@debugbundle/sdk-react-native 1.3.0 → 3.0.0

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## [Unreleased]
+
+## [3.0.0] - 2026-09-25
+
+### Changed
+
+- Bound pending native probe and context calls with the shared event bridge budgets, contain throwing capture context accessors, and sanitize context field names before retaining or handing off values. Context keeps at most 50 fields with 128-character keys; saturated probes and context updates are best-effort drops.
+
+- Reject locally disabled or below-threshold logs and disabled request capture before JavaScript context redaction and `beforeSend`; filtered console records skip argument formatting when the SDK client exposes its eligibility check.
+- Limit unresolved native bridge event calls to 256 and 4 MiB, with 32 calls and 1 MiB reserved for errors and exceptions. Individual retained events are capped at 64 KiB; calls above capacity are discarded so a stalled bridge cannot retain an unbounded promise backlog.
+
+## [2.0.0] - 2026-09-21
+
+### Security
+
+- Enforce mandatory JavaScript capture protection before and after `beforeSend` and before native bridge calls, including the legacy bridge fallback.
+
+### Changed
+
+- Pin the protected Android 2.0.0 and Swift 2.0 release lines and fail the release when any wrapper, bridge, podspec, Android, or smoke-test version drifts.
+- Require published-native Android 17/API 37.0 and Xcode 27/iOS 27 app-delivery gates before npm publication.
+
 ## [1.3.0] - 2026-09-12
 
 ### Changed
@@ -10,8 +32,6 @@ All notable changes to this project will be documented in this file.
 - Use Android1.3.1 with complete packaged Apache licenses and the Apache-2.0 Swift SDK1.3.0.
 - Publish npm releases through GitHub Actions trusted publishing without an npm token.
 
-## Unreleased
-
 ## 1.2.0 - 2026-07-29
 
 - Preserve React Native SDK identity, original JavaScript error fields, service, correlation, context, probes, and mobile metadata through additive Android and Swift external-event APIs.

package/DebugBundleReactNative.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name         = "DebugBundleReactNative"
-  s.version      = "1.3.0"
+  s.version      = "3.0.0"
   s.summary      = "React Native wrapper for the DebugBundle mobile SDKs."
   s.license      = { :type => "Apache-2.0", :file => "LICENSE" }
   s.author       = { "DebugBundle" => "support@debugbundle.com" }
@@ -12,5 +12,5 @@ Pod::Spec.new do |s|
 
   s.dependency "React-Core"
   install_modules_dependencies(s) if defined?(install_modules_dependencies)
-  s.dependency "DebugBundle", "~> 1.3"
+  s.dependency "DebugBundle", "~> 3.0"
 end

package/MIGRATION-3.0.md

@@ -0,0 +1,9 @@
+# React Native 3.0 migration
+
+React Native 2.0 remains the published compatibility baseline. Version 3 uses the hardened Swift3 and Android3 native SDKs with the same installation flow and bridge APIs; no collector or extra service is needed. Install/rebuild the native binary when upgrading and verify both native dependency versions before publishing the wrapper.
+
+Optional `beforeSend` callbacks run after capture returns on the JavaScript event loop. They must return promptly: closures retain application state and cannot be transparently moved to isolated workers. Hook side effects are no longer synchronous with capture. Valid replacements, null drops and protected-original fallback for thrown/invalid hooks remain supported. Final values receive privacy protection and level checks again before native handoff.
+
+Privacy-safe pending preparation and native calls share a 256-call/4-MiB cap. Low-priority work may use224 calls/3MiB, reserving space for errors and exceptions. Both the protected original and final bridge snapshot stay charged until the bridge settles. Under pressure a pending hook or valid expanded replacement can be discarded; it never causes a return to pre-hook application content. SDK-owned queues stay bounded if the native bridge stalls. Explicit flush lets prior deferred preparations reach the bridge before requesting the native flush.
+
+The existing canonical and legacy native bridge methods remain supported. Context, probes, JavaScript error identity and native offline/ACK behavior remain available. Swift3 and Android3 document background persistence and safe custom-exception projection separately.

