@mushi-mushi/react-native 0.8.1 → 0.11.0

package/CONTRIBUTING.md

@@ -91,6 +91,33 @@ pnpm changeset
 
 Select the affected packages, the semver bump type, and write a summary. The changeset file gets committed with your PR.
 
+## Release flow
+
+Releases are fully automated. Maintainers don't run `npm publish` by hand.
+
+1. PRs land on `master` with one or more changeset files in `.changeset/`.
+2. `release.yml` runs on every push to `master`. It opens (or updates) a `chore: version packages` PR that bumps every affected `package.json`, rolls up the changelogs, and deletes the consumed changesets.
+3. Merging that "Version Packages" PR re-fires `release.yml`. The publish step authenticates to npm via **OpenID Connect (OIDC) Trusted Publishers** — no long-lived `NPM_TOKEN` is exchanged — and every tarball ships with a **Sigstore provenance attestation** uploaded to the public transparency log.
+
+If GitHub's anti-loop protection suppresses the auto re-fire (the squash merge can be attributed to `github-actions[bot]`), trigger the workflow manually: **Actions → release → Run workflow → master**.
+
+### Adding a brand-new publishable package
+
+Trusted Publisher bindings are configured **per package** on `npmjs.com` and require the package to already exist on the registry. New packages therefore need a one-time bootstrap before OIDC can take over.
+
+1. Add the package under `packages/<name>/` with a real `version`, `files`, `publishConfig.access: "public"`, `LICENSE`, and the standard fields enforced by `pnpm check:publish-readiness`.
+2. Build it locally: `pnpm install && pnpm -r build`.
+3. Mint a short-lived granular access token at `https://www.npmjs.com/settings/<your-user>/tokens/granular-access-tokens/new` — **Bypass 2FA: ON**, **Read and write: All packages**, **Expiration: 7 days**.
+4. Bootstrap-publish:
+   ```bash
+   NPM_TOKEN=npm_xxx pnpm bootstrap:new-package
+   ```
+   The script auto-detects which workspace packages are missing on npm and publishes them via `pnpm publish --no-provenance` (so `workspace:^` specifiers get rewritten to real semver in the tarball).
+5. The script prints one URL per freshly-published package. Open each, click **GitHub Actions** under "Trusted Publisher", confirm the auto-filled fields (`<owner>` / `<repo>` / `release.yml`), and tap your security key.
+6. Revoke the bootstrap token at `https://www.npmjs.com/settings/<your-user>/tokens`.
+
+From the next changeset bump onward, that package publishes through the normal `release.yml` flow with full OIDC provenance — same as the rest.
+
 ## Code Style
 
 - **TypeScript strict mode** — no `any` unless absolutely necessary

package/SECURITY.md

@@ -19,15 +19,59 @@ If you discover a security vulnerability, please report it responsibly.
 
 **Do NOT open a public GitHub issue.**
 
-Instead, email: **kensaurus@gmail.com**
+Use either channel below:
+
+1. **GitHub Private Vulnerability Reporting** — strongly preferred.
+   <https://github.com/kensaurus/mushi-mushi/security/advisories/new>
+   Routes the report into a private advisory with built-in CVE issuance,
+   patch coordination, and contributor-credit workflow.
+2. **Email** — `kensaurus@gmail.com`, subject prefix `[mushi-security]`.
+   PGP welcome but not required.
 
 Include:
 - Description of the vulnerability
-- Steps to reproduce
-- Impact assessment
+- Steps to reproduce (smallest reproducer wins)
+- Impact assessment (what an attacker gains)
 - Suggested fix (if any)
+- Whether you want public credit (and how to spell your name)
+
+### Coordinated-disclosure timeline
+
+| Day | Action |
+|-----|--------|
+| 0 | Report received |
+| ≤ 2 | Acknowledgment + assigned a tracking ID |
+| ≤ 7 | Triage complete: severity assigned (CVSS 3.1) and target patch date communicated |
+| ≤ 30 | Patch released for critical / high (CVSS ≥ 7.0); ≤ 60 days for medium; best-effort for low |
+| Patch + 7 | Public advisory + CVE published; reporter credited unless they declined |
+| Patch + 90 | Embargo expires regardless; if upstream is unresponsive, the reporter is free to publish |
+
+### Safe harbor
+
+Good-faith security research on Mushi Mushi is welcome. If you stay
+within the rules below, we will not pursue legal action, will not ask
+your hosting provider to take you offline, and will publicly credit your
+work:
+
+- Test only against your own self-hosted instance, the public demo at
+  <https://kensaur.us/mushi-mushi/admin/>, or accounts you own.
+- Do not access, exfiltrate, or modify data belonging to other users.
+- Do not run automated scanning that affects availability for others
+  (rate-limit your tooling, exclude `/health`).
+- Disclose privately first (channels above); do not publish before the
+  embargo above expires.
+- Do not intentionally exploit a finding to escalate beyond proving it
+  exists.
+
+If a finding requires touching production data to confirm, **stop and
+ask first** — describe what you'd need to do and we'll spin up a sandbox.
+
+### Hall of fame
 
-We will acknowledge receipt within 48 hours and aim to release a patch within 7 days for critical issues.
+Researchers who report a confirmed vulnerability are credited in the
+release notes for the patched version and added to
+[`docs/SECURITY_HALL_OF_FAME.md`](./docs/SECURITY_HALL_OF_FAME.md) (with
+permission).
 
