@mushi-mushi/react-native 0.18.1 → 0.19.1

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # @mushi-mushi/react-native
 
+## 0.19.1
+
+### Patch Changes
+
+- 08108e6: Setup UX overhaul: zero-paste `mushi login` browser device-auth, credential error visibility, and docs fixes.
+
+  - **CLI**: `mushi login` now implements RFC 8628 browser device-auth (zero copy-paste). Opens the console in the browser, user clicks Approve, CLI receives a session token automatically, then lists/creates a project and saves the API key. `--api-key` flag remains as the CI/non-interactive fallback.
+  - **Core SDK**: 401/403 responses now emit a one-time `console.error` with a clear credential-failure message and the console URL, instead of silently entering the offline retry queue.
+  - **React Native**: Same 401/403 credential-failure detection in `MushiProvider.submitReport` — skips enqueue and surfaces the error immediately.
+
+- Updated dependencies [08108e6]
+  - @mushi-mushi/core@1.19.1
+
+## 0.19.0
+
+### Minor Changes
+
+- a8f183e: Show the captured screenshot as a visible preview with a configurable
+  "remove anything sensitive" privacy caption, so reporters can see and consent to
+  exactly what gets sent.
+
+  - **core/types**: new `widget.screenshotSensitiveHint?: boolean | string` config.
+    `true` (default) shows the localized caption, a string overrides it verbatim,
+    `false` hides the caption (the preview + remove control always remain). Travels
+    in the `widget` block of `GET /v1/sdk/config`, so it's settable per-host via the
+    SDK and remotely via the Mushi console runtime config.
+  - **web/widget**: the details step now renders the attached screenshot as an
+    `<img>` preview (previously only a "Screenshot attached ✓" label) with an
+    optional privacy caption beneath it. The preview stays in sync through the
+    annotate/markup flow and clears when the screenshot is removed. Image `src` and
+    caption are HTML-escaped. New `en`/`es`/`ja`/`th` strings.
+  - **react-native**: the bottom sheet's existing screenshot thumbnail gains the
+    same configurable privacy caption, resolved by the provider from
+    `widget.screenshotSensitiveHint`.
+
+  This lets privacy-sensitive hosts (e.g. finance apps) enable screenshot capture
+  with an explicit user-facing review-and-remove step instead of disabling it
+  outright.
+
+### Patch Changes
+
+- Updated dependencies [a8f183e]
+- Updated dependencies [a8f183e]
+  - @mushi-mushi/core@1.19.0
+
 ## 0.18.1
 
 ### Patch Changes

package/CONTRIBUTING.md

@@ -27,12 +27,24 @@ pnpm build
 
 ```bash
 pnpm dev          # Start all dev servers (admin on :6464)
+```
+
+| Surface | URL |
+| --- | --- |
+| Admin console | http://localhost:6464 |
+| Docs site | http://localhost:3000 |
+| CLI console override | `MUSHI_CONSOLE_URL=http://localhost:6464` |
+
+```bash
 pnpm test         # Run Vitest across all packages
 pnpm typecheck    # TypeScript checks
 pnpm lint         # ESLint
 pnpm format       # Prettier
+pnpm smoke:cli-setup   # Playwright: onboarding ?setup=cli + success panel (skips headless if unsigned)
 ```
 
+Set `CLI_SETUP_SMOKE_STRICT=1` to fail the smoke script when Playwright is not signed in (CI gate).
+
 Ad-hoc screenshots captured during UI reviews can live temporarily at the repo
 root, but root-level `*.png` files are intentionally ignored. Canonical
 screenshots that should be versioned belong under `docs/screenshots/`.

package/README.md

@@ -106,13 +106,27 @@ import { MushiBottomSheet, MushiFloatingButton } from '@mushi-mushi/react-native
 
 ## Screenshots
 
-When `react-native-view-shot` is installed, the SDK captures the current screen **before** the report sheet overlays it, and shows the user a thumbnail they can remove before submitting. Enabled by default; turn off with `capture: { screenshot: false }`.
+When `react-native-view-shot` is installed, the SDK captures the current screen **before** the report sheet overlays it, and shows the user a **thumbnail preview** they can remove before submitting. A configurable **privacy caption** (`widget.screenshotSensitiveHint`) appears under the preview — default copy reminds reporters to drop balances or PII. Enabled by default; turn off capture with `capture: { screenshot: false }`.
+
+```tsx
+<MushiProvider
+  config={{
+    widget: {
+      // true (default) | "Custom compliance copy" | false (hide caption only)
+      screenshotSensitiveHint: true,
+    },
+    capture: { screenshot: true },
+  }}
+>
+```
 
 ```bash
 npx expo install react-native-view-shot   # v4+ on Expo SDK 55; v5+ for Fabric / New Architecture
 ```
 
-> **Masking sensitive screens.** `captureScreen()` grabs whatever is on screen, which on a finance/health app can include balances or PII. The user always reviews and can remove the thumbnail before submit, but for screens that should never be captured, set `capture: { screenshot: false }` while they're focused, or use `expo-screen-capture` to mark the view secure. Field-level masking is on the roadmap.
+> **Masking sensitive screens.** `captureScreen()` grabs whatever is on screen. The preview + Remove control is the reporter's consent gate — finance apps can keep screenshots on with a custom caption instead of disabling capture entirely. For screens that must never be photographed, set `capture: { screenshot: false }` while they're focused, or use `expo-screen-capture` to mark the view secure. Full doc: [`docs/SDK_SCREENSHOT_PREVIEW.md`](../../docs/SDK_SCREENSHOT_PREVIEW.md).
+
+> **Metro / Hermes hosts.** The published dist uses esbuild `__require()` for optional peers. Host apps may need a postinstall patch (see yen-yen `scripts/patch-mushi.mjs`) so Metro resolves `react-native-view-shot` and `@react-native-community/netinfo`.
 
 ## Identifying the reporter
 

package/dist/index.cjs

@@ -47,9 +47,10 @@ module.exports = __toCommonJS(index_exports);
 
 // src/provider.tsx
 var import_react3 = require("react");
-var import_core3 = require("@mushi-mushi/core");
+var import_core5 = require("@mushi-mushi/core");
 
 // src/capture/console-capture.ts
+var import_core = require("@mushi-mushi/core");
 function setupConsoleCapture(maxEntries = 100) {
   const entries = [];
   const methods = ["log", "warn", "error"];
@@ -60,7 +61,7 @@ function setupConsoleCapture(maxEntries = 100) {
     console[method] = (...args) => {
       entries.push({
         level: method,
-        message: args.map(String).join(" ").slice(0, 500),
+        message: (0, import_core.scrubPii)(args.map(String).join(" ").slice(0, 500)),
         timestamp: Date.now()
       });
       if (entries.length > maxEntries) entries.shift();
@@ -189,16 +190,154 @@ function getDeviceFingerprintHash(device) {
 }
 
