@scalebun/react-native 1.10.4 → 1.10.6

package/dist/scalebun.slim.js

@@ -173,6 +173,45 @@ function redactHeaders(headers) {
   }
   return result;
 }
+function _normalizeKey(key) {
+  return key.toLowerCase().replace(/[_\-\s]/g, "");
+}
+function _isSensitiveKey(key) {
+  return NORMALIZED_SENSITIVE_KEYS.has(_normalizeKey(key));
+}
+function _luhnValid(digits) {
+  const s = digits.replace(/[^\d]/g, "");
+  if (s.length < 12 || s.length > 19) return false;
+  let sum = 0;
+  let alt = false;
+  for (let i = s.length - 1; i >= 0; i--) {
+    let d = s.charCodeAt(i) - 48;
+    if (alt) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    alt = !alt;
+  }
+  return sum % 10 === 0;
+}
+function _scrubSecretsInString(value) {
+  if (value.length > MAX_STRING_SCRUB_CHARS) {
+    value = value.slice(0, MAX_STRING_SCRUB_CHARS);
+  }
+  let out = value;
+  try {
+    for (const {
+      pattern,
+      luhn
+    } of VALUE_SCRUB_PATTERNS) {
+      pattern.lastIndex = 0;
+      out = out.replace(pattern, (m) => luhn && !_luhnValid(m) ? m : REDACTED);
+    }
+  } catch {
+  }
+  return out;
+}
 function redactBody(body, maxDepth = 10) {
   try {
     return _redactValue(body, 0, maxDepth);
@@ -184,7 +223,7 @@ function _redactValue(value, depth, maxDepth) {
   if (depth > maxDepth) return "[MAX_DEPTH]";
   if (value === null || value === void 0) return value;
   if (typeof value === "string") {
-    return value;
+    return _redactString(value, depth, maxDepth);
   }
   if (Array.isArray(value)) {
     return value.map((item) => _redactValue(item, depth + 1, maxDepth));
@@ -192,7 +231,7 @@ function _redactValue(value, depth, maxDepth) {
   if (typeof value === "object") {
     const result = {};
     for (const [key, val] of Object.entries(value)) {
-      if (SENSITIVE_BODY_KEYS.has(key) || SENSITIVE_BODY_KEYS.has(key.toLowerCase())) {
+      if (_isSensitiveKey(key)) {
         result[key] = REDACTED;
       } else {
         result[key] = _redactValue(val, depth + 1, maxDepth);
@@ -202,52 +241,95 @@ function _redactValue(value, depth, maxDepth) {
   }
   return value;
 }
-function scanForPII(text2, location = "unknown") {
-  const warnings = [];
+function _redactString(value, depth, maxDepth) {
+  const trimmed = value.trimStart();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(value);
+      if (parsed !== null && typeof parsed === "object") {
+        const redacted = _redactValue(parsed, depth + 1, maxDepth);
+        return JSON.stringify(redacted);
+      }
+    } catch {
+    }
+  }
+  return _scrubSecretsInString(value);
+}
+function _newScanContext() {
+  return {
+    warnings: [],
+    byType: {},
+    deadline: Date.now() + SCAN_TIME_BUDGET_MS,
+    truncated: false,
+    total: 0
+  };
+}
+function _pushWarning(ctx, type, rawMatch, location) {
+  ctx.total += 1;
+  ctx.byType[type] = (ctx.byType[type] ?? 0) + 1;
+  if (ctx.warnings.length < MAX_PII_WARNINGS) {
+    ctx.warnings.push({
+      type,
+      match: _maskPII(rawMatch),
+      location
+    });
+  } else {
+    ctx.truncated = true;
+  }
+}
+function _finalizeScan(ctx) {
+  if (ctx.truncated) {
+    ctx.warnings.push({
+      type: "_summary",
+      match: `truncated: ${ctx.total} matches`,
+      location: `counts:${JSON.stringify(ctx.byType)}`
+    });
+  }
+  return ctx.warnings;
+}
+function _scanTextInto(text2, location, ctx) {
+  const input = text2.length > MAX_SCAN_INPUT_CHARS ? text2.slice(0, MAX_SCAN_INPUT_CHARS) : text2;
   try {
     for (const {
       name,
       pattern
     } of PII_PATTERNS) {
       pattern.lastIndex = 0;
-      let match = pattern.exec(text2);