 ## Scope
 
@@ -48,6 +92,125 @@ We will acknowledge receipt within 48 hours and aim to release a patch within 7
 - **Rotate API keys** regularly via the admin console
 - **Enable SSO** for team projects (Enterprise tier)
 - **Review audit logs** periodically for suspicious activity
+- **Verify SDK integrity** with `npm audit signatures` after install
+- **Set `Content-Security-Policy`** on any page embedding the Mushi widget;
+  the widget itself ships with `script-src 'self'` and does not load
+  remote scripts.
+
+## Threat model
+
+What we treat as in-scope attacker capabilities, and what we don't.
+
+| Capability | In scope | Notes |
+|-----------|----------|-------|
+| Unauthenticated network attacker hitting public endpoints | ✅ | Rate-limit + HMAC + replay protection on every webhook endpoint (`packages/server/supabase/functions/_shared/webhook-middleware.ts`). |
+| Authenticated user trying to read another tenant's data | ✅ | Postgres RLS on every `public.*` table; advisor lints reviewed monthly. |
+| Authenticated user trying to escalate to super-admin | ✅ | Role lives in `auth.users.raw_app_meta_data.role`; cannot be self-edited via PostgREST. |
+| Compromised dependency (npm supply-chain attack) | ✅ | 7-day cooldown + provenance + Harden-Runner + pinned SHAs (see "Supply-chain hardening" below). |
+| Stolen API key | ✅ | Per-key scopes (`api_key_has_scope`), revocation via admin console, audit log of every use. |
+| User pasting a Stripe / OpenAI / GitHub PAT into a bug report | ✅ | PII scrubber redacts ~15 vendor token formats client-side before the report leaves the device. Mirrors `packages/core/src/pii-scrubber.ts` across iOS, Android, Flutter, React Native. |
+| Stolen end-user device with the SDK installed | ⚠️ partial | Offline queue is AsyncStorage / Keychain / SharedPreferences — no app-level encryption beyond the OS default. Reports waiting to flush are vulnerable to a forensic attacker. |
+| Compromised Supabase service-role key | ❌ | Treated as a tier-0 incident; would require key rotation and audit-log forensics. Not defendable in software. |
+| Compromise of `kensaurus@gmail.com` | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
+| Physical / OS-level attacker on an end-user device | ❌ | Out of scope. |
+| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT/BSL grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
+
+## Data handling and PII
+
+### What the SDK collects by default
+
+| Field | Scope | PII risk |
+|-------|-------|----------|
+| URL / route the user was on | Always | Low — strip query strings if your routes encode user IDs. |
+| Browser / OS / device | Always | None |
+| Console errors (last 50) | Opt-in via `captureConsole: true` | Medium — can include user data your code logs. |
+| Network failures (URL + status) | Opt-in via `captureNetwork: true` | Medium — query params logged as-is unless you redact in-app. |
+| User id / email / role | Only if you call `setUser()` | High — only set what you need; we do not auto-discover. |
+| Session replay frames | Off by default | High — handled by the masking layer; passwords / cards / opted-out elements never leave the page. |
+| Free-text bug description | Always | Medium — passed through the PII scrubber (see below). |
+
+### What the PII scrubber redacts before send
+
+Implemented identically across `@mushi-mushi/core`, the iOS, Android,
+Flutter, and React Native SDKs. Defaults are below — every category can
+be toggled off, but `secretTokens` is on by default and we recommend
+keeping it that way.
+
+| Category | Default | Patterns |
+|----------|---------|----------|
+| `ssns` | on | `123-45-6789` |
+| `creditCards` | on | 12–19 digit Luhn-shaped sequences with optional separators |
+| `secretTokens` | on | AWS access key (`AKIA…` / `ASIA…`), AWS secret (`aws_secret_access_key=…`), Stripe (`sk_live_…`, `sk_test_…`, `rk_…`, `pk_…`), Slack (`xox[abpor]-…`), GitHub PAT (`ghp_…`, `github_pat_…`), OpenAI (`sk-…`, `sk-proj-…`), Anthropic (`sk-ant-…`), Google API (`AIza…`), JWT (`eyJ…` 3-segment) |
+| `emails` | on | RFC-5322 lite |
+| `phones` | on | E.164 with optional country code |
+| `ipAddresses` | off | IPv4 (off because internal IPs are usually not PII and noise hurts triage) |
+| `ipv6` | off | Same |
+
+The fields scrubbed are:
+
+- `description` — primary free-text field of every bug report
+- `summary` — short summary, in the same composer
+- `breadcrumbs[].message` — auto-captured user-action trail (clicks, route changes, console messages)
+
+Structured fields you set explicitly (`metadata.userEmail`,
+`metadata.userId`, etc.) are intentionally **not** scrubbed — those are
+opt-in attribution data, and silently rewriting them would break
+support workflows.
+
+### Where data lives
+
+- **Reports & telemetry** — Supabase Postgres in the `us-west-1` region.
+- **Session replays** — Supabase Storage, same region. Lifecycle policy
+  trims replays older than 30 days unless explicitly retained from the
+  admin console.
+- **Inbound webhook bodies** — only a SHA-256 hash + `delivery_id` of
+  the body is persisted (`webhook_audit_log`). The full body is
+  processed in memory and discarded.
+- **Outbound integrations** (Slack, Jira, …) — Mushi is a sender only;
+  the receiving system's retention applies.
+
+### Encryption
+
+| Surface | At rest | In transit |
+|---------|---------|------------|
+| Postgres (Supabase) | AES-256 (Supabase default) | TLS 1.2+ |
+| Supabase Storage (replays) | AES-256 | TLS 1.2+ |
+| Edge Function ↔ Postgres | — | TLS via the Supavisor pooler |
+| SDK ↔ ingest endpoint | — | TLS 1.2+ enforced; HSTS preload on `kensaur.us` |
+| Inbound webhooks | — | TLS terminated at CloudFront / Supabase edge |
+| Audit log integrity | append-only by RLS; no in-row signing | — |
+
+### Cryptographic primitives
+
+| Use | Algorithm | Implementation |
+|-----|-----------|---------------|
+| Webhook HMAC verification (Sentry, GitHub, Datadog, Honeycomb, Grafana, Bugsnag, Rollbar, Crashlytics) | HMAC-SHA256, constant-time compare | Web Crypto in Deno; `crypto.subtle.timingSafeEqual` analogue |
+| AWS SNS subscription confirmation | RSA-SHA1 / RSA-SHA256 | Deno `crypto.subtle.verify` with the cert from `SigningCertURL` (URL allow-listed to `*.sns.*.amazonaws.com`) |
+| Opsgenie JWT shared-token | HS256 with `aud` claim verification | `jose` (Deno-compatible) |
+| API-key hashing (database) | SHA-256 prefix + bcrypt secret half | `pgcrypto` |
+| Provenance attestations (npm) | Sigstore (Fulcio + Rekor) | `npm publish --provenance` |
+
+We deliberately do not roll our own crypto. If you find an algorithm or
+library above that has been deprecated, please file a security advisory.
+
+### Operator security checklist
+
+When you provision a new self-hosted Mushi instance:
+
+- [ ] Set `auth_leaked_password_protection = true` in Supabase Auth
+      (HaveIBeenPwned blocklist; flagged as `auth_leaked_password_protection`
+      in the security advisor).
+- [ ] Enable at least two MFA factors in Supabase Auth (`auth_insufficient_mfa_options`).
+- [ ] Rotate the service-role key on day 1, then quarterly.
+- [ ] Restrict Postgres direct connections to your CI / migration runners
+      via Supabase network restrictions.
+- [ ] Run `pnpm dlx supabase advisors --project-ref <ref>` after every
+      migration; aim for zero ERROR-level findings.
+- [ ] Configure a Supabase log drain to your SIEM if you are subject to
+      SOC 2 / ISO 27001.
+- [ ] Set CSP `frame-ancestors` on the host page if you embed the Mushi
+      widget (the widget is iframe-friendly but does not enforce
+      framing constraints itself).
 
