@scalebun/react-native 1.10.4 → 1.10.6

package/lib/commonjs/features/navigation/AutoScreenDetector.js

@@ -41,12 +41,22 @@ class AutoScreenDetector {
   _manualScreen = null;
   _manualScreenTs = 0;
   _autoScreen = null;
+  /** `name#key` of the last auto-detected screen VISIT — see _extractActiveVisit. */
+  _autoVisitSig = null;
   _navigationRef = null;
   _navListenerRemover = null;
   _navListenerWired = false;
   _heuristicTimer = null;
   _started = false;
   _lastEmittedScreen = null;
+  _lastEmittedTs = 0;
+  /**
+   * Cross-source emit dedup window — see _emitScreenChange. Long enough to absorb the manual
+   * beacon and the navRef listener both reporting the SAME transition (they land within the
+   * 30ms nav debounce plus a render), short enough that a genuine re-visit of the same route
+   * a moment later is a new screen view rather than silence.
+   */
+  static EMIT_DEDUP_WINDOW_MS = 800;
   _navDebounceTimer = null;
   /** Whether the React Navigation exports were actually replaced — see _autoHookReactNavigation. */
   _autoHookInstalled = false;
@@ -105,6 +115,7 @@ class AutoScreenDetector {
       if (this.isManualScreenActive()) return;
       if (name !== this._autoScreen) {
         this._autoScreen = name;
+        this._autoVisitSig = name; // native lifecycle carries no route key — name-only visit
         this._emitScreenChange(name, 'heuristic');
       }
     } catch {/* no-throw */}
@@ -167,10 +178,13 @@ class AutoScreenDetector {
               try {
                 const state = typeof container.getRootState === 'function' ? container.getRootState() : null;
                 if (state) {
-                  const screen = this._extractActiveRoute(state);
-                  if (screen && screen !== this._autoScreen) {
-                    this._autoScreen = screen;
-                    this._emitScreenChange(screen, 'navRef');
+                  // Compared by name#key so a re-VISIT of the same route
+                  // (new key) is recorded — name-only comparison swallowed it.
+                  const visit = this._extractActiveVisit(state);
+                  if (visit && this._visitSig(visit) !== this._autoVisitSig) {
+                    this._autoScreen = visit.name;
+                    this._autoVisitSig = this._visitSig(visit);
+                    this._emitScreenChange(visit.name, 'navRef');
                   }
                 }
               } catch {/* no-throw */}
@@ -184,10 +198,11 @@ class AutoScreenDetector {
       if (typeof container.getRootState === 'function') {
         const state = container.getRootState();
         if (state) {
-          const screen = this._extractActiveRoute(state);
-          if (screen) {
-            this._autoScreen = screen;
-            this._emitScreenChange(screen, 'navRef');
+          const visit = this._extractActiveVisit(state);
+          if (visit) {
+            this._autoScreen = visit.name;
+            this._autoVisitSig = this._visitSig(visit);
+            this._emitScreenChange(visit.name, 'navRef');
           }
         }
       }
@@ -223,10 +238,14 @@ class AutoScreenDetector {
         if (navContainer) {
           const state = typeof navContainer.getRootState === 'function' ? navContainer.getRootState() : null;
           if (state) {
-            const screen = this._extractActiveRoute(state);
-            if (screen && screen !== this._autoScreen) {
-              this._autoScreen = screen;
-              this._emitScreenChange(screen, 'heuristic');
+            // name#key comparison: a re-opened route (same name, fresh key) seen
+            // across poll ticks is a new visit even when every intermediate screen
+            // fell between polls — the case a name-only diff could never see.
+            const visit = this._extractActiveVisit(state);
+            if (visit && this._visitSig(visit) !== this._autoVisitSig) {
+              this._autoScreen = visit.name;
+              this._autoVisitSig = this._visitSig(visit);
+              this._emitScreenChange(visit.name, 'heuristic');
             }
           }
         }
@@ -266,6 +285,22 @@ class AutoScreenDetector {
    * Handles nested navigators by walking to the deepest active route.
    */
   _extractActiveRoute(state) {
+    return this._extractActiveVisit(state)?.name ?? null;
+  }
+
+  /**
+   * Extract the active route's name AND its React Navigation route `key`.
+   *
+   * The key is what makes re-VISITS detectable. Comparing names alone collapses two
+   * different visits to the same route into one screen view: leave Details, open Details
+   * again, and `name === _autoScreen` swallowed the second visit entirely (QA: "opened the
+   * same route again and no screen event was recorded"). React Navigation mints a fresh
+   * `key` for every pushed route instance, so a re-push of the same name is a NEW key —
+   * name+key comparison records each visit while a mere re-render of the same instance
+   * (same key) still emits nothing. States without keys degrade to name-only, i.e. the
+   * old behaviour, never worse.
+   */
+  _extractActiveVisit(state) {
     try {
       if (!state?.routes || typeof state.index !== 'number') return null;
       const activeRoute = state.routes[state.index];
@@ -273,15 +308,25 @@ class AutoScreenDetector {
 