 // src/storage/async-storage-queue.ts
-var QUEUE_KEY = "@mushi:offline_queue";
+var import_core2 = require("@mushi-mushi/core");
+
+// src/storage/secure-storage.ts
+var REPORTER_TOKEN_KEY = "@mushi:reporter_token";
+var QUEUE_CRYPTO_KEY = "@mushi:queue_aes_key";
+var LEGACY_QUEUE_KEY = "@mushi:offline_queue";
+var ENCRYPTED_QUEUE_KEY = "@mushi:offline_queue_enc";
+var ENCRYPTED_PREFIX = "mushi_enc_v1:";
+async function loadAsyncStorage() {
+  try {
+    const mod = await import("@react-native-async-storage/async-storage");
+    return mod.default;
+  } catch {
+    return null;
+  }
+}
+async function loadSecureStore() {
+  try {
+    const mod = await import("expo-secure-store");
+    return mod.default ?? mod;
+  } catch {
+    return null;
+  }
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  if (typeof btoa === "function") return btoa(binary);
+  const B = globalThis.Buffer;
+  if (B) return B.from(bytes).toString("base64");
+  return "";
+}
+function base64ToBytes(b64) {
+  if (typeof atob === "function") {
+    const binary = atob(b64);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+    return out;
+  }
+  const B = globalThis.Buffer;
+  if (B) return new Uint8Array(B.from(b64, "base64"));
+  return new Uint8Array();
+}
+function hasWebCrypto() {
+  return typeof globalThis.crypto?.subtle?.importKey === "function";
+}
+async function getOrCreateQueueKey(secure) {
+  if (!hasWebCrypto()) return null;
+  let rawB64 = await secure.getItemAsync(QUEUE_CRYPTO_KEY);
+  if (!rawB64) {
+    const raw2 = new Uint8Array(32);
+    globalThis.crypto.getRandomValues(raw2);
+    rawB64 = bytesToBase64(raw2);
+    await secure.setItemAsync(QUEUE_CRYPTO_KEY, rawB64);
+  }
+  const raw = base64ToBytes(rawB64);
+  return globalThis.crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+async function encryptQueueBlob(plaintext, secureStorage) {
+  if (!secureStorage) return plaintext;
+  const secure = await loadSecureStore();
+  if (!secure) return plaintext;
+  const key = await getOrCreateQueueKey(secure);
+  if (!key) return plaintext;
+  const iv = new Uint8Array(12);
+  globalThis.crypto.getRandomValues(iv);
+  const encoded = new TextEncoder().encode(plaintext);
+  const cipher = await globalThis.crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, encoded);
+  const combined = new Uint8Array(iv.length + cipher.byteLength);
+  combined.set(iv, 0);
+  combined.set(new Uint8Array(cipher), iv.length);
+  return ENCRYPTED_PREFIX + bytesToBase64(combined);
+}
+async function decryptQueueBlob(stored, secureStorage) {
+  if (!stored.startsWith(ENCRYPTED_PREFIX)) return stored;
+  if (!secureStorage) return stored;
+  const secure = await loadSecureStore();
+  if (!secure || !hasWebCrypto()) return stored;
+  const key = await getOrCreateQueueKey(secure);
+  if (!key) return stored;
+  const combined = base64ToBytes(stored.slice(ENCRYPTED_PREFIX.length));
+  if (combined.length < 13) return stored;
+  const iv = combined.slice(0, 12);
+  const cipher = combined.slice(12);
+  try {
+    const plain = await globalThis.crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, cipher);
+    return new TextDecoder().decode(plain);
+  } catch {
+    return stored;
+  }
+}
+async function loadReporterToken(secureStorage) {
+  if (secureStorage) {
+    const secure = await loadSecureStore();
+    if (secure) {
+      const fromSecure = await secure.getItemAsync(REPORTER_TOKEN_KEY);
+      if (fromSecure?.startsWith("mushi_")) return fromSecure;
+      const storage2 = await loadAsyncStorage();
+      if (storage2) {
+        const legacy = await storage2.getItem(REPORTER_TOKEN_KEY);
+        if (legacy?.startsWith("mushi_")) {
+          await secure.setItemAsync(REPORTER_TOKEN_KEY, legacy);
+          await storage2.removeItem(REPORTER_TOKEN_KEY);
+          return legacy;
+        }
+      }
+      return fromSecure;
+    }
+  }
+  const storage = await loadAsyncStorage();
+  if (!storage) return null;
+  return storage.getItem(REPORTER_TOKEN_KEY);
+}
+async function saveReporterToken(token, secureStorage) {
+  if (secureStorage) {
+    const secure = await loadSecureStore();
+    if (secure) {
+      await secure.setItemAsync(REPORTER_TOKEN_KEY, token);
+      const storage2 = await loadAsyncStorage();
+      if (storage2) await storage2.removeItem(REPORTER_TOKEN_KEY);
+      return;
+    }
+  }
+  const storage = await loadAsyncStorage();
+  if (storage) await storage.setItem(REPORTER_TOKEN_KEY, token);
+}
+
+// src/storage/async-storage-queue.ts
+var QUEUE_KEY = ENCRYPTED_QUEUE_KEY;
 var AsyncStorageQueue = class {
   maxSize;
   apiEndpoint;
   apiKey;
+  projectId;
+  sdkPackage;
+  sdkVersion;
+  getUserToken;
+  secureStorage;
   onSynced;
   constructor(config) {
     this.maxSize = config.maxSize ?? 50;
     this.apiEndpoint = config.apiEndpoint;
     this.apiKey = config.apiKey;
+    this.projectId = config.projectId;
+    this.sdkPackage = config.sdkPackage;
+    this.sdkVersion = config.sdkVersion;
+    this.getUserToken = config.getUserToken;
+    this.secureStorage = config.secureStorage !== false;
     this.onSynced = config.onSynced;
   }
   async enqueue(report) {
@@ -208,7 +347,7 @@ var AsyncStorageQueue = class {
     if (queue.length >= this.maxSize) queue.shift();
     const scrubbedReport = this.scrubReportPii(report);
     queue.push({ report: scrubbedReport, enqueuedAt: Date.now() });
-    await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue));
+    await this.persistQueue(AsyncStorage, queue);
   }
   async flush() {
     const AsyncStorage = await this.getAsyncStorage();
@@ -218,7 +357,14 @@ var AsyncStorageQueue = class {
     let flushed = 0;
     const remaining = [];
     for (const item of queue) {
-      const ok = await sendWithRetry(item, this.apiEndpoint, this.apiKey);
+      const ok = await sendWithRetry(item, {
+        apiEndpoint: this.apiEndpoint,
+        apiKey: this.apiKey,
+        projectId: this.projectId,
+        sdkPackage: this.sdkPackage,
+        sdkVersion: this.sdkVersion,
+        getUserToken: this.getUserToken
+      });
       if (ok) {
         flushed++;
         const reportId = item.report.id;
@@ -233,7 +379,7 @@ var AsyncStorageQueue = class {
         break;
       }
     }
-    await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(remaining));
+    await this.persistQueue(AsyncStorage, remaining);
     return flushed;
   }
   async size() {
@@ -242,31 +388,43 @@ var AsyncStorageQueue = class {
     const queue = await this.getQueue(AsyncStorage);
     return queue.length;
   }
-  // Added: PII scrubbing (Phase 2.4)
-  // Scrubs free-text fields where users typically type emails / phones /
-  // card numbers when describing a bug. We deliberately do NOT scrub
-  // structured fields like `metadata.userEmail` — those are explicitly
-  // captured by the host app via `setUser()` and the operator opts in to
-  // collecting them. Scrubbing them here would silently break attribution.
   scrubReportPii(report) {
     const next = { ...report };
     if (typeof next.description === "string") {
-      next.description = scrubPii(next.description);
+      next.description = (0, import_core2.scrubPii)(next.description);
     }
     if (typeof next.summary === "string") {
-      next.summary = scrubPii(next.summary);
+      next.summary = (0, import_core2.scrubPii)(next.summary);
     }
     if (Array.isArray(next.breadcrumbs)) {
       next.breadcrumbs = next.breadcrumbs.map(
-        (b) => typeof b?.message === "string" ? { ...b, message: scrubPii(b.message) } : b
+        (b) => typeof b?.message === "string" ? { ...b, message: (0, import_core2.scrubPii)(b.message) } : b
+      );
+    }
+    if (Array.isArray(next.consoleLogs)) {
+      next.consoleLogs = next.consoleLogs.map(
+        (entry) => typeof entry?.message === "string" ? { ...entry, message: (0, import_core2.scrubPii)(entry.message) } : entry
       );
     }