 ## Supply-chain hardening (how this package is protected)
 

package/dist/index.cjs

@@ -34,6 +34,7 @@ __export(index_exports, {
   MushiBottomSheet: () => MushiBottomSheet,
   MushiFloatingButton: () => MushiFloatingButton,
   MushiProvider: () => MushiProvider,
+  MushiTrigger: () => MushiTrigger,
   getDeviceInfo: () => getDeviceInfo,
   setupConsoleCapture: () => setupConsoleCapture,
   setupNetworkCapture: () => setupNetworkCapture,
@@ -138,13 +139,28 @@ function stripQueryParams(url) {
 var import_react_native = require("react-native");
 function getDeviceInfo() {
   const { width, height } = import_react_native.Dimensions.get("window");
+  const locale = (
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    import_react_native.NativeModules.SettingsManager?.settings?.AppleLocale ?? // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    import_react_native.NativeModules.I18nManager?.localeIdentifier ?? "en"
+  );
+  let timezone = "UTC";
+  try {
+    timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+  } catch {
+  }
+  const appVersion = import_react_native.NativeModules.RNDeviceInfo?.appVersion ?? import_react_native.NativeModules.RNBuildConfig?.VERSION_NAME ?? String(import_react_native.Platform.Version);
   return {
     platform: import_react_native.Platform.OS,
     osVersion: import_react_native.Platform.Version,
     screenWidth: width,
     screenHeight: height,
     pixelRatio: import_react_native.PixelRatio.get(),
-    fontScale: import_react_native.PixelRatio.getFontScale()
+    fontScale: import_react_native.PixelRatio.getFontScale(),
+    systemName: import_react_native.Platform.OS,
+    locale,
+    timezone,
+    appVersion
   };
 }
 