       // If this route has nested state, recurse to find the deepest active route
       if (activeRoute.state?.routes && typeof activeRoute.state.index === 'number') {
-        const nested = this._extractActiveRoute(activeRoute.state);
+        const nested = this._extractActiveVisit(activeRoute.state);
         if (nested) return nested;
       }
-      return activeRoute.name || null;
+      if (!activeRoute.name) return null;
+      const rawKey = activeRoute.key;
+      return {
+        name: activeRoute.name,
+        key: typeof rawKey === 'string' ? rawKey : null
+      };
     } catch {
       return null;
     }
   }
 
+  /** `name#key` signature of one screen VISIT — what the auto paths dedup on. */
+  _visitSig(visit) {
+    return visit.key ? `${visit.name}#${visit.key}` : visit.name;
+  }
+
   // ─── Lifecycle ──────────────────────────────────────────────────────
 
   /** Start auto-detection (idempotent) */
@@ -471,9 +516,16 @@ class AutoScreenDetector {
 
   _emitScreenChange(name, source) {
     try {
-      // Deduplicate: don't emit if the screen is the same as last emitted
-      if (name === this._lastEmittedScreen) return;
+      // Cross-source dedup, TIME-BOUNDED. This used to drop any name equal to the last
+      // emitted, forever — so re-entering a route whose departure was never observed
+      // (heuristic poll missed the intermediate screen, or the user re-pushed the same
+      // route) was swallowed on EVERY path, manual beacons included (QA: "opened the
+      // same route again, no screen event"). Same name within the window is still one
+      // transition double-reported by two sources; same name after it is a new visit.
+      const emitNow = Date.now();
+      if (name === this._lastEmittedScreen && emitNow - this._lastEmittedTs < AutoScreenDetector.EMIT_DEDUP_WINDOW_MS) return;
       this._lastEmittedScreen = name;
+      this._lastEmittedTs = emitNow;
       for (const cb of this._listeners) {
         try {
           cb(name, source);