+      let match = pattern.exec(input);
       while (match) {
-        warnings.push({
-          type: name,
-          match: _maskPII(match[0]),
-          location
-        });
-        match = pattern.exec(text2);
+        _pushWarning(ctx, name, match[0], location);
+        if (Date.now() > ctx.deadline) {
+          ctx.truncated = true;
+          return;
+        }
+        if (pattern.lastIndex === match.index) pattern.lastIndex++;
+        match = pattern.exec(input);
       }
     }
   } catch {
   }
-  return warnings;
-}
-function scanObjectForPII(obj, basePath = "", maxDepth = 10) {
-  const warnings = [];
-  try {
-    _scanObject(obj, basePath, 0, maxDepth, warnings);
-  } catch {
-  }
-  return warnings;
 }
-function _scanObject(value, path, depth, maxDepth, warnings) {
+function _scanObjectInto(value, path, depth, maxDepth, ctx) {
   if (depth > maxDepth || value === null || value === void 0) return;
+  if (ctx.truncated || Date.now() > ctx.deadline) {
+    ctx.truncated = true;
+    return;
+  }
   if (typeof value === "string") {
-    const found = scanForPII(value, path);
-    warnings.push(...found);
+    _scanTextInto(value, path, ctx);
     return;
   }
   if (Array.isArray(value)) {
-    value.forEach((item, i) => {
-      _scanObject(item, `${path}[${i}]`, depth + 1, maxDepth, warnings);
-    });
+    for (let i = 0; i < value.length; i++) {
+      if (ctx.truncated) return;
+      _scanObjectInto(value[i], `${path}[${i}]`, depth + 1, maxDepth, ctx);
+    }
     return;
   }
   if (typeof value === "object") {
     for (const [key, val] of Object.entries(value)) {
-      _scanObject(val, path ? `${path}.${key}` : key, depth + 1, maxDepth, warnings);
+      if (ctx.truncated) return;
+      _scanObjectInto(val, path ? `${path}.${key}` : key, depth + 1, maxDepth, ctx);
     }
   }
 }
@@ -270,16 +352,17 @@ function redactUrl(url) {
   }
 }
 function redactNetworkEvent(event) {
-  const piiWarnings = [];
+  const ctx = _newScanContext();
   if (event.url) {
-    piiWarnings.push(...scanForPII(event.url, "url"));
+    _scanTextInto(event.url, "url", ctx);
   }
   if (event.requestBody) {
-    piiWarnings.push(...scanObjectForPII(event.requestBody, "requestBody"));
+    _scanObjectInto(event.requestBody, "requestBody", 0, 10, ctx);
   }
   if (event.responseBody) {
-    piiWarnings.push(...scanObjectForPII(event.responseBody, "responseBody"));
+    _scanObjectInto(event.responseBody, "responseBody", 0, 10, ctx);
   }
+  const piiWarnings = _finalizeScan(ctx);
   return {
     url: event.url ? redactUrl(event.url) : "",
     method: event.method ?? "GET",
@@ -292,29 +375,54 @@ function redactNetworkEvent(event) {
     piiWarnings
   };
 }
-var REDACTED, SENSITIVE_HEADERS, PII_PATTERNS, SENSITIVE_BODY_KEYS;
+var REDACTED, MAX_SCAN_INPUT_CHARS, SCAN_TIME_BUDGET_MS, MAX_PII_WARNINGS, MAX_STRING_SCRUB_CHARS, SENSITIVE_HEADERS, PII_PATTERNS, VALUE_SCRUB_PATTERNS, SENSITIVE_BODY_KEYS, NORMALIZED_SENSITIVE_KEYS;
 var init_redaction = __esm({
   "lib/module/debug/redaction.js"() {
     "use strict";
     REDACTED = "[REDACTED]";
+    MAX_SCAN_INPUT_CHARS = 16 * 1024;
+    SCAN_TIME_BUDGET_MS = 10;
+    MAX_PII_WARNINGS = 20;
+    MAX_STRING_SCRUB_CHARS = 64 * 1024;
     SENSITIVE_HEADERS = /* @__PURE__ */ new Set(["authorization", "cookie", "set-cookie", "x-api-key", "x-auth-token", "proxy-authorization"]);
     PII_PATTERNS = [{
       name: "email",
-      pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g
+      pattern: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63}){0,8}\.[A-Za-z]{2,24}/g
     }, {
       name: "phone",