     return next;
   }
+  async persistQueue(storage, queue) {
+    const plaintext = JSON.stringify(queue);
+    const blob = await encryptQueueBlob(plaintext, this.secureStorage);
+    await storage.setItem(QUEUE_KEY, blob);
+  }
   async getQueue(storage) {
     try {
-      const raw = await storage.getItem(QUEUE_KEY);
-      return raw ? JSON.parse(raw) : [];
+      let raw = await storage.getItem(QUEUE_KEY);
+      if (!raw) {
+        raw = await storage.getItem(LEGACY_QUEUE_KEY);
+        if (raw) {
+          await storage.removeItem(LEGACY_QUEUE_KEY);
+        }
+      }
+      if (!raw) return [];
+      const plaintext = await decryptQueueBlob(raw, this.secureStorage);
+      return JSON.parse(plaintext);
     } catch {
       return [];
     }
@@ -280,56 +438,33 @@ var AsyncStorageQueue = class {
     }
   }
 };
-var SCRUB_PATTERNS = [
-  [/\b\d{3}-\d{2}-\d{4}\b/g, "[REDACTED_SSN]"],
-  [/\b(?:\d[ -]*){12,18}\d\b/g, "[REDACTED_CC]"],
-  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "[REDACTED_AWS_KEY]"],
-  [
-    /(?:aws_secret_access_key|secret_access_key)["'\s:=]+[A-Za-z0-9/+=]{40}\b/gi,
-    "aws_secret_access_key=[REDACTED_AWS_SECRET]"
-  ],
-  [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_KEY]"],
-  [/\bpk_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_PK]"],
-  [/\bxox[abpor]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED_SLACK_TOKEN]"],
-  [/\bghp_[A-Za-z0-9]{36}\b/g, "[REDACTED_GITHUB_PAT]"],
-  [/\bgithub_pat_[A-Za-z0-9_]{80,}\b/g, "[REDACTED_GITHUB_PAT]"],
-  [/\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_OPENAI_KEY]"],
-  [/\bsk-ant-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_ANTHROPIC_KEY]"],
-  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED_GOOGLE_KEY]"],
-  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED_JWT]"],
-  [/\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g, "[REDACTED_EMAIL]"],
-  [
-    /(?:\+\d{1,3}[\s.\-])?\(?\d{2,4}\)?[\s.\-]\d{3,4}[\s.\-]\d{3,4}\b/g,
-    "[REDACTED_PHONE]"
-  ]
-];
-function scrubPii(text) {
-  let result = text;
-  for (const [regex, replacement] of SCRUB_PATTERNS) {
-    result = result.replace(regex, replacement);
-  }
-  return result;
-}
-async function sendWithRetry(item, endpoint, apiKey, attempt = 0) {
+async function sendWithRetry(item, ctx, attempt = 0) {
   const delay = Math.min(1e3 * Math.pow(2, attempt) + Math.random() * 500, 1e4);
+  const internalKind = "report-submit";
+  const userToken = ctx.getUserToken?.() ?? null;
   try {
-    const res = await fetch(`${endpoint}/v1/reports`, {
+    const res = await fetch(`${ctx.apiEndpoint}/v1/reports`, {
       method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-Mushi-Api-Key": apiKey
-      },
-      body: JSON.stringify(item.report)
+      headers: (0, import_core2.buildSdkIngestHeaders)({
+        apiKey: ctx.apiKey,
+        projectId: ctx.projectId,
+        sdkPackage: ctx.sdkPackage,
+        sdkVersion: ctx.sdkVersion,
+        userToken,
+        internalKind
+      }),
+      body: JSON.stringify(item.report),
+      [import_core2.MUSHI_INTERNAL_INIT_MARKER]: internalKind
     });
     if ((res.status === 429 || res.status >= 500) && attempt < 3) {
       await sleep(delay);
-      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+      return sendWithRetry(item, ctx, attempt + 1);
     }
     return res.ok;
   } catch {
     if (attempt < 3) {
       await sleep(delay);
-      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+      return sendWithRetry(item, ctx, attempt + 1);
     }
     return false;
   }
@@ -341,7 +476,7 @@ function sleep(ms) {
 // src/components/MushiBottomSheet.tsx
 var import_react = require("react");
 var import_react_native2 = require("react-native");
-var import_core = require("@mushi-mushi/core");
+var import_core3 = require("@mushi-mushi/core");
 var import_jsx_runtime = require("react/jsx-runtime");
 var { height: SCREEN_HEIGHT } = import_react_native2.Dimensions.get("window");
 var SHEET_HEIGHT = SCREEN_HEIGHT * 0.55;
@@ -364,7 +499,8 @@ var MushiBottomSheet = ({
   visible,
   onClose,
   screenshotDataUrl,
-  onClearScreenshot
+  onClearScreenshot,
+  screenshotSensitiveHint
 }) => {
   const mushi = useMushiContext();
   const scheme = (0, import_react_native2.useColorScheme)();
@@ -498,7 +634,7 @@ var MushiBottomSheet = ({
     }
   };
   const activeScreenshot = screenshotDataUrl && screenshotAttached ? screenshotDataUrl : null;
-  const pal = (0, import_core.mushiPalette)(dark ? "dark" : "light");
+  const pal = (0, import_core3.mushiPalette)(dark ? "dark" : "light");
   const colors = dark ? { bg: pal.paper, text: pal.ink, sub: pal.inkMuted, card: pal.paperRaised, accent: NEON.accent, accentInk: NEON.ink, border: pal.ruleStrong, backdrop: "rgba(0,0,0,0.6)", disabled: "#3a3a3c", disabledText: pal.inkFaint } : { bg: pal.paperRaised, text: pal.ink, sub: pal.inkMuted, card: pal.paper, accent: NEON.accent, accentInk: NEON.ink, border: pal.ruleStrong, backdrop: "rgba(0,0,0,0.35)", disabled: "#d1d1d6", disabledText: pal.inkFaint };
   const canSubmit = !!category && description.trim().length > 0 && phase === "form";
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_native2.Modal, { visible, transparent: true, animationType: "none", statusBarTranslucent: true, children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
@@ -656,7 +792,7 @@ var MushiBottomSheet = ({
                       ),
                       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_react_native2.View, { style: s.screenshotMeta, children: [
                         /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_native2.Text, { style: [s.screenshotLabel, { color: colors.text }], children: "Screenshot attached" }),
-                        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_native2.Text, { style: [s.screenshotSub, { color: colors.sub }], children: "Helps the team see the issue" })
+                        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_native2.Text, { style: [s.screenshotSub, { color: colors.sub }], children: screenshotSensitiveHint && screenshotSensitiveHint.trim() ? `\u26A0 ${screenshotSensitiveHint}` : "Helps the team see the issue" })
                       ] }),
                       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
                         import_react_native2.TouchableOpacity,
@@ -893,7 +1029,7 @@ var s = import_react_native2.StyleSheet.create({
 // src/components/MushiFloatingButton.tsx
 var import_react2 = require("react");
 var import_react_native3 = require("react-native");
-var import_core2 = require("@mushi-mushi/core");
+var import_core4 = require("@mushi-mushi/core");
 var import_jsx_runtime2 = require("react/jsx-runtime");
 var FAB_SIZE = 56;
 var EDGE_PADDING = 12;
@@ -945,7 +1081,7 @@ var MushiFloatingButton = ({
   const currentX = (0, import_react2.useRef)(baseX);
   const currentY = (0, import_react2.useRef)(0);
   const isDragging = (0, import_react2.useRef)(false);
-  const accentColor = accent ?? (0, import_core2.mushiPalette)(dark ? "dark" : "light").accent;
+  const accentColor = accent ?? (0, import_core4.mushiPalette)(dark ? "dark" : "light").accent;
   (0, import_react2.useEffect)(() => {
     if (!persist) return;
     void loadStoredPos().then((pos) => {
@@ -1055,7 +1191,7 @@ var MushiFloatingButton = ({
       onStartShouldSetResponder: () => !draggable,
       onResponderGrant: handlePressIn,
       onResponderRelease: handlePressOut,
-      children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_react_native3.Animated.Text, { style: s2.emoji, children: import_core2.MUSHI_COPY.triggerText })
+      children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_react_native3.Animated.Text, { style: s2.emoji, children: import_core4.MUSHI_COPY.triggerText })
     }
   );
 };
@@ -1080,11 +1216,17 @@ var s2 = import_react_native3.StyleSheet.create({
 