package/lib/commonjs/features/session/BackendSessionAdapter.js

@@ -99,6 +99,13 @@ class BackendSessionAdapter {
   // the flush timer retries, so nothing is lost to a start/child race. The durable native
   // outbox path has its own ordering; this guards only the JS in-memory fallback.
   _startedSessionIds = new Set();
+  // §11 offline-start recovery: INGESTION_START payloads whose POST failed (e.g. the app
+  // launched with no connectivity). Without this, a failed START was logged and forgotten —
+  // the row-ready gate never opened, every child lane re-buffered forever, and the session
+  // stayed stuck until an app restart even after the network returned. Each flush tick
+  // re-attempts these until acked (network errors keep retrying; permanent 4xx gives up).
+  _pendingStartPayloads = new Map();
+  _startRetryInFlight = false;
   pendingFrames = [];
   pendingEvents = [];
   pendingNetworkRequests = [];
@@ -234,11 +241,20 @@ class BackendSessionAdapter {
         }
       };
       __DEV__ && _internalLogger.logger.debug(`[BackendSessionAdapter] POST session start: ${session.sessionId}`);
-      return this._post(startEndpoint, payload);
-    }).then(() => {
-      // §11: row now exists — release the child-lane flush gate for this id.
-      this._startedSessionIds.add(session.sessionId);
-      __DEV__ && _internalLogger.logger.info(`[ScaleBun Replay] backend session upload success`);
+      return this._post(startEndpoint, payload).then(() => {
+        // §11: row now exists — release the child-lane flush gate for this id.
+        this._startedSessionIds.add(session.sessionId);
+        this._pendingStartPayloads.delete(session.sessionId);
+        __DEV__ && _internalLogger.logger.info(`[ScaleBun Replay] backend session upload success`);
+      }, err => {
+        // Offline-start recovery: keep the payload; the flush timer re-attempts it
+        // until the row is acked. A permanent 4xx (rejected key) is not retried —
+        // the same payload can never succeed.
+        if (!BackendSessionAdapter._isPermanentHttpError(err)) {
+          this._pendingStartPayloads.set(session.sessionId, payload);
+        }
+        _internalLogger.logger.info(`[ScaleBun Replay] backend session upload failure`);
+      });
     }).catch(() => _internalLogger.logger.info(`[ScaleBun Replay] backend session upload failure`));
   }
   sendSessionEnd(session) {
@@ -333,10 +349,22 @@ class BackendSessionAdapter {
           environment: m?.buildType
         }
       };
-      await this._post(startEndpoint, payload);
+      try {
+        await this._post(startEndpoint, payload);
+      } catch (err) {
+        // Offline-start recovery: keep the payload for the flush-tick retry loop.
+        // Without this a session that started with no connectivity NEVER opened its
+        // row-ready gate — frames/events re-buffered for the life of the process and
+        // only an app restart recovered it, even after the network came back.
+        if (!BackendSessionAdapter._isPermanentHttpError(err)) {
+          this._pendingStartPayloads.set(session.sessionId, payload);
+        }
+        throw err;
+      }
       // §11: row exists. When recording adopts this analytics id (one-row merge),
       // this also releases the recording child-lane gate (_sessionRowReady).
       this._startedSessionIds.add(session.sessionId);
+      this._pendingStartPayloads.delete(session.sessionId);
       // Row is confirmed — replay any events buffered while START was in flight.
       // The pre-ack flush at the top of this method is gated off until now, so
       // this is what actually drains the pre-ready buffer (no premature 404).
@@ -347,6 +375,42 @@ class BackendSessionAdapter {
     }
   }
 
+  /**
+   * Re-attempt any INGESTION_START whose POST failed (offline app launch). Runs on every
+   * flush tick of BOTH lanes — cheap no-op when the map is empty, single-flight guarded.
+   * On ack: opens the row-ready gate and drains whichever lane the id belongs to, which is
+   * exactly what un-sticks a replay that started offline once connectivity returns.
+   */
+  _retryPendingStarts() {
+    if (this.destroyed || this._startRetryInFlight || this._pendingStartPayloads.size === 0) return;
+    const entry = this._pendingStartPayloads.entries().next().value;
+    if (!entry) return;
+    const [sessionId, payload] = entry;
+    // A stale pending start for a session that already ended AND is not the open analytics
+    // session would create a row nothing will ever finalize — drop it instead.
+    const stillRelevant = sessionId === this.currentSessionId || sessionId === this._analyticsSessionId;
+    if (!stillRelevant) {
+      this._pendingStartPayloads.delete(sessionId);
+      return;
+    }
+    this._startRetryInFlight = true;
+    const startEndpoint = this.config.clientKey ? _endpoints.ENDPOINTS.INGESTION_START : '/replay/sessions';
+    this._post(startEndpoint, payload).then(() => {
+      this._startedSessionIds.add(sessionId);
+      this._pendingStartPayloads.delete(sessionId);
+      __DEV__ && _internalLogger.logger.info(`[ScaleBun Replay] deferred session start delivered: ${sessionId}`);
+      if (sessionId === this._analyticsSessionId) {
+        this._flushAnalyticsEvents().catch(() => {});
+      }
+    }).catch(err => {
+      if (BackendSessionAdapter._isPermanentHttpError(err)) {
+        this._pendingStartPayloads.delete(sessionId); // will never succeed — stop retrying
+      }
+    }).finally(() => {
+      this._startRetryInFlight = false;
+    });
+  }
+
   /**
    * Enqueue a user track() event. Buffers (bounded, drop-oldest) when the
    * analytics session is not yet open; flushes at >=20 once it is.
@@ -494,6 +558,7 @@ class BackendSessionAdapter {
   _startAnalyticsFlushTimer() {
     this._stopAnalyticsFlushTimer();
     this.analyticsFlushTimer = setInterval(() => {
+      this._retryPendingStarts();
       this._flushAnalyticsEvents().catch(() => {});
     }, this.config.flushIntervalMs);
   }
@@ -740,6 +805,7 @@ class BackendSessionAdapter {
     this._analyticsSessionId = null;
     this._pendingFinalizeId = null;
     this._startedSessionIds.clear();
+    this._pendingStartPayloads.clear();
   }
 
