@scalebun/react-native 1.10.4 → 1.10.6

package/lib/module/features/session/SessionManager.js

@@ -86,6 +86,22 @@ export class SessionManager {
    * differently across devices and pushes markers ~10% off vertically).
    */
   _lastNativeViewportJsUnits = null;
+
+  /**
+   * Exact-duplicate gesture suppression (QA: one physical tap recorded 2–3×).
+   *
+   * Measured in production data: the native tracker re-emitted the SAME tap — identical
+   * gestureType and identical coordinates to the SUB-PIXEL (e.g. x=466.962890625) — at
+   * 160–240ms gaps, sometimes twice. A human re-tap cannot reproduce a sub-pixel float
+   * exactly, so exact coordinate equality within the window is a safe discriminator: real
+   * double-taps land on at least slightly different pixels and pass through untouched.
+   * The pipeline's own 100ms dedup was too narrow for these; this window covers what was
+   * actually observed with margin. Sits at the ONE entry point every gesture source funnels
+   * through, so recording and analytics lanes are protected equally.
+   */
+  _lastGestureSig = null;
+  _lastGestureTs = 0;
+  static GESTURE_DEDUP_WINDOW_MS = 400;
   /** Memoized native file-outbox frame adapter (gated by the backend transport). */
   _outboxFrameCapture = null;
   constructor(debugTransport, nativeCapture, managerConfig) {
@@ -933,6 +949,18 @@ export class SessionManager {
    * Emits a USER_ACTION event with gesture-specific subtype and payload.
    */
   onGestureDetected(gestureType, details) {
+    // Exact-duplicate suppression — see _lastGestureSig. Signature is the gesture type plus
+    // raw coordinates verbatim; String() keeps undefined coords distinct from 0 (a payload
+    // with no coords never collides with a real origin tap).
+    const dedupSig = `${gestureType}|${String(details?.x)}|${String(details?.y)}|${String(details?.endX)}|${String(details?.endY)}`;
+    const nowTs = Date.now();
+    if (dedupSig === this._lastGestureSig && nowTs - this._lastGestureTs <= SessionManager.GESTURE_DEDUP_WINDOW_MS) {
+      this._lastGestureTs = nowTs; // a burst of 3 stays suppressed even if gaps chain past the window
+      return;
+    }
+    this._lastGestureSig = dedupSig;
+    this._lastGestureTs = nowTs;
+
     // Build the canonical gesture payload ONCE so the recording lane and the
     // (additive) analytics lane carry byte-identical keys (normalizedX/Y,
     // gestureType, etc.). Same object shape that was previously inlined.

package/lib/module/public/ScaleBunFacade.js

@@ -18,13 +18,14 @@ import { BugReportFeature } from '../features/bugreport/BugReportFeature';
 import { PersistentQueue } from '../pipeline/queue/persistentQueue';
 import { MemoryBackend, createStorageBackend } from '../storage/StorageBackend';
 import { getDeviceId } from '../core/id/deviceId';
-import { mergeDeviceContext, resolveEventPlatform } from '../core/context/device';
+import { mergeDeviceContext, nativeDeviceContext, resolveEventPlatform } from '../core/context/device';
 import { coreContainer } from '../core/di/container';
 import { flushQueue } from '../pipeline/queue/flushQueue';
 import { enableDebug as _enableDebug, disableDebug as _disableDebug, isDebugEnabled, addBreadcrumb as _addBreadcrumb, ping as _ping, _getStream, _setFlushFn, getPerformanceFeature as _getPerformanceFeature, requestExport as _requestExport, buildDebugConfigFromInitConfig, applyFeatureGatesToDebugConfig, sendDebugMetric } from '../debug';
 import { ReplaySdk } from '../features/replay/public/api';
 import { SDKBootstrapper } from '../bootstrap/SDKBootstrapper';
 import { EventTracker } from '../analytics/EventTracker';
+import { bridgeAdapter } from '../features/replay/bridge/adapters/bridgeAdapter';
 import { emitAutomaticEvent } from '../analytics/automaticEvents';
 import { resolveEventLane, isUploadedSessionEvent } from '../analytics/eventLane';
 import { ConfigManager } from '../config/ConfigManager';
@@ -307,6 +308,8 @@ class ScaleBunFacade {
          * the whole time. The SDK knows the device; the integrator is guessing at it.
          * Everything outside the detected keys is still theirs.
          */
+        // Everything Platform.constants knows. On iOS that is neither the model nor the
+        // manufacturer, so the bridge completes it below once it answers.
         context: mergeDeviceContext(rawConfig?.context),
         // Use the same foreground id as replay/journey capture. The
         // callback is resolved per event because the session subsystem
@@ -321,6 +324,19 @@ class ScaleBunFacade {
       this._eventTracker.start();
       __DEV__ && logger.info('[ScaleBun] Envelope event tracking started → /v1/batch.');
 