@@ -164,7 +180,8 @@ var AsyncStorageQueue = class {
     if (!AsyncStorage) return;
     const queue = await this.getQueue(AsyncStorage);
     if (queue.length >= this.maxSize) queue.shift();
-    queue.push({ report, enqueuedAt: Date.now() });
+    const scrubbedReport = this.scrubReportPii(report);
+    queue.push({ report: scrubbedReport, enqueuedAt: Date.now() });
     await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue));
   }
   async flush() {
@@ -175,21 +192,10 @@ var AsyncStorageQueue = class {
     let flushed = 0;
     const remaining = [];
     for (const item of queue) {
-      try {
-        const res = await fetch(`${this.apiEndpoint}/v1/reports`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "X-Mushi-Api-Key": this.apiKey
-          },
-          body: JSON.stringify(item.report)
-        });
-        if (res.ok) {
-          flushed++;
-        } else {
-          remaining.push(item);
-        }
-      } catch {
+      const ok = await sendWithRetry(item, this.apiEndpoint, this.apiKey);
+      if (ok) {
+        flushed++;
+      } else {
         remaining.push(item);
         break;
       }
@@ -203,6 +209,27 @@ var AsyncStorageQueue = class {
     const queue = await this.getQueue(AsyncStorage);
     return queue.length;
   }
+  // Added: PII scrubbing (Phase 2.4)
+  // Scrubs free-text fields where users typically type emails / phones /
+  // card numbers when describing a bug. We deliberately do NOT scrub
+  // structured fields like `metadata.userEmail` — those are explicitly
+  // captured by the host app via `setUser()` and the operator opts in to
+  // collecting them. Scrubbing them here would silently break attribution.
+  scrubReportPii(report) {
+    const next = { ...report };
+    if (typeof next.description === "string") {
+      next.description = scrubPii(next.description);
+    }
+    if (typeof next.summary === "string") {
+      next.summary = scrubPii(next.summary);
+    }
+    if (Array.isArray(next.breadcrumbs)) {
+      next.breadcrumbs = next.breadcrumbs.map(
+        (b) => typeof b?.message === "string" ? { ...b, message: scrubPii(b.message) } : b
+      );
+    }
+    return next;
+  }
   async getQueue(storage) {
     try {
       const raw = await storage.getItem(QUEUE_KEY);
@@ -220,6 +247,63 @@ var AsyncStorageQueue = class {
     }
   }
 };
+var SCRUB_PATTERNS = [
+  [/\b\d{3}-\d{2}-\d{4}\b/g, "[REDACTED_SSN]"],
+  [/\b(?:\d[ -]*){12,18}\d\b/g, "[REDACTED_CC]"],
+  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "[REDACTED_AWS_KEY]"],
+  [
+    /(?:aws_secret_access_key|secret_access_key)["'\s:=]+[A-Za-z0-9/+=]{40}\b/gi,
+    "aws_secret_access_key=[REDACTED_AWS_SECRET]"
+  ],
+  [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_KEY]"],
+  [/\bpk_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_PK]"],
+  [/\bxox[abpor]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED_SLACK_TOKEN]"],
+  [/\bghp_[A-Za-z0-9]{36}\b/g, "[REDACTED_GITHUB_PAT]"],
+  [/\bgithub_pat_[A-Za-z0-9_]{80,}\b/g, "[REDACTED_GITHUB_PAT]"],
+  [/\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_OPENAI_KEY]"],
+  [/\bsk-ant-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_ANTHROPIC_KEY]"],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED_GOOGLE_KEY]"],
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED_JWT]"],
+  [/\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g, "[REDACTED_EMAIL]"],
+  [
+    /(?:\+\d{1,3}[\s.\-])?\(?\d{2,4}\)?[\s.\-]\d{3,4}[\s.\-]\d{3,4}\b/g,
+    "[REDACTED_PHONE]"
+  ]
+];
+function scrubPii(text) {
+  let result = text;
+  for (const [regex, replacement] of SCRUB_PATTERNS) {
+    result = result.replace(regex, replacement);
+  }
+  return result;
+}
+async function sendWithRetry(item, endpoint, apiKey, attempt = 0) {
+  const delay = Math.min(1e3 * Math.pow(2, attempt) + Math.random() * 500, 1e4);
+  try {
+    const res = await fetch(`${endpoint}/v1/reports`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Mushi-Api-Key": apiKey
+      },
+      body: JSON.stringify(item.report)
+    });
+    if ((res.status === 429 || res.status >= 500) && attempt < 3) {
+      await sleep(delay);
+      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+    }
+    return res.ok;
+  } catch {
+    if (attempt < 3) {
+      await sleep(delay);
+      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+    }
+    return false;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 
 // src/components/MushiBottomSheet.tsx
 var import_react = require("react");
@@ -599,6 +683,11 @@ function MushiProvider({ children, ...config }) {
   const queueRef = (0, import_react3.useRef)(null);
   const apiClientRef = (0, import_react3.useRef)(null);
   const [sheetVisible, setSheetVisible] = (0, import_react3.useState)(false);
+  if (config.endpoint !== void 0 && config.endpoint.trim() === "") {
+    throw new Error(
+      "[MushiProvider] endpoint is set to an empty string. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api, or omit it to use the cloud default."
+    );
+  }
   const apiEndpoint = config.endpoint ?? import_core.DEFAULT_API_ENDPOINT;
   (0, import_react3.useEffect)(() => {
     if (config.capture?.console !== false) {
@@ -624,6 +713,20 @@ function MushiProvider({ children, ...config }) {
       networkRef.current?.restore();
     };
   }, []);
+  (0, import_react3.useEffect)(() => {
+    let unsubscribe;
+    try {
+      const NetInfo = require("@react-native-community/netinfo").default;
+      unsubscribe = NetInfo.addEventListener((state) => {
+        if (state.isConnected && state.isInternetReachable) {
+          queueRef.current?.flush().catch(() => {
+          });
+        }
+      });
+    } catch {
+    }
+    return () => unsubscribe?.();
+  }, []);
   const open = (0, import_react3.useCallback)(() => setSheetVisible(true), []);
   const close = (0, import_react3.useCallback)(() => setSheetVisible(false), []);
   const attachTo = (0, import_react3.useCallback)(() => ({ onPress: open }), [open]);
@@ -634,20 +737,22 @@ function MushiProvider({ children, ...config }) {
     let cleanup;
     let lastShake = 0;
     const threshold = config.widget?.shakeThreshold ?? 2.7;
-    new Function("specifier", "return import(specifier)")("expo-sensors").then((mod) => {
-      if (disposed) return;
-      mod.Accelerometer.setUpdateInterval(120);
-      const sub = mod.Accelerometer.addListener((evt) => {
-        const g = Math.sqrt(evt.x * evt.x + evt.y * evt.y + evt.z * evt.z);
-        if (g < threshold) return;
-        const now = Date.now();
-        if (now - lastShake < 1e3) return;
-        lastShake = now;
-        open();
-      });
-      cleanup = () => sub.remove();
-    }).catch(() => {
-    });
+    try {
+      const mod = require("expo-sensors");
+      if (!disposed) {
+        mod.Accelerometer.setUpdateInterval(120);
+        const sub = mod.Accelerometer.addListener((evt) => {
+          const g = Math.sqrt(evt.x * evt.x + evt.y * evt.y + evt.z * evt.z);
+          if (g < threshold) return;
+          const now = Date.now();
+          if (now - lastShake < 1e3) return;
+          lastShake = now;
+          open();
+        });
+        cleanup = () => sub.remove();
+      }
+    } catch {
+    }
     return () => {
       disposed = true;
       cleanup?.();
@@ -688,6 +793,31 @@ function MushiProvider({ children, ...config }) {
     },
     [config.projectId, config.apiKey, apiEndpoint]
   );
+  const userRef = (0, import_react3.useRef)(null);
+  const metadataRef = (0, import_react3.useRef)({});
+  const screenRef = (0, import_react3.useRef)(null);
+  const activityQueueRef = (0, import_react3.useRef)([]);
+  const rewardsFlushRef = (0, import_react3.useRef)(null);
+  (0, import_react3.useEffect)(() => {
+    const rewards = config.rewards;
+    if (!rewards?.enabled || !rewards.trackActivity) return;
+    const flushMs = Math.max(3e4, rewards.flushIntervalMs ?? 3e5);
+    rewardsFlushRef.current = setInterval(async () => {
+      const userId = userRef.current?.id;
+      const client = apiClientRef.current;
+      if (!userId || !client || activityQueueRef.current.length === 0) return;
+      const batch = activityQueueRef.current.splice(0, 100);
+      await client.submitActivity(userId, batch, {
+        userTraits: userRef.current ?? void 0,
+        optedIn: true
+      }).catch(() => {
+        activityQueueRef.current.unshift(...batch.slice(0, 50));
+      });
+    }, flushMs);
+    return () => {
+      if (rewardsFlushRef.current) clearInterval(rewardsFlushRef.current);
+    };
+  }, [config.rewards?.enabled, config.rewards?.trackActivity, config.rewards?.flushIntervalMs]);
   const instance = (0, import_react3.useMemo)(
     () => ({
       open,
@@ -696,9 +826,50 @@ function MushiProvider({ children, ...config }) {
       submitReport,
       getDeviceInfo,
       getConsoleEntries: () => consoleRef.current?.getEntries() ?? [],
-      getNetworkEntries: () => networkRef.current?.getEntries() ?? []
+      getNetworkEntries: () => networkRef.current?.getEntries() ?? [],
+      // v0.10.0: new identity methods (these were causing workarounds in apps/mobile/src/native/mushi.ts)
+      identify(userId, traits) {
+        userRef.current = {
+          id: userId,
+          email: traits?.email,
+          name: traits?.name,
+          provider: traits?.provider
+        };
+      },
+      setMetadata(key, value) {
+        metadataRef.current[key] = value;
+      },
+      setScreen(screen) {
+        screenRef.current = screen;
+      },
+      // Rewards (P1)
+      recordActivity(action, metadata) {
+        if (!config.rewards?.enabled) return;
+        activityQueueRef.current.push({ action, metadata });
+      },
+      async getTier() {
+        const userId = userRef.current?.id;
+        const client = apiClientRef.current;
+        if (!userId || !client) return null;
+        const res = await client.getMyTier(userId);
+        return res.ok ? res.data : null;
+      },
+      async getReputation() {
+        const userId = userRef.current?.id;
+        const client = apiClientRef.current;
+        if (!userId || !client) return null;
+        const res = await client.getMyPoints(userId);
+        if (!res.ok) return null;
+        return {
+          totalPoints: res.data.total_points ?? 0,
+          points30d: res.data.points_30d ?? 0,
+          reputation: 1,
+          confirmedBugs: 0,
+          totalReports: 0
+        };
+      }
     }),
-    [open, close, attachTo, submitReport]
+    [open, close, attachTo, submitReport, config.rewards?.enabled]
   );
   const trigger = config.widget?.trigger ?? "button";
   const showFab = trigger === "button" || trigger === "both" || trigger === "auto" || trigger === "edge-tab";
@@ -748,11 +919,25 @@ function useMushiWidget() {
   };
 }
 