 // src/version.ts
 var MUSHI_SDK_PACKAGE = "@mushi-mushi/react-native";
-var MUSHI_SDK_VERSION = "0.18.1" ? "0.18.1" : "0.17.0";
+var MUSHI_SDK_VERSION = "0.19.1" ? "0.19.1" : "0.17.0";
 
 // src/provider.tsx
 var import_jsx_runtime3 = require("react/jsx-runtime");
 var MushiContext = (0, import_react3.createContext)(null);
+var DEFAULT_SCREENSHOT_HINT = "Check the preview \u2014 remove it if any private info (balances, personal details) is visible.";
+function resolveScreenshotHint(v) {
+  if (v === false) return null;
+  if (typeof v === "string") return v.trim() ? v : null;
+  return DEFAULT_SCREENSHOT_HINT;
+}
 function breadcrumbToTimelineKind(category) {
   switch (category) {
     case "navigation":
@@ -1121,9 +1263,9 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
   const networkRef = (0, import_react3.useRef)(null);
   const queueRef = (0, import_react3.useRef)(null);
   const apiClientRef = (0, import_react3.useRef)(null);
-  const sessionIdRef = (0, import_react3.useRef)(`sess_${(0, import_core3.newUuid)()}`);
+  const sessionIdRef = (0, import_react3.useRef)(`sess_${(0, import_core5.newUuid)()}`);
   const breadcrumbsRef = (0, import_react3.useRef)(
-    (0, import_core3.createBreadcrumbBuffer)({ max: config.capture?.maxBreadcrumbs ?? 50 })
+    (0, import_core5.createBreadcrumbBuffer)({ max: config.capture?.maxBreadcrumbs ?? 50 })
   );
   const [sheetVisible, setSheetVisible] = (0, import_react3.useState)(false);
   const [sheetScreenshot, setSheetScreenshot] = (0, import_react3.useState)(null);
@@ -1146,7 +1288,7 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
   if (config.endpoint && !config.apiEndpoint && __DEV__) {
     console.warn("[MushiProvider] `endpoint` is deprecated \u2014 use `apiEndpoint` instead.");
   }
-  const apiEndpoint = rawEndpoint ?? import_core3.DEFAULT_API_ENDPOINT;
+  const apiEndpoint = rawEndpoint ?? import_core5.DEFAULT_API_ENDPOINT;
   (0, import_react3.useEffect)(() => {
     if (config.capture?.console !== false) {
       consoleRef.current = setupConsoleCapture(config.capture?.maxConsoleEntries);
@@ -1154,7 +1296,7 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
     if (config.capture?.network !== false) {
       networkRef.current = setupNetworkCapture(config.capture?.maxNetworkEntries, apiEndpoint);
     }
-    apiClientRef.current = (0, import_core3.createApiClient)({
+    apiClientRef.current = (0, import_core5.createApiClient)({
       projectId: config.projectId,
       apiKey: config.apiKey,
       apiEndpoint,
@@ -1166,6 +1308,11 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       maxSize: config.storage?.maxQueueSize,
       apiEndpoint,
       apiKey: config.apiKey,
+      projectId: config.projectId,
+      sdkPackage: MUSHI_SDK_PACKAGE,
+      sdkVersion: MUSHI_SDK_VERSION,
+      getUserToken: () => userTokenRef.current,
+      secureStorage: config.storage?.secureStorage,
       // `onReportSynced` fires here — when a previously-queued report actually
       // drains to the server — not on the direct-submit path (where it would be
       // indistinguishable from `onReportSubmitted` and thus meaningless).
@@ -1180,21 +1327,20 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       data: { sdk: MUSHI_SDK_PACKAGE, version: MUSHI_SDK_VERSION }
     });
     (async () => {
-      const TOKEN_KEY = "@mushi:reporter_token";
       try {
-        const AsyncStorage = (await import("@react-native-async-storage/async-storage")).default;
-        const existing = await AsyncStorage.getItem(TOKEN_KEY);
+        const secureStorage = config.storage?.secureStorage !== false;
+        const existing = await loadReporterToken(secureStorage);
         if (existing && existing.startsWith("mushi_")) {
           reporterTokenRef.current = existing;
         } else {
-          const fresh = `mushi_${(0, import_core3.newUuid)()}`;
+          const fresh = `mushi_${(0, import_core5.newUuid)()}`;
           reporterTokenRef.current = fresh;
-          await AsyncStorage.setItem(TOKEN_KEY, fresh);
+          await saveReporterToken(fresh, secureStorage);
         }
         resolveReporterTokenReady();
       } catch {
         if (reporterTokenRef.current === `rn-${config.projectId}-anon`) {
-          reporterTokenRef.current = `mushi_${(0, import_core3.newUuid)()}`;
+          reporterTokenRef.current = `mushi_${(0, import_core5.newUuid)()}`;
         }
         resolveReporterTokenReady();
       }
@@ -1304,7 +1450,10 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       if (screenRef.current?.route) contextMeta.screenRoute = screenRef.current.route;
       if (screenRef.current?.feature) contextMeta.screenFeature = screenRef.current.feature;
       const merged = Object.keys(metadataRef.current).length > 0 ? { ...contextMeta, ...metadataRef.current } : Object.keys(contextMeta).length > 0 ? contextMeta : void 0;
-      const breadcrumbs = breadcrumbsRef.current.getAll();
+      const breadcrumbs = breadcrumbsRef.current.getAll().map((c) => ({
+        ...c,
+        message: (0, import_core5.scrubPii)(c.message)
+      }));
       const timeline = breadcrumbs.map((c) => ({
         ts: c.timestamp,
         kind: breadcrumbToTimelineKind(c.category),
@@ -1312,10 +1461,10 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       }));
       const fingerprintHash = getDeviceFingerprintHash(deviceInfo);
       const report = {
-        id: (0, import_core3.newUuid)(),
+        id: (0, import_core5.newUuid)(),
         projectId: config.projectId,
         category: data.category,
-        description: data.description,
+        description: (0, import_core5.scrubPii)(data.description),
         environment: {
           userAgent: deviceInfo.systemName ?? "ReactNative",
           platform: deviceInfo.platform ?? "mobile",
@@ -1326,7 +1475,10 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           timezone: deviceInfo.timezone ?? "UTC"
         },
-        consoleLogs: consoleRef.current?.getEntries() ?? [],
+        consoleLogs: (consoleRef.current?.getEntries() ?? []).map((entry) => ({
+          ...entry,
+          message: (0, import_core5.scrubPii)(entry.message)
+        })),
         networkLogs: networkRef.current?.getEntries().map((entry) => ({
           ...entry,
           status: entry.status ?? 0
@@ -1347,6 +1499,13 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       if (!client) return;
       const result = await client.submitReport(report);
       if (!result.ok) {
+        const isCredentialError = result.error?.code === "HTTP_401" || result.error?.code === "HTTP_403" || result.error?.code?.includes("UNAUTHORIZED") || result.error?.code?.includes("FORBIDDEN");
+        if (isCredentialError) {
+          console.error(
+            '[Mushi] Credentials rejected. Check your projectId and apiKey (must have "report:write" scope). Get the correct values at: https://kensaur.us/mushi-mushi/admin/projects'
+          );
+          return;
+        }
         await queueRef.current?.enqueue(report);
         config.callbacks?.onReportQueued?.(report.id);
       } else {
@@ -1409,7 +1568,7 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       identifyWithToken(token) {
         userTokenRef.current = token && typeof token === "string" ? token : null;
         if (userTokenRef.current) {
-          const claims = (0, import_core3.parseIdentityToken)(userTokenRef.current);
+          const claims = (0, import_core5.parseIdentityToken)(userTokenRef.current);
           if (claims?.sub) {
             userRef.current = {
               id: claims.sub,
@@ -1532,7 +1691,8 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
         visible: sheetVisible,
         onClose: close,
         screenshotDataUrl: sheetScreenshot ?? void 0,
-        onClearScreenshot: () => setSheetScreenshot(null)
+        onClearScreenshot: () => setSheetScreenshot(null),
+        screenshotSensitiveHint: resolveScreenshotHint(config.widget?.screenshotSensitiveHint)
       }
     )
   ] });