   // ─── Internal: Flush ────────────────────────────────────────────────
@@ -1366,6 +1432,7 @@ class BackendSessionAdapter {
   _startFlushTimer() {
     this._stopFlushTimer();
     this.flushTimer = setInterval(() => {
+      this._retryPendingStarts();
       this._flushFrames().catch(() => {});
       this._flushEvents().catch(() => {});
       this._flushNetwork().catch(() => {});

package/lib/commonjs/features/session/SessionManager.js

@@ -91,6 +91,22 @@ class SessionManager {
    * differently across devices and pushes markers ~10% off vertically).
    */
   _lastNativeViewportJsUnits = null;
+
+  /**
+   * Exact-duplicate gesture suppression (QA: one physical tap recorded 2–3×).
+   *
+   * Measured in production data: the native tracker re-emitted the SAME tap — identical
+   * gestureType and identical coordinates to the SUB-PIXEL (e.g. x=466.962890625) — at
+   * 160–240ms gaps, sometimes twice. A human re-tap cannot reproduce a sub-pixel float
+   * exactly, so exact coordinate equality within the window is a safe discriminator: real
+   * double-taps land on at least slightly different pixels and pass through untouched.
+   * The pipeline's own 100ms dedup was too narrow for these; this window covers what was
+   * actually observed with margin. Sits at the ONE entry point every gesture source funnels
+   * through, so recording and analytics lanes are protected equally.
+   */
+  _lastGestureSig = null;
+  _lastGestureTs = 0;
+  static GESTURE_DEDUP_WINDOW_MS = 400;
   /** Memoized native file-outbox frame adapter (gated by the backend transport). */
   _outboxFrameCapture = null;
   constructor(debugTransport, nativeCapture, managerConfig) {
@@ -938,6 +954,18 @@ class SessionManager {
    * Emits a USER_ACTION event with gesture-specific subtype and payload.
    */
   onGestureDetected(gestureType, details) {
+    // Exact-duplicate suppression — see _lastGestureSig. Signature is the gesture type plus
+    // raw coordinates verbatim; String() keeps undefined coords distinct from 0 (a payload
+    // with no coords never collides with a real origin tap).
+    const dedupSig = `${gestureType}|${String(details?.x)}|${String(details?.y)}|${String(details?.endX)}|${String(details?.endY)}`;
+    const nowTs = Date.now();
+    if (dedupSig === this._lastGestureSig && nowTs - this._lastGestureTs <= SessionManager.GESTURE_DEDUP_WINDOW_MS) {
+      this._lastGestureTs = nowTs; // a burst of 3 stays suppressed even if gaps chain past the window
+      return;
+    }
+    this._lastGestureSig = dedupSig;
+    this._lastGestureTs = nowTs;
+
     // Build the canonical gesture payload ONCE so the recording lane and the
     // (additive) analytics lane carry byte-identical keys (normalizedX/Y,
     // gestureType, etc.). Same object shape that was previously inlined.

