI_* here
+ * instead of duplicating hex literals.
  */
 type MushiThemeMode = 'light' | 'dark';
 interface MushiColorPalette {
@@ -2032,6 +2134,41 @@ interface MushiColorPalette {
 declare const MUSHI_COLORS_LIGHT: MushiColorPalette;
 /** Dark-mode palette. */
 declare const MUSHI_COLORS_DARK: MushiColorPalette;
+/** Reward tier accent colours — editorial palette, not Tailwind defaults. */
+declare const MUSHI_TIER_COLORS: {
+    readonly free: string;
+    readonly explorer: "#2563EB";
+    readonly contributor: "#7C3AED";
+    readonly champion: "#D97706";
+    readonly default: string;
+};
+/** Neon beta banner — web `.mushi-banner.neon` + RN sheet header parity. */
+declare const MUSHI_BANNER_NEON: {
+    readonly bg: "#0FFF50";
+    readonly fg: "#0a1a0a";
+    readonly border: "#00C43A";
+};
+/** On-accent button text (hanko stamp, submit CTA). */
+declare const MUSHI_ON_ACCENT = "#FAF7F0";
+/** Pure white for assistant bubbles on accent backgrounds. */
+declare const MUSHI_INVERSE = "#ffffff";
+/** Submit-button depth shadow (accent ink, mode-specific). */
+declare const MUSHI_ACCENT_SHADOW: {
+    readonly light: "#9A2A1E";
+    readonly dark: "#7A1F15";
+};
+/** Brand banner border under vermillion strip. */
+declare const MUSHI_BANNER_BRAND_BORDER: {
+    readonly light: "#B52F1F";
+    readonly dark: "#C4321E";
+};
+/** Reporter inbox status chip colours (fg / bg / border). */
+interface MushiReporterStatusTone {
+    fg: string;
+    bg: string;
+    border: string;
+}
+declare const MUSHI_REPORTER_STATUS: Record<MushiThemeMode, Record<'sent' | 'review' | 'fixing' | 'fixed', MushiReporterStatusTone>>;
 /** Resolve the palette for a theme mode. */
 declare function mushiPalette(mode: MushiThemeMode): MushiColorPalette;
 /**
@@ -2093,20 +2230,35 @@ declare const MUSHI_MOTION: {
 declare const MUSHI_GEOMETRY: {
     readonly bannerHeight: 36;
     readonly fabSize: 52;
-    readonly edgeTabWidth: 28;
+    /** edge-tab launcher width (px) */
+    readonly edgeTabWidth: 32;
     /** default gutter from the screen edge (added on top of safe-area insets) */
     readonly gutter: 24;
-    readonly panelWidth: 384;
+    /** Web panel width (px) — matches shipped Shadow DOM widget */
+    readonly panelWidth: 360;
+    /** max panel height before keyboard inset (px) */
+    readonly panelMaxHeight: 480;
     /** below this viewport width the panel becomes a full-width bottom sheet */
     readonly panelSheetBreakpoint: 480;
 };
+/** Safe hex validator for user-supplied accent overrides (Shadow DOM CSS injection guard). */
+declare function safeWidgetHex(v: string): string;
+/**
+ * Resolve widget accent colours, honouring optional host overrides while
+ * falling back to the canonical palette from mushiPalette().
+ */
+declare function resolveWidgetAccent(mode: MushiThemeMode, accent?: string, accentText?: string): {
+    accent: string;
+    accentWash: string;
+    accentInk: string;
+};
 /**
  * Default user-facing copy. Centralised so apps stop drifting on the banner
  * label / CTA wording (seen as inconsistent across the four host apps).
  */
 declare const MUSHI_COPY: {
     readonly bannerLabel: "Beta";
-    readonly bannerMessage: "Help us improve — your feedback shapes what we ship.";
+    readonly bannerMessage: "Found a bug? Tap to report it.";
     readonly bugCta: "Report a bug";
     readonly featureCta: "Feature request";
     readonly triggerText: "🐛";
@@ -2233,4 +2385,4 @@ declare function projectInitialsThemeIndex(projectId: string): number;
  */
 declare function readPageFaviconHref(): string | null;
 
-export { type ApiClientOptions, type BreadcrumbBuffer, type BreadcrumbBufferOptions, DEFAULT_API_ENDPOINT, type LogEntry, type LogFormat, type LogLevel, type Logger, type LoggerOptions, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_MOTION, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, type MushiActivityEvent, type MushiApiCascadeConfig, type MushiApiClient, type MushiApiResponse, type MushiAssistantConfig, type MushiAssistantReply, type MushiAssistantStep, type MushiBannerConfig, type MushiBannerLink, type MushiBetaChangelogEntry, type MushiBetaModeConfig, type MushiBreadcrumb, type MushiCaptureConfig, type MushiCaptureEventInput, type MushiCaptureExceptionOptions, type MushiColorPalette, type MushiConfig, type MushiConsoleEntry, type MushiCooldownConfig, type MushiCrossAppReport, type MushiCustomCategory, type MushiDiagnosticsResult, type MushiDiscoverInventoryConfig, type MushiDiscoveryEventPayload, type MushiEnvironment, type MushiEventHandler, type MushiEventType, type MushiHallOfFameEntry, type MushiIdentityClaims, type MushiIntegrationsConfig, type MushiInternalRequestKind, type