-      pattern: /(?:\+?\d{1,3}[-.\s]?)?\(?\d{2,4}\)?[-.\s]?\d{3,4}[-.\s]?\d{3,4}/g
+      pattern: /\+?\d{1,3}[-.\s]?\(?\d{2,4}\)?[-.\s]?\d{3,4}[-.\s]?\d{3,4}/g
     }, {
       name: "ssn",
       pattern: /\b\d{3}-\d{2}-\d{4}\b/g
     }, {
       name: "credit_card",
       pattern: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g
+    }, {
+      name: "iban",
+      pattern: /\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b/g
+    }, {
+      name: "jwt",
+      pattern: /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b/g
     }, {
       name: "ip_address",
       pattern: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g
     }];
-    SENSITIVE_BODY_KEYS = /* @__PURE__ */ new Set(["password", "passwd", "secret", "token", "access_token", "refresh_token", "api_key", "apiKey", "private_key", "privateKey", "credit_card", "creditCard", "ccNumber", "cvv", "ssn", "social_security"]);
+    VALUE_SCRUB_PATTERNS = [{
+      name: "jwt",
+      pattern: /eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g
+    }, {
+      name: "email",
+      pattern: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63}){0,8}\.[A-Za-z]{2,24}/g
+    }, {
+      name: "iban",
+      pattern: /\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b/g
+    }, {
+      name: "credit_card",
+      pattern: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{2,7}\b/g,
+      luhn: true
+    }];
+    SENSITIVE_BODY_KEYS = /* @__PURE__ */ new Set(["password", "passwd", "secret", "token", "access_token", "refresh_token", "id_token", "api_key", "apiKey", "private_key", "privateKey", "credit_card", "creditCard", "ccnumber", "cardnumber", "card_number", "pan", "cvv", "cvc", "ssn", "social_security", "nationalid", "national_id", "iban", "otp", "pin", "totp", "mfa", "mnemonic", "seed"]);
+    NORMALIZED_SENSITIVE_KEYS = new Set(Array.from(SENSITIVE_BODY_KEYS, _normalizeKey));
   }
 });
 
@@ -492,7 +600,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "lib/module/core/constants/version.js"() {
     "use strict";
-    SDK_VERSION = "1.10.4";
+    SDK_VERSION = "1.10.6";
   }
 });
 
@@ -534,6 +642,15 @@ function staticDeviceContext() {
   if (c.Model) out.device_model = String(c.Model);
   if (c.Manufacturer) out.manufacturer = String(c.Manufacturer);
   else if (c.Brand) out.manufacturer = String(c.Brand);
+  else if (out.platform_os === "ios") out.manufacturer = "Apple";
+  return out;
+}
+function nativeDeviceContext(info) {
+  const out = {};
+  if (!info) return out;
+  if (info.osVersion) out.os_version = info.osVersion;
+  if (info.deviceModel) out.device_model = info.deviceModel;
+  if (info.manufacturer) out.manufacturer = info.manufacturer;
   return out;
 }
 function mergeDeviceContext(configured, detected = staticDeviceContext()) {
@@ -1236,12 +1353,22 @@ var init_AutoScreenDetector = __esm({
       _manualScreen = null;
       _manualScreenTs = 0;
       _autoScreen = null;
+      /** `name#key` of the last auto-detected screen VISIT — see _extractActiveVisit. */
+      _autoVisitSig = null;
       _navigationRef = null;
       _navListenerRemover = null;
       _navListenerWired = false;
       _heuristicTimer = null;
       _started = false;
       _lastEmittedScreen = null;
+      _lastEmittedTs = 0;
+      /**
+       * Cross-source emit dedup window — see _emitScreenChange. Long enough to absorb the manual
+       * beacon and the navRef listener both reporting the SAME transition (they land within the
+       * 30ms nav debounce plus a render), short enough that a genuine re-visit of the same route
+       * a moment later is a new screen view rather than silence.