package/dist/index.d.cts

@@ -66,6 +66,16 @@ interface MushiRNConfig {
             left?: number;
             right?: number;
         };
+        /**
+         * Privacy nudge shown beneath the attached-screenshot preview, reminding
+         * the reporter to remove anything sensitive (balances, PII) before sending.
+         * The sheet always shows the captured image as a preview the user can
+         * remove; this only controls the caption.
+         * - `true` (default) — show the default caption.
+         * - string — show this custom caption.
+         * - `false` — hide the caption (preview + remove still show).
+         */
+        screenshotSensitiveHint?: boolean | string;
     };
     capture?: {
         console?: boolean;
@@ -88,6 +98,8 @@ interface MushiRNConfig {
     storage?: {
         maxQueueSize?: number;
         retryIntervalMs?: number;
+        /** Encrypt offline queue + store reporter token in SecureStore when available. Default true. */
+        secureStorage?: boolean;
     };
     rewards?: MushiRewardsConfig;
 }
@@ -220,6 +232,11 @@ interface MushiBottomSheetProps {
     screenshotDataUrl?: string;
     /** Called when the user removes the attached screenshot. */
     onClearScreenshot?: () => void;
+    /**
+     * Privacy caption shown beneath the screenshot preview. `null` hides it.
+     * Resolved by the provider from `widget.screenshotSensitiveHint`.
+     */
+    screenshotSensitiveHint?: string | null;
 }
 declare const MushiBottomSheet: FC<MushiBottomSheetProps>;
 
@@ -283,22 +300,35 @@ declare function useNavigationCapture(navigationRef: {
     addListener?: (event: string, cb: () => void) => () => void;
 } | null): () => NavigationEntry[];
 
+interface AsyncStorageQueueConfig {
+    maxSize?: number;
+    apiEndpoint: string;
+    apiKey: string;
+    projectId: string;
+    sdkPackage?: string;
+    sdkVersion?: string;
+    getUserToken?: () => string | null | undefined;
+    /** When true (default), encrypt queue + store reporter token in SecureStore when available. */
+    secureStorage?: boolean;
+    /** Fired once per queued report that drains successfully to the server. */
+    onSynced?: (reportId: string) => void;
+}
 declare class AsyncStorageQueue {
     private maxSize;
     private apiEndpoint;
     private apiKey;
+    private projectId;
+    private sdkPackage?;
+    private sdkVersion?;
+    private getUserToken?;
+    private secureStorage;
     private onSynced?;
-    constructor(config: {
-        maxSize?: number;
-        apiEndpoint: string;
-        apiKey: string;
-        /** Fired once per queued report that drains successfully to the server. */
-        onSynced?: (reportId: string) => void;
-    });
+    constructor(config: AsyncStorageQueueConfig);
     enqueue(report: object): Promise<void>;
     flush(): Promise<number>;
     size(): Promise<number>;
     private scrubReportPii;
+    private persistQueue;
     private getQueue;
     private getAsyncStorage;
 }

package/dist/index.d.ts

@@ -66,6 +66,16 @@ interface MushiRNConfig {
             left?: number;
             right?: number;
         };
+        /**
+         * Privacy nudge shown beneath the attached-screenshot preview, reminding
+         * the reporter to remove anything sensitive (balances, PII) before sending.
+         * The sheet always shows the captured image as a preview the user can
+         * remove; this only controls the caption.
+         * - `true` (default) — show the default caption.
+         * - string — show this custom caption.
+         * - `false` — hide the caption (preview + remove still show).
+         */
+        screenshotSensitiveHint?: boolean | string;
     };
     capture?: {
         console?: boolean;
@@ -88,6 +98,8 @@ interface MushiRNConfig {
     storage?: {
         maxQueueSize?: number;
         retryIntervalMs?: number;
+        /** Encrypt offline queue + store reporter token in SecureStore when available. Default true. */
+        secureStorage?: boolean;
     };
     rewards?: MushiRewardsConfig;
 }
@@ -220,6 +232,11 @@ interface MushiBottomSheetProps {
     screenshotDataUrl?: string;
     /** Called when the user removes the attached screenshot. */
     onClearScreenshot?: () => void;
+    /**
+     * Privacy caption shown beneath the screenshot preview. `null` hides it.
+     * Resolved by the provider from `widget.screenshotSensitiveHint`.
+     */
+    screenshotSensitiveHint?: string | null;
 }
 declare const MushiBottomSheet: FC<MushiBottomSheetProps>;
 
@@ -283,22 +300,35 @@ declare function useNavigationCapture(navigationRef: {
     addListener?: (event: string, cb: () => void) => () => void;
 } | null): () => NavigationEntry[];
 