+      // Complete the device context from the native bridge.
+      //
+      // `Platform.constants` answers Android synchronously — model and manufacturer ride the
+      // first event. It answers NEITHER on iOS, so without this every iOS installation
+      // reported no device model at all: `nativeDeviceContext` existed for exactly this and
+      // had no caller, and the bridge's own answer was `UIDevice.current.model` — the string
+      // "iPhone", identical on every iPhone ever made.
+      //
+      // Fire-and-forget on purpose. The bridge is async and absent entirely on Expo Go or an
+      // older native binary; waiting on it would delay the first event, and failing on it
+      // would take analytics down over a nice-to-have field.
+      this._applyNativeDeviceContext(this._eventTracker);
+
       // Android: capture the Play Install Referrer once per install → feeds the
       // deterministic click_id path + a one-off install_referrer event (UTM/gclid).
       // Fire-and-forget; no-op off Android.
@@ -345,6 +361,24 @@ class ScaleBunFacade {
     }
   }
 
+  /**
+   * Fold the native bridge's device facts into the analytics context once it answers.
+   *
+   * Detected values never overwrite a populated one with an empty one — `nativeDeviceContext`
+   * drops absent keys and `applyDetectedContext` ignores an empty patch — so a bridge that
+   * cannot answer leaves whatever `Platform.constants` already found.
+   */
+  _applyNativeDeviceContext(tracker) {
+    Promise.resolve().then(() => bridgeAdapter.getDeviceInfo()).then(info => {
+      if (!info) return;
+      tracker.applyDetectedContext(nativeDeviceContext({
+        osVersion: info.osVersion,
+        deviceModel: info.deviceModel
+        // iOS ships no manufacturer over the bridge; it is a constant there and the
+        // static path already set it. Android's arrives via Platform.constants.
+      }));
+    }).catch(() => {/* bridge unavailable — the static context stands */});
+  }
   /**
    * Android-only: read the Play Install Referrer once per install and route it into
    * attribution. `scalebun_click_id` → the deterministic click path; the full
@@ -543,17 +577,94 @@ class ScaleBunFacade {
     });
   }
 
-  /** Clear user identity */
-  clearUser() {
+  /**
+   * Clear user identity.
+   *
+   * SB-11: pass `{ purgeLocal: true }` on logout / consent withdrawal to also
+   * erase all locally-stored SDK data (see {@link eraseLocalData}). Without it,
+   * behaviour is unchanged (identity-only clear).
+   */
+  clearUser(options) {
     return noThrow(() => {
       this._identifiedUserId = null;
       this._pendingIdentity = null;
       if (!this.initialized) return;
       this._eventTracker?.clearIdentity();
       this.track('$clear_user', {});
+      if (options?.purgeLocal) void this.eraseLocalData();
+    });
+  }
+
+  /**
+   * SB-11: erase all locally-stored SDK data from the device — the durable event
+   * queue, the pre-init buffer, and the first-party KV store (cached install /
+   * anonymous / session IDs, plus any queued payloads including SB-26 disk data).
+   *
+   * Order matters: capture is stopped FIRST so nothing is written back in behind
+   * the delete. Best-effort and never throws.
+   *
+   * Note: native replay frames written to disk on iOS are addressed separately
+   * (SB-15); this covers every store reachable from JS today.
+   */
+  async eraseLocalData() {
+    try {
+      // 1) Stop capture so no new frames/events are produced mid-erase.
+      try {
+        SessionManager.getExistingInstance()?.endSession('ended');
+      } catch {/* best-effort */}
+      // 2) Clear the durable queue and the pre-init buffer.
+      try {
+        this._getQueue().clear();
+      } catch {/* best-effort */}
+      try {
+        this._preInitBuffer.clear();
+      } catch {/* best-effort */}
+      // 3) Wipe the first-party KV store (cached IDs + any on-disk queue
+      //    residue) by removing every key through the backend interface.
+      try {
+        const store = createStorageBackend();
+        for (const key of store.getAllKeys()) {
+          store.delete(key);
+        }
+      } catch {/* best-effort */}
+    } catch {
+      // Never throw — erasure is a safety operation on a best-effort basis.
+    }
+  }
+
+  /**
+   * SB-11: record the user's data-collection consent. When `enabled` is false,
+   * capture is stopped immediately; pass `{ purgeLocal: true }` to also erase
+   * everything already stored locally. Never throws.
+   */
+  setConsent(enabled, options) {
+    noThrow(() => {
+      if (enabled) return;
+      try {
+        SessionManager.getExistingInstance()?.endSession('ended');
+      } catch {/* best-effort */}
+      if (options?.purgeLocal) void this.eraseLocalData();
     });
   }
 