package/lib/commonjs/public/ScaleBunFacade.js

@@ -20,6 +20,7 @@ var _debug = require("../debug");
 var _api = require("../features/replay/public/api");
 var _SDKBootstrapper = require("../bootstrap/SDKBootstrapper");
 var _EventTracker = require("../analytics/EventTracker");
+var _bridgeAdapter = require("../features/replay/bridge/adapters/bridgeAdapter");
 var _automaticEvents = require("../analytics/automaticEvents");
 var _eventLane = require("../analytics/eventLane");
 var _ConfigManager = require("../config/ConfigManager");
@@ -313,6 +314,8 @@ class ScaleBunFacade {
          * the whole time. The SDK knows the device; the integrator is guessing at it.
          * Everything outside the detected keys is still theirs.
          */
+        // Everything Platform.constants knows. On iOS that is neither the model nor the
+        // manufacturer, so the bridge completes it below once it answers.
         context: (0, _device.mergeDeviceContext)(rawConfig?.context),
         // Use the same foreground id as replay/journey capture. The
         // callback is resolved per event because the session subsystem
@@ -327,6 +330,19 @@ class ScaleBunFacade {
       this._eventTracker.start();
       __DEV__ && _internalLogger.logger.info('[ScaleBun] Envelope event tracking started → /v1/batch.');
 
+      // Complete the device context from the native bridge.
+      //
+      // `Platform.constants` answers Android synchronously — model and manufacturer ride the
+      // first event. It answers NEITHER on iOS, so without this every iOS installation
+      // reported no device model at all: `nativeDeviceContext` existed for exactly this and
+      // had no caller, and the bridge's own answer was `UIDevice.current.model` — the string
+      // "iPhone", identical on every iPhone ever made.
+      //
+      // Fire-and-forget on purpose. The bridge is async and absent entirely on Expo Go or an
+      // older native binary; waiting on it would delay the first event, and failing on it
+      // would take analytics down over a nice-to-have field.
+      this._applyNativeDeviceContext(this._eventTracker);
+
       // Android: capture the Play Install Referrer once per install → feeds the
       // deterministic click_id path + a one-off install_referrer event (UTM/gclid).
       // Fire-and-forget; no-op off Android.
@@ -351,6 +367,24 @@ class ScaleBunFacade {
     }
   }
 
+  /**
+   * Fold the native bridge's device facts into the analytics context once it answers.
+   *
+   * Detected values never overwrite a populated one with an empty one — `nativeDeviceContext`
+   * drops absent keys and `applyDetectedContext` ignores an empty patch — so a bridge that
+   * cannot answer leaves whatever `Platform.constants` already found.
+   */
+  _applyNativeDeviceContext(tracker) {
+    Promise.resolve().then(() => _bridgeAdapter.bridgeAdapter.getDeviceInfo()).then(info => {
+      if (!info) return;
+      tracker.applyDetectedContext((0, _device.nativeDeviceContext)({
+        osVersion: info.osVersion,
+        deviceModel: info.deviceModel
+        // iOS ships no manufacturer over the bridge; it is a constant there and the
+        // static path already set it. Android's arrives via Platform.constants.
+      }));
+    }).catch(() => {/* bridge unavailable — the static context stands */});
+  }
   /**
    * Android-only: read the Play Install Referrer once per install and route it into
    * attribution. `scalebun_click_id` → the deterministic click path; the full
@@ -549,17 +583,94 @@ class ScaleBunFacade {
     });
   }
 