+interface AsyncStorageQueueConfig {
+    maxSize?: number;
+    apiEndpoint: string;
+    apiKey: string;
+    projectId: string;
+    sdkPackage?: string;
+    sdkVersion?: string;
+    getUserToken?: () => string | null | undefined;
+    /** When true (default), encrypt queue + store reporter token in SecureStore when available. */
+    secureStorage?: boolean;
+    /** Fired once per queued report that drains successfully to the server. */
+    onSynced?: (reportId: string) => void;
+}
 declare class AsyncStorageQueue {
     private maxSize;
     private apiEndpoint;
     private apiKey;
+    private projectId;
+    private sdkPackage?;
+    private sdkVersion?;
+    private getUserToken?;
+    private secureStorage;
     private onSynced?;
-    constructor(config: {
-        maxSize?: number;
-        apiEndpoint: string;
-        apiKey: string;
-        /** Fired once per queued report that drains successfully to the server. */
-        onSynced?: (reportId: string) => void;
-    });
+    constructor(config: AsyncStorageQueueConfig);
     enqueue(report: object): Promise<void>;
     flush(): Promise<number>;
     size(): Promise<number>;
     private scrubReportPii;
+    private persistQueue;
     private getQueue;
     private getAsyncStorage;
 }

package/dist/index.js

@@ -20,10 +20,12 @@ import {
   createBreadcrumbBuffer,
   DEFAULT_API_ENDPOINT,
   newUuid,
-  parseIdentityToken
+  parseIdentityToken,
+  scrubPii as scrubPii3
 } from "@mushi-mushi/core";
 
 // src/capture/console-capture.ts
+import { scrubPii } from "@mushi-mushi/core";
 function setupConsoleCapture(maxEntries = 100) {
   const entries = [];
   const methods = ["log", "warn", "error"];
@@ -34,7 +36,7 @@ function setupConsoleCapture(maxEntries = 100) {
     console[method] = (...args) => {
       entries.push({
         level: method,
-        message: args.map(String).join(" ").slice(0, 500),
+        message: scrubPii(args.map(String).join(" ").slice(0, 500)),
         timestamp: Date.now()
       });
       if (entries.length > maxEntries) entries.shift();
@@ -163,16 +165,158 @@ function getDeviceFingerprintHash(device) {
 }
 