-// src/capture/navigation-capture.ts
+// src/components/MushiTrigger.tsx
 var import_react6 = require("react");
+function MushiTrigger({ children }) {
+  const mushi = useMushiContext();
+  if (!(0, import_react6.isValidElement)(children)) return children;
+  const originalOnPress = children.props.onPress;
+  return (0, import_react6.cloneElement)(children, {
+    onPress: () => {
+      originalOnPress?.();
+      mushi?.open();
+    }
+  });
+}
+
+// src/capture/navigation-capture.ts
+var import_react7 = require("react");
 function useNavigationCapture(navigationRef) {
-  const historyRef = (0, import_react6.useRef)([]);
-  (0, import_react6.useEffect)(() => {
+  const historyRef = (0, import_react7.useRef)([]);
+  (0, import_react7.useEffect)(() => {
     if (!navigationRef?.addListener || !navigationRef?.getCurrentRoute) return;
     const unsubscribe = navigationRef.addListener("state", () => {
       const route = navigationRef.getCurrentRoute?.();
@@ -771,6 +956,7 @@ function useNavigationCapture(navigationRef) {
   MushiBottomSheet,
   MushiFloatingButton,
   MushiProvider,
+  MushiTrigger,
   getDeviceInfo,
   setupConsoleCapture,
   setupNetworkCapture,

package/dist/index.d.cts

@@ -1,5 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { ReactNode, FC } from 'react';
+import * as react from 'react';
+import { ReactNode, FC, ReactElement } from 'react';
+import { MushiRewardsConfig, MushiTierResult, MushiReputationResult } from '@mushi-mushi/core';
 
 interface ConsoleEntry {
     level: 'log' | 'warn' | 'error';
@@ -36,6 +38,7 @@ interface DeviceInfo {
     systemName?: string;
     locale?: string;
     timezone?: string;
+    appVersion?: string;
 }
 declare function getDeviceInfo(): DeviceInfo;
 
@@ -64,6 +67,7 @@ interface MushiRNConfig {
         maxQueueSize?: number;
         retryIntervalMs?: number;
     };
+    rewards?: MushiRewardsConfig;
 }
 interface MushiRNInstance {
     open(): void;
@@ -78,6 +82,27 @@ interface MushiRNInstance {
     getDeviceInfo(): ReturnType<typeof getDeviceInfo>;
     getConsoleEntries(): ReturnType<ReturnType<typeof setupConsoleCapture>['getEntries']>;
     getNetworkEntries(): ReturnType<ReturnType<typeof setupNetworkCapture>['getEntries']>;
+    /** Set the current authenticated user. Equivalent to Mushi.identify() on web. */
+    identify(userId: string, traits?: {
+        email?: string;
+        name?: string;
+        provider?: string;
+        [k: string]: unknown;
+    }): void;
+    /** Attach arbitrary key/value metadata to subsequent reports. */
+    setMetadata(key: string, value: unknown): void;
+    /** Set the current screen context attached to subsequent reports. */
+    setScreen(screen: {
+        name: string;
+        route?: string;
+        feature?: string;
+    }): void;
+    /** Manually record a host-defined activity event. */
+    recordActivity(action: string, metadata?: Record<string, unknown>): void;
+    /** Returns the current user's tier. */
+    getTier(): Promise<MushiTierResult | null>;
+    /** Returns the current user's reputation + point totals. */
+    getReputation(): Promise<MushiReputationResult | null>;
 }
 declare function MushiProvider({ children, ...config }: MushiRNConfig & {
     children: ReactNode;
@@ -166,6 +191,20 @@ interface MushiFloatingButtonProps {
 }
 declare const MushiFloatingButton: FC<MushiFloatingButtonProps>;
 
+interface MushiTriggerProps {
+    /** A single React Native element that accepts `onPress`. */
+    children: ReactElement<{
+        onPress?: () => void;
+    }>;
+}
+/**
+ * Clones `children` and injects `onPress` → `mushi.open()`.
+ * The child is responsible for its own visual styling.
+ */
+declare function MushiTrigger({ children }: MushiTriggerProps): ReactElement<{
+    onPress?: () => void;
+}, string | react.JSXElementConstructor<any>>;
+
 interface NavigationEntry {
     screen: string;
     timestamp: number;
@@ -189,8 +228,9 @@ declare class AsyncStorageQueue {
     enqueue(report: object): Promise<void>;
     flush(): Promise<number>;
     size(): Promise<number>;
+    private scrubReportPii;
     private getQueue;
     private getAsyncStorage;
 }
 
-export { AsyncStorageQueue, type ConsoleEntry, type DeviceInfo, MushiBottomSheet, type MushiBottomSheetProps, MushiFloatingButton, type MushiFloatingButtonProps, MushiProvider, type MushiRNConfig, type MushiRNInstance, type NavigationEntry, type NetworkEntry, getDeviceInfo, setupConsoleCapture, setupNetworkCapture, useMushi, useMushiReport, useMushiWidget, useNavigationCapture };
+export { AsyncStorageQueue, type ConsoleEntry, type DeviceInfo, MushiBottomSheet, type MushiBottomSheetProps, MushiFloatingButton, type MushiFloatingButtonProps, MushiProvider, type MushiRNConfig, type MushiRNInstance, MushiTrigger, type MushiTriggerProps, type NavigationEntry, type NetworkEntry, getDeviceInfo, setupConsoleCapture, setupNetworkCapture, useMushi, useMushiReport, useMushiWidget, useNavigationCapture };