package/README.md

@@ -15,6 +15,7 @@ Published implementation:
 - React Navigation breadcrumb helpers.
 - `fetch` and `XMLHttpRequest` instrumentation with target-scoped `X-DebugBundle-Trace-Id`.
 - JS-side bounded serialization and redaction before native queue persistence.
+- Local log level, log capture, and request capture switches are checked before event construction or `beforeSend`. A stalled native bridge accepts at most 224 lower-priority event calls / 3 MiB and reserves 32 more calls / 1 MiB for errors and exceptions. Each event is capped at 64 KiB; excess calls are discarded.
 - Android and iOS native wrappers that delegate queueing, config/status, request capture, crash/error capture, flushing, and probe trigger activation to the native SDK foundations.
 - Repository-local Android Java, Swift, and Objective-C++ wrapper tests with an
   enforced 80% line-coverage floor for every handwritten native bridge source.
@@ -25,9 +26,9 @@ Published implementation:
 | Lane | Support |
 | --- | --- |
 | Minimum compatibility | React Native 0.76+, React 18.2+, iOS 15+, Android minSdk 23 |
-| Recommended production | Current stable React Native 0.86.x with Hermes and the New Architecture enabled where your app supports it |
+| Recommended production | Current stable React Native 0.87.x with Hermes and the New Architecture enabled where your app supports it |
 | Installed-base compatibility | React Native 0.76 through current stable, including legacy bridge apps |
-| Rolling CI | TypeScript/package smoke, Android bridge compile on RN 0.76.9, 0.82.1, and 0.85.3, bare iOS compatibility/current-installed-base lanes, plus Expo SDK 57 / RN 0.86 Android and iOS development builds |
+| Rolling CI | TypeScript/package smoke, Android bridge compile on RN 0.76.9, 0.82.1, 0.85.3, and 0.87.1, bare iOS compatibility/current-installed-base lanes, plus Expo SDK 57 / RN 0.86 Android and iOS development builds |
 | Expo | Expo development builds and prebuild; Expo Go is degraded because it cannot load custom native modules |
 
 JSC compatibility is best-effort where the selected React Native lane still supports it. Hermes is the primary tested JavaScript engine.
@@ -141,4 +142,8 @@ checks.
 
 ## Release
 
-The package publishes to npm from `v*` tags through GitHub Actions. Configure an npm GitHub Actions trusted publisher for `debugbundle/debugbundle-react-native` and `release.yml`, with a blank environment and direct `npm publish` enabled. Publishing uses OIDC without a long-lived npm token. Make sure the tag matches `package.json` exactly, for example `v1.3.0`, and push the tag only after the exact Android and Swift native dependency line referenced by this package is available to Maven Central and CocoaPods consumers. The release workflow compiles clean apps against those published artifacts before npm publication.
+The package publishes to npm from `v*` tags through GitHub Actions. Configure an npm GitHub Actions trusted publisher for `debugbundle/debugbundle-react-native` and `release.yml`, with a blank environment and direct `npm publish` enabled. Publishing uses OIDC without a long-lived npm token. Make sure the tag matches `package.json` exactly. The next protected release requires a matching 2.x wrapper/Swift pod line and a published Android 2.x BOM/module pin. `make check-protected-native-pins` refuses the current 1.x source line; update the wrapper version, native pins, and embedded SDK versions together only after the exact Android and Swift artifacts are available to Maven Central and CocoaPods consumers. The release workflow then compiles and runs clean apps against those published artifacts on Android API 37 and Xcode 27 before npm publication.
+
+Probe and context native calls share the event bridge's pending count and byte limits, including reserved exception capacity. Saturated auxiliary calls are discarded without evaluating probe suppliers. Probe labels are limited to 128 characters. Persistent JS context retains at most 50 fields with keys up to 128 characters, and field-sensitive privacy runs before local retention and native handoff. Throwing capture context accessors are withheld without escaping into application code. These bounds do not move native SDK persistence off its caller thread.
+
+Version 3 defers optional `beforeSend` callbacks until capture returns. Callbacks run on the JavaScript event loop and must return promptly. Pending preparation and native delivery share bounded count/byte limits; valid expanded replacements may be dropped under pressure. See [the version3 migration guide](MIGRATION-3.0.md).

package/android/build.gradle

@@ -11,7 +11,7 @@ if (isReactNativeHostBuild) {
 def hostKotlinVersion = rootProject.ext.has("kotlinVersion")
   ? rootProject.ext.get("kotlinVersion")
   : "2.1.20"
-def debugBundleAndroidVersion = rootProject.findProperty("debugBundleAndroidVersion") ?: "1.3.1"
+def debugBundleAndroidVersion = rootProject.findProperty("debugBundleAndroidVersion") ?: "3.0.0"
 
 android {
   namespace "com.debugbundle.reactnative"
@@ -32,7 +32,7 @@ android {
 }
 
 dependencies {
-  compileOnly "com.facebook.react:react-android:${rootProject.findProperty("reactNativeVersion") ?: "0.85.3"}"
+  compileOnly "com.facebook.react:react-android:${rootProject.findProperty("reactNativeVersion") ?: "0.87.1"}"
   implementation "org.jetbrains.kotlin:kotlin-stdlib:${hostKotlinVersion}"
   implementation platform("com.debugbundle:debugbundle-android-bom:${debugBundleAndroidVersion}")
   implementation("com.debugbundle:debugbundle-android") {
@@ -40,7 +40,7 @@ dependencies {
     exclude group: "org.jetbrains.kotlin", module: "kotlin-stdlib-jdk7"
     exclude group: "org.jetbrains.kotlin", module: "kotlin-stdlib-jdk8"
   }
-  testImplementation "com.facebook.react:react-android:${rootProject.findProperty("reactNativeVersion") ?: "0.85.3"}"
+  testImplementation "com.facebook.react:react-android:${rootProject.findProperty("reactNativeVersion") ?: "0.87.1"}"
   testImplementation "junit:junit:4.13.2"
   testImplementation "org.mockito:mockito-core:5.14.2"
 }

package/android/src/main/java/com/debugbundle/reactnative/DebugBundleReactNativeModule.java