+       */
+      static EMIT_DEDUP_WINDOW_MS = 800;
       _navDebounceTimer = null;
       /** Whether the React Navigation exports were actually replaced — see _autoHookReactNavigation. */
       _autoHookInstalled = false;
@@ -1293,6 +1420,7 @@ var init_AutoScreenDetector = __esm({
           if (this.isManualScreenActive()) return;
           if (name !== this._autoScreen) {
             this._autoScreen = name;
+            this._autoVisitSig = name;
             this._emitScreenChange(name, "heuristic");
           }
         } catch {
@@ -1343,10 +1471,11 @@ var init_AutoScreenDetector = __esm({
                   try {
                     const state = typeof container.getRootState === "function" ? container.getRootState() : null;
                     if (state) {
-                      const screen = this._extractActiveRoute(state);
-                      if (screen && screen !== this._autoScreen) {
-                        this._autoScreen = screen;
-                        this._emitScreenChange(screen, "navRef");
+                      const visit = this._extractActiveVisit(state);
+                      if (visit && this._visitSig(visit) !== this._autoVisitSig) {
+                        this._autoScreen = visit.name;
+                        this._autoVisitSig = this._visitSig(visit);
+                        this._emitScreenChange(visit.name, "navRef");
                       }
                     }
                   } catch {
@@ -1360,10 +1489,11 @@ var init_AutoScreenDetector = __esm({
           if (typeof container.getRootState === "function") {
             const state = container.getRootState();
             if (state) {
-              const screen = this._extractActiveRoute(state);
-              if (screen) {
-                this._autoScreen = screen;
-                this._emitScreenChange(screen, "navRef");
+              const visit = this._extractActiveVisit(state);
+              if (visit) {
+                this._autoScreen = visit.name;
+                this._autoVisitSig = this._visitSig(visit);
+                this._emitScreenChange(visit.name, "navRef");
               }
             }
           }
@@ -1389,10 +1519,11 @@ var init_AutoScreenDetector = __esm({
             if (navContainer) {
               const state = typeof navContainer.getRootState === "function" ? navContainer.getRootState() : null;
               if (state) {
-                const screen = this._extractActiveRoute(state);
-                if (screen && screen !== this._autoScreen) {
-                  this._autoScreen = screen;
-                  this._emitScreenChange(screen, "heuristic");
+                const visit = this._extractActiveVisit(state);
+                if (visit && this._visitSig(visit) !== this._autoVisitSig) {
+                  this._autoScreen = visit.name;
+                  this._autoVisitSig = this._visitSig(visit);
+                  this._emitScreenChange(visit.name, "heuristic");
                 }
               }
             }
@@ -1424,19 +1555,43 @@ var init_AutoScreenDetector = __esm({
        * Handles nested navigators by walking to the deepest active route.
        */
       _extractActiveRoute(state) {
+        return this._extractActiveVisit(state)?.name ?? null;
+      }
+      /**
+       * Extract the active route's name AND its React Navigation route `key`.
+       *
+       * The key is what makes re-VISITS detectable. Comparing names alone collapses two
+       * different visits to the same route into one screen view: leave Details, open Details
+       * again, and `name === _autoScreen` swallowed the second visit entirely (QA: "opened the
+       * same route again and no screen event was recorded"). React Navigation mints a fresh
+       * `key` for every pushed route instance, so a re-push of the same name is a NEW key —
+       * name+key comparison records each visit while a mere re-render of the same instance
+       * (same key) still emits nothing. States without keys degrade to name-only, i.e. the
+       * old behaviour, never worse.
+       */
+      _extractActiveVisit(state) {
         try {
           if (!state?.routes || typeof state.index !== "number") return null;
           const activeRoute = state.routes[state.index];
           if (!activeRoute) return null;
           if (activeRoute.state?.routes && typeof activeRoute.state.index === "number") {
-            const nested = this._extractActiveRoute(activeRoute.state);
+            const nested = this._extractActiveVisit(activeRoute.state);
             if (nested) return nested;
           }
-          return activeRoute.name || null;
+          if (!activeRoute.name) return null;
+          const rawKey = activeRoute.key;
+          return {
+            name: activeRoute.name,
+            key: typeof rawKey === "string" ? rawKey : null
+          };
         } catch {
           return null;
         }
       }
+      /** `name#key` signature of one screen VISIT — what the auto paths dedup on. */
+      _visitSig(visit) {
+        return visit.key ? `${visit.name}#${visit.key}` : visit.name;
+      }
       // ─── Lifecycle ──────────────────────────────────────────────────────
       /** Start auto-detection (idempotent) */
       start() {
@@ -1601,8 +1756,10 @@ var init_AutoScreenDetector = __esm({
       // ─── Internal ───────────────────────────────────────────────────────
       _emitScreenChange(name, source) {
         try {
-          if (name === this._lastEmittedScreen) return;
+          const emitNow = Date.now();
+          if (name === this._lastEmittedScreen && emitNow - this._lastEmittedTs < _AutoScreenDetector.EMIT_DEDUP_WINDOW_MS) return;
           this._lastEmittedScreen = name;
+          this._lastEmittedTs = emitNow;
           for (const cb of this._listeners) {
             try {
               cb(name, source);
@@ -3487,6 +3644,21 @@ var init_SessionManager = __esm({
        * differently across devices and pushes markers ~10% off vertically).