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { ReactNode, FC } from 'react';
+import * as react from 'react';
+import { ReactNode, FC, ReactElement } from 'react';
+import { MushiRewardsConfig, MushiTierResult, MushiReputationResult } from '@mushi-mushi/core';
 
 interface ConsoleEntry {
     level: 'log' | 'warn' | 'error';
@@ -36,6 +38,7 @@ interface DeviceInfo {
     systemName?: string;
     locale?: string;
     timezone?: string;
+    appVersion?: string;
 }
 declare function getDeviceInfo(): DeviceInfo;
 
@@ -64,6 +67,7 @@ interface MushiRNConfig {
         maxQueueSize?: number;
         retryIntervalMs?: number;
     };
+    rewards?: MushiRewardsConfig;
 }
 interface MushiRNInstance {
     open(): void;
@@ -78,6 +82,27 @@ interface MushiRNInstance {
     getDeviceInfo(): ReturnType<typeof getDeviceInfo>;
     getConsoleEntries(): ReturnType<ReturnType<typeof setupConsoleCapture>['getEntries']>;
     getNetworkEntries(): ReturnType<ReturnType<typeof setupNetworkCapture>['getEntries']>;
+    /** Set the current authenticated user. Equivalent to Mushi.identify() on web. */
+    identify(userId: string, traits?: {
+        email?: string;
+        name?: string;
+        provider?: string;
+        [k: string]: unknown;
+    }): void;
+    /** Attach arbitrary key/value metadata to subsequent reports. */
+    setMetadata(key: string, value: unknown): void;
+    /** Set the current screen context attached to subsequent reports. */
+    setScreen(screen: {
+        name: string;
+        route?: string;
+        feature?: string;
+    }): void;
+    /** Manually record a host-defined activity event. */
+    recordActivity(action: string, metadata?: Record<string, unknown>): void;
+    /** Returns the current user's tier. */
+    getTier(): Promise<MushiTierResult | null>;
+    /** Returns the current user's reputation + point totals. */
+    getReputation(): Promise<MushiReputationResult | null>;
 }
 declare function MushiProvider({ children, ...config }: MushiRNConfig & {
     children: ReactNode;
@@ -166,6 +191,20 @@ interface MushiFloatingButtonProps {
 }
 declare const MushiFloatingButton: FC<MushiFloatingButtonProps>;
 
+interface MushiTriggerProps {
+    /** A single React Native element that accepts `onPress`. */
+    children: ReactElement<{
+        onPress?: () => void;
+    }>;
+}
+/**
+ * Clones `children` and injects `onPress` → `mushi.open()`.
+ * The child is responsible for its own visual styling.
+ */
+declare function MushiTrigger({ children }: MushiTriggerProps): ReactElement<{
+    onPress?: () => void;
+}, string | react.JSXElementConstructor<any>>;
+
 interface NavigationEntry {
     screen: string;
     timestamp: number;
@@ -189,8 +228,9 @@ declare class AsyncStorageQueue {
     enqueue(report: object): Promise<void>;
     flush(): Promise<number>;
     size(): Promise<number>;
+    private scrubReportPii;
     private getQueue;
     private getAsyncStorage;
 }
 
-export { AsyncStorageQueue, type ConsoleEntry, type DeviceInfo, MushiBottomSheet, type MushiBottomSheetProps, MushiFloatingButton, type MushiFloatingButtonProps, MushiProvider, type MushiRNConfig, type MushiRNInstance, type NavigationEntry, type NetworkEntry, getDeviceInfo, setupConsoleCapture, setupNetworkCapture, useMushi, useMushiReport, useMushiWidget, useNavigationCapture };
+export { AsyncStorageQueue, type ConsoleEntry, type DeviceInfo, MushiBottomSheet, type MushiBottomSheetProps, MushiFloatingButton, type MushiFloatingButtonProps, MushiProvider, type MushiRNConfig, type MushiRNInstance, MushiTrigger, type MushiTriggerProps, type NavigationEntry, type NetworkEntry, getDeviceInfo, setupConsoleCapture, setupNetworkCapture, useMushi, useMushiReport, useMushiWidget, useNavigationCapture };

package/dist/index.js

@@ -1,3 +1,10 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
 // src/provider.tsx
 import {
   createContext,
@@ -8,7 +15,10 @@ import {
   useCallback as useCallback3,
   useMemo
 } from "react";
-import { createApiClient, DEFAULT_API_ENDPOINT } from "@mushi-mushi/core";
+import {
+  createApiClient,
+  DEFAULT_API_ENDPOINT
+} from "@mushi-mushi/core";
 
 // src/capture/console-capture.ts
 function setupConsoleCapture(maxEntries = 100) {
@@ -97,16 +107,31 @@ function stripQueryParams(url) {
 }
 
 // src/capture/device-info.ts
-import { Platform, Dimensions, PixelRatio } from "react-native";
+import { Platform, Dimensions, PixelRatio, NativeModules } from "react-native";
 function getDeviceInfo() {
   const { width, height } = Dimensions.get("window");
+  const locale = (
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    NativeModules.SettingsManager?.settings?.AppleLocale ?? // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    NativeModules.I18nManager?.localeIdentifier ?? "en"
+  );
+  let timezone = "UTC";
+  try {
+    timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+  } catch {
+  }
+  const appVersion = NativeModules.RNDeviceInfo?.appVersion ?? NativeModules.RNBuildConfig?.VERSION_NAME ?? String(Platform.Version);
   return {
     platform: Platform.OS,
     osVersion: Platform.Version,
     screenWidth: width,
     screenHeight: height,
     pixelRatio: PixelRatio.get(),
-    fontScale: PixelRatio.getFontScale()
+    fontScale: PixelRatio.getFontScale(),
+    systemName: Platform.OS,
+    locale,
+    timezone,
+    appVersion
   };
 }
 