 // src/storage/async-storage-queue.ts
-var QUEUE_KEY = "@mushi:offline_queue";
+import {
+  buildSdkIngestHeaders,
+  MUSHI_INTERNAL_INIT_MARKER,
+  scrubPii as scrubPii2
+} from "@mushi-mushi/core";
+
+// src/storage/secure-storage.ts
+var REPORTER_TOKEN_KEY = "@mushi:reporter_token";
+var QUEUE_CRYPTO_KEY = "@mushi:queue_aes_key";
+var LEGACY_QUEUE_KEY = "@mushi:offline_queue";
+var ENCRYPTED_QUEUE_KEY = "@mushi:offline_queue_enc";
+var ENCRYPTED_PREFIX = "mushi_enc_v1:";
+async function loadAsyncStorage() {
+  try {
+    const mod = await import("@react-native-async-storage/async-storage");
+    return mod.default;
+  } catch {
+    return null;
+  }
+}
+async function loadSecureStore() {
+  try {
+    const mod = await import("expo-secure-store");
+    return mod.default ?? mod;
+  } catch {
+    return null;
+  }
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  if (typeof btoa === "function") return btoa(binary);
+  const B = globalThis.Buffer;
+  if (B) return B.from(bytes).toString("base64");
+  return "";
+}
+function base64ToBytes(b64) {
+  if (typeof atob === "function") {
+    const binary = atob(b64);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+    return out;
+  }
+  const B = globalThis.Buffer;
+  if (B) return new Uint8Array(B.from(b64, "base64"));
+  return new Uint8Array();
+}
+function hasWebCrypto() {
+  return typeof globalThis.crypto?.subtle?.importKey === "function";
+}
+async function getOrCreateQueueKey(secure) {
+  if (!hasWebCrypto()) return null;
+  let rawB64 = await secure.getItemAsync(QUEUE_CRYPTO_KEY);
+  if (!rawB64) {
+    const raw2 = new Uint8Array(32);
+    globalThis.crypto.getRandomValues(raw2);
+    rawB64 = bytesToBase64(raw2);
+    await secure.setItemAsync(QUEUE_CRYPTO_KEY, rawB64);
+  }
+  const raw = base64ToBytes(rawB64);
+  return globalThis.crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+async function encryptQueueBlob(plaintext, secureStorage) {
+  if (!secureStorage) return plaintext;
+  const secure = await loadSecureStore();
+  if (!secure) return plaintext;
+  const key = await getOrCreateQueueKey(secure);
+  if (!key) return plaintext;
+  const iv = new Uint8Array(12);
+  globalThis.crypto.getRandomValues(iv);
+  const encoded = new TextEncoder().encode(plaintext);
+  const cipher = await globalThis.crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, encoded);
+  const combined = new Uint8Array(iv.length + cipher.byteLength);
+  combined.set(iv, 0);
+  combined.set(new Uint8Array(cipher), iv.length);
+  return ENCRYPTED_PREFIX + bytesToBase64(combined);
+}
+async function decryptQueueBlob(stored, secureStorage) {
+  if (!stored.startsWith(ENCRYPTED_PREFIX)) return stored;
+  if (!secureStorage) return stored;
+  const secure = await loadSecureStore();
+  if (!secure || !hasWebCrypto()) return stored;
+  const key = await getOrCreateQueueKey(secure);
+  if (!key) return stored;
+  const combined = base64ToBytes(stored.slice(ENCRYPTED_PREFIX.length));
+  if (combined.length < 13) return stored;
+  const iv = combined.slice(0, 12);
+  const cipher = combined.slice(12);
+  try {
+    const plain = await globalThis.crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, cipher);
+    return new TextDecoder().decode(plain);
+  } catch {
+    return stored;
+  }
+}
+async function loadReporterToken(secureStorage) {
+  if (secureStorage) {
+    const secure = await loadSecureStore();
+    if (secure) {
+      const fromSecure = await secure.getItemAsync(REPORTER_TOKEN_KEY);
+      if (fromSecure?.startsWith("mushi_")) return fromSecure;
+      const storage2 = await loadAsyncStorage();
+      if (storage2) {
+        const legacy = await storage2.getItem(REPORTER_TOKEN_KEY);
+        if (legacy?.startsWith("mushi_")) {
+          await secure.setItemAsync(REPORTER_TOKEN_KEY, legacy);
+          await storage2.removeItem(REPORTER_TOKEN_KEY);
+          return legacy;
+        }
+      }
+      return fromSecure;
+    }
+  }
+  const storage = await loadAsyncStorage();
+  if (!storage) return null;
+  return storage.getItem(REPORTER_TOKEN_KEY);
+}
+async function saveReporterToken(token, secureStorage) {
+  if (secureStorage) {
+    const secure = await loadSecureStore();
+    if (secure) {
+      await secure.setItemAsync(REPORTER_TOKEN_KEY, token);
+      const storage2 = await loadAsyncStorage();
+      if (storage2) await storage2.removeItem(REPORTER_TOKEN_KEY);
+      return;
+    }
+  }
+  const storage = await loadAsyncStorage();
+  if (storage) await storage.setItem(REPORTER_TOKEN_KEY, token);
+}
+
+// src/storage/async-storage-queue.ts
+var QUEUE_KEY = ENCRYPTED_QUEUE_KEY;
 var AsyncStorageQueue = class {
   maxSize;
   apiEndpoint;
   apiKey;
+  projectId;
+  sdkPackage;
+  sdkVersion;
+  getUserToken;
+  secureStorage;
   onSynced;
   constructor(config) {
     this.maxSize = config.maxSize ?? 50;
     this.apiEndpoint = config.apiEndpoint;
     this.apiKey = config.apiKey;
+    this.projectId = config.projectId;
+    this.sdkPackage = config.sdkPackage;
+    this.sdkVersion = config.sdkVersion;
+    this.getUserToken = config.getUserToken;
+    this.secureStorage = config.secureStorage !== false;
     this.onSynced = config.onSynced;
   }
   async enqueue(report) {
@@ -182,7 +326,7 @@ var AsyncStorageQueue = class {
     if (queue.length >= this.maxSize) queue.shift();
     const scrubbedReport = this.scrubReportPii(report);
     queue.push({ report: scrubbedReport, enqueuedAt: Date.now() });
-    await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue));
+    await this.persistQueue(AsyncStorage, queue);
   }
   async flush() {
     const AsyncStorage = await this.getAsyncStorage();
@@ -192,7 +336,14 @@ var AsyncStorageQueue = class {
     let flushed = 0;
     const remaining = [];
     for (const item of queue) {
-      const ok = await sendWithRetry(item, this.apiEndpoint, this.apiKey);
+      const ok = await sendWithRetry(item, {
+        apiEndpoint: this.apiEndpoint,
+        apiKey: this.apiKey,
+        projectId: this.projectId,
+        sdkPackage: this.sdkPackage,
+        sdkVersion: this.sdkVersion,
+        getUserToken: this.getUserToken
+      });
       if (ok) {
         flushed++;
         const reportId = item.report.id;
@@ -207,7 +358,7 @@ var AsyncStorageQueue = class {
         break;
       }
     }
-    await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(remaining));
+    await this.persistQueue(AsyncStorage, remaining);
     return flushed;
   }
   async size() {
@@ -216,31 +367,43 @@ var AsyncStorageQueue = class {
     const queue = await this.getQueue(AsyncStorage);
     return queue.length;
   }
-  // Added: PII scrubbing (Phase 2.4)
-  // Scrubs free-text fields where users typically type emails / phones /
-  // card numbers when describing a bug. We deliberately do NOT scrub
-  // structured fields like `metadata.userEmail` — those are explicitly
-  // captured by the host app via `setUser()` and the operator opts in to
-  // collecting them. Scrubbing them here would silently break attribution.
   scrubReportPii(report) {
     const next = { ...report };
     if (typeof next.description === "string") {
-      next.description = scrubPii(next.description);
+      next.description = scrubPii2(next.description);
     }
     if (typeof next.summary === "string") {
-      next.summary = scrubPii(next.summary);
+      next.summary = scrubPii2(next.summary);
     }
     if (Array.isArray(next.breadcrumbs)) {
       next.breadcrumbs = next.breadcrumbs.map(
-        (b) => typeof b?.message === "string" ? { ...b, message: scrubPii(b.message) } : b
+        (b) => typeof b?.message === "string" ? { ...b, message: scrubPii2(b.message) } : b
+      );
+    }
+    if (Array.isArray(next.consoleLogs)) {
+      next.consoleLogs = next.consoleLogs.map(
+        (entry) => typeof entry?.message === "string" ? { ...entry, message: scrubPii2(entry.message) } : entry
       );
     }
     return next;
   }
+  async persistQueue(storage, queue) {
+    const plaintext = JSON.stringify(queue);
+    const blob = await encryptQueueBlob(plaintext, this.secureStorage);
+    await storage.setItem(QUEUE_KEY, blob);
+  }
   async getQueue(storage) {
     try {
-      const raw = await storage.getItem(QUEUE_KEY);
-      return raw ? JSON.parse(raw) : [];
+      let raw = await storage.getItem(QUEUE_KEY);
+      if (!raw) {
+        raw = await storage.getItem(LEGACY_QUEUE_KEY);
+        if (raw) {
+          await storage.removeItem(LEGACY_QUEUE_KEY);
+        }
+      }
+      if (!raw) return [];
+      const plaintext = await decryptQueueBlob(raw, this.secureStorage);
+      return JSON.parse(plaintext);
     } catch {
       return [];
     }
@@ -254,56 +417,33 @@ var AsyncStorageQueue = class {
     }
   }
 };
-var SCRUB_PATTERNS = [
-  [/\b\d{3}-\d{2}-\d{4}\b/g, "[REDACTED_SSN]"],
-  [/\b(?:\d[ -]*){12,18}\d\b/g, "[REDACTED_CC]"],
-  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "[REDACTED_AWS_KEY]"],
-  [
-    /(?:aws_secret_access_key|secret_access_key)["'\s:=]+[A-Za-z0-9/+=]{40}\b/gi,
-    "aws_secret_access_key=[REDACTED_AWS_SECRET]"
-  ],
-  [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_KEY]"],
-  [/\bpk_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_PK]"],
-  [/\bxox[abpor]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED_SLACK_TOKEN]"],
-  [/\bghp_[A-Za-z0-9]{36}\b/g, "[REDACTED_GITHUB_PAT]"],
-  [/\bgithub_pat_[A-Za-z0-9_]{80,}\b/g, "[REDACTED_GITHUB_PAT]"],
-  [/\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_OPENAI_KEY]"],
-  [/\bsk-ant-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_ANTHROPIC_KEY]"],
-  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED_GOOGLE_KEY]"],
-  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED_JWT]"],
-  [/\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g, "[REDACTED_EMAIL]"],
-  [
-    /(?:\+\d{1,3}[\s.\-])?\(?\d{2,4}\)?[\s.\-]\d{3,4}[\s.\-]\d{3,4}\b/g,
-    "[REDACTED_PHONE]"
-  ]
-];
-function scrubPii(text) {
-  let result = text;
-  for (const [regex, replacement] of SCRUB_PATTERNS) {
-    result = result.replace(regex, replacement);
-  }
-  return result;
-}
-async function sendWithRetry(item, endpoint, apiKey, attempt = 0) {
+async function sendWithRetry(item, ctx, attempt = 0) {
   const delay = Math.min(1e3 * Math.pow(2, attempt) + Math.random() * 500, 1e4);
+  const internalKind = "report-submit";
+  const userToken = ctx.getUserToken?.() ?? null;
   try {
-    const res = await fetch(`${endpoint}/v1/reports`, {
+    const res = await fetch(`${ctx.apiEndpoint}/v1/reports`, {
       method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "X-Mushi-Api-Key": apiKey
-      },
-      body: JSON.stringify(item.report)
+      headers: buildSdkIngestHeaders({
+        apiKey: ctx.apiKey,
+        projectId: ctx.projectId,
+        sdkPackage: ctx.sdkPackage,
+        sdkVersion: ctx.sdkVersion,
+        userToken,
+        internalKind
+      }),
+      body: JSON.stringify(item.report),
+      [MUSHI_INTERNAL_INIT_MARKER]: internalKind
     });
     if ((res.status === 429 || res.status >= 500) && attempt < 3) {
       await sleep(delay);
-      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+      return sendWithRetry(item, ctx, attempt + 1);
     }
     return res.ok;
   } catch {
     if (attempt < 3) {
       await sleep(delay);
-      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+      return sendWithRetry(item, ctx, attempt + 1);
     }
     return false;
   }
@@ -358,7 +498,8 @@ var MushiBottomSheet = ({
   visible,
   onClose,
   screenshotDataUrl,
-  onClearScreenshot
+  onClearScreenshot,
+  screenshotSensitiveHint
 }) => {
   const mushi = useMushiContext();
   const scheme = useColorScheme();
@@ -650,7 +791,7 @@ var MushiBottomSheet = ({
                       ),
                       /* @__PURE__ */ jsxs(View, { style: s.screenshotMeta, children: [
                         /* @__PURE__ */ jsx(Text, { style: [s.screenshotLabel, { color: colors.text }], children: "Screenshot attached" }),
-                        /* @__PURE__ */ jsx(Text, { style: [s.screenshotSub, { color: colors.sub }], children: "Helps the team see the issue" })
+                        /* @__PURE__ */ jsx(Text, { style: [s.screenshotSub, { color: colors.sub }], children: screenshotSensitiveHint && screenshotSensitiveHint.trim() ? `\u26A0 ${screenshotSensitiveHint}` : "Helps the team see the issue" })
                       ] }),
                       /* @__PURE__ */ jsx(
                         TouchableOpacity,
@@ -1081,11 +1222,17 @@ var s2 = StyleSheet2.create({
 