-  /** Clear user identity */
-  clearUser() {
+  /**
+   * Clear user identity.
+   *
+   * SB-11: pass `{ purgeLocal: true }` on logout / consent withdrawal to also
+   * erase all locally-stored SDK data (see {@link eraseLocalData}). Without it,
+   * behaviour is unchanged (identity-only clear).
+   */
+  clearUser(options) {
     return (0, _crashSafe.noThrow)(() => {
       this._identifiedUserId = null;
       this._pendingIdentity = null;
       if (!this.initialized) return;
       this._eventTracker?.clearIdentity();
       this.track('$clear_user', {});
+      if (options?.purgeLocal) void this.eraseLocalData();
+    });
+  }
+
+  /**
+   * SB-11: erase all locally-stored SDK data from the device — the durable event
+   * queue, the pre-init buffer, and the first-party KV store (cached install /
+   * anonymous / session IDs, plus any queued payloads including SB-26 disk data).
+   *
+   * Order matters: capture is stopped FIRST so nothing is written back in behind
+   * the delete. Best-effort and never throws.
+   *
+   * Note: native replay frames written to disk on iOS are addressed separately
+   * (SB-15); this covers every store reachable from JS today.
+   */
+  async eraseLocalData() {
+    try {
+      // 1) Stop capture so no new frames/events are produced mid-erase.
+      try {
+        _SessionManager.SessionManager.getExistingInstance()?.endSession('ended');
+      } catch {/* best-effort */}
+      // 2) Clear the durable queue and the pre-init buffer.
+      try {
+        this._getQueue().clear();
+      } catch {/* best-effort */}
+      try {
+        this._preInitBuffer.clear();
+      } catch {/* best-effort */}
+      // 3) Wipe the first-party KV store (cached IDs + any on-disk queue
+      //    residue) by removing every key through the backend interface.
+      try {
+        const store = (0, _StorageBackend.createStorageBackend)();
+        for (const key of store.getAllKeys()) {
+          store.delete(key);
+        }
+      } catch {/* best-effort */}
+    } catch {
+      // Never throw — erasure is a safety operation on a best-effort basis.
+    }
+  }
+
+  /**
+   * SB-11: record the user's data-collection consent. When `enabled` is false,
+   * capture is stopped immediately; pass `{ purgeLocal: true }` to also erase
+   * everything already stored locally. Never throws.
+   */
+  setConsent(enabled, options) {
+    (0, _crashSafe.noThrow)(() => {
+      if (enabled) return;
+      try {
+        _SessionManager.SessionManager.getExistingInstance()?.endSession('ended');
+      } catch {/* best-effort */}
+      if (options?.purgeLocal) void this.eraseLocalData();
     });
   }
 
+  /**
+   * SB-10: return the effective privacy policy actually in force, resolving the
+   * public config against the SDK's safe defaults. Lets callers and tests assert
+   * what is active rather than guessing from the (previously dead) config object.
+   */
+  getEffectivePrivacyPolicy() {
+    const p = this._privacyConfig ?? {};
+    return {
+      // Real default is true (matches the replay capture default) — the old
+      // doc comment claiming "false" was both wrong and less safe.
+      maskTextInputs: p.maskTextInputs ?? true,
+      maskImages: p.maskImages ?? false,
+      redactAuth: p.redactAuth ?? true,
+      redactCookies: p.redactCookies ?? true,
+      redactBodies: p.redactBodies ?? false
+    };
+  }
+
   /**
    * Submit in-app rating (1-5 stars).
    * Attaches to current session when available; otherwise sends standalone.

package/lib/module/analytics/EventTracker.js

@@ -336,6 +336,28 @@ export class EventTracker {
     this.persistQueue();
   }
 
+  /**
+   * Fold in device facts that were not knowable at init.
+   *
+   * `Platform.constants` answers Android synchronously, so its model and manufacturer ride the
+   * very first event. iOS exposes neither there — only the native bridge knows, and the bridge is
+   * async and may not be installed at all. Without this the iOS half of every install reported no
+   * model whatsoever.
+   *
+   * `buildEnvelope` reads `cfg.context` per event, so applying it here reaches every event from
+   * the next one onward. Detected keys WIN over whatever the integrator configured, for the same
+   * reason `mergeDeviceContext` inverts the usual precedence: a measurement must not be
+   * overridable by a guess. Empty patches are ignored so a bridge that answered with nothing
+   * cannot blank a value the static path already found.
+   */
+  applyDetectedContext(patch) {
+    if (!patch || Object.keys(patch).length === 0) return;
+    this.cfg.context = {
+      ...(this.cfg.context ?? {}),
+      ...patch
+    };
+  }
+
   // ─── internals ─────────────────────────────────────────────────────────────
 