MushiLeaderboardEntry, type MushiNetworkEntry, type MushiOfflineConfig, type MushiOnDeviceClassifier, type MushiOnDeviceClassifierInput, type MushiOnDeviceClassifierResult, type MushiPageContext, type MushiPerformanceMetrics, type MushiPreFilterConfig, type MushiPreset, type MushiPrivacyConfig, type MushiProactiveConfig, type MushiRegion, type MushiReport, type MushiReportBuilder, type MushiReportCategory, type MushiReportStatus, type MushiReporterComment, type MushiReporterReport, type MushiReputationResult, type MushiRewardsConfig, type MushiRuntimeSdkConfig, type MushiSDKInstance, type MushiSdkVersionInfo, type MushiSelectedElement, type MushiSentryConfig, type MushiSentryContext, type MushiTesterReputation, type MushiThemeMode, type MushiTierResult, type MushiTimelineEntry, type MushiTimelineKind, type MushiTokenSnapshot, type MushiTracePropagationConfig, type MushiUrlMatcher, type MushiWidgetAnchor, type MushiWidgetConfig, type NormalisedException, type OfflineQueue, type PayloadGuardResult, type PiiScrubberConfig, type PreFilterResult, type ProjectFaviconSource, REGION_ENDPOINTS, type RateLimiter, type RateLimiterConfig, type ResolvedEnvConfig, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, scrubPii };
+export { type ApiClientOptions, type BreadcrumbBuffer, type BreadcrumbBufferOptions, DEFAULT_API_ENDPOINT, DEFAULT_MAX_RETRIES, DEFAULT_TIMEOUT, type LogEntry, type LogFormat, type LogLevel, type Logger, type LoggerOptions, MAX_REPORT_PAYLOAD_BYTES, MAX_SCREENSHOT_DATA_URL_BYTES, MUSHI_ACCENT_SHADOW, MUSHI_BANNER_BRAND_BORDER, MUSHI_BANNER_NEON, MUSHI_COLORS_DARK, MUSHI_COLORS_LIGHT, MUSHI_COPY, MUSHI_GEOMETRY, MUSHI_IDENTITY_TOKEN_PREFIX, MUSHI_INTERNAL_HEADER, MUSHI_INTERNAL_INIT_MARKER, MUSHI_INVERSE, MUSHI_MOTION, MUSHI_ON_ACCENT, MUSHI_PROJECT_HEADER, MUSHI_RADIUS, MUSHI_REPORTER_STATUS, MUSHI_SDK_PACKAGE_HEADER, MUSHI_SDK_VERSION_HEADER, MUSHI_SPACING, MUSHI_TIER_COLORS, MUSHI_TYPE, MUSHI_USER_TOKEN_HEADER, MUSHI_Z, type MushiActivityEvent, type MushiApiCascadeConfig, type MushiApiClient, type MushiApiResponse, type MushiAssistantConfig, type MushiAssistantReply, type MushiAssistantStep, type MushiBannerConfig, type MushiBannerLink, type MushiBetaChangelogEntry, type MushiBetaModeConfig, type MushiBreadcrumb, type MushiCaptureConfig, type MushiCaptureEventInput, type MushiCaptureExceptionOptions, type MushiColorPalette, type MushiConfig, type MushiConsoleEntry, type MushiCooldownConfig, type MushiCrossAppReport, type MushiCustomCategory, type MushiDiagnosticsResult, type MushiDiscoverInventoryConfig, type MushiDiscoveryEventPayload, type MushiEnvironment, type MushiEventHandler, type MushiEventType, type MushiHallOfFameEntry, type MushiIdentityClaims, type MushiIntegrationsConfig, type MushiInternalRequestKind, type MushiLeaderboardEntry, type MushiNetworkEntry, type MushiOfflineConfig, type MushiOnDeviceClassifier, type MushiOnDeviceClassifierInput, type MushiOnDeviceClassifierResult, type MushiPageContext, type MushiPerformanceMetrics, type MushiPreFilterConfig, type MushiPreset, type MushiPrivacyConfig, type MushiProactiveConfig, type MushiRegion, type MushiReport, type MushiReportBuilder, type MushiReportCategory, type MushiReportStatus, type MushiReporterComment, type MushiReporterReport, type MushiReputationResult, type MushiRewardsConfig, type MushiRuntimeSdkConfig, type MushiSDKInstance, type MushiSdkVersionInfo, type MushiSelectedElement, type MushiSentryConfig, type MushiSentryContext, type MushiTesterReputation, type MushiThemeMode, type MushiTierResult, type MushiTimelineEntry, type MushiTimelineKind, type MushiTokenSnapshot, type MushiTracePropagationConfig, type MushiUrlMatcher, type MushiWidgetAnchor, type MushiWidgetConfig, type NormalisedException, type OfflineQueue, type PayloadGuardResult, type PiiScrubberConfig, type PreFilterResult, type ProjectFaviconSource, REGION_ENDPOINTS, type RateLimiter, type RateLimiterConfig, type ResolvedEnvConfig, buildIdentityClaims, buildSdkIngestHeaders, captureEnvironment, checkReportPayloadSize, createApiClient, createBreadcrumbBuffer, createLogger, createOfflineQueue, createPiiScrubber, createPreFilter, createRateLimiter, estimateJsonBytes, faviconUrlCandidates, formatBytes, getDeviceFingerprintHash, getReporterToken, getSessionId, githubRepoDomainHint, hmacSha256Hex, isLikelyGenericFavicon, isUntrustedFaviconUrl, mushiPalette, mushiTokens, newUuid, noopLogger, normaliseThrown, originToDomain, parseIdentityToken, projectFaviconUrlCandidates, projectInitials, projectInitialsThemeIndex, readPageFaviconHref, resolveEnvConfig, resolveProjectDomain, resolveProjectFaviconDomains, resolveRegionEndpoint, resolveWidgetAccent, safeWidgetHex, scrubPii, sha256Hex };