 // src/version.ts
 var MUSHI_SDK_PACKAGE = "@mushi-mushi/react-native";
-var MUSHI_SDK_VERSION = "0.18.1" ? "0.18.1" : "0.17.0";
+var MUSHI_SDK_VERSION = "0.19.1" ? "0.19.1" : "0.17.0";
 
 // src/provider.tsx
 import { jsx as jsx3, jsxs as jsxs2 } from "react/jsx-runtime";
 var MushiContext = createContext(null);
+var DEFAULT_SCREENSHOT_HINT = "Check the preview \u2014 remove it if any private info (balances, personal details) is visible.";
+function resolveScreenshotHint(v) {
+  if (v === false) return null;
+  if (typeof v === "string") return v.trim() ? v : null;
+  return DEFAULT_SCREENSHOT_HINT;
+}
 function breadcrumbToTimelineKind(category) {
   switch (category) {
     case "navigation":
@@ -1167,6 +1314,11 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       maxSize: config.storage?.maxQueueSize,
       apiEndpoint,
       apiKey: config.apiKey,
+      projectId: config.projectId,
+      sdkPackage: MUSHI_SDK_PACKAGE,
+      sdkVersion: MUSHI_SDK_VERSION,
+      getUserToken: () => userTokenRef.current,
+      secureStorage: config.storage?.secureStorage,
       // `onReportSynced` fires here — when a previously-queued report actually
       // drains to the server — not on the direct-submit path (where it would be
       // indistinguishable from `onReportSubmitted` and thus meaningless).
@@ -1181,16 +1333,15 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       data: { sdk: MUSHI_SDK_PACKAGE, version: MUSHI_SDK_VERSION }
     });
     (async () => {
-      const TOKEN_KEY = "@mushi:reporter_token";
       try {
-        const AsyncStorage = (await import("@react-native-async-storage/async-storage")).default;
-        const existing = await AsyncStorage.getItem(TOKEN_KEY);
+        const secureStorage = config.storage?.secureStorage !== false;
+        const existing = await loadReporterToken(secureStorage);
         if (existing && existing.startsWith("mushi_")) {
           reporterTokenRef.current = existing;
         } else {
           const fresh = `mushi_${newUuid()}`;
           reporterTokenRef.current = fresh;
-          await AsyncStorage.setItem(TOKEN_KEY, fresh);
+          await saveReporterToken(fresh, secureStorage);
         }
         resolveReporterTokenReady();
       } catch {
@@ -1305,7 +1456,10 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       if (screenRef.current?.route) contextMeta.screenRoute = screenRef.current.route;
       if (screenRef.current?.feature) contextMeta.screenFeature = screenRef.current.feature;
       const merged = Object.keys(metadataRef.current).length > 0 ? { ...contextMeta, ...metadataRef.current } : Object.keys(contextMeta).length > 0 ? contextMeta : void 0;
-      const breadcrumbs = breadcrumbsRef.current.getAll();
+      const breadcrumbs = breadcrumbsRef.current.getAll().map((c) => ({
+        ...c,
+        message: scrubPii3(c.message)
+      }));
       const timeline = breadcrumbs.map((c) => ({
         ts: c.timestamp,
         kind: breadcrumbToTimelineKind(c.category),
@@ -1316,7 +1470,7 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
         id: newUuid(),
         projectId: config.projectId,
         category: data.category,
-        description: data.description,
+        description: scrubPii3(data.description),
         environment: {
           userAgent: deviceInfo.systemName ?? "ReactNative",
           platform: deviceInfo.platform ?? "mobile",
@@ -1327,7 +1481,10 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           timezone: deviceInfo.timezone ?? "UTC"
         },
-        consoleLogs: consoleRef.current?.getEntries() ?? [],
+        consoleLogs: (consoleRef.current?.getEntries() ?? []).map((entry) => ({
+          ...entry,
+          message: scrubPii3(entry.message)
+        })),
         networkLogs: networkRef.current?.getEntries().map((entry) => ({
           ...entry,
           status: entry.status ?? 0
@@ -1348,6 +1505,13 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
       if (!client) return;
       const result = await client.submitReport(report);
       if (!result.ok) {
+        const isCredentialError = result.error?.code === "HTTP_401" || result.error?.code === "HTTP_403" || result.error?.code?.includes("UNAUTHORIZED") || result.error?.code?.includes("FORBIDDEN");
+        if (isCredentialError) {
+          console.error(
+            '[Mushi] Credentials rejected. Check your projectId and apiKey (must have "report:write" scope). Get the correct values at: https://kensaur.us/mushi-mushi/admin/projects'
+          );
+          return;
+        }
         await queueRef.current?.enqueue(report);
         config.callbacks?.onReportQueued?.(report.id);
       } else {
@@ -1533,7 +1697,8 @@ function MushiProvider({ children, config: configProp, ...barePropConfig }) {
         visible: sheetVisible,
         onClose: close,
         screenshotDataUrl: sheetScreenshot ?? void 0,
-        onClearScreenshot: () => setSheetScreenshot(null)
+        onClearScreenshot: () => setSheetScreenshot(null),
+        screenshotSensitiveHint: resolveScreenshotHint(config.widget?.screenshotSensitiveHint)
       }
     )
   ] });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/react-native",
-  "version": "0.18.1",
+  "version": "0.19.1",
   "license": "MIT",
   "description": "React Native SDK for Mushi Mushi — shake-to-report, bottom sheet widget, full context capture",
   "main": "./dist/index.cjs",
@@ -11,6 +11,7 @@
     "@react-native-community/netinfo": ">=11",
     "@react-navigation/native": ">=6",
     "expo-sensors": ">=13",
+    "expo-secure-store": ">=13",
     "react": ">=18",
     "react-native": ">=0.72",
     "react-native-view-shot": ">=3.8"
@@ -25,6 +26,9 @@
     "expo-sensors": {
       "optional": true
     },
+    "expo-secure-store": {
+      "optional": true
+    },
     "@react-native-community/netinfo": {
       "optional": true
     },
@@ -33,7 +37,7 @@
     }
   },
   "dependencies": {
-    "@mushi-mushi/core": "^1.17.0"
+    "@mushi-mushi/core": "^1.19.1"
   },
   "devDependencies": {
     "@types/react": "^19.2.17",