        */
       _lastNativeViewportJsUnits = null;
+      /**
+       * Exact-duplicate gesture suppression (QA: one physical tap recorded 2–3×).
+       *
+       * Measured in production data: the native tracker re-emitted the SAME tap — identical
+       * gestureType and identical coordinates to the SUB-PIXEL (e.g. x=466.962890625) — at
+       * 160–240ms gaps, sometimes twice. A human re-tap cannot reproduce a sub-pixel float
+       * exactly, so exact coordinate equality within the window is a safe discriminator: real
+       * double-taps land on at least slightly different pixels and pass through untouched.
+       * The pipeline's own 100ms dedup was too narrow for these; this window covers what was
+       * actually observed with margin. Sits at the ONE entry point every gesture source funnels
+       * through, so recording and analytics lanes are protected equally.
+       */
+      _lastGestureSig = null;
+      _lastGestureTs = 0;
+      static GESTURE_DEDUP_WINDOW_MS = 400;
       /** Memoized native file-outbox frame adapter (gated by the backend transport). */
       _outboxFrameCapture = null;
       constructor(debugTransport, nativeCapture2, managerConfig) {
@@ -4135,6 +4307,14 @@ var init_SessionManager = __esm({
        * Emits a USER_ACTION event with gesture-specific subtype and payload.
        */
       onGestureDetected(gestureType, details) {
+        const dedupSig = `${gestureType}|${String(details?.x)}|${String(details?.y)}|${String(details?.endX)}|${String(details?.endY)}`;
+        const nowTs = Date.now();
+        if (dedupSig === this._lastGestureSig && nowTs - this._lastGestureTs <= _SessionManager.GESTURE_DEDUP_WINDOW_MS) {
+          this._lastGestureTs = nowTs;
+          return;
+        }
+        this._lastGestureSig = dedupSig;
+        this._lastGestureTs = nowTs;
         const payload = {
           gestureType,
           x: details?.x,
@@ -6357,6 +6537,27 @@ var init_EventTracker = __esm({
         }
         this.persistQueue();
       }
+      /**
+       * Fold in device facts that were not knowable at init.
+       *
+       * `Platform.constants` answers Android synchronously, so its model and manufacturer ride the
+       * very first event. iOS exposes neither there — only the native bridge knows, and the bridge is
+       * async and may not be installed at all. Without this the iOS half of every install reported no
+       * model whatsoever.
+       *
+       * `buildEnvelope` reads `cfg.context` per event, so applying it here reaches every event from
+       * the next one onward. Detected keys WIN over whatever the integrator configured, for the same
+       * reason `mergeDeviceContext` inverts the usual precedence: a measurement must not be
+       * overridable by a guess. Empty patches are ignored so a bridge that answered with nothing
+       * cannot blank a value the static path already found.
+       */
+      applyDetectedContext(patch) {
+        if (!patch || Object.keys(patch).length === 0) return;
+        this.cfg.context = {
+          ...this.cfg.context ?? {},
+          ...patch
+        };
+      }
       // ─── internals ─────────────────────────────────────────────────────────────
       buildEnvelope(eventName, properties) {
         const ctx = this.cfg.context ?? {};
@@ -9499,6 +9700,35 @@ var SHAPE = {
       })
     }
   },
+  // SB-10: the public, documented top-level privacy config. Previously only the
+  // nested replay privacy took effect; this is validated here and mapped onto the
+  // effective replay privacy policy in the bootstrapper so it actually masks.