@@ -126,7 +151,8 @@ var AsyncStorageQueue = class {
     if (!AsyncStorage) return;
     const queue = await this.getQueue(AsyncStorage);
     if (queue.length >= this.maxSize) queue.shift();
-    queue.push({ report, enqueuedAt: Date.now() });
+    const scrubbedReport = this.scrubReportPii(report);
+    queue.push({ report: scrubbedReport, enqueuedAt: Date.now() });
     await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue));
   }
   async flush() {
@@ -137,21 +163,10 @@ var AsyncStorageQueue = class {
     let flushed = 0;
     const remaining = [];
     for (const item of queue) {
-      try {
-        const res = await fetch(`${this.apiEndpoint}/v1/reports`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "X-Mushi-Api-Key": this.apiKey
-          },
-          body: JSON.stringify(item.report)
-        });
-        if (res.ok) {
-          flushed++;
-        } else {
-          remaining.push(item);
-        }
-      } catch {
+      const ok = await sendWithRetry(item, this.apiEndpoint, this.apiKey);
+      if (ok) {
+        flushed++;
+      } else {
         remaining.push(item);
         break;
       }
@@ -165,6 +180,27 @@ var AsyncStorageQueue = class {
     const queue = await this.getQueue(AsyncStorage);
     return queue.length;
   }
+  // Added: PII scrubbing (Phase 2.4)
+  // Scrubs free-text fields where users typically type emails / phones /
+  // card numbers when describing a bug. We deliberately do NOT scrub
+  // structured fields like `metadata.userEmail` — those are explicitly
+  // captured by the host app via `setUser()` and the operator opts in to
+  // collecting them. Scrubbing them here would silently break attribution.
+  scrubReportPii(report) {
+    const next = { ...report };
+    if (typeof next.description === "string") {
+      next.description = scrubPii(next.description);
+    }
+    if (typeof next.summary === "string") {
+      next.summary = scrubPii(next.summary);
+    }
+    if (Array.isArray(next.breadcrumbs)) {
+      next.breadcrumbs = next.breadcrumbs.map(
+        (b) => typeof b?.message === "string" ? { ...b, message: scrubPii(b.message) } : b
+      );
+    }
+    return next;
+  }
   async getQueue(storage) {
     try {
       const raw = await storage.getItem(QUEUE_KEY);
@@ -182,6 +218,63 @@ var AsyncStorageQueue = class {
     }
   }
 };
+var SCRUB_PATTERNS = [
+  [/\b\d{3}-\d{2}-\d{4}\b/g, "[REDACTED_SSN]"],
+  [/\b(?:\d[ -]*){12,18}\d\b/g, "[REDACTED_CC]"],
+  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "[REDACTED_AWS_KEY]"],
+  [
+    /(?:aws_secret_access_key|secret_access_key)["'\s:=]+[A-Za-z0-9/+=]{40}\b/gi,
+    "aws_secret_access_key=[REDACTED_AWS_SECRET]"
+  ],
+  [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_KEY]"],
+  [/\bpk_(?:live|test)_[A-Za-z0-9]{24,}\b/g, "[REDACTED_STRIPE_PK]"],
+  [/\bxox[abpor]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED_SLACK_TOKEN]"],
+  [/\bghp_[A-Za-z0-9]{36}\b/g, "[REDACTED_GITHUB_PAT]"],
+  [/\bgithub_pat_[A-Za-z0-9_]{80,}\b/g, "[REDACTED_GITHUB_PAT]"],
+  [/\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_OPENAI_KEY]"],
+  [/\bsk-ant-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED_ANTHROPIC_KEY]"],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED_GOOGLE_KEY]"],
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED_JWT]"],
+  [/\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g, "[REDACTED_EMAIL]"],
+  [
+    /(?:\+\d{1,3}[\s.\-])?\(?\d{2,4}\)?[\s.\-]\d{3,4}[\s.\-]\d{3,4}\b/g,
+    "[REDACTED_PHONE]"
+  ]
+];
+function scrubPii(text) {
+  let result = text;
+  for (const [regex, replacement] of SCRUB_PATTERNS) {
+    result = result.replace(regex, replacement);
+  }
+  return result;
+}
+async function sendWithRetry(item, endpoint, apiKey, attempt = 0) {
+  const delay = Math.min(1e3 * Math.pow(2, attempt) + Math.random() * 500, 1e4);
+  try {
+    const res = await fetch(`${endpoint}/v1/reports`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Mushi-Api-Key": apiKey
+      },
+      body: JSON.stringify(item.report)
+    });
+    if ((res.status === 429 || res.status >= 500) && attempt < 3) {
+      await sleep(delay);
+      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+    }
+    return res.ok;
+  } catch {
+    if (attempt < 3) {
+      await sleep(delay);
+      return sendWithRetry(item, endpoint, apiKey, attempt + 1);
+    }
+    return false;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 
 // src/components/MushiBottomSheet.tsx
 import {
@@ -585,6 +678,11 @@ function MushiProvider({ children, ...config }) {
   const queueRef = useRef3(null);
   const apiClientRef = useRef3(null);
   const [sheetVisible, setSheetVisible] = useState2(false);
+  if (config.endpoint !== void 0 && config.endpoint.trim() === "") {
+    throw new Error(
+      "[MushiProvider] endpoint is set to an empty string. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api, or omit it to use the cloud default."
+    );
+  }
   const apiEndpoint = config.endpoint ?? DEFAULT_API_ENDPOINT;
   useEffect2(() => {
     if (config.capture?.console !== false) {
@@ -610,6 +708,20 @@ function MushiProvider({ children, ...config }) {
       networkRef.current?.restore();
     };
   }, []);
+  useEffect2(() => {
+    let unsubscribe;
+    try {
+      const NetInfo = __require("@react-native-community/netinfo").default;
+      unsubscribe = NetInfo.addEventListener((state) => {
+        if (state.isConnected && state.isInternetReachable) {
+          queueRef.current?.flush().catch(() => {
+          });
+        }
+      });
+    } catch {
+    }
+    return () => unsubscribe?.();
+  }, []);
   const open = useCallback3(() => setSheetVisible(true), []);
   const close = useCallback3(() => setSheetVisible(false), []);
   const attachTo = useCallback3(() => ({ onPress: open }), [open]);
@@ -620,20 +732,22 @@ function MushiProvider({ children, ...config }) {
     let cleanup;
     let lastShake = 0;
     const threshold = config.widget?.shakeThreshold ?? 2.7;
-    new Function("specifier", "return import(specifier)")("expo-sensors").then((mod) => {
-      if (disposed) return;
-      mod.Accelerometer.setUpdateInterval(120);
-      const sub = mod.Accelerometer.addListener((evt) => {
-        const g = Math.sqrt(evt.x * evt.x + evt.y * evt.y + evt.z * evt.z);
-        if (g < threshold) return;
-        const now = Date.now();
-        if (now - lastShake < 1e3) return;
-        lastShake = now;
-        open();
-      });
-      cleanup = () => sub.remove();
-    }).catch(() => {
-    });
+    try {
+      const mod = __require("expo-sensors");
+      if (!disposed) {
+        mod.Accelerometer.setUpdateInterval(120);
+        const sub = mod.Accelerometer.addListener((evt) => {
+          const g = Math.sqrt(evt.x * evt.x + evt.y * evt.y + evt.z * evt.z);
+          if (g < threshold) return;
+          const now = Date.now();
+          if (now - lastShake < 1e3) return;
+          lastShake = now;
+          open();
+        });
+        cleanup = () => sub.remove();
+      }
+    } catch {
+    }
     return () => {
       disposed = true;
       cleanup?.();
@@ -674,6 +788,31 @@ function MushiProvider({ children, ...config }) {
     },
     [config.projectId, config.apiKey, apiEndpoint]
   );
+  const userRef = useRef3(null);
+  const metadataRef = useRef3({});
+  const screenRef = useRef3(null);
+  const activityQueueRef = useRef3([]);
+  const rewardsFlushRef = useRef3(null);
+  useEffect2(() => {
+    const rewards = config.rewards;
+    if (!rewards?.enabled || !rewards.trackActivity) return;
+    const flushMs = Math.max(3e4, rewards.flushIntervalMs ?? 3e5);
+    rewardsFlushRef.current = setInterval(async () => {
+      const userId = userRef.current?.id;
+      const client = apiClientRef.current;
+      if (!userId || !client || activityQueueRef.current.length === 0) return;
+      const batch = activityQueueRef.current.splice(0, 100);
+      await client.submitActivity(userId, batch, {
+        userTraits: userRef.current ?? void 0,
+        optedIn: true
+      }).catch(() => {
+        activityQueueRef.current.unshift(...batch.slice(0, 50));
+      });
+    }, flushMs);
+    return () => {
+      if (rewardsFlushRef.current) clearInterval(rewardsFlushRef.current);
+    };
+  }, [config.rewards?.enabled, config.rewards?.trackActivity, config.rewards?.flushIntervalMs]);
   const instance = useMemo(
     () => ({
       open,
@@ -682,9 +821,50 @@ function MushiProvider({ children, ...config }) {
       submitReport,
       getDeviceInfo,
       getConsoleEntries: () => consoleRef.current?.getEntries() ?? [],
-      getNetworkEntries: () => networkRef.current?.getEntries() ?? []
+      getNetworkEntries: () => networkRef.current?.getEntries() ?? [],
+      // v0.10.0: new identity methods (these were causing workarounds in apps/mobile/src/native/mushi.ts)
+      identify(userId, traits) {
+        userRef.current = {
+          id: userId,
+          email: traits?.email,
+          name: traits?.name,
+          provider: traits?.provider
+        };
+      },
+      setMetadata(key, value) {
+        metadataRef.current[key] = value;
+      },
+      setScreen(screen) {
+        screenRef.current = screen;
+      },
+      // Rewards (P1)
+      recordActivity(action, metadata) {
+        if (!config.rewards?.enabled) return;
+        activityQueueRef.current.push({ action, metadata });
+      },
+      async getTier() {
+        const userId = userRef.current?.id;
+        const client = apiClientRef.current;
+        if (!userId || !client) return null;
+        const res = await client.getMyTier(userId);
+        return res.ok ? res.data : null;
+      },
+      async getReputation() {
+        const userId = userRef.current?.id;
+        const client = apiClientRef.current;
+        if (!userId || !client) return null;
+        const res = await client.getMyPoints(userId);
+        if (!res.ok) return null;
+        return {
+          totalPoints: res.data.total_points ?? 0,
+          points30d: res.data.points_30d ?? 0,
+          reputation: 1,
+          confirmedBugs: 0,
+          totalReports: 0
+        };
+      }
     }),
-    [open, close, attachTo, submitReport]
+    [open, close, attachTo, submitReport, config.rewards?.enabled]
   );
   const trigger = config.widget?.trigger ?? "button";
   const showFab = trigger === "button" || trigger === "both" || trigger === "auto" || trigger === "edge-tab";
@@ -734,6 +914,20 @@ function useMushiWidget() {
   };
 }
 