@@ -199,12 +199,12 @@ public final class DebugBundleReactNativeModule extends ReactContextBaseJavaModu
     }
   }
 
-  private String currentSdkVersion = "1.3.0";
+  private String currentSdkVersion = "3.0.0";
   private String currentService = "react-native-app";
   private String currentEnvironment = "production";
 
   private DebugBundleConfig createConfig(ReadableMap config) {
-    currentSdkVersion = stringOrDefault(config, "sdkVersion", "1.3.0");
+    currentSdkVersion = stringOrDefault(config, "sdkVersion", "3.0.0");
     currentService = stringOrDefault(config, "service", "react-native-app");
     currentEnvironment = stringOrDefault(config, "environment", "production");
     return DebugBundleConfig.create(

package/app.plugin.js

@@ -49,4 +49,4 @@ function withAndroidDesugaring(contents) {
   return next;
 }
 
-export default createRunOncePlugin(withDebugBundle, "@debugbundle/sdk-react-native", "1.3.0");
+export default createRunOncePlugin(withDebugBundle, "@debugbundle/sdk-react-native", "3.0.0");

package/dist/before-send.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"before-send.d.ts","sourceRoot":"","sources":["../src/before-send.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AA2ClF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,wBAAwB,EAC/B,IAAI,EAAE,qBAAqB,GAAG,IAAI,GACjC,wBAAwB,GAAG,IAAI,CAajC"}
+{"version":3,"file":"before-send.d.ts","sourceRoot":"","sources":["../src/before-send.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AA2ClF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,wBAAwB,EAC/B,IAAI,EAAE,qBAAqB,GAAG,IAAI,GACjC,wBAAwB,GAAG,IAAI,CAmBjC"}

package/dist/before-send.js

@@ -42,6 +42,12 @@ export function applyBeforeSend(event, hook) {
     }
     try {
         const result = hook(cloneEvent(event));
+        // Hooks have synchronous return contracts. Contain mistaken async failures
+        // before treating their Promise as invalid and keeping the protected original.
+        if (result instanceof Promise) {
+            void result.catch(() => undefined);
+            return event;
+        }
         if (result === null) {
             return null;
         }

package/dist/client.d.ts

@@ -7,6 +7,8 @@ export declare class DebugBundleReactNativeClient implements DebugBundleClient {
     private breadcrumbs;
     private probeBuffers;
     private jsProbeActivationExpiresAt;
+    private pendingNativeCalls;
+    private pendingNativeBytes;
     constructor(config?: DebugBundleConfig);
     get status(): DebugBundleStatus;
     get lastEventAt(): number | null;
@@ -14,15 +16,21 @@ export declare class DebugBundleReactNativeClient implements DebugBundleClient {
     captureException(error: unknown, context?: DebugBundleCaptureContext): void;
     captureError(error: unknown, context?: DebugBundleCaptureContext): void;
     captureLog(message: string, level?: DebugBundleLogLevel, context?: DebugBundleCaptureContext): void;
+    isLogEnabled(level: DebugBundleLogLevel): boolean;
     captureRequest(request: DebugBundleRequestInfo, response: DebugBundleResponseInfo, context?: DebugBundleCaptureContext): void;
     captureMessage(message: string, level?: DebugBundleLogLevel, context?: DebugBundleCaptureContext): void;
     setContext(key: string, value: unknown): void;
     probe(label: string, data: unknown | (() => unknown), options?: DebugBundleProbeOptions): void;
+    private enqueueNativeAuxiliary;
     flush(): Promise<void>;
     activateProbeTriggerToken(token: string): Promise<boolean>;
     recordBreadcrumb(type: string, data?: Record<string, unknown>): void;
     recordScreen(screenName: string, previousScreen?: string | null, source?: string): void;
     private enqueue;
+    private sendAdmittedEvent;
+    private prepareAdmittedEvent;
+    private hasNativeCapacity;
+    private releaseNativeCapacity;
     private canCapture;
     private mergeContext;
     private snapshotProbeData;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EAEjB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EAIjB,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAYpB,qBAAa,4BAA6B,YAAW,iBAAiB;IACpE,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,YAAY,CAAwC;IAC5D,OAAO,CAAC,WAAW,CAAkE;IACrF,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,YAAY,CAAqD;IACzE,OAAO,CAAC,0BAA0B,CAAK;gBAE3B,MAAM,GAAE,iBAAsB;IAO1C,IAAI,MAAM,IAAI,iBAAiB,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IA8BrC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,yBAA8B,GAAG,IAAI;IAc/E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,yBAA8B,GAAG,IAAI;IAI3E,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,mBAA+B,EAAE,OAAO,GAAE,yBAA8B,GAAG,IAAI;IAYlH,cAAc,CACZ,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,uBAAuB,EACjC,OAAO,GAAE,yBAA8B,GACtC,IAAI;IA+BP,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,mBAA+B,EAAE,OAAO,GAAE,yBAA8B,GAAG,IAAI;IAQtH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAS7C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,OAAO,GAAE,uBAA4B,GAAG,IAAI;IA4B5F,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWhE,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,IAAI;IAcxE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,GAAE,MAAM,GAAG,IAAW,EAAE,MAAM,SAAqB,GAAG,IAAI;IAWzG,OAAO,CAAC,OAAO;IA6Cf,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,0BAA0B;CAInC;AAED,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,iBAAsB,GAAG,4BAA4B,CAEpG;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,yBAAyB,CAsClF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EAEjB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EAIjB,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAoDpB,qBAAa,4BAA6B,YAAW,iBAAiB;IACpE,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,YAAY,CAAwC;IAC5D,OAAO,CAAC,WAAW,CAAkE;IACrF,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,YAAY,CAAqD;IACzE,OAAO,CAAC,0BAA0B,CAAK;IACvC,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,kBAAkB,CAAK;gBAEnB,MAAM,GAAE,iBAAsB;IAO1C,IAAI,MAAM,IAAI,iBAAiB,CAE9B;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IA8BrC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,yBAA8B,GAAG,IAAI;IAgB/E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,yBAA8B,GAAG,IAAI;IAI3E,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,mBAA+B,EAAE,OAAO,GAAE,yBAA8B,GAAG,IAAI;IAalH,YAAY,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO;IAMjD,cAAc,CACZ,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,uBAAuB,EACjC,OAAO,GAAE,yBAA8B,GACtC,IAAI;IA6BP,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,mBAA+B,EAAE,OAAO,GAAE,yBAA8B,GAAG,IAAI;IAQtH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAqB7C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,OAAO,GAAE,uBAA4B,GAAG,IAAI;IAuBlG,OAAO,CAAC,sBAAsB;IASxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAatB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWhE,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,IAAI;IAcxE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,GAAE,MAAM,GAAG,IAAW,EAAE,MAAM,SAAqB,GAAG,IAAI;IAWzG,OAAO,CAAC,OAAO;IA4Df,OAAO,CAAC,iBAAiB;IA8BzB,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,qBAAqB;IAK7B,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,0BAA0B;CAInC;AAiBD,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,iBAAsB,GAAG,4BAA4B,CAEpG;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,yBAAyB,CAsClF"}