+  privacy: {
+    kind: "obj",
+    opt: true,
+    shape: {
+      maskTextInputs: {
+        kind: "bool",
+        opt: true
+      },
+      maskImages: {
+        kind: "bool",
+        opt: true
+      },
+      redactAuth: {
+        kind: "bool",
+        opt: true
+      },
+      redactCookies: {
+        kind: "bool",
+        opt: true
+      },
+      redactBodies: {
+        kind: "bool",
+        opt: true
+      }
+    }
+  },
   captureInteractionHeatmap: bool(true),
   // Opt-in: intercept console.* and ship the lines to the Diagnose → Logs lane in SaaS
   // mode. OFF by default — console output can carry PII/secrets and adds ingest volume,
@@ -12296,6 +12526,13 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
   // the flush timer retries, so nothing is lost to a start/child race. The durable native
   // outbox path has its own ordering; this guards only the JS in-memory fallback.
   _startedSessionIds = /* @__PURE__ */ new Set();
+  // §11 offline-start recovery: INGESTION_START payloads whose POST failed (e.g. the app
+  // launched with no connectivity). Without this, a failed START was logged and forgotten —
+  // the row-ready gate never opened, every child lane re-buffered forever, and the session
+  // stayed stuck until an app restart even after the network returned. Each flush tick
+  // re-attempts these until acked (network errors keep retrying; permanent 4xx gives up).
+  _pendingStartPayloads = /* @__PURE__ */ new Map();
+  _startRetryInFlight = false;
   pendingFrames = [];
   pendingEvents = [];
   pendingNetworkRequests = [];
@@ -12419,10 +12656,16 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
         }
       };
       __DEV__ && logger.debug(`[BackendSessionAdapter] POST session start: ${session.sessionId}`);
-      return this._post(startEndpoint, payload);
-    }).then(() => {
-      this._startedSessionIds.add(session.sessionId);
-      __DEV__ && logger.info(`[ScaleBun Replay] backend session upload success`);
+      return this._post(startEndpoint, payload).then(() => {
+        this._startedSessionIds.add(session.sessionId);
+        this._pendingStartPayloads.delete(session.sessionId);
+        __DEV__ && logger.info(`[ScaleBun Replay] backend session upload success`);
+      }, (err) => {
+        if (!_BackendSessionAdapter._isPermanentHttpError(err)) {
+          this._pendingStartPayloads.set(session.sessionId, payload);
+        }
+        logger.info(`[ScaleBun Replay] backend session upload failure`);
+      });
     }).catch(() => logger.info(`[ScaleBun Replay] backend session upload failure`));
   }
   sendSessionEnd(session) {
@@ -12495,8 +12738,16 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
           environment: m?.buildType
         }
       };
-      await this._post(startEndpoint, payload);
+      try {
+        await this._post(startEndpoint, payload);
+      } catch (err) {
+        if (!_BackendSessionAdapter._isPermanentHttpError(err)) {
+          this._pendingStartPayloads.set(session.sessionId, payload);
+        }
+        throw err;
+      }
       this._startedSessionIds.add(session.sessionId);
+      this._pendingStartPayloads.delete(session.sessionId);
       this._flushAnalyticsEvents().catch(() => {
       });
       __DEV__ && logger.info(`[ScaleBun Analytics] session start upload success: ${session.sessionId}`);
@@ -12504,6 +12755,40 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
       __DEV__ && logger.info(`[ScaleBun Analytics] session start upload failure`);
     }
   }
+  /**
+   * Re-attempt any INGESTION_START whose POST failed (offline app launch). Runs on every
+   * flush tick of BOTH lanes — cheap no-op when the map is empty, single-flight guarded.
+   * On ack: opens the row-ready gate and drains whichever lane the id belongs to, which is
+   * exactly what un-sticks a replay that started offline once connectivity returns.
+   */
+  _retryPendingStarts() {
+    if (this.destroyed || this._startRetryInFlight || this._pendingStartPayloads.size === 0) return;
+    const entry = this._pendingStartPayloads.entries().next().value;
+    if (!entry) return;
+    const [sessionId, payload] = entry;
+    const stillRelevant = sessionId === this.currentSessionId || sessionId === this._analyticsSessionId;
+    if (!stillRelevant) {
+      this._pendingStartPayloads.delete(sessionId);
+      return;
+    }
+    this._startRetryInFlight = true;
+    const startEndpoint = this.config.clientKey ? ENDPOINTS.INGESTION_START : "/replay/sessions";
+    this._post(startEndpoint, payload).then(() => {
+      this._startedSessionIds.add(sessionId);
+      this._pendingStartPayloads.delete(sessionId);
+      __DEV__ && logger.info(`[ScaleBun Replay] deferred session start delivered: ${sessionId}`);
+      if (sessionId === this._analyticsSessionId) {
+        this._flushAnalyticsEvents().catch(() => {
+        });
+      }
+    }).catch((err) => {
+      if (_BackendSessionAdapter._isPermanentHttpError(err)) {
+        this._pendingStartPayloads.delete(sessionId);
+      }
+    }).finally(() => {
+      this._startRetryInFlight = false;
+    });
+  }
   /**
    * Enqueue a user track() event. Buffers (bounded, drop-oldest) when the
    * analytics session is not yet open; flushes at >=20 once it is.
@@ -12618,6 +12903,7 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
   _startAnalyticsFlushTimer() {
     this._stopAnalyticsFlushTimer();
     this.analyticsFlushTimer = setInterval(() => {
+      this._retryPendingStarts();
       this._flushAnalyticsEvents().catch(() => {
       });
     }, this.config.flushIntervalMs);
@@ -12844,6 +13130,7 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
     this._analyticsSessionId = null;
     this._pendingFinalizeId = null;
     this._startedSessionIds.clear();
+    this._pendingStartPayloads.clear();
   }
   // ─── Internal: Flush ────────────────────────────────────────────────
   /** Wire metadata for a frame — real format/sizeBytes from native (no hardcoded literals). */
@@ -13362,6 +13649,7 @@ var BackendSessionAdapter = class _BackendSessionAdapter {
   _startFlushTimer() {
     this._stopFlushTimer();
     this.flushTimer = setInterval(() => {
+      this._retryPendingStarts();
       this._flushFrames().catch(() => {
       });
       this._flushEvents().catch(() => {
@@ -13692,6 +13980,18 @@ var SDKBootstrapper = class {
     if (features.replay !== false) {
       try {
         __DEV__ && logger.debug("[Bootstrap] Initializing unified SessionManager");
+        const pub = this.config.privacy ?? {};
+        const sessionReplay = {
+          ...this.config.replay ?? {}
+        };
+        if (typeof pub.maskTextInputs === "boolean" || typeof pub.maskImages === "boolean") {
+          sessionReplay.privacyPolicy = {
+            redactTextInputs: pub.maskTextInputs ?? true,
+            redactImages: pub.maskImages ?? false,
+            blockTestIds: [],
+            captureExclusions: []
+          };
+        }
         const sessionManager = SessionManager.getInstance(
           null,
           // No desktop transport initially
@@ -13702,9 +14002,7 @@ var SDKBootstrapper = class {
           // Also flow the Feature #4 heatmap flag so tap/gesture coords
           // route to the analytics lane even when no recording is active.
           {
-            ...this.config.replay ? {
-              sessionReplay: this.config.replay
-            } : {},
+            sessionReplay,
             captureInteractionHeatmap: this.config.captureInteractionHeatmap === true
           }
         );
@@ -13930,6 +14228,7 @@ var SDKBootstrapper = class {
 
 // lib/module/public/ScaleBunFacade.js
 init_EventTracker();
+init_bridgeAdapter();
 init_automaticEvents();
 
 // lib/module/analytics/eventLane.js
@@ -16446,6 +16745,8 @@ var ScaleBunFacade = class {
          * the whole time. The SDK knows the device; the integrator is guessing at it.
          * Everything outside the detected keys is still theirs.
          */
+        // Everything Platform.constants knows. On iOS that is neither the model nor the
+        // manufacturer, so the bridge completes it below once it answers.
         context: mergeDeviceContext(rawConfig?.context),
         // Use the same foreground id as replay/journey capture. The
         // callback is resolved per event because the session subsystem
@@ -16459,6 +16760,7 @@ var ScaleBunFacade = class {
       });
       this._eventTracker.start();
       __DEV__ && logger.info("[ScaleBun] Envelope event tracking started \u2192 /v1/batch.");
+      this._applyNativeDeviceContext(this._eventTracker);
       this._captureInstallReferrer(this._eventTracker);
       const tracker = this._eventTracker;
       this._configManager = new ConfigManager({
@@ -16477,6 +16779,25 @@ var ScaleBunFacade = class {
       logger.warn("[ScaleBun] Failed to start envelope event tracking:", err?.message);
     }
   }
+  /**
+   * Fold the native bridge's device facts into the analytics context once it answers.
+   *
+   * Detected values never overwrite a populated one with an empty one — `nativeDeviceContext`
+   * drops absent keys and `applyDetectedContext` ignores an empty patch — so a bridge that
+   * cannot answer leaves whatever `Platform.constants` already found.
+   */
+  _applyNativeDeviceContext(tracker) {
+    Promise.resolve().then(() => bridgeAdapter.getDeviceInfo()).then((info) => {
+      if (!info) return;
+      tracker.applyDetectedContext(nativeDeviceContext({
+        osVersion: info.osVersion,
+        deviceModel: info.deviceModel
+        // iOS ships no manufacturer over the bridge; it is a constant there and the
+        // static path already set it. Android's arrives via Platform.constants.
+      }));
+    }).catch(() => {
+    });
+  }
   /**
    * Android-only: read the Play Install Referrer once per install and route it into
    * attribution. `scalebun_click_id` → the deterministic click path; the full
@@ -16660,16 +16981,90 @@ var ScaleBunFacade = class {
       });
     });
   }
-  /** Clear user identity */
-  clearUser() {
+  /**
+   * Clear user identity.
+   *
+   * SB-11: pass `{ purgeLocal: true }` on logout / consent withdrawal to also
+   * erase all locally-stored SDK data (see {@link eraseLocalData}). Without it,
+   * behaviour is unchanged (identity-only clear).
+   */
+  clearUser(options) {
     return noThrow(() => {
       this._identifiedUserId = null;
       this._pendingIdentity = null;
       if (!this.initialized) return;
       this._eventTracker?.clearIdentity();
       this.track("$clear_user", {});
+      if (options?.purgeLocal) void this.eraseLocalData();
     });
   }
+  /**
+   * SB-11: erase all locally-stored SDK data from the device — the durable event
+   * queue, the pre-init buffer, and the first-party KV store (cached install /
+   * anonymous / session IDs, plus any queued payloads including SB-26 disk data).
+   *
+   * Order matters: capture is stopped FIRST so nothing is written back in behind
+   * the delete. Best-effort and never throws.
+   *
+   * Note: native replay frames written to disk on iOS are addressed separately
+   * (SB-15); this covers every store reachable from JS today.
+   */
+  async eraseLocalData() {
+    try {
+      try {
+        SessionManager.getExistingInstance()?.endSession("ended");
+      } catch {
+      }
+      try {
+        this._getQueue().clear();
+      } catch {
+      }
+      try {
+        this._preInitBuffer.clear();
+      } catch {
+      }
+      try {
+        const store = createStorageBackend();
+        for (const key of store.getAllKeys()) {
+          store.delete(key);
+        }
+      } catch {
+      }
+    } catch {
+    }
+  }
+  /**
+   * SB-11: record the user's data-collection consent. When `enabled` is false,
+   * capture is stopped immediately; pass `{ purgeLocal: true }` to also erase
+   * everything already stored locally. Never throws.
+   */
+  setConsent(enabled, options) {
+    noThrow(() => {
+      if (enabled) return;
+      try {
+        SessionManager.getExistingInstance()?.endSession("ended");
+      } catch {
+      }
+      if (options?.purgeLocal) void this.eraseLocalData();
+    });
+  }
+  /**
+   * SB-10: return the effective privacy policy actually in force, resolving the
+   * public config against the SDK's safe defaults. Lets callers and tests assert
+   * what is active rather than guessing from the (previously dead) config object.
+   */
+  getEffectivePrivacyPolicy() {
+    const p = this._privacyConfig ?? {};
+    return {
+      // Real default is true (matches the replay capture default) — the old
+      // doc comment claiming "false" was both wrong and less safe.
+      maskTextInputs: p.maskTextInputs ?? true,
+      maskImages: p.maskImages ?? false,
+      redactAuth: p.redactAuth ?? true,
+      redactCookies: p.redactCookies ?? true,
+      redactBodies: p.redactBodies ?? false
+    };
+  }
   /**
    * Submit in-app rating (1-5 stars).
    * Attaches to current session when available; otherwise sends standalone.
@@ -29750,7 +30145,7 @@ function ScaleBunDebugRoot({
             }
           } catch {
           }
-        }, 200);
+        }, 600);
       }
       touchStartRef.current = null;
     } catch {