@scalebun/react-native 1.10.3 → 1.10.5

package/lib/commonjs/features/session/BackendSessionAdapter.js

@@ -99,6 +99,13 @@ class BackendSessionAdapter {
   // the flush timer retries, so nothing is lost to a start/child race. The durable native
   // outbox path has its own ordering; this guards only the JS in-memory fallback.
   _startedSessionIds = new Set();
+  // §11 offline-start recovery: INGESTION_START payloads whose POST failed (e.g. the app
+  // launched with no connectivity). Without this, a failed START was logged and forgotten —
+  // the row-ready gate never opened, every child lane re-buffered forever, and the session
+  // stayed stuck until an app restart even after the network returned. Each flush tick
+  // re-attempts these until acked (network errors keep retrying; permanent 4xx gives up).
+  _pendingStartPayloads = new Map();
+  _startRetryInFlight = false;
   pendingFrames = [];
   pendingEvents = [];
   pendingNetworkRequests = [];
@@ -234,11 +241,20 @@ class BackendSessionAdapter {
         }
       };
       __DEV__ && _internalLogger.logger.debug(`[BackendSessionAdapter] POST session start: ${session.sessionId}`);
-      return this._post(startEndpoint, payload);
-    }).then(() => {
-      // §11: row now exists — release the child-lane flush gate for this id.
-      this._startedSessionIds.add(session.sessionId);
-      __DEV__ && _internalLogger.logger.info(`[ScaleBun Replay] backend session upload success`);
+      return this._post(startEndpoint, payload).then(() => {
+        // §11: row now exists — release the child-lane flush gate for this id.
+        this._startedSessionIds.add(session.sessionId);
+        this._pendingStartPayloads.delete(session.sessionId);
+        __DEV__ && _internalLogger.logger.info(`[ScaleBun Replay] backend session upload success`);
+      }, err => {
+        // Offline-start recovery: keep the payload; the flush timer re-attempts it
+        // until the row is acked. A permanent 4xx (rejected key) is not retried —
+        // the same payload can never succeed.
+        if (!BackendSessionAdapter._isPermanentHttpError(err)) {
+          this._pendingStartPayloads.set(session.sessionId, payload);
+        }
+        _internalLogger.logger.info(`[ScaleBun Replay] backend session upload failure`);
+      });
     }).catch(() => _internalLogger.logger.info(`[ScaleBun Replay] backend session upload failure`));
   }
   sendSessionEnd(session) {
@@ -333,10 +349,22 @@ class BackendSessionAdapter {
           environment: m?.buildType
         }
       };
-      await this._post(startEndpoint, payload);
+      try {
+        await this._post(startEndpoint, payload);
+      } catch (err) {
+        // Offline-start recovery: keep the payload for the flush-tick retry loop.
+        // Without this a session that started with no connectivity NEVER opened its
+        // row-ready gate — frames/events re-buffered for the life of the process and
+        // only an app restart recovered it, even after the network came back.
+        if (!BackendSessionAdapter._isPermanentHttpError(err)) {
+          this._pendingStartPayloads.set(session.sessionId, payload);
+        }
+        throw err;
+      }
       // §11: row exists. When recording adopts this analytics id (one-row merge),
       // this also releases the recording child-lane gate (_sessionRowReady).
       this._startedSessionIds.add(session.sessionId);
+      this._pendingStartPayloads.delete(session.sessionId);
       // Row is confirmed — replay any events buffered while START was in flight.
       // The pre-ack flush at the top of this method is gated off until now, so
       // this is what actually drains the pre-ready buffer (no premature 404).
@@ -347,6 +375,42 @@ class BackendSessionAdapter {
     }
   }
 
+  /**
+   * Re-attempt any INGESTION_START whose POST failed (offline app launch). Runs on every
+   * flush tick of BOTH lanes — cheap no-op when the map is empty, single-flight guarded.
+   * On ack: opens the row-ready gate and drains whichever lane the id belongs to, which is
+   * exactly what un-sticks a replay that started offline once connectivity returns.
+   */
+  _retryPendingStarts() {
+    if (this.destroyed || this._startRetryInFlight || this._pendingStartPayloads.size === 0) return;
+    const entry = this._pendingStartPayloads.entries().next().value;
+    if (!entry) return;
+    const [sessionId, payload] = entry;
+    // A stale pending start for a session that already ended AND is not the open analytics
+    // session would create a row nothing will ever finalize — drop it instead.
+    const stillRelevant = sessionId === this.currentSessionId || sessionId === this._analyticsSessionId;
+    if (!stillRelevant) {
+      this._pendingStartPayloads.delete(sessionId);
+      return;
+    }
+    this._startRetryInFlight = true;
+    const startEndpoint = this.config.clientKey ? _endpoints.ENDPOINTS.INGESTION_START : '/replay/sessions';
+    this._post(startEndpoint, payload).then(() => {
+      this._startedSessionIds.add(sessionId);
+      this._pendingStartPayloads.delete(sessionId);
+      __DEV__ && _internalLogger.logger.info(`[ScaleBun Replay] deferred session start delivered: ${sessionId}`);
+      if (sessionId === this._analyticsSessionId) {
+        this._flushAnalyticsEvents().catch(() => {});
+      }
+    }).catch(err => {
+      if (BackendSessionAdapter._isPermanentHttpError(err)) {
+        this._pendingStartPayloads.delete(sessionId); // will never succeed — stop retrying
+      }
+    }).finally(() => {
+      this._startRetryInFlight = false;
+    });
+  }
+
   /**
    * Enqueue a user track() event. Buffers (bounded, drop-oldest) when the
    * analytics session is not yet open; flushes at >=20 once it is.
@@ -494,6 +558,7 @@ class BackendSessionAdapter {
   _startAnalyticsFlushTimer() {
     this._stopAnalyticsFlushTimer();
     this.analyticsFlushTimer = setInterval(() => {
+      this._retryPendingStarts();
       this._flushAnalyticsEvents().catch(() => {});
     }, this.config.flushIntervalMs);
   }
@@ -740,6 +805,7 @@ class BackendSessionAdapter {
     this._analyticsSessionId = null;
     this._pendingFinalizeId = null;
     this._startedSessionIds.clear();
+    this._pendingStartPayloads.clear();
   }
 
   // ─── Internal: Flush ────────────────────────────────────────────────
@@ -1366,6 +1432,7 @@ class BackendSessionAdapter {
   _startFlushTimer() {
     this._stopFlushTimer();
     this.flushTimer = setInterval(() => {
+      this._retryPendingStarts();
       this._flushFrames().catch(() => {});
       this._flushEvents().catch(() => {});
       this._flushNetwork().catch(() => {});

package/lib/commonjs/features/session/SessionManager.js

@@ -91,6 +91,22 @@ class SessionManager {
    * differently across devices and pushes markers ~10% off vertically).
    */
   _lastNativeViewportJsUnits = null;
+
+  /**
+   * Exact-duplicate gesture suppression (QA: one physical tap recorded 2–3×).
+   *
+   * Measured in production data: the native tracker re-emitted the SAME tap — identical
+   * gestureType and identical coordinates to the SUB-PIXEL (e.g. x=466.962890625) — at
+   * 160–240ms gaps, sometimes twice. A human re-tap cannot reproduce a sub-pixel float
+   * exactly, so exact coordinate equality within the window is a safe discriminator: real
+   * double-taps land on at least slightly different pixels and pass through untouched.
+   * The pipeline's own 100ms dedup was too narrow for these; this window covers what was
+   * actually observed with margin. Sits at the ONE entry point every gesture source funnels
+   * through, so recording and analytics lanes are protected equally.
+   */
+  _lastGestureSig = null;
+  _lastGestureTs = 0;
+  static GESTURE_DEDUP_WINDOW_MS = 400;
   /** Memoized native file-outbox frame adapter (gated by the backend transport). */
   _outboxFrameCapture = null;
   constructor(debugTransport, nativeCapture, managerConfig) {
@@ -938,6 +954,18 @@ class SessionManager {
    * Emits a USER_ACTION event with gesture-specific subtype and payload.
    */
   onGestureDetected(gestureType, details) {
+    // Exact-duplicate suppression — see _lastGestureSig. Signature is the gesture type plus
+    // raw coordinates verbatim; String() keeps undefined coords distinct from 0 (a payload
+    // with no coords never collides with a real origin tap).
+    const dedupSig = `${gestureType}|${String(details?.x)}|${String(details?.y)}|${String(details?.endX)}|${String(details?.endY)}`;
+    const nowTs = Date.now();
+    if (dedupSig === this._lastGestureSig && nowTs - this._lastGestureTs <= SessionManager.GESTURE_DEDUP_WINDOW_MS) {
+      this._lastGestureTs = nowTs; // a burst of 3 stays suppressed even if gaps chain past the window
+      return;
+    }
+    this._lastGestureSig = dedupSig;
+    this._lastGestureTs = nowTs;
+
     // Build the canonical gesture payload ONCE so the recording lane and the
     // (additive) analytics lane carry byte-identical keys (normalizedX/Y,
     // gestureType, etc.). Same object shape that was previously inlined.

package/lib/commonjs/public/ScaleBunFacade.js

@@ -549,17 +549,94 @@ class ScaleBunFacade {
     });
   }
 
-  /** Clear user identity */
-  clearUser() {
+  /**
+   * Clear user identity.
+   *
+   * SB-11: pass `{ purgeLocal: true }` on logout / consent withdrawal to also
+   * erase all locally-stored SDK data (see {@link eraseLocalData}). Without it,
+   * behaviour is unchanged (identity-only clear).
+   */
+  clearUser(options) {
     return (0, _crashSafe.noThrow)(() => {
       this._identifiedUserId = null;
       this._pendingIdentity = null;
       if (!this.initialized) return;
       this._eventTracker?.clearIdentity();
       this.track('$clear_user', {});
+      if (options?.purgeLocal) void this.eraseLocalData();
+    });
+  }
+
+  /**
+   * SB-11: erase all locally-stored SDK data from the device — the durable event
+   * queue, the pre-init buffer, and the first-party KV store (cached install /
+   * anonymous / session IDs, plus any queued payloads including SB-26 disk data).
+   *
+   * Order matters: capture is stopped FIRST so nothing is written back in behind
+   * the delete. Best-effort and never throws.
+   *
+   * Note: native replay frames written to disk on iOS are addressed separately
+   * (SB-15); this covers every store reachable from JS today.
+   */
+  async eraseLocalData() {
+    try {
+      // 1) Stop capture so no new frames/events are produced mid-erase.
+      try {
+        _SessionManager.SessionManager.getExistingInstance()?.endSession('ended');
+      } catch {/* best-effort */}
+      // 2) Clear the durable queue and the pre-init buffer.
+      try {
+        this._getQueue().clear();
+      } catch {/* best-effort */}
+      try {
+        this._preInitBuffer.clear();
+      } catch {/* best-effort */}
+      // 3) Wipe the first-party KV store (cached IDs + any on-disk queue
+      //    residue) by removing every key through the backend interface.
+      try {
+        const store = (0, _StorageBackend.createStorageBackend)();
+        for (const key of store.getAllKeys()) {
+          store.delete(key);
+        }
+      } catch {/* best-effort */}
+    } catch {
+      // Never throw — erasure is a safety operation on a best-effort basis.
+    }
+  }
+
+  /**
+   * SB-11: record the user's data-collection consent. When `enabled` is false,
+   * capture is stopped immediately; pass `{ purgeLocal: true }` to also erase
+   * everything already stored locally. Never throws.
+   */
+  setConsent(enabled, options) {
+    (0, _crashSafe.noThrow)(() => {
+      if (enabled) return;
+      try {
+        _SessionManager.SessionManager.getExistingInstance()?.endSession('ended');
+      } catch {/* best-effort */}
+      if (options?.purgeLocal) void this.eraseLocalData();
     });
   }
 
+  /**
+   * SB-10: return the effective privacy policy actually in force, resolving the
+   * public config against the SDK's safe defaults. Lets callers and tests assert
+   * what is active rather than guessing from the (previously dead) config object.
+   */
+  getEffectivePrivacyPolicy() {
+    const p = this._privacyConfig ?? {};
+    return {
+      // Real default is true (matches the replay capture default) — the old
+      // doc comment claiming "false" was both wrong and less safe.
+      maskTextInputs: p.maskTextInputs ?? true,
+      maskImages: p.maskImages ?? false,
+      redactAuth: p.redactAuth ?? true,
+      redactCookies: p.redactCookies ?? true,
+      redactBodies: p.redactBodies ?? false
+    };
+  }
+
   /**
    * Submit in-app rating (1-5 stars).
    * Attaches to current session when available; otherwise sends standalone.

package/lib/module/bootstrap/SDKBootstrapper.js

@@ -317,6 +317,22 @@ export class SDKBootstrapper {
     if (features.replay !== false) {
       try {
         __DEV__ && logger.debug('[Bootstrap] Initializing unified SessionManager');
+        // SB-10: map the public top-level privacy config onto the replay
+        // privacy policy — the field the native capture path actually reads.
+        // Unspecified fields fall back to the SDK's safe defaults
+        // (redactTextInputs: true), so this only ever tightens masking.
+        const pub = this.config.privacy ?? {};
+        const sessionReplay = {
+          ...(this.config.replay ?? {})
+        };
+        if (typeof pub.maskTextInputs === 'boolean' || typeof pub.maskImages === 'boolean') {
+          sessionReplay.privacyPolicy = {
+            redactTextInputs: pub.maskTextInputs ?? true,
+            redactImages: pub.maskImages ?? false,
+            blockTestIds: [],
+            captureExclusions: []
+          };
+        }
         const sessionManager = SessionManager.getInstance(null,
         // No desktop transport initially
         nativeCapture,
@@ -326,9 +342,7 @@ export class SDKBootstrapper {
         // Also flow the Feature #4 heatmap flag so tap/gesture coords
         // route to the analytics lane even when no recording is active.
         {
-          ...(this.config.replay ? {
-            sessionReplay: this.config.replay
-          } : {}),
+          sessionReplay: sessionReplay,
           captureInteractionHeatmap: this.config.captureInteractionHeatmap === true
         });
 
@@ -358,6 +372,19 @@ export class SDKBootstrapper {
           });
           sessionManager.setBackendTransport(backendAdapter);
 
+          // Re-drain recovered crashes now that a backend transport exists.
+          //
+          // drainNativeCrash already ran inside initializeAll — BEFORE this line — so a
+          // crash recovered from the previous run was reported into a NULL transport, the
+          // backend sink no-op'd, and the record was KEPT on disk. Next launch loses the
+          // identical race, so without this a recovered crash (JS or native) never reaches
+          // the dashboard. The record is durable (the persist fix), so re-draining here
+          // delivers it THIS launch; the adapter buffers the error until the session row
+          // exists, so it lands even though startSession may not have completed yet. A
+          // no-op when nothing is pending. Fire-and-forget — crash delivery must never
+          // block or fail session setup.
+          import('../features/crash/nativeCrashBridge').then(m => m.drainNativeCrash()).catch(() => {});
+
           // Opt-in console → Logs lane. Armed here (not only in the desktop-debug
           // replay orchestrator) so a stock SaaS app can capture console.* without
           // pulling in the devTools bundle. Gated by clientKey (the backend transport

package/lib/module/core/config/schema.js

@@ -239,6 +239,35 @@ const SHAPE = {
       })
     }
   },
+  // SB-10: the public, documented top-level privacy config. Previously only the
+  // nested replay privacy took effect; this is validated here and mapped onto the
+  // effective replay privacy policy in the bootstrapper so it actually masks.
+  privacy: {
+    kind: 'obj',
+    opt: true,
+    shape: {
+      maskTextInputs: {
+        kind: 'bool',
+        opt: true
+      },
+      maskImages: {
+        kind: 'bool',
+        opt: true
+      },
+      redactAuth: {
+        kind: 'bool',
+        opt: true
+      },
+      redactCookies: {
+        kind: 'bool',
+        opt: true
+      },
+      redactBodies: {
+        kind: 'bool',
+        opt: true
+      }
+    }
+  },
   captureInteractionHeatmap: bool(true),
   // Opt-in: intercept console.* and ship the lines to the Diagnose → Logs lane in SaaS
   // mode. OFF by default — console output can carry PII/secrets and adds ingest volume,

package/lib/module/core/constants/version.js

@@ -3,5 +3,5 @@
  * can attribute telemetry to the SDK build that produced it.
  * Keep in sync with package.json "version".
  */
-export const SDK_VERSION = '1.10.3';
+export const SDK_VERSION = '1.10.5';
 //# sourceMappingURL=version.js.map