package/dist/client.js

@@ -1,8 +1,16 @@
 import { getNativeModule, degradedNativeState, safeNativeCall } from "./native.js";
 import { applyBeforeSend } from "./before-send.js";
 import { defaultRedactFields, DEFAULT_HEADER_ALLOWLIST, sanitizeHeaders, sanitizeValue } from "./redaction.js";
+import { sanitizeTelemetry } from "./privacy-telemetry.js";
 const SDK_NAME = "@debugbundle/sdk-react-native";
-const DEFAULT_SDK_VERSION = "1.3.0";
+const DEFAULT_SDK_VERSION = "3.0.0";
+const MAX_PENDING_NATIVE_CALLS = 256;
+const MAX_PENDING_LOW_PRIORITY_CALLS = 224;
+const MAX_PENDING_NATIVE_BYTES = 4 * 1024 * 1024;
+const MAX_PENDING_LOW_PRIORITY_BYTES = 3 * 1024 * 1024;
+const MAX_NATIVE_EVENT_BYTES = 64 * 1024;
+const MAX_CONTEXT_FIELDS = 50;
+const MAX_CONTEXT_KEY_LENGTH = 128;
 const LOG_LEVELS = {
     debug: 10,
     info: 20,
@@ -10,6 +18,37 @@ const LOG_LEVELS = {
     error: 40,
     critical: 50
 };
+function protectEventFields(event, additionalKeys) {
+    // Preserve typed identities only when their scalar values pass the mandatory policy.
+    for (const value of [event.schema_version, event.sdk_name, event.sdk_version,
+        ...Object.values(event.correlation ?? {})]) {
+        if (typeof value !== "string")
+            continue;
+        const checked = sanitizeTelemetry(value, { additionalKeys });
+        if (!checked.ok || checked.value !== value)
+            return null;
+    }
+    const result = sanitizeTelemetry({
+        service: event.service,
+        payload: event.payload,
+        ...(event.context ? { context: event.context } : {})
+    }, { additionalKeys });
+    if (!result.ok || !result.value || typeof result.value !== "object" || Array.isArray(result.value)) {
+        return null;
+    }
+    const safeFields = result.value;
+    if (!safeFields.service || !safeFields.payload ||
+        typeof safeFields.service !== "object" || Array.isArray(safeFields.service) ||
+        typeof safeFields.payload !== "object" || Array.isArray(safeFields.payload)) {
+        return null;
+    }
+    return {
+        ...event,
+        service: safeFields.service,
+        payload: safeFields.payload,
+        ...(event.context ? { context: safeFields.context } : {})
+    };
+}
 export class DebugBundleReactNativeClient {
     config;
     nativeModule = null;
@@ -18,6 +57,8 @@ export class DebugBundleReactNativeClient {
     breadcrumbs = [];
     probeBuffers = new Map();
     jsProbeActivationExpiresAt = 0;
+    pendingNativeCalls = 0;
+    pendingNativeBytes = 0;
     constructor(config = {}) {
         this.config = resolveConfig(config);
         if (Object.keys(config).length > 0) {
@@ -62,6 +103,9 @@ export class DebugBundleReactNativeClient {
         }
     }
     captureException(error, context = {}) {
+        if (!this.config.captureErrors || !this.canCapture("frontend_exception", false) ||
+            !this.hasNativeCapacity(true))
+            return;
         const mergedContext = this.mergeContext(context);
         const sanitizedError = asRecord(sanitizeValue(error, { redactFields: this.config.redactFields }));
         this.enqueue("frontend_exception", {
@@ -78,16 +122,26 @@ export class DebugBundleReactNativeClient {
         this.captureException(error, context);
     }
     captureLog(message, level = "warning", context = {}) {
+        if (!this.isLogEnabled(level))
+            return;
+        const mergedContext = this.mergeContext(context);
         this.enqueue("log_event", {
             level,
             message: sanitizeValue(message, { redactFields: this.config.redactFields }),
             attributes: {
-                ...asRecord(sanitizeValue(this.mergeContext(context), { redactFields: this.config.redactFields })),
+                ...asRecord(sanitizeValue(mergedContext, { redactFields: this.config.redactFields })),
                 source: "javascript"
             }
-        }, stringValue(context.trace_id), true, undefined, this.config.captureLogs && LOG_LEVELS[level] >= LOG_LEVELS[this.config.logLevel]);
+        }, stringValue(mergedContext.trace_id), true);
+    }
+    isLogEnabled(level) {
+        const rank = LOG_LEVELS[level];
+        return rank !== undefined && this.config.captureLogs && rank >= LOG_LEVELS[this.config.logLevel] &&
+            this.canCapture("log_event", true) && this.hasNativeCapacity(rank >= LOG_LEVELS.error);
     }
     captureRequest(request, response, context = {}) {
+        if (!this.config.captureNetwork || !this.canCapture("request_event", true) || !this.hasNativeCapacity(false))
+            return;
         const mergedContext = this.mergeContext(context);
         const traceId = request.traceId ?? stringValue(mergedContext.trace_id);
         const parsedUrl = parseRequestUrl(request.url);
@@ -105,10 +159,8 @@ export class DebugBundleReactNativeClient {
             }),
             duration_ms: response.durationMillis ?? 0
         };
-        if (this.config.captureNetwork) {
-            this.recordBreadcrumb("network_request", payload);
-        }
-        this.enqueue("request_event", payload, traceId, true, asRecord(sanitizeValue(mergedContext, { redactFields: this.config.redactFields })), this.config.captureNetwork);
+        this.recordBreadcrumb("network_request", payload);
+        this.enqueue("request_event", payload, traceId, true, asRecord(sanitizeValue(mergedContext, { redactFields: this.config.redactFields })));
     }
     captureMessage(message, level = "warning", context = {}) {
         this.recordBreadcrumb("message", {
@@ -118,39 +170,66 @@ export class DebugBundleReactNativeClient {
         });
     }
     setContext(key, value) {
-        this.context[key] = sanitizeValue(value, { redactFields: this.config.redactFields });
-        if (this.nativeModule?.setContextValue) {
-            void safeNativeCall(() => this.nativeModule.setContextValue(key, { value: this.context[key] }), undefined);
+        if (typeof key !== "string" || !key || key.length > MAX_CONTEXT_KEY_LENGTH ||
+            !this.hasNativeCapacity(false) ||
+            !Object.hasOwn(this.context, key) && Object.keys(this.context).length >= MAX_CONTEXT_FIELDS)
+            return;
+        try {
+            // Include the field name in mandatory privacy before local or native ownership.
+            const fields = asRecord(sanitizeValue({ [key]: value }, { redactFields: this.config.redactFields }));