+  /**
+   * SB-10: return the effective privacy policy actually in force, resolving the
+   * public config against the SDK's safe defaults. Lets callers and tests assert
+   * what is active rather than guessing from the (previously dead) config object.
+   */
+  getEffectivePrivacyPolicy() {
+    const p = this._privacyConfig ?? {};
+    return {
+      // Real default is true (matches the replay capture default) — the old
+      // doc comment claiming "false" was both wrong and less safe.
+      maskTextInputs: p.maskTextInputs ?? true,
+      maskImages: p.maskImages ?? false,
+      redactAuth: p.redactAuth ?? true,
+      redactCookies: p.redactCookies ?? true,
+      redactBodies: p.redactBodies ?? false
+    };
+  }
+
   /**
    * Submit in-app rating (1-5 stars).
    * Attaches to current session when available; otherwise sends standalone.

package/lib/typescript/analytics/EventTracker.d.ts

@@ -134,6 +134,21 @@ export declare class EventTracker {
     }): void;
     flush(): Promise<void>;
     stop(): void;
+    /**
+     * Fold in device facts that were not knowable at init.
+     *
+     * `Platform.constants` answers Android synchronously, so its model and manufacturer ride the
+     * very first event. iOS exposes neither there — only the native bridge knows, and the bridge is
+     * async and may not be installed at all. Without this the iOS half of every install reported no
+     * model whatsoever.
+     *
+     * `buildEnvelope` reads `cfg.context` per event, so applying it here reaches every event from
+     * the next one onward. Detected keys WIN over whatever the integrator configured, for the same
+     * reason `mergeDeviceContext` inverts the usual precedence: a measurement must not be
+     * overridable by a guess. Empty patches are ignored so a bridge that answered with nothing
+     * cannot blank a value the static path already found.
+     */
+    applyDetectedContext(patch: Record<string, string>): void;
     private buildEnvelope;
     private enqueue;
     private scheduleFlush;

package/lib/typescript/core/config/schema.d.ts

@@ -77,6 +77,14 @@ export interface ScaleBunConfig {
         deltaEncoding?: boolean;
         deltaKeyframeInterval?: number;
     };
+    /** SB-10: public top-level privacy config, mapped onto the replay privacy policy. */
+    privacy?: {
+        maskTextInputs?: boolean;
+        maskImages?: boolean;
+        redactAuth?: boolean;
+        redactCookies?: boolean;
+        redactBodies?: boolean;
+    };
     captureInteractionHeatmap: boolean;
     /** Opt-in: capture console.* into the Logs lane in SaaS mode. Default false. */
     captureConsoleLogs: boolean;

package/lib/typescript/core/constants/version.d.ts

@@ -3,5 +3,5 @@
  * can attribute telemetry to the SDK build that produced it.
  * Keep in sync with package.json "version".
  */
-export declare const SDK_VERSION = "1.10.4";
+export declare const SDK_VERSION = "1.10.6";
 //# sourceMappingURL=version.d.ts.map

package/lib/typescript/core/context/device.d.ts

@@ -34,6 +34,7 @@ export declare function nativeDeviceContext(info: {
     platform?: string;
     osVersion?: string;
     deviceModel?: string;
+    manufacturer?: string;
 } | null): Record<string, string>;
 /**
  * Merge the integrator's context with what we detected — DETECTED WINS on the keys above.

package/lib/typescript/debug/redaction.d.ts

@@ -13,6 +13,12 @@ export declare function redactHeaders(headers: Record<string, string> | undefine
 /**
  * Deep-redact sensitive keys in a body object. Returns a new object.
  * Handles nested objects and arrays. Never throws.
+ *
+ * SB-02: string bodies (what JSON.stringify produces — i.e. essentially every
+ * React Native network body) are no longer passed through untouched. If a string
+ * parses as JSON it is deep-redacted and re-serialized; otherwise structured
+ * secrets in the string are scrubbed. This closes the "6 of 9 seeded secrets
+ * survived" leak while leaving non-sensitive metadata intact.
  */
 export declare function redactBody(body: unknown, maxDepth?: number): unknown;
 export interface PIIWarning {
@@ -22,12 +28,12 @@ export interface PIIWarning {
     location: string;
 }
 /**
- * Scan a string for PII patterns. Returns list of warnings.
+ * Scan a string for PII patterns. Returns a bounded list of warnings.
  * Never throws.
  */
 export declare function scanForPII(text: string, location?: string): PIIWarning[];
 /**
- * Scan an object deeply for PