@coralogix/react-native-plugin 0.10.1 → 0.11.0

package/index.esm.js

@@ -1,4 +1,4 @@
-import { AppState, Platform, NativeModules, NativeEventEmitter, findNodeHandle } from 'react-native';
+import { findNodeHandle, AppState, Platform, NativeModules, View, NativeEventEmitter } from 'react-native';
 import React from 'react';
 import { InstrumentationBase, registerInstrumentations } from '@opentelemetry/instrumentation';
 import { FetchInstrumentation } from '@opentelemetry/instrumentation-fetch';
@@ -14,6 +14,15 @@ function _extends() {
     return n;
   }, _extends.apply(null, arguments);
 }
+function _objectWithoutPropertiesLoose(r, e) {
+  if (null == r) return {};
+  var t = {};
+  for (var n in r) if ({}.hasOwnProperty.call(r, n)) {
+    if (-1 !== e.indexOf(n)) continue;
+    t[n] = r[n];
+  }
+  return t;
+}
 
 let CoralogixEventType = /*#__PURE__*/function (CoralogixEventType) {
   CoralogixEventType["ERROR"] = "error";
@@ -37,6 +46,16 @@ let CoralogixLogSeverity = /*#__PURE__*/function (CoralogixLogSeverity) {
   return CoralogixLogSeverity;
 }({});
 
+/**
+ * `interaction_context` as it appears on a user-interaction RUM event — the
+ * shape `beforeSend` receives. Built natively (field names differ from the
+ * {@link InteractionContext} payload JS hands to the bridge).
+ *
+ * Intentionally editable in `beforeSend` (except `is_masked_element`): a
+ * callback may blank the coordinates in `attributes`, redact text fields, or
+ * drop the whole event to enforce a masking policy stricter than the default.
+ */
+
 /** Versions of the plugin and the underlying native SDK that produced an event. */
 
 /**
@@ -72,11 +91,30 @@ let CoralogixLogSeverity = /*#__PURE__*/function (CoralogixLogSeverity) {
 
 /** OTLP JSON-format trace data delivered to the `tracesExporter` callback. */
 
+/**
+ * Interaction payload JS hands to the native bridge.
+ *
+ * Masking is resolved from three sources whose knowledge is unioned:
+ * `is_masked` below, when JS can see the answer in the component tree;
+ * {@link InteractionContext.view_tag}, which lets the plugin's native module
+ * walk the tapped control's own view tree for a `maskView` mark; and finally
+ * the tap coordinates in `attributes`, tested by the SDK against the frame's
+ * mask geometry.
+ *
+ * Scroll and swipe carry no coordinates, so the third source cannot answer for
+ * them — but they do carry `view_tag`, so a scroll inside a masked container
+ * resolves through the second and reports
+ * `interaction_context.is_masked_element: true`.
+ */
+
 const ERROR_INSTRUMENTATION_NAME = 'errors';
 const ERROR_INSTRUMENTATION_VERSION = '1';
 
-let defaultConsoleError = (..._params) => {};
 const MESSAGE_LIMIT = 1024;
+
+// The `console.error` handler installed by this module, so a repeated `enable()` can tell
+// our own handler apart from anyone else's and leave it in place.
+let installedConsoleError;
 const getCircularReplacer = () => {
   const seen = new WeakSet();
   return (_key, value) => {
@@ -99,11 +137,29 @@ class CoralogixErrorInstrumentation extends InstrumentationBase {
   }
   init() {}
   listenToConsoleError() {
+    // `enable()` runs from the InstrumentationBase constructor, so every `CoralogixRum.init()`
+    // reaching instrumentation registration wraps `console.error` again — including a second
+    // init that slipped through while the first was still starting up. Nothing to do if the
+    // handler currently installed is already ours.
+    // `installedConsoleError` is undefined until we install one, so it has to be checked
+    // separately: a host whose `console.error` is undefined would otherwise match it and
+    // leave console errors uninstrumented.
+    if (installedConsoleError && console.error === installedConsoleError) {
+      return;
+    }
+
+    // Held by this wrapper alone rather than in module state, so the handler it forwards to
+    // can never be reassigned to the wrapper itself. That self-reference is what turned a
+    // repeated init into unbounded recursion and killed the app on the next `console.error`
+    // with a RangeError ("Maximum call stack size exceeded") inside `onConsoleError`.
+    // Falls back to a no-op so a host without a callable `console.error` still gets its
+    // errors reported rather than a TypeError from the forward.
+    const previousConsoleError = typeof console.error === 'function' ? console.error : () => undefined;
     const onConsoleError = (...params) => {
-      defaultConsoleError.apply(console, params);
+      previousConsoleError.apply(console, params);
       this.report(params, false);
     };
-    defaultConsoleError = console.error;
+    installedConsoleError = onConsoleError;
     console.error = onConsoleError;
   }
   report(arg, isFatal) {
@@ -186,11 +242,130 @@ const USER_INTERACTION_INSTRUMENTATION_VERSION = '1';
 // If onMomentumScrollBegin fires within this window, it's a swipe instead.
 const SWIPE_MOMENTUM_TIMEOUT_MS = 80;
 
+// Replacement for the visible text of a masked element. Must stay byte-identical
+// to the sentinel both native SDKs use for the same field, so a masked
+// interaction reads the same whether JS or native resolved the masking.
+const MASKED_INNER_TEXT = '***';
+
 // Drag speed (px/ms) below which a gesture is classified as a deliberate scroll.
 // Computed from position delta and elapsed time in onScrollEndDrag; works on all platforms.
 // ~0.5 px/ms ≈ 300px in 600ms (slow deliberate drag); a fling is typically >1 px/ms.
 const SWIPE_VELOCITY_THRESHOLD = 0.5;
 
+var _ref, _ref$MASKED_CONTEXT_K, _ref2, _ref2$MASK_SCOPE_CONT;
+
+/**
+ * Brands a component type as the `Masked` wrapper.
+ *
+ * Keyed on a `Symbol.for` rather than element identity (`type === Masked`) so
+ * recognition survives a consuming app resolving two copies of the plugin: the
+ * symbol comes from the global registry, so a `Masked` rendered by one copy is
+ * still recognized by the instrumentation of another.
+ */
+const MASKED_COMPONENT_MARKER = Symbol.for('coralogix.masking.masked');
+const MASKED_CONTEXT_KEY = Symbol.for('coralogix.masking.context');
+
+/**
+ * True anywhere inside a `Masked` subtree.
+ *
+ * Read it with `MaskedContext.Consumer`, never `useContext`: the plugin's React
+ * and the renderer's React are different instances in a consuming app, and hooks
+ * resolve through the instance-specific ReactCurrentDispatcher. Non-hook APIs
+ * (`createContext`, `forwardRef`, `createElement`) are safe under that
+ * constraint — the same one the user-interaction wrappers already work under.
+ *
+ * Cached on the global registry rather than created per module, for the same
+ * reason {@link MASKED_COMPONENT_MARKER} is a `Symbol.for`: an app that resolves
+ * two copies of the plugin would otherwise get two distinct context objects, and
+ * a `Consumer` from one copy reads its own default `false` no matter what a
+ * `Masked` from the other copy provided. That fails open — masking dropped and
+ * the real text reported — so the two copies have to share one object.
+ */
+const MaskedContext = (_ref$MASKED_CONTEXT_K = (_ref = globalThis)[MASKED_CONTEXT_KEY]) != null ? _ref$MASKED_CONTEXT_K : _ref[MASKED_CONTEXT_KEY] = /*#__PURE__*/React.createContext(false);
+
+/**
+ * A pressable's record of whether masked content rendered anywhere inside it.
+ *
+ * The children walk in `extractInnerTextWithMasking` reads the *element* tree —
+ * what the caller passed — so it cannot see a `Masked` that a composite renders
+ * internally. `<Pressable><SensitiveValue>{card}</SensitiveValue></Pressable>`,
+ * where `SensitiveValue` renders `<Masked>` around its children, harvests the
+ * card number through `props.children` and never meets the `Masked`. That fails
+ * open: the real value ships with the flag omitted.
+ *
+ * This closes it from the other end. Each instrumented pressable owns one scope,
+ * and every `Masked` marks the scope it renders inside, whoever rendered it. The
+ * press handler reads the mark, so the verdict comes from what actually
+ * rendered rather than from what was passed in.
+ *
+ * `masked` is sticky. React can re-render a pressable without re-rendering
+ * children that did not change, so clearing the mark per render would drop a
+ * verdict that nothing goes on to re-assert. Over-masking after a `Masked`
+ * genuinely goes away is the direction that leaks nothing.
+ */
+
+const MASK_SCOPE_CONTEXT_KEY = Symbol.for('coralogix.masking.scope');
+
+/**
+ * The nearest enclosing pressable's {@link MaskScope}, or null outside one.
+ *
+ * Cached on the global registry for the same reason {@link MaskedContext} is.
+ */
+const MaskScopeContext = (_ref2$MASK_SCOPE_CONT = (_ref2 = globalThis)[MASK_SCOPE_CONTEXT_KEY]) != null ? _ref2$MASK_SCOPE_CONT : _ref2[MASK_SCOPE_CONTEXT_KEY] = /*#__PURE__*/React.createContext(null);
+
+/** Marks `scope` and every scope enclosing it as containing masked content. */
+function markScopeMasked(scope) {
+  for (let current = scope; current !== null; current = current.parent) {
+    current.masked = true;
+  }
+}
+
+/**
+ * Owns one {@link MaskScope} and provides it to its subtree.
+ *
+ * A class, not a function component: the scope has to be the same object across
+ * re-renders for a mark made during one render to still be readable at press
+ * time, and `useRef` is unavailable here — the plugin's React and the renderer's
+ * React are different instances in a consuming app, and hooks resolve through
+ * the instance-specific ReactCurrentDispatcher. A class instance needs no
+ * dispatcher.
+ */
+class MaskScopeBoundary extends React.Component {
+  constructor(...args) {
+    super(...args);
+    this.scope = {
+      masked: false,
+      parent: null
+    };
+  }
+  componentDidMount() {
+    var _this$props$onCommit, _this$props;
+    (_this$props$onCommit = (_this$props = this.props).onCommit) == null || _this$props$onCommit.call(_this$props, this.scope);
+  }
+  componentDidUpdate() {
+    var _this$props$onCommit2, _this$props2;
+    (_this$props$onCommit2 = (_this$props2 = this.props).onCommit) == null || _this$props$onCommit2.call(_this$props2, this.scope);
+  }
+  render() {
+    var _ref3;
+    // Linked in render rather than in the constructor: `this.context` is not
+    // reliably populated before the first render, and a subtree can be moved
+    // under a different parent.
+    this.scope.parent = (_ref3 = this.context) != null ? _ref3 : null;
+    return /*#__PURE__*/React.createElement(MaskScopeContext.Provider, {
+      value: this.scope
+    }, this.props.children(this.scope));
+  }
+}
+
+/** Whether a React element's `type` is the `Masked` wrapper. */
+MaskScopeBoundary.contextType = MaskScopeContext;
+function isMaskedComponentType(type) {
+  if (type === null || type === undefined) return false;
+  if (typeof type !== 'function' && typeof type !== 'object') return false;
+  return type[MASKED_COMPONENT_MARKER] === true;
+}
+
 // Mirrors Android SDK's direction inference: compare |dx| vs |dy|, sign gives direction.
 // contentOffset delta: dy > 0 = user scrolled DOWN, dx > 0 = user scrolled RIGHT.
 function inferDirectionFromDelta(dx, dy) {
@@ -199,23 +374,105 @@ function inferDirectionFromDelta(dx, dy) {
   }
   return dy > 0 ? 'down' : 'up';
 }
-
-// Shallow-recursive text extraction from React children.
-// Handles: string, number, arrays, and React elements with props.children.
-function extractInnerText(children) {
-  var _children$props;
-  if (children === null || children === undefined) return undefined;
-  if (typeof children === 'string') return children.trim() || undefined;
-  if (typeof children === 'number') return String(children);
+// Shallow-recursive text extraction from React children, which doubles as the
+// masking probe: the walk that harvests the text is the walk that decides
+// whether the text is masked, so the two can never disagree.
+//
+// Text from inside a masked subtree is still returned — the caller redacts the
+// whole value (see MASKED_INNER_TEXT). Reporting it here would be the bug this
+// exists to prevent, but discarding it would lose the fact that there *was*
+// text to redact.
+function extractInnerTextWithMasking(children) {
+  var _children$props2;
+  if (children === null || children === undefined) return {
+    masked: false
+  };
+  if (typeof children === 'string') {
+    return {
+      text: children.trim() || undefined,
+      masked: false
+    };
+  }
+  if (typeof children === 'number') {
+    return {
+      text: String(children),
+      masked: false
+    };
+  }
   if (Array.isArray(children)) {
-    const parts = children.map(extractInnerText).filter(Boolean);
-    return parts.length > 0 ? parts.join(' ') : undefined;
+    const parts = [];
+    let masked = false;
+    for (const child of children) {
+      const extraction = extractInnerTextWithMasking(child);
+      if (extraction.masked) masked = true;
+      if (extraction.text) parts.push(extraction.text);
+    }
+    return {
+      text: parts.length > 0 ? parts.join(' ') : undefined,
+      masked
+    };
+  }
+  if (isMaskedComponentType(children == null ? void 0 : children.type)) {
+    var _children$props;
+    // A Masked wrapper masks everything under it, so there is no need to keep
+    // looking for further wrappers deeper in — only for the text to redact.
+    return {
+      text: extractInnerTextWithMasking((_children$props = children.props) == null ? void 0 : _children$props.children).text,
+      masked: true
+    };
+  }
+  if ((children == null || (_children$props2 = children.props) == null ? void 0 : _children$props2.children) !== undefined) {
+    return extractInnerTextWithMasking(children.props.children);
+  }
+  return {
+    masked: false
+  };
+}
+
+class Logger {
+  constructor(config = {}) {
+    var _config$shouldLog, _config$prefix;
+    this._shouldLog = void 0;
+    this._prefix = void 0;
+    this._shouldLog = (_config$shouldLog = config.shouldLog) != null ? _config$shouldLog : false;
+    this._prefix = (_config$prefix = config.prefix) != null ? _config$prefix : '[Coralogix React Native SDK] - ';
+  }
+  set shouldLog(value) {
+    this._shouldLog = value;
+  }
+  debug(message, ...args) {
+    if (this._shouldLog) {
+      console.debug(`${this._prefix} ${message}`, ...args);
+    }
+  }
+  info(message, ...args) {
+    if (this._shouldLog) {
+      console.info(`${this._prefix} ${message}`, ...args);
+    }
+  }
+  warn(message, ...args) {
+    if (this._shouldLog) {
+      console.warn(`${this._prefix} ${message}`, ...args);
+    }
+  }
+
+  /**
+   * Warns even when debug logging is off.
+   *
+   * For failures the developer has to know about because nothing else in their
+   * app reveals them — masking that did not apply, say, where the cost of
+   * staying quiet is sensitive data reaching the backend.
+   */
+  alwaysWarn(message, ...args) {
+    console.warn(`${this._prefix} ${message}`, ...args);
   }
-  if ((children == null || (_children$props = children.props) == null ? void 0 : _children$props.children) !== undefined) {
-    return extractInnerText(children.props.children);
+  error(message, ...args) {
+    if (this._shouldLog) {
+      console.error(`${this._prefix} ${message}`, ...args);
+    }
   }
-  return undefined;
 }
+const logger = new Logger();
 
 let isEnabled = false;
 // No-op default so reportInteraction never needs a null-check.
@@ -234,165 +491,414 @@ let scrollState = {
   startTime: null,
   timeout: null
 };
+
+/**
+ * A mounted control's native view tag, behind a callback ref of stable identity.
+ *
+ * Native resolves masking by coordinate, so it can answer "is this *point*
+ * masked?" but not "does this *control* contain anything masked?" — React Native
+ * presses go through the JS responder system, leaving no native marker that says
+ * where a control begins and ends. Handing native the control's view tag is what
+ * lets it walk the real view tree and see an imperative `maskView` that JS cannot.
+ */
+
+/**
+ * One handle per mounted control, keyed on the {@link MaskScope} its
+ * {@link MaskScopeBoundary} owns — already exactly one stable object per mounted
+ * pressable, which is what a callback ref of stable identity needs and what
+ * hooks would otherwise provide (they are unavailable here; see MaskedContext).
+ */
+const controlHandles = new WeakMap();
+function assignRef(ref, node) {
+  if (typeof ref === 'function') {
+    ref(node);
+  } else if (ref !== null && typeof ref === 'object') {
+    ref.current = node;
+  }
+}
+function controlHandleFor(scope, appRef) {
+  let handle = controlHandles.get(scope);
+  if (!handle) {
+    const created = {
+      viewTag: null,
+      node: null,
+      appRef: null,
+      pendingRef: null,
+      attach: node => {
+        created.node = node != null ? node : null;
+        try {
+          created.viewTag = node == null ? null : findNodeHandle(node);
+        } catch (error) {
+          created.viewTag = null;
+          logger.debug('user-interaction: could not resolve the control view tag: ', error);
+        }
+        // After ours, and outside the try: the app's ref must be written even if
+        // resolving the tag throws. Reporting is never worth breaking a ref the
+        // app depends on.
+        assignRef(created.appRef, node);
+      }
+    };
+    handle = created;
+    controlHandles.set(scope, created);
+  }
+
+  // `attach` keeps one identity for the life of the mounted control: a fresh
+  // callback ref each render would make React detach and re-attach it on every
+  // re-render, handing every app ref a spurious null in between — object refs
+  // from `useRef`, the overwhelming majority, included.
+  //
+  // The cost of that stability is that `attach` does not re-fire when the app
+  // swaps the ref it passes — `ref={editing ? a : b}` — which React would
+  // otherwise handle by detaching one and attaching the other. So the swap is
+  // completed here, and only once a node exists: before that, `attach` writes to
+  // whichever ref is current when it runs. A ref the app rebuilds every render
+  // (an inline callback ref) therefore still gets called every render, which is
+  // exactly what React does with one.
+  if (handle.appRef !== appRef) {
+    if (handle.node === null) {
+      // Nothing attached yet, so there is nothing to write through: recording
+      // which ref `attach` should target is a pure assignment, and `attach`
+      // itself runs in commit.
+      handle.appRef = appRef;
+    } else {
+      // Mounted, and the app swapped the ref it passes. The write has to
+      // happen, but not from here — this runs inside MaskScopeBoundary.render(),
+      // and calling an app's callback ref during render lets something as
+      // ordinary as `ref={node => setNode(node)}` set state in the middle of
+      // another component's render. Recorded now, performed in the boundary's
+      // commit by flushControlRef.
+      handle.pendingRef = {
+        ref: appRef
+      };
+    }
+  }
+  return handle;
+}
+
+/**
+ * Applies a ref swap recorded during render, from the boundary's commit.
+ *
+ * Passed to every {@link MaskScopeBoundary} as `onCommit`, so it runs at the
+ * same point React would have detached one ref and attached the other.
+ */
+function flushControlRef(scope) {
+  const handle = controlHandles.get(scope);
+  const pending = handle == null ? void 0 : handle.pendingRef;
+  if (!handle || !pending) return;
+  handle.pendingRef = null;
+  const previous = handle.appRef;
+  handle.appRef = pending.ref;
+  if (previous !== pending.ref && handle.node !== null) {
+    assignRef(previous, null);
+    assignRef(pending.ref, handle.node);
+  }
+}
 function reportInteraction(ctx) {
   if (!isEnabled) return;
   onInteraction(ctx);
 }
-function makeInstrumentedPressable(OrigComp, componentName) {
+
+/**
+ * Runs reporting work so that it can never break the host app.
+ *
+ * Every wrapper below computes and reports *before* handing control to the app's
+ * own handler, so anything that throws on the way — a press event with no
+ * `nativeEvent` (accessibility-triggered presses, and any wrapper forwarding
+ * `onPress()` with no argument), a getter that throws inside the children walk,
+ * a consumer callback that blows up — would swallow the app's handler and leave
+ * the control looking dead. Telemetry is never worth that.
+ */
+function safely(report) {
+  try {
+    report();
+  } catch (error) {
+    logger.debug('user-interaction: reporting failed, ignored: ', error);
+  }
+}
+
+/**
+ * Carries the original's statics onto the wrapper.
+ *
+ * `React.forwardRef` returns a plain object, so anything hung off the component
+ * is lost unless it is copied: `ScrollView.Context`, which VirtualizedList reads
+ * and throws without, and `propTypes`, which React validates against in
+ * development.
+ */
+function copyStatics(target, source) {
+  // `length`, `name` and `prototype` are function/class intrinsics, not statics
+  // anyone hung off the component. Button and TouchableNativeFeedback are still
+  // classes in RN 0.73, so copying their `prototype` onto a forwardRef exotic
+  // object would give the wrapper a truthy `prototype.isReactComponent` — a lie
+  // about the component kind to anything that probes it (devtools, Animated,
+  // consumer code) — and, being non-writable, would make a second copyStatics
+  // call throw into the catch below.
+  const skipKeys = new Set(['$$typeof', 'render', 'displayName', 'length', 'name', 'prototype']);
+  Object.getOwnPropertyNames(source != null ? source : {}).forEach(key => {
+    if (skipKeys.has(key)) return;
+    try {
+      const descriptor = Object.getOwnPropertyDescriptor(source, key);
+      if (descriptor) Object.defineProperty(target, key, descriptor);
+    } catch (_unused) {
+      /* ignore non-configurable descriptors */
+    }
+  });
+}
+
+/**
+ * @param wrapWithoutHandler Whether to render the masking wrappers even when
+ *   there is no onPress to report. True for the touchables: branching on the
+ *   handler changes the element type at this position when a component toggles
+ *   its handler — a button that disables itself by dropping onPress — and React
+ *   then unmounts and remounts the native control it wraps, resetting its state
+ *   and briefly nulling the forwarded ref. False for Text, which has no native
+ *   state a remount can lose, and where the overwhelming majority of instances
+ *   carry no handler at all.
+ */
+function makeInstrumentedPressable(OrigComp, componentName, wrapWithoutHandler = true) {
   const InstrumentedComp = /*#__PURE__*/React.forwardRef(function InstrumentedPressable(props, ref) {
-    const wrappedProps = props.onPress ? _extends({}, props, {
-      onPress: e => {
-        var _props$accessibilityL, _extractInnerText;
-        const {
-          pageX,
-          pageY
-        } = e.nativeEvent;
-        reportInteraction({
-          type: 'click',
-          attributes: {
-            x: Math.round(pageX * 100) / 100,
-            y: Math.round(pageY * 100) / 100
-          },
-          element_classes: componentName,
-          target_element: (_props$accessibilityL = props.accessibilityLabel) != null ? _props$accessibilityL : componentName,
-          target_id: props.testID,
-          inner_text: (_extractInnerText = extractInnerText(props.children)) != null ? _extractInnerText : props.title
-        });
-        props.onPress(e);
-      }
-    }) : props;
-    return /*#__PURE__*/React.createElement(OrigComp, _extends({}, wrappedProps, {
-      ref
-    }));
+    if (!props.onPress && !wrapWithoutHandler) {
+      return /*#__PURE__*/React.createElement(OrigComp, _extends({}, props, {
+        ref
+      }));
+    }
+
+    // The masking verdict needs three things props alone cannot answer: whether
+    // an ancestor is masked (context, flowing down from Masked), whether a
+    // descendant is (the children walk), and whether a *composite* descendant
+    // rendered a Masked internally — which the children walk cannot see, because
+    // it reads the element tree (hence the scope, marked during render; see
+    // MaskScope). Only JS has any of that: native sees a ReactViewGroup of
+    // ReactTextViews and resolves masking by coordinate, which is why a tap on a
+    // touchable's padding around a masked <Text> reads as unmasked there.
+    //
+    // Consumer rather than useContext: hooks are unavailable in these wrappers
+    // (see MaskedContext).
+    return /*#__PURE__*/React.createElement(MaskedContext.Consumer, {
+      children: isAncestorMasked => /*#__PURE__*/React.createElement(MaskScopeBoundary, {
+        onCommit: flushControlRef,
+        children: scope => {
+          const control = controlHandleFor(scope, ref);
+          return /*#__PURE__*/React.createElement(OrigComp, _extends({}, props, props.onPress ? {
+            onPress: e => {
+              safely(() => {
+                var _e$nativeEvent, _extraction$text, _props$accessibilityL;
+                const {
+                  pageX,
+                  pageY
+                } = (_e$nativeEvent = e == null ? void 0 : e.nativeEvent) != null ? _e$nativeEvent : {};
+                const extraction = extractInnerTextWithMasking(props.children);
+                const isMasked = isAncestorMasked || extraction.masked || scope.masked;
+                const innerText = (_extraction$text = extraction.text) != null ? _extraction$text : props.title;
+                reportInteraction(_extends({
+                  type: 'click'
+                }, Number.isFinite(pageX) && Number.isFinite(pageY) ? {
+                  attributes: {
+                    x: Math.round(pageX * 100) / 100,
+                    y: Math.round(pageY * 100) / 100
+                  }
+                } : {}, {
+                  element_classes: componentName,
+                  target_element: (_props$accessibilityL = props.accessibilityLabel) != null ? _props$accessibilityL : componentName,
+                  target_id: props.testID,
+                  // Whole-value redaction, matching the browser SDK: one masked
+                  // contributor masks the entire string rather than part of it,
+                  // and the real text never crosses the bridge.
+                  inner_text: innerText !== undefined && isMasked ? MASKED_INNER_TEXT : innerText
+                }, isMasked ? {
+                  is_masked: true
+                } : control.viewTag !== null ? {
+                  view_tag: control.viewTag
+                } : {}));
+              });
+              props.onPress(e);
+            }
+          } : {}, {
+            // Ours, with the app's ref written through it, rather than the
+            // app's directly — this is where the control's view tag comes from.
+            ref: control.attach
+          }));
+        }
+      })
+    });
   });
   InstrumentedComp.displayName = componentName;
+  copyStatics(InstrumentedComp, OrigComp);
   return InstrumentedComp;
 }
+
+// A Switch reports no coordinates, so native masking resolution has nothing to
+// fall back on — without the ancestor verdict from context, a Switch inside a
+// masked container would report false.
+//
+// It carries no view tag either, and so is the one control the native view-tree
+// walk cannot answer for: onValueChange hands over a boolean rather than an
+// event, so the tag would have to come from a ref, and a ref needs the stable
+// per-instance object that only MaskScopeBoundary provides — a boundary a Switch
+// has no other use for, having no children to scope. So an imperative maskView
+// on a Switch's container still reports false. Wrap it in `Masked` instead,
+// which the context below already honours.
 function makeInstrumentedSwitch(OrigComp) {
   const InstrumentedSwitch = /*#__PURE__*/React.forwardRef(function InstrumentedSwitch(props, ref) {
-    const wrappedProps = props.onValueChange ? _extends({}, props, {
-      onValueChange: value => {
-        var _props$accessibilityL2;
-        reportInteraction({
-          type: 'click',
-          element_classes: 'Switch',
-          target_element: (_props$accessibilityL2 = props.accessibilityLabel) != null ? _props$accessibilityL2 : 'Switch',
-          target_id: props.testID
-        });
-        props.onValueChange(value);
-      }
-    }) : props;
-    return /*#__PURE__*/React.createElement(OrigComp, _extends({}, wrappedProps, {
-      ref
-    }));
+    // Rendered unconditionally, for the reason given in makeInstrumentedPressable.
+    return /*#__PURE__*/React.createElement(MaskedContext.Consumer, {
+      children: isAncestorMasked => /*#__PURE__*/React.createElement(OrigComp, _extends({}, props, props.onValueChange ? {
+        onValueChange: value => {
+          safely(() => {
+            var _props$accessibilityL2;
+            reportInteraction(_extends({
+              type: 'click',
+              element_classes: 'Switch',
+              target_element: (_props$accessibilityL2 = props.accessibilityLabel) != null ? _props$accessibilityL2 : 'Switch',
+              target_id: props.testID
+            }, isAncestorMasked ? {
+              is_masked: true
+            } : {}));
+          });
+          props.onValueChange(value);
+        }
+      } : {}, {
+        ref
+      }))
+    });
   });
   InstrumentedSwitch.displayName = 'Switch';
+  copyStatics(InstrumentedSwitch, OrigComp);
   return InstrumentedSwitch;
 }
+
+// Scroll and swipe payloads carry no coordinates, so the SDK's own coordinate
+// resolution has nothing to test against. They carry the scroll view's tag
+// instead, which the plugin's native module resolves against the view tree — so
+// a scroll inside a masked container reports masked rather than falling back to
+// the documented "cannot resolve" default of false.
+//
+// Container, and only container: native counts descendants for a click, because
+// a click reports the control's whole concatenated text and a masked descendant
+// has to mask it. A scroll reports no text, so descendants are not consulted —
+// otherwise one masked row anywhere in a list would mask every scroll of it.
+//
+// The tag comes from a ref, exactly as it does for a press, and NOT from
+// `nativeEvent.target`. A scroll event is emitted by the scroll view rather than
+// hit-tested to a leaf, so its target would be the right view — but only Android
+// puts one in the event body (ScrollEvent.java stamps `target`; iOS's
+// RCTScrollEvent body carries just the offsets and sizes). Reading it would have
+// worked on Android and silently never fired on iOS.
+//
+// MaskScopeBoundary is here only for the stable per-instance object its scope
+// gives the ref (see controlHandleFor). Nothing reads this scope's `masked`
+// flag: a scroll reports no text, so it has no verdict of its own to compute.
 function makeInstrumentedScrollView(OrigComp) {
   const InstrumentedScrollView = /*#__PURE__*/React.forwardRef(function InstrumentedScrollView(props, ref) {
-    const wrappedProps = _extends({}, props, {
-      onScrollBeginDrag: e => {
-        scrollState.startOffset = _extends({}, e.nativeEvent.contentOffset);
-        scrollState.startTime = Date.now();
-        props.onScrollBeginDrag == null || props.onScrollBeginDrag(e);
-      },
-      onScrollEndDrag: e => {
-        var _scrollState$timeout;
-        const endOffset = _extends({}, e.nativeEvent.contentOffset);
-        // Capture start state immediately — scrollState may be mutated by a
-        // concurrent ScrollView's onScrollBeginDrag before the timeout fires.
-        const {
-          startOffset,
-          startTime
-        } = scrollState;
-        clearTimeout((_scrollState$timeout = scrollState.timeout) != null ? _scrollState$timeout : undefined);
-
-        // Compute drag speed (px/ms) to distinguish a deliberate scroll from a fling.
-        // Works on both iOS and Android without relying on native velocity fields.
-        let classified = false;
-        if (startOffset !== null && startTime !== null) {
-          const elapsed = Date.now() - startTime;
-          const dx = endOffset.x - startOffset.x;
-          const dy = endOffset.y - startOffset.y;
-          const speed = elapsed > 0 ? Math.sqrt(dx * dx + dy * dy) / elapsed : 0;
-          if (speed < SWIPE_VELOCITY_THRESHOLD) {
-            // Slow deliberate drag → report scroll immediately.
-            reportInteraction({
-              type: 'scroll',
-              target_element: 'ScrollView',
-              direction: inferDirectionFromDelta(dx, dy)
+    return /*#__PURE__*/React.createElement(MaskScopeBoundary, {
+      onCommit: flushControlRef,
+      children: scope => {
+        const control = controlHandleFor(scope, ref);
+        return /*#__PURE__*/React.createElement(OrigComp, _extends({}, props, {
+          onScrollBeginDrag: e => {
+            safely(() => {
+              scrollState.startOffset = _extends({}, e.nativeEvent.contentOffset);
+              scrollState.startTime = Date.now();
             });
-            scrollState = {
-              startOffset: null,
-              startTime: null,
-              timeout: null
-            };
-            classified = true;
-          }
-        }
-        if (!classified) {
-          // Fast drag → wait for onMomentumScrollBegin to classify as swipe.
-          // If momentum doesn't fire within the window, fall back to scroll.
-          // Uses captured startOffset (not scrollState.startOffset) to avoid
-          // reading stale state if another scroll begins before the timeout fires.
-          scrollState.timeout = setTimeout(() => {
-            if (startOffset) {
-              reportInteraction({
-                type: 'scroll',
-                target_element: 'ScrollView',
-                direction: inferDirectionFromDelta(endOffset.x - startOffset.x, endOffset.y - startOffset.y)
-              });
-            }
-            scrollState = {
-              startOffset: null,
-              startTime: null,
-              timeout: null
-            };
-          }, SWIPE_MOMENTUM_TIMEOUT_MS);
-        }
-        props.onScrollEndDrag == null || props.onScrollEndDrag(e);
-      },
-      onMomentumScrollBegin: e => {
-        var _scrollState$timeout2;
-        clearTimeout((_scrollState$timeout2 = scrollState.timeout) != null ? _scrollState$timeout2 : undefined);
-        const currentOffset = _extends({}, e.nativeEvent.contentOffset);
-        const {
-          startOffset
-        } = scrollState;
-        if (startOffset) {
-          reportInteraction({
-            type: 'swipe',
-            target_element: 'ScrollView',
-            direction: inferDirectionFromDelta(currentOffset.x - startOffset.x, currentOffset.y - startOffset.y)
-          });
-        }
-        scrollState = {
-          startOffset: null,
-          startTime: null,
-          timeout: null
-        };
-        props.onMomentumScrollBegin == null || props.onMomentumScrollBegin(e);
+            props.onScrollBeginDrag == null || props.onScrollBeginDrag(e);
+          },
+          onScrollEndDrag: e => {
+            safely(() => classifyScrollEndDrag(e, control.viewTag));
+            props.onScrollEndDrag == null || props.onScrollEndDrag(e);
+          },
+          onMomentumScrollBegin: e => {
+            safely(() => classifyMomentumScrollBegin(e, control.viewTag));
+            props.onMomentumScrollBegin == null || props.onMomentumScrollBegin(e);
+          },
+          ref: control.attach
+        }));
       }
     });
-    return /*#__PURE__*/React.createElement(OrigComp, _extends({}, wrappedProps, {
-      ref
-    }));
   });
   InstrumentedScrollView.displayName = 'ScrollView';
-
-  // Copy static properties from OrigComp (e.g. ScrollView.Context used by VirtualizedList/FlatList).
-  // React.forwardRef returns a plain object so these statics are lost without explicit copying.
-  const skipKeys = new Set(['$$typeof', 'render', 'displayName']);
-  Object.getOwnPropertyNames(OrigComp).forEach(key => {
-    if (skipKeys.has(key)) return;
-    try {
-      const descriptor = Object.getOwnPropertyDescriptor(OrigComp, key);
-      if (descriptor) Object.defineProperty(InstrumentedScrollView, key, descriptor);
-    } catch (_unused) {/* ignore non-configurable descriptors */}
-  });
+  copyStatics(InstrumentedScrollView, OrigComp);
   return InstrumentedScrollView;
 }
+function classifyScrollEndDrag(e, viewTag) {
+  var _scrollState$timeout;
+  const endOffset = _extends({}, e.nativeEvent.contentOffset);
+  // Capture start state immediately — scrollState may be mutated by a
+  // concurrent ScrollView's onScrollBeginDrag before the timeout fires.
+  const {
+    startOffset,
+    startTime
+  } = scrollState;
+  clearTimeout((_scrollState$timeout = scrollState.timeout) != null ? _scrollState$timeout : undefined);
+
+  // Compute drag speed (px/ms) to distinguish a deliberate scroll from a fling.
+  // Works on both iOS and Android without relying on native velocity fields.
+  let classified = false;
+  if (startOffset !== null && startTime !== null) {
+    const elapsed = Date.now() - startTime;
+    const dx = endOffset.x - startOffset.x;
+    const dy = endOffset.y - startOffset.y;
+    const speed = elapsed > 0 ? Math.sqrt(dx * dx + dy * dy) / elapsed : 0;
+    if (speed < SWIPE_VELOCITY_THRESHOLD) {
+      // Slow deliberate drag → report scroll immediately.
+      reportInteraction(_extends({
+        type: 'scroll',
+        target_element: 'ScrollView',
+        direction: inferDirectionFromDelta(dx, dy)
+      }, viewTag !== null ? {
+        view_tag: viewTag
+      } : {}));
+      scrollState = {
+        startOffset: null,
+        startTime: null,
+        timeout: null
+      };
+      classified = true;
+    }
+  }
+  if (!classified) {
+    // Fast drag → wait for onMomentumScrollBegin to classify as swipe.
+    // If momentum doesn't fire within the window, fall back to scroll.
+    // Uses captured startOffset (not scrollState.startOffset) to avoid
+    // reading stale state if another scroll begins before the timeout fires.
+    scrollState.timeout = setTimeout(() => {
+      if (startOffset) {
+        reportInteraction(_extends({
+          type: 'scroll',
+          target_element: 'ScrollView',
+          direction: inferDirectionFromDelta(endOffset.x - startOffset.x, endOffset.y - startOffset.y)
+        }, viewTag !== null ? {
+          view_tag: viewTag
+        } : {}));
+      }
+      scrollState = {
+        startOffset: null,
+        startTime: null,
+        timeout: null
+      };
+    }, SWIPE_MOMENTUM_TIMEOUT_MS);
+  }
+}
+function classifyMomentumScrollBegin(e, viewTag) {
+  var _scrollState$timeout2;
+  clearTimeout((_scrollState$timeout2 = scrollState.timeout) != null ? _scrollState$timeout2 : undefined);
+  const currentOffset = _extends({}, e.nativeEvent.contentOffset);
+  const {
+    startOffset
+  } = scrollState;
+  if (startOffset) {
+    reportInteraction(_extends({
+      type: 'swipe',
+      target_element: 'ScrollView',
+      direction: inferDirectionFromDelta(currentOffset.x - startOffset.x, currentOffset.y - startOffset.y)
+    }, viewTag !== null ? {
+      view_tag: viewTag
+    } : {}));
+  }
+  scrollState = {
+    startOffset: null,
+    startTime: null,
+    timeout: null
+  };
+}
 
 // react-native is in Metro's nonInlinedRequires list, so app code reads properties
 // like _rn.Pressable from the shared module object at each render. Mutating the
@@ -411,11 +917,16 @@ const originals = {
   TouchableNativeFeedback: RN.TouchableNativeFeedback,
   TouchableWithoutFeedback: RN.TouchableWithoutFeedback,
   Switch: RN.Switch,
-  ScrollView: RN.ScrollView
+  ScrollView: RN.ScrollView,
+  Text: RN.Text
 };
 
-// Wrapper components are created once from the originals captured above.
-// They are patched into / restored from the RN module in enable() / disable().
+// Wrapper components are created once from the originals captured above, and
+// swapped into the RN module at load (see patchComponents below). They stay
+// there: `disable()` leaves them in place because they are inert while reporting
+// is off, and removing them would strand anything mounted meanwhile. The one
+// path that puts the originals back is an explicit opt-out — see
+// restoreUserInteractionComponents.
 const instrumented = {
   Button: makeInstrumentedPressable(originals.Button, 'Button'),
   Pressable: makeInstrumentedPressable(originals.Pressable, 'Pressable'),
@@ -424,7 +935,23 @@ const instrumented = {
   TouchableNativeFeedback: makeInstrumentedPressable(originals.TouchableNativeFeedback, 'TouchableNativeFeedback'),
   TouchableWithoutFeedback: makeInstrumentedPressable(originals.TouchableWithoutFeedback, 'TouchableWithoutFeedback'),
   Switch: makeInstrumentedSwitch(originals.Switch),
-  ScrollView: makeInstrumentedScrollView(originals.ScrollView)
+  ScrollView: makeInstrumentedScrollView(originals.ScrollView),
+  // Text is the one press target that is not a touchable: TextProps declares
+  // onPress, so a link-style `<Text onPress>` reported nothing at all. The
+  // pressable wrapper fits it as-is — the press event carries the same
+  // pageX/pageY, and the text to report is its own children.
+  //
+  // A Text without an onPress renders the original component directly, with no
+  // Consumer and no scope boundary: Text is the most numerous component in a
+  // typical app and the great majority carry no handler, so the wrappers would be
+  // pure overhead on the hottest path. Safe for Text specifically, because a Text
+  // that gains or loses a handler remounts without losing native state — the
+  // reason the touchables wrap unconditionally.
+  //
+  // One thing to know: `RN.Text` is compared by identity in react-native's own
+  // `ReactNativeTestTools`, so a consumer using those helpers sees our wrapper
+  // instead — nothing in production code does this.
+  Text: makeInstrumentedPressable(originals.Text, 'Text', false)
 };
 function defineComp(key, value) {
   Object.defineProperty(RN, key, {
@@ -443,8 +970,27 @@ function patchComponents() {
   defineComp('TouchableWithoutFeedback', instrumented.TouchableWithoutFeedback);
   defineComp('Switch', instrumented.Switch);
   defineComp('ScrollView', instrumented.ScrollView);
+  defineComp('Text', instrumented.Text);
 }
-function restoreComponents() {
+
+// Patched at module load, not in enable(). An element captures its component
+// type when it is created, so anything already mounted keeps pointing at the
+// original: `CoralogixRum.init()` is async and typically runs from a useEffect,
+// so patching in enable() left every control on the first screen uninstrumented
+// until something happened to re-render it — losing, among other things, the
+// first press on it. Reporting stays gated on `isEnabled` (see
+// reportInteraction), so the wrappers are inert until the SDK is initialized.
+patchComponents();
+
+/**
+ * Puts the original RN components back.
+ *
+ * For one caller: a customer who opted out with
+ * `instrumentations: { user_interaction: false }`. Patching happens at module
+ * load, before any options exist to consult, so the opt-out is honored by undoing
+ * it once the options are known. `disable()` deliberately does not do this.
+ */
+function restoreUserInteractionComponents() {
   defineComp('Button', originals.Button);
   defineComp('Pressable', originals.Pressable);
   defineComp('TouchableOpacity', originals.TouchableOpacity);
@@ -453,10 +999,13 @@ function restoreComponents() {
   defineComp('TouchableWithoutFeedback', originals.TouchableWithoutFeedback);
   defineComp('Switch', originals.Switch);
   defineComp('ScrollView', originals.ScrollView);
+  defineComp('Text', originals.Text);
 }
 class UserInteractionInstrumentation extends InstrumentationBase {
   constructor(config) {
     super(USER_INTERACTION_INSTRUMENTATION_NAME, USER_INTERACTION_INSTRUMENTATION_VERSION, {});
+    this.report = void 0;
+    this.report = config.onInteraction;
     onInteraction = config.onInteraction;
   }
 
@@ -464,12 +1013,26 @@ class UserInteractionInstrumentation extends InstrumentationBase {
   init() {}
   enable() {
     isEnabled = true;
+    // Re-attached, not just flipped: disable() drops the callback, so an
+    // instance that is disabled and enabled again would otherwise report
+    // nothing for the rest of its life.
+    //
+    // Guarded because InstrumentationBase's constructor calls enable() from
+    // inside super(), before `this.report` is assigned — so the first call would
+    // otherwise install `undefined` as the module-level callback. Today the
+    // constructor's next statement overwrites it with no yield point in between,
+    // but that is an ordering this class should not depend on.
+    if (this.report) {
+      onInteraction = this.report;
+    }
     patchComponents();
   }
   disable() {
     isEnabled = false;
     onInteraction = () => {};
-    restoreComponents();
+    // The wrappers stay installed. They are inert while `isEnabled` is false,
+    // and putting the originals back would strand every control mounted in the
+    // meantime the same way patching late did.
     if (scrollState.timeout) {
       clearTimeout(scrollState.timeout);
     }
@@ -575,44 +1138,10 @@ function stopJsRefreshRateSampler() {
   appStateSub = null;
 }
 
-var version = "0.10.1";
+var version = "0.11.0";
 var pkg = {
 	version: version};
 
-class Logger {
-  constructor(config = {}) {
-    var _config$shouldLog, _config$prefix;
-    this._shouldLog = void 0;
-    this._prefix = void 0;
-    this._shouldLog = (_config$shouldLog = config.shouldLog) != null ? _config$shouldLog : false;
-    this._prefix = (_config$prefix = config.prefix) != null ? _config$prefix : '[Coralogix React Native SDK] - ';
-  }
-  set shouldLog(value) {
-    this._shouldLog = value;
-  }
-  debug(message, ...args) {
-    if (this._shouldLog) {
-      console.debug(`${this._prefix} ${message}`, ...args);
-    }
-  }
-  info(message, ...args) {
-    if (this._shouldLog) {
-      console.info(`${this._prefix} ${message}`, ...args);
-    }
-  }
-  warn(message, ...args) {
-    if (this._shouldLog) {
-      console.warn(`${this._prefix} ${message}`, ...args);
-    }
-  }
-  error(message, ...args) {
-    if (this._shouldLog) {
-      console.error(`${this._prefix} ${message}`, ...args);
-    }
-  }
-}
-const logger = new Logger();
-
 let activeGlobalSpanId = null;
 const spanTraceIds = new Map();
 let ignoredInstruments = new Set();
@@ -764,9 +1293,43 @@ const getUrlFragments = url => {
     return url;
   }
 };
+
+/**
+ * Rolls the session sampling dice.
+ *
+ * This is the only roll for a config without `excludeFromSampling`: `init` pins the
+ * rate it sends to native to 100 in that case, so native does not roll again. See the
+ * comment in `CoralogixRum.init` for why the exclude case is handled the other way round.
+ */
 function isSamplingOn(threshold) {
   return threshold > 0 && Math.random() * 100 <= threshold;
 }
+
+/**
+ * Normalizes `sessionSampleRate` into the shape both native SDKs expect: an
+ * integer percentage in [0, 100].
+ *
+ * The bridges read the value as an integer (`NSNumber.intValue` on iOS,
+ * `ReadableMap.getInt` on Android), so a fractional rate such as `0.5` would be
+ * truncated to `0` on iOS — silently sampling every session out — and can throw
+ * on Android. Round instead, and never round a caller-requested non-zero rate
+ * down to `0`: `0` is the one value that means "emit nothing".
+ */
+function normalizeSessionSampleRate(rate) {
+  if (typeof rate !== 'number' || !Number.isFinite(rate)) {
+    logger.warn(`CoralogixRum: \`sessionSampleRate\` must be a finite number; received ${String(rate)}. Falling back to 100.`);
+    return 100;
+  }
+  if (rate <= 0) {
+    return 0;
+  }
+  if (rate >= 100) {
+    return 100;
+  }
+
+  // Keep a sub-1% request alive rather than truncating it to "emit nothing".
+  return Math.max(1, Math.round(rate));
+}
 function resolveCoralogixOtelWebConfig(config) {
   var _config$sessionSample, _config$view_context;
   const {
@@ -778,7 +1341,7 @@ function resolveCoralogixOtelWebConfig(config) {
   OPTIONS_DEFAULTS.ignoreUrls && resolvedIgnoreUrls.push(...OPTIONS_DEFAULTS.ignoreUrls);
   return _extends({}, OPTIONS_DEFAULTS, config, {
     ignoreUrls: resolvedIgnoreUrls,
-    sessionSampleRate: (_config$sessionSample = config.sessionSampleRate) != null ? _config$sessionSample : 100,
+    sessionSampleRate: normalizeSessionSampleRate((_config$sessionSample = config.sessionSampleRate) != null ? _config$sessionSample : 100),
     debug,
     view_context: (_config$view_context = config.view_context) != null ? _config$view_context : OPTIONS_DEFAULTS.view_context
   });
@@ -974,6 +1537,79 @@ function isSessionReplayOptionsValid(options) {
   return scaleValid && sampleRateValid && qualityValid;
 }
 
+/**
+ * The native module, or a proxy that throws on first use when it is missing.
+ *
+ * Lives in its own leaf module so anything needing the bridge — the masking
+ * components included — can reach it without importing the SDK entry point and
+ * cycling back through it. `CxSdkClient` is imported as a type only, so the
+ * declaration site stays in `index.ts` with nothing cycling at runtime.
+ */
+
+const LINKING_ERROR = `The package 'cx-plugin' doesn't seem to be linked. Make sure: \n\n` + Platform.select({
+  ios: "- You have run 'pod install'\n",
+  default: ''
+}) + '- You rebuilt the app after installing the package\n' + '- You are not using Expo Go\n';
+function createErrorProxy(errorMessage) {
+  return new Proxy({}, {
+    get() {
+      throw new Error(errorMessage);
+    }
+  });
+}
+const CxSdk = NativeModules.CxSdk ? NativeModules.CxSdk : createErrorProxy(LINKING_ERROR);
+
+const reportFailure = viewTag => error => {
+  // Dropped from the registry so a later layout pass retries rather than
+  // being deduped against a registration that did not take.
+  registeredViewTags.delete(viewTag);
+  logger.alwaysWarn(`masking: the native SDK could not mask the view for tag ${viewTag}, so nothing was masked: `, error);
+};
+
+/**
+ * Native view tags already registered for masking.
+ *
+ * `onLayout` fires on every re-measure, not just the first, and marking a view
+ * natively is idempotent — so without this, a screen of `Masked` rows repeats
+ * the bridge hop once per row per layout pass, and a view whose registration
+ * keeps failing emits one ungated warning per layout event rather than one per
+ * view, burying LogBox.
+ *
+ * Safe to hold for the life of the JS context: React Native allocates view tags
+ * monotonically within a context and does not reuse them, so a tag in here
+ * always refers to the same view.
+ */
+const registeredViewTags = new Set();
+
+/**
+ * Registers the view that fired the layout event for masking.
+ *
+ * Failures warn rather than pass silently: masking that does not apply leaves
+ * sensitive content in the replay, which is not something a caller can notice
+ * by looking at their own code.
+ */
+function maskView(event) {
+  logger.debug('masking: maskView called');
+  const viewTag = findNodeHandle(event.target);
+  if (!viewTag) {
+    logger.alwaysWarn('masking: this layout event carried no resolvable native view, so nothing was masked. Pass `maskView` to the `onLayout` prop of a host component (`View`, `Text`, …).');
+    return;
+  }
+  if (registeredViewTags.has(viewTag)) return;
+  registeredViewTags.add(viewTag);
+
+  // Both platforms bridge this as a promise and reject when the view cannot be
+  // resolved. The call itself is in the try because an unlinked native module is
+  // an error-throwing proxy: reading `maskViewByTag` off it throws
+  // synchronously, before there is any promise to attach a handler to, and that
+  // would surface as an exception out of a layout handler rather than a warning.
+  try {
+    Promise.resolve(CxSdk.maskViewByTag(viewTag)).catch(reportFailure(viewTag));
+  } catch (error) {
+    reportFailure(viewTag)(error);
+  }
+}
+
 let lastRouteName;
 function getLastNavigationRouteDetected() {
   return lastRouteName;
@@ -1015,22 +1651,93 @@ let CoralogixDomain = /*#__PURE__*/function (CoralogixDomain) {
   return CoralogixDomain;
 }({});
 
-const LINKING_ERROR = `The package 'cx-plugin' doesn't seem to be linked. Make sure: \n\n` + Platform.select({
-  ios: "- You have run 'pod install'\n",
-  default: ''
-}) + '- You rebuilt the app after installing the package\n' + '- You are not using Expo Go\n';
+const _excluded = ["children", "onLayout"];
+
+/**
+ * Props of `Masked`. It renders a real `View`, so it accepts everything a
+ * `View` does — `style` included. `onLayout` is chained, not replaced: the
+ * handler runs after the view is registered for masking.
+ *
+ * `collapsable` is not among them: masking depends on this view surviving RN's
+ * view flattening, so the component pins it to `false` and the prop would be
+ * ignored. Omitted rather than accepted-and-dropped, so the type says so.
+ */
+
+/**
+ * Masks its subtree in session replay, and tells the user-interaction
+ * instrumentation that everything inside is masked.
+ *
+ * The imperative `SessionReplay.maskView` masks pixels just as well, but it can
+ * only be resolved by coordinate: native sees `<Pressable><Text>5</Text></Pressable>`
+ * as a ReactViewGroup wrapping a ReactTextView, so masking the inner `<Text>`
+ * alone leaves a tap on the pressable's padding resolving as unmasked, shipping
+ * the real text. This wrapper closes that gap by making the verdict visible in
+ * JS, where the component tree is.
+ *
+ * Renders a real `View` — it participates in layout, and forwards `style` and
+ * the rest of its props. `collapsable={false}` keeps RN view flattening from
+ * removing the very view being masked.
+ *
+ * ```tsx
+ * <Pressable onPress={pay}>
+ *   <Masked>
+ *     <Text>{cardNumber}</Text>
+ *   </Masked>
+ * </Pressable>
+ * ```
+ */
+const Masked = /*#__PURE__*/React.forwardRef(function Masked(props, ref) {
+  const {
+      children,
+      onLayout
+    } = props,
+    viewProps = _objectWithoutPropertiesLoose(props, _excluded);
+
+  // Consumed, not just provided: the enclosing pressable's children walk reads
+  // the element tree and cannot see a `Masked` that a composite renders
+  // internally, so this tells the pressable directly. Marking during render is
+  // deliberate — it has to happen before the press it protects, and it is
+  // idempotent, so a StrictMode double render is harmless.
+  return /*#__PURE__*/React.createElement(MaskScopeContext.Consumer, {
+    children: scope => {
+      markScopeMasked(scope);
+      return /*#__PURE__*/React.createElement(MaskedContext.Provider, {
+        value: true
+      }, /*#__PURE__*/React.createElement(View, _extends({}, viewProps, {
+        ref,
+        // Set after the spread: masking depends on this view surviving
+        // flattening, so it is not the caller's to override.
+        collapsable: false,
+        onLayout: event => {
+          maskView(event);
+          onLayout == null || onLayout(event);
+        }
+      }), children));
+    }
+  });
+});
+
+// Brands the component for the instrumentation's children walk. Assigned rather
+// than declared because forwardRef returns an exotic object, not a class.
+Masked[MASKED_COMPONENT_MARKER] = true;
+
+/**
+ * The bridge contract, and the source of truth for it: every method here must
+ * exist in `ios/CxSdk.swift` and in the Android module with a matching
+ * signature. Exported as a type so `nativeModule.ts` can hold the instance
+ * without the declaration leaving this file.
+ */
+
 let beforeSendCallback;
 let tracesExporterSubscription;
 let _deregisterInstrumentations;
-const CxSdk = NativeModules.CxSdk ? NativeModules.CxSdk : createErrorProxy(LINKING_ERROR);
-function createErrorProxy(errorMessage) {
-  return new Proxy({}, {
-    get() {
-      throw new Error(errorMessage);
-    }
-  });
-}
 let isInited = false;
+// Set for the duration of an in-flight `init()` so concurrent callers join it
+// instead of starting a second initialization. See `CoralogixRum.init`.
+let initPromise;
+// Whether native, rather than JS, rolled the sampling for this init. Only in that mode can
+// `CoralogixRum.isInited` be true while native has no RUM behind it.
+let nativeOwnsSamplingRoll = false;
 let fetchInstrumentation;
 function toSafeRecord(name, value) {
   if (value == null) {
@@ -1042,63 +1749,149 @@ function toSafeRecord(name, value) {
   }
   return value;
 }
+
+/**
+ * The real init work. Runs at most once per in-flight/finished init: `CoralogixRum.init`
+ * memoizes the promise this returns, so concurrent callers share this single run.
+ */
+async function runInit(options,
+// Per call rather than module state: `logger.warn` below runs an app's console handler,
+// which can call `init()` again, and a shared flag would let that nested call answer for
+// this one.
+progress) {
+  var _options$debug, _resolvedOptions$excl, _resolvedOptions$excl2;
+  // Configure the logger before anything that can warn: the `public_key` check below, and
+  // resolving the options, which normalizes `sessionSampleRate` and warns about an invalid
+  // rate. Setting it any later swallowed those warnings on the first init — exactly when
+  // the caller needs to see them.
+  logger.shouldLog = (_options$debug = options == null ? void 0 : options.debug) != null ? _options$debug : false;
+  if (typeof (options == null ? void 0 : options.public_key) !== 'string' || options.public_key.length === 0) {
+    logger.warn('`public_key` is required and must be a non-empty string; initialization aborted.');
+    return;
+  }
+  const resolvedOptions = resolveCoralogixOtelWebConfig(options);
+
+  // The rate has to be applied exactly *once*. Rolling it on both sides squared it:
+  // `sessionSampleRate: 1` kept ~0.01% of sessions instead of 1%.
+  //
+  // Without `excludeFromSampling`, JS rolls and the rate sent to native is pinned to 100
+  // so native does not roll again; a losing roll returns here, which also keeps JS
+  // instrumentation off a session that would emit nothing. With `excludeFromSampling`,
+  // only native can honour "sampled out, but still emit these categories", so JS does not
+  // roll and forwards the real rate — pinning to 100 there would sample every session in.
+  const hasExcludeOverrides = ((_resolvedOptions$excl = (_resolvedOptions$excl2 = resolvedOptions.excludeFromSampling) == null ? void 0 : _resolvedOptions$excl2.length) != null ? _resolvedOptions$excl : 0) > 0;
+  if (!hasExcludeOverrides && !isSamplingOn(resolvedOptions.sessionSampleRate)) {
+    logger.debug('CoralogixRum: Session tracking is disabled');
+    return;
+  }
+  nativeOwnsSamplingRoll = hasExcludeOverrides;
+  const nativeSessionSampleRate = hasExcludeOverrides ? resolvedOptions.sessionSampleRate : 100;
+
+  // Past every bail-out above: this init is really happening, and only from here is there
+  // an in-flight run for other callers to join. Everything above returns synchronously, so
+  // `init` can read this the moment it calls us. Keep this immediately before the first
+  // `await` — moving it after one would leave concurrent callers un-deduplicated.
+  progress.reachedAsyncWork = true;
+  await registerCoralogixInstrumentations(resolvedOptions);
+  let finalOptions;
+  const lastNavRoute = getLastNavigationRouteDetected();
+  if (lastNavRoute) {
+    finalOptions = _extends({}, resolvedOptions, {
+      view_context: {
+        view: lastNavRoute
+      }
+    });
+  } else {
+    finalOptions = resolvedOptions;
+  }
+  if (finalOptions.tracesExporter) {
+    const callback = finalOptions.tracesExporter;
+    tracesExporterSubscription = eventEmitter.addListener('onTracesExport', jsonString => {
+      let data;
+      try {
+        data = JSON.parse(jsonString);
+      } catch (e) {
+        logger.warn('Error parsing onTracesExport payload:', e);
+        return;
+      }
+      try {
+        callback(data);
+      } catch (e) {
+        logger.warn('tracesExporter callback threw:', e);
+      }
+    });
+  }
+  await CxSdk.initialize(_extends({}, finalOptions, {
+    sessionSampleRate: nativeSessionSampleRate,
+    frameworkVersion: pkg.version,
+    networkExtraConfig: finalOptions.networkExtraConfig ? serializeNetworkCaptureRules(finalOptions.networkExtraConfig) : undefined,
+    hasBeforeSend: !!finalOptions.beforeSend,
+    hasTracesExporter: !!finalOptions.tracesExporter
+  }));
+  isInited = true;
+}
+
+/**
+ * Undo what a failed init attempt registered. `shutdown()` early-returns while `isInited`
+ * is false, and the next `init()` overwrites these handles, so without this the failed
+ * attempt's instrumentations stay registered and reporting for the rest of the session and
+ * a retry ends up running two sets of them.
+ */
+function rollbackFailedInit() {
+  _deregisterInstrumentations == null || _deregisterInstrumentations();
+  _deregisterInstrumentations = undefined;
+  if (tracesExporterSubscription) {
+    tracesExporterSubscription.remove();
+    tracesExporterSubscription = undefined;
+  }
+  cleanupResources();
+}
 const CoralogixRum = {
   get isInited() {
     return isInited;
   },
-  init: async function (options) {
-    var _resolvedOptions$debu, _resolvedOptions$excl, _resolvedOptions$excl2;
+  init: function (options) {
     if (isInited) {
-      console.warn('[Coralogix React Native SDK] - already initialized');
-      return;
-    }
-    if (typeof (options == null ? void 0 : options.public_key) !== 'string' || options.public_key.length === 0) {
-      console.warn('[Coralogix React Native SDK] - `public_key` is required and must be a non-empty string; initialization aborted.');
-      return;
-    }
-    const resolvedOptions = resolveCoralogixOtelWebConfig(options);
-    logger.shouldLog = (_resolvedOptions$debu = resolvedOptions.debug) != null ? _resolvedOptions$debu : false;
-    const hasExcludeOverrides = ((_resolvedOptions$excl = (_resolvedOptions$excl2 = resolvedOptions.excludeFromSampling) == null ? void 0 : _resolvedOptions$excl2.length) != null ? _resolvedOptions$excl : 0) > 0;
-    if (!isSamplingOn(resolvedOptions.sessionSampleRate) && !hasExcludeOverrides) {
-      logger.debug('CoralogixRum: Session tracking is disabled');
-      return;
+      logger.warn('already initialized');
+      return Promise.resolve();
     }
-    await registerCoralogixInstrumentations(resolvedOptions);
-    let finalOptions;
-    const lastNavRoute = getLastNavigationRouteDetected();
-    if (lastNavRoute) {
-      finalOptions = _extends({}, resolvedOptions, {
-        view_context: {
-          view: lastNavRoute
-        }
-      });
-    } else {
-      finalOptions = resolvedOptions;
+
+    // `isInited` flips only once native init has resolved, which is a couple of bridge
+    // round trips away — hundreds of ms on a dev/debug startup, where the JS and main
+    // threads are busy. A caller that guards on `CoralogixRum.isInited` therefore still
+    // reads `false` for that whole window, so a second `init()` from another bootstrap
+    // path used to walk past the guard above and initialize everything a second time:
+    // duplicate instrumentations, a leaked `_deregisterInstrumentations`, a leaked
+    // `onTracesExport` listener and a second native session. Hand every caller inside
+    // the window the same in-flight promise instead — one init, and awaiting any of the
+    // calls waits for that one to finish.
+    if (initPromise) {
+      logger.warn('initialization already in progress');
+      return initPromise;
     }
-    if (finalOptions.tracesExporter) {
-      const callback = finalOptions.tracesExporter;
-      tracesExporterSubscription = eventEmitter.addListener('onTracesExport', jsonString => {
-        let data;
-        try {
-          data = JSON.parse(jsonString);
-        } catch (e) {
-          logger.warn('Error parsing onTracesExport payload:', e);
-          return;
-        }
-        try {
-          callback(data);
-        } catch (e) {
-          logger.warn('tracesExporter callback threw:', e);
-        }
-      });
+    const progress = {
+      reachedAsyncWork: false
+    };
+    const run = runInit(options, progress);
+
+    // `runInit` runs synchronously until its first `await`, so this already tells us
+    // whether it bailed out — invalid key, or a session sampled out. Such a run is
+    // finished and must not be memoized: its cleanup below only lands on a later
+    // microtask, so a valid `init()` in this same tick would otherwise join the aborted
+    // promise and never initialize at all.
+    if (!progress.reachedAsyncWork) {
+      return run;
     }
-    await CxSdk.initialize(_extends({}, finalOptions, {
-      frameworkVersion: pkg.version,
-      networkExtraConfig: finalOptions.networkExtraConfig ? serializeNetworkCaptureRules(finalOptions.networkExtraConfig) : undefined,
-      hasBeforeSend: !!finalOptions.beforeSend,
-      hasTracesExporter: !!finalOptions.tracesExporter
-    }));
-    isInited = true;
+
+    // Cleared once it settles: on success `isInited` takes over as the guard, and on
+    // failure a later `init()` can try again exactly as before.
+    initPromise = run.catch(error => {
+      rollbackFailedInit();
+      throw error;
+    }).finally(() => {
+      initPromise = undefined;
+    });
+    return initPromise;
   },
   shutdown: () => {
     if (!isInited) {
@@ -1278,7 +2071,21 @@ const SessionReplay = {
       logger.warn("invalid options in SessionReplay.init: ", options);
       return false;
     }
-    return await CxSdk.initializeSessionReplay(options);
+    try {
+      // iOS resolves the string "initializeSessionReplay success" rather than a boolean,
+      // so coerce instead of handing a truthy string back through a `Promise<boolean>`.
+      return !!(await CxSdk.initializeSessionReplay(options));
+    } catch (e) {
+      // When native owns the sampling roll, a sampled-out session leaves no native RUM
+      // behind and iOS rejects rather than resolving. That is an expected outcome, not a
+      // failure, so report it as `false` like the guards above rather than surfacing an
+      // unhandled rejection. Every other rejection is a real error and stays the caller's.
+      if (!nativeOwnsSamplingRoll) {
+        throw e;
+      }
+      logger.warn('SessionReplay.init: no native RUM for this session (sampled out); replay not started.', e);
+      return false;
+    }
   },
   shutdown: async () => {
     logger.debug("session replay: shutdown called");
@@ -1304,13 +2111,7 @@ const SessionReplay = {
     logger.debug("session replay: stopSessionRecording called");
     CxSdk.stopSessionRecording();
   },
-  maskView: event => {
-    logger.debug("session replay: maskViewByTag called");
-    const viewTag = findNodeHandle(event.target);
-    if (viewTag) {
-      CxSdk.maskViewByTag(viewTag);
-    }
-  }
+  maskView
 };
 function trackMobileVitals(options) {
   var _options$mobileVitals;
@@ -1398,6 +2199,13 @@ async function registerCoralogixInstrumentations(options) {
         CxSdk.reportUserInteraction(ctx);
       }
     }));
+  } else {
+    // Patching happens when the instrumentation module loads, because an element
+    // captures its component type when it is created and a later swap cannot
+    // reach an already-mounted tree. That is before any options exist to read,
+    // so an explicit opt-out is honored here instead, by putting the originals
+    // back now that we know.
+    restoreUserInteractionComponents();
   }
 