+            if (!Object.hasOwn(fields, key))
+                return;
+            const entry = { value: fields[key] };
+            this.context = { ...this.context, [key]: entry.value };
+            const nativeModule = this.nativeModule;
+            if (nativeModule?.setContextValue) {
+                this.enqueueNativeAuxiliary({ key, entry }, () => nativeModule.setContextValue(key, entry));
+            }
+            else if (nativeModule?.setContext) {
+                this.enqueueNativeAuxiliary({ key, entry }, () => nativeModule.setContext(key, entry.value));
+            }
         }
-        else if (this.nativeModule?.setContext) {
-            void safeNativeCall(() => this.nativeModule.setContext(key, this.context[key]), undefined);
+        catch {
+            // Context accessors and optional native integrations cannot escape into the host.
         }
     }
     probe(label, data, options = {}) {
-        if (!label || this.probeBuffers.size >= this.config.maxProbeLabels && !this.probeBuffers.has(label)) {
-            return;
-        }
-        const nativeProbeActive = this.nativeModule?.isProbeActive?.(label) ?? false;
-        if (options.heavy && !nativeProbeActive && !this.hasActiveJsProbeActivation()) {
+        if (!label || label.length > MAX_CONTEXT_KEY_LENGTH || !this.hasNativeCapacity(false) ||
+            this.probeBuffers.size >= this.config.maxProbeLabels && !this.probeBuffers.has(label))
             return;
+        try {
+            const nativeModule = this.nativeModule;
+            const nativeProbeActive = nativeModule?.isProbeActive?.(label) ?? false;
+            if (options.heavy && !nativeProbeActive && !this.hasActiveJsProbeActivation())
+                return;
+            const value = typeof data === "function" ? safeInvoke(data) : data;
+            const sanitizedData = objectWrap(sanitizeValue(value, { redactFields: this.config.redactFields }));
+            const occurredAt = new Date().toISOString();
+            const entry = { label, data: sanitizedData, timestamp: occurredAt, activation_id: null };
+            const entries = this.probeBuffers.get(label) ?? [];
+            entries.push(entry);
+            this.probeBuffers.set(label, entries.slice(-this.config.maxProbeEntriesPerLabel));
+            if (nativeModule?.captureProbe) {
+                this.enqueueNativeAuxiliary({ label, data: sanitizedData, occurredAt }, () => nativeModule.captureProbe(label, sanitizedData, occurredAt));
+            }
         }
-        const value = typeof data === "function" ? safeInvoke(data) : data;
-        const sanitizedData = objectWrap(sanitizeValue(value, { redactFields: this.config.redactFields }));
-        const occurredAt = new Date().toISOString();
-        const entry = {
-            label,
-            data: sanitizedData,
-            timestamp: occurredAt,
-            activation_id: null
-        };
-        const entries = this.probeBuffers.get(label) ?? [];
-        entries.push(entry);
-        this.probeBuffers.set(label, entries.slice(-this.config.maxProbeEntriesPerLabel));
-        if (this.nativeModule?.captureProbe) {
-            void safeNativeCall(() => this.nativeModule.captureProbe(label, sanitizedData, occurredAt), false);
+        catch {
+            // Probe options, native activation readers and data access cannot throw into the host.
         }
     }
+    enqueueNativeAuxiliary(payload, operation) {
+        if (!this.hasNativeCapacity(false))
+            return;
+        const bytes = utf8ByteLength(JSON.stringify(payload));
+        if (bytes > MAX_NATIVE_EVENT_BYTES || this.pendingNativeBytes + bytes > MAX_PENDING_LOW_PRIORITY_BYTES)
+            return;
+        this.pendingNativeCalls += 1;
+        this.pendingNativeBytes += bytes;
+        void safeNativeCall(operation, undefined).finally(() => this.releaseNativeCapacity(bytes));
+    }
     async flush() {
+        // Hook preparation queued by earlier capture calls must reach the bridge first.
+        await Promise.resolve();
         if (!this.nativeModule) {
             return;
         }
@@ -194,43 +273,117 @@ export class DebugBundleReactNativeClient {
         });
     }
     enqueue(eventType, payload, traceId, countTowardSession, context, localPolicyAllows = true) {
-        if (!this.canCapture(eventType, countTowardSession)) {
+        if (!localPolicyAllows)
             return;
-        }
-        const authoredEvent = {
-            schema_version: "2026-03-01",
-            event_id: generateId(),
-            event_type: eventType,
-            sdk_name: SDK_NAME,
-            sdk_version: this.config.sdkVersion,
-            service: {
-                name: this.config.service,
-                environment: this.config.environment,
-                runtime: "react-native",
-                framework: "react-native"
-            },
-            occurred_at: new Date().toISOString(),
-            ...(traceId ? { correlation: { trace_id: traceId } } : {}),
-            ...(context && Object.keys(context).length > 0 ? { context } : {}),
-            payload: this.nativeState.device
-                ? { ...payload, device: canonicalDevice(this.nativeState.device, this.config) }
-                : payload
-        };
-        const event = applyBeforeSend(authoredEvent, this.config.beforeSend);
-        if (!event || !localPolicyAllows) {
+        if (!this.canCapture(eventType, countTowardSession)) {
             return;
         }
-        if (!this.nativeModule) {
-            this.nativeState = degradedNativeState("native_module_unavailable");
+        const highPriority = eventType === "frontend_exception" ||
+            eventType === "log_event" && (payload.level === "error" || payload.level === "critical");
+        if (!this.hasNativeCapacity(highPriority))
             return;
+        this.pendingNativeCalls += 1;
+        let handedOff = false;
+        let reservedBytes = 0;
+        try {
+            const authoredEvent = {
+                schema_version: "2026-03-01",
+                event_id: generateId(),
+                event_type: eventType,
+                sdk_name: SDK_NAME,
+                sdk_version: this.config.sdkVersion,
+                service: {
+                    name: this.config.service,
+                    environment: this.config.environment,
+                    runtime: "react-native",
+                    framework: "react-native"
+                },
+                occurred_at: new Date().toISOString(),
+                ...(traceId ? { correlation: { trace_id: traceId } } : {}),
+                ...(context && Object.keys(context).length > 0 ? { context } : {}),
+                payload: this.nativeState.device
+                    ? { ...payload, device: canonicalDevice(this.nativeState.device, this.config) }
+                    : payload
+            };
+            const initial = protectEventFields(authoredEvent, this.config.redactFields);
+            if (!initial)
+                return;
+            const config = this.config;
+            const nativeModule = this.nativeModule;
+            const initialBytes = utf8ByteLength(JSON.stringify(initial));
+            const byteLimit = highPriority ? MAX_PENDING_NATIVE_BYTES : MAX_PENDING_LOW_PRIORITY_BYTES;
+            if (initialBytes > MAX_NATIVE_EVENT_BYTES || this.pendingNativeBytes + initialBytes > byteLimit)
+                return;
+            this.pendingNativeBytes += initialBytes;
+            reservedBytes = initialBytes;
+            if (!nativeModule) {
+                this.nativeState = degradedNativeState("native_module_unavailable");
+                return;
+            }
+            handedOff = true;
+            this.sendAdmittedEvent(initial, config, nativeModule, reservedBytes);
         }
-        if (this.nativeModule.enqueueCanonicalEvent) {
-            void safeNativeCall(() => this.nativeModule.enqueueCanonicalEvent(event), undefined);
+        catch {
+            this.nativeState = degradedNativeState("event_preparation_failed");
         }
-        else {
-            void safeNativeCall(() => this.nativeModule.enqueueEvent(toLegacyNativeEvent(event)), undefined);
+        finally {
+            if (!handedOff)
+                this.releaseNativeCapacity(reservedBytes);
         }
     }
+    sendAdmittedEvent(initial, config, nativeModule, reservedBytes) {
+        // This activation receives only a protected snapshot: deferred closures must
+        // not retain the raw capture payload/context through their lexical scope.
+        const prepareAndSend = async () => {
+            if (this.config !== config)
+                return;
+            const safeEvent = this.prepareAdmittedEvent(initial, config, nativeModule.enqueueCanonicalEvent !== undefined);
+            if (safeEvent === null)
+                return;
+            const finalPriority = safeEvent.event_type === "frontend_exception" ||
+                safeEvent.event_type === "log_event" && ["error", "critical"].includes(String(safeEvent.payload.level));
+            const eventBytes = utf8ByteLength(JSON.stringify(safeEvent));
+            const finalLimit = finalPriority ? MAX_PENDING_NATIVE_BYTES : MAX_PENDING_LOW_PRIORITY_BYTES;
+            // The callback closure can retain the protected original until the bridge
+            // settles. Charge both it and the final snapshot instead of forgetting it.
+            if (eventBytes > MAX_NATIVE_EVENT_BYTES || this.pendingNativeBytes + eventBytes > finalLimit)
+                return;
+            this.pendingNativeBytes += eventBytes;
+            reservedBytes += eventBytes;
+            if (nativeModule.enqueueCanonicalEvent)
+                await nativeModule.enqueueCanonicalEvent(safeEvent);
+            else
+                await nativeModule.enqueueEvent(safeEvent);
+        };
+        const operation = config.beforeSend === null
+            ? safeNativeCall(prepareAndSend, undefined)
+            : Promise.resolve().then(() => safeNativeCall(prepareAndSend, undefined));
+        void operation.finally(() => { this.releaseNativeCapacity(reservedBytes); });
+    }
+    prepareAdmittedEvent(initial, config, canonical) {
+        // Exit this synchronous activation before awaiting the bridge. An application
+        // replacement may be huge before projection and must not survive suspension.
+        const event = applyBeforeSend(initial, config.beforeSend);
+        if (!event || this.config !== config)
+            return null;
+        const safeEvent = protectEventFields(event, config.redactFields);
+        if (!safeEvent)
+            return null;
+        if (safeEvent.event_type === "log_event" &&
+            (!config.captureLogs || !(LOG_LEVELS[safeEvent.payload.level] >= LOG_LEVELS[config.logLevel])))
+            return null;
+        if (safeEvent.event_type === "frontend_exception" && !config.captureErrors)
+            return null;
+        return canonical ? safeEvent : toLegacyNativeEvent(safeEvent);
+    }
+    hasNativeCapacity(highPriority) {
+        return this.pendingNativeCalls < (highPriority ? MAX_PENDING_NATIVE_CALLS : MAX_PENDING_LOW_PRIORITY_CALLS) &&
+            this.pendingNativeBytes < (highPriority ? MAX_PENDING_NATIVE_BYTES : MAX_PENDING_LOW_PRIORITY_BYTES);
+    }
+    releaseNativeCapacity(bytes) {
+        this.pendingNativeCalls -= 1;
+        this.pendingNativeBytes -= bytes;
+    }
     canCapture(eventType, countTowardSession) {
         if (!this.config.enabled || !this.config.projectToken) {
             return false;
@@ -240,7 +393,13 @@ export class DebugBundleReactNativeClient {
         return true;
     }
     mergeContext(context) {
-        return { ...this.context, ...context };
+        try {
+            return { ...this.context, ...context };
+        }
+        catch {
+            // A hostile caller accessor cannot interrupt error reporting or application work.
+            return { ...this.context };
+        }
     }
     snapshotProbeData() {
         if (!this.config.probeFlushOnError) {
@@ -255,6 +414,24 @@ export class DebugBundleReactNativeClient {
         return this.jsProbeActivationExpiresAt > Date.now();
     }
 }
+function utf8ByteLength(value) {
+    let bytes = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code < 0x80)
+            bytes += 1;
+        else if (code < 0x800)
+            bytes += 2;
+        else if (code >= 0xd800 && code <= 0xdbff && index + 1 < value.length &&
+            value.charCodeAt(index + 1) >= 0xdc00 && value.charCodeAt(index + 1) <= 0xdfff) {
+            bytes += 4;
+            index += 1;
+        }
+        else
+            bytes += 3;
+    }
+    return bytes;
+}
 export function createDebugBundleClient(config = {}) {
     return new DebugBundleReactNativeClient(config);
 }

package/dist/console.d.ts

@@ -1,3 +1,5 @@
-import type { DebugBundleClient } from "./types.js";
-export declare function captureDebugBundleConsole(client: Pick<DebugBundleClient, "captureLog">): () => void;
+import type { DebugBundleClient, DebugBundleLogLevel } from "./types.js";
+export declare function captureDebugBundleConsole(client: Pick<DebugBundleClient, "captureLog"> & {
+    isLogEnabled?: (level: DebugBundleLogLevel) => boolean;
+}): () => void;
 //# sourceMappingURL=console.d.ts.map

package/dist/console.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../src/console.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAuB,MAAM,YAAY,CAAC;AAIzE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GAAG,MAAM,IAAI,CAiCnG"}
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../src/console.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAIzE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GAAG;IACxF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC;CACxD,GAAG,MAAM,IAAI,CAoCb"}

package/dist/console.js

@@ -26,8 +26,13 @@ export function captureDebugBundleConsole(client) {
         }
         inCapture = true;
         try {
+            if (client.isLogEnabled?.(level) === false)
+                return;
             client.captureLog(args.map(String).join(" "), level, { source: "console" });
         }
+        catch {
+            // Console instrumentation must not change host logging behavior.
+        }
         finally {
             inCapture = false;
         }

package/dist/privacy-keys.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_SENSITIVE_KEYS: readonly ["password", "secret", "token", "api_key", "apikey", "access_token", "refresh_token", "private_key", "authorization", "bearer", "cookie", "session_id", "passwd", "ssn", "credit_card", "card_number", "cvv", "cvc", "pin", "expiry", "phone", "otp", "verification_code"];
+export declare function isSensitiveKey(key: string, sensitiveKeys: readonly string[]): boolean;
+//# sourceMappingURL=privacy-keys.d.ts.map

package/dist/privacy-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-keys.d.ts","sourceRoot":"","sources":["../src/privacy-keys.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,qRAKzB,CAAC;AAeX,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAkBrF"}