   buildEnvelope(eventName, properties) {

package/lib/module/bootstrap/SDKBootstrapper.js

@@ -317,6 +317,22 @@ export class SDKBootstrapper {
     if (features.replay !== false) {
       try {
         __DEV__ && logger.debug('[Bootstrap] Initializing unified SessionManager');
+        // SB-10: map the public top-level privacy config onto the replay
+        // privacy policy — the field the native capture path actually reads.
+        // Unspecified fields fall back to the SDK's safe defaults
+        // (redactTextInputs: true), so this only ever tightens masking.
+        const pub = this.config.privacy ?? {};
+        const sessionReplay = {
+          ...(this.config.replay ?? {})
+        };
+        if (typeof pub.maskTextInputs === 'boolean' || typeof pub.maskImages === 'boolean') {
+          sessionReplay.privacyPolicy = {
+            redactTextInputs: pub.maskTextInputs ?? true,
+            redactImages: pub.maskImages ?? false,
+            blockTestIds: [],
+            captureExclusions: []
+          };
+        }
         const sessionManager = SessionManager.getInstance(null,
         // No desktop transport initially
         nativeCapture,
@@ -326,9 +342,7 @@ export class SDKBootstrapper {
         // Also flow the Feature #4 heatmap flag so tap/gesture coords
         // route to the analytics lane even when no recording is active.
         {
-          ...(this.config.replay ? {
-            sessionReplay: this.config.replay
-          } : {}),
+          sessionReplay: sessionReplay,
           captureInteractionHeatmap: this.config.captureInteractionHeatmap === true
         });
 

package/lib/module/core/config/schema.js

@@ -239,6 +239,35 @@ const SHAPE = {
       })
     }
   },
+  // SB-10: the public, documented top-level privacy config. Previously only the
+  // nested replay privacy took effect; this is validated here and mapped onto the
+  // effective replay privacy policy in the bootstrapper so it actually masks.
+  privacy: {
+    kind: 'obj',
+    opt: true,
+    shape: {
+      maskTextInputs: {
+        kind: 'bool',
+        opt: true
+      },
+      maskImages: {
+        kind: 'bool',
+        opt: true
+      },
+      redactAuth: {
+        kind: 'bool',
+        opt: true
+      },
+      redactCookies: {
+        kind: 'bool',
+        opt: true
+      },
+      redactBodies: {
+        kind: 'bool',
+        opt: true
+      }
+    }
+  },
   captureInteractionHeatmap: bool(true),
   // Opt-in: intercept console.* and ship the lines to the Diagnose → Logs lane in SaaS
   // mode. OFF by default — console output can carry PII/secrets and adds ingest volume,

package/lib/module/core/constants/version.js

@@ -3,5 +3,5 @@
  * can attribute telemetry to the SDK build that produced it.
  * Keep in sync with package.json "version".
  */
-export const SDK_VERSION = '1.10.4';
+export const SDK_VERSION = '1.10.6';
 //# sourceMappingURL=version.js.map

package/lib/module/core/context/device.js

@@ -92,6 +92,10 @@ export function staticDeviceContext() {
   if (osVersion) out.os_version = String(osVersion);
   if (c.Model) out.device_model = String(c.Model);
   if (c.Manufacturer) out.manufacturer = String(c.Manufacturer);else if (c.Brand) out.manufacturer = String(c.Brand);
+  // iOS exposes no manufacturer because it does not need to: every device running iOS is Apple's.
+  // A tautology, not a guess — and it means the field is populated on event #1 rather than waiting
+  // for a bridge that may never answer.
+  else if (out.platform_os === 'ios') out.manufacturer = 'Apple';
   return out;
 }
 
@@ -101,6 +105,7 @@ export function nativeDeviceContext(info) {
   if (!info) return out;
   if (info.osVersion) out.os_version = info.osVersion;
   if (info.deviceModel) out.device_model = info.deviceModel;
+  if (info.manufacturer) out.manufacturer = info.manufacturer;
   return out;
 }