   // Register Instrumentations
@@ -1470,6 +2278,12 @@ const EDITABLE_SESSION_FIELDS = ['user_id', 'user_name', 'user_email', 'user_met
  * Mirrors the native SDKs' read-only set. `view_number` and `isNavigationEvent`
  * are included for the same reason they are natively: they record what the SDK
  * saw at build time, not a property derived from the (possibly relabelled) event.
+ *
+ * `interaction_context` is intentionally NOT here: a callback blanking the tap
+ * coordinates or dropping a masked interaction outright is the supported escape
+ * hatch for masking policies stricter than the default. Its one SDK-owned field,
+ * `is_masked_element`, is restored by {@link restoreInteractionMaskFlag}, not
+ * by this list.
  */
 const READ_ONLY_CX_RUM_KEYS = ['snapshot_context', 'isSnapshotEvent', 'mobile_sdk', 'timestamp', 'traceId', 'spanId', 'fingerPrint', 'prev_session', 'platform', 'view_number', 'isNavigationEvent'];
 const isPlainObject = value => typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -1523,6 +2337,62 @@ const rebuildSessionContext = (merged, original) => {
   }
   return rebuilt;
 };
+const IS_MASKED_ELEMENT_KEY = 'is_masked_element';
+
+/**
+ * Puts the SDK's `is_masked_element` back on `interaction_context`, in place.
+ *
+ * The flag is deliberately VISIBLE to the callback — reading it is how a
+ * customer enforces a masking policy stricter than the default — but it is the
+ * SDK's own observation, so visibility must not make it writable: a forged
+ * value would corrupt the audit trail the flag exists to provide. Same
+ * visible-read-only treatment as `session_context.isSessionSampledIn`, and the
+ * same enforcement point: native uploads the batch JS hands back verbatim, so
+ * the bridge is the only place a rewrite can be caught.
+ *
+ * The rest of `interaction_context` stays editable — blanking coordinates or
+ * redacting text fields is the supported escape hatch, and so is dropping the
+ * whole container, which keeps the flag alone rather than resurrecting the
+ * fields the callback removed.
+ *
+ * @param merged              `cx_rum` as it stands after the callback ran.
+ * @param originalInteraction `interaction_context` snapshotted *before* the
+ *                            callback ran.
+ */
+const restoreInteractionMaskFlag = (merged, originalInteraction) => {
+  const mergedInteraction = merged['interaction_context'];
+  if (!isPlainObject(originalInteraction)) {
+    // Native never sent an interaction_context, so a callback must not be able
+    // to stamp the SDK-observation flag on one it invented.
+    if (isPlainObject(mergedInteraction)) {
+      delete mergedInteraction[IS_MASKED_ELEMENT_KEY];
+    }
+    return;
+  }
+
+  // A callback that dropped interaction_context, or replaced it with something
+  // that is not an object, keeps only the flag — on a fresh minimal object.
+  //
+  // Restoring the SDK's whole object here would re-ship exactly what the
+  // callback was trying to get rid of: `delete event.interaction_context` is a
+  // very plausible reading of "drop this interaction's details", and it would
+  // silently put the coordinates and target_element_inner_text back. The flag
+  // still has to survive, or erasing the container would be a way to erase an
+  // SDK observation, so it is carried over on its own and nothing else is.
+  if (!isPlainObject(mergedInteraction)) {
+    merged['interaction_context'] = IS_MASKED_ELEMENT_KEY in originalInteraction ? {
+      [IS_MASKED_ELEMENT_KEY]: originalInteraction[IS_MASKED_ELEMENT_KEY]
+    } : {};
+    return;
+  }
+  if (IS_MASKED_ELEMENT_KEY in originalInteraction) {
+    mergedInteraction[IS_MASKED_ELEMENT_KEY] = originalInteraction[IS_MASKED_ELEMENT_KEY];
+  } else {
+    // An older native SDK omits the flag; the SDK never invents one, so neither
+    // may a callback.
+    delete mergedInteraction[IS_MASKED_ELEMENT_KEY];
+  }
+};
 
 /** Puts the SDK's values back on the read-only top-level keys, in place. */
 const restoreReadOnlyCxRumKeys = (merged, protectedValues) => {
@@ -1571,6 +2441,7 @@ const subscription = eventEmitter.addListener('onBeforeSend', events => {
           }
         }
         const protectedSessionContext = cloneBridgeValue(event == null ? void 0 : event.session_context);
+        const protectedInteractionContext = cloneBridgeValue(event == null ? void 0 : event.interaction_context);
         const res = beforeSendCallback(event);
         if (!res) {
           continue;
@@ -1591,6 +2462,7 @@ const subscription = eventEmitter.addListener('onBeforeSend', events => {
         const mergedCxRum = _extends({}, fullEvent.text.cx_rum, edits);
         mergedCxRum.session_context = rebuildSessionContext(mergedCxRum.session_context, protectedSessionContext);
         restoreReadOnlyCxRumKeys(mergedCxRum, protectedValues);
+        restoreInteractionMaskFlag(mergedCxRum, protectedInteractionContext);
         const mergeEvent = _extends({}, fullEvent, {
           text: _extends({}, fullEvent.text, {
             cx_rum: mergedCxRum
@@ -1610,4 +2482,4 @@ const subscription = eventEmitter.addListener('onBeforeSend', events => {
   }
 });
 
-export { CoralogixCustomSpan, CoralogixCustomTracer, CoralogixDomain, CoralogixEventType, CoralogixGlobalSpan, CoralogixLogSeverity, CoralogixRum, CxSdk, SessionReplay, attachReactNavigationObserver, parseErrorStack, waitForFatalErrorFlush };
+export { CoralogixCustomSpan, CoralogixCustomTracer, CoralogixDomain, CoralogixEventType, CoralogixGlobalSpan, CoralogixLogSeverity, CoralogixRum, CxSdk, Masked, SessionReplay, attachReactNavigationObserver, parseErrorStack, waitForFatalErrorFlush };