+// src/components/MushiTrigger.tsx
+import { cloneElement, isValidElement } from "react";
+function MushiTrigger({ children }) {
+  const mushi = useMushiContext();
+  if (!isValidElement(children)) return children;
+  const originalOnPress = children.props.onPress;
+  return cloneElement(children, {
+    onPress: () => {
+      originalOnPress?.();
+      mushi?.open();
+    }
+  });
+}
+
 // src/capture/navigation-capture.ts
 import { useEffect as useEffect3, useRef as useRef4 } from "react";
 function useNavigationCapture(navigationRef) {
@@ -756,6 +950,7 @@ export {
   MushiBottomSheet,
   MushiFloatingButton,
   MushiProvider,
+  MushiTrigger,
   getDeviceInfo,
   setupConsoleCapture,
   setupNetworkCapture,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/react-native",
-  "version": "0.8.1",
+  "version": "0.11.0",
   "license": "MIT",
   "description": "React Native SDK for Mushi Mushi — shake-to-report, bottom sheet widget, full context capture",
   "main": "./dist/index.js",
@@ -8,6 +8,7 @@
   "types": "./dist/index.d.ts",
   "peerDependencies": {
     "@react-native-async-storage/async-storage": ">=1.19",
+    "@react-native-community/netinfo": ">=11",
     "@react-navigation/native": ">=6",
     "expo-sensors": ">=13",
     "react": ">=18",
@@ -22,18 +23,21 @@
     },
     "expo-sensors": {
       "optional": true
+    },
+    "@react-native-community/netinfo": {
+      "optional": true
     }
   },
   "dependencies": {
-    "@mushi-mushi/core": "^0.9.0"
+    "@mushi-mushi/core": "^1.1.0"
   },
   "devDependencies": {
-    "@types/react": "^19.1.4",
-    "react": "^19.1.0",
-    "react-native": "^0.79.0",
+    "@types/react": "^19.2.14",
+    "react": "^19.2.5",
+    "react-native": "^0.79.7",
     "tsup": "^8.5.1",
-    "typescript": "^6.0.2",
-    "vitest": "^4.1.4"
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.5"
   },
   "author": "Kenji Sakuramoto",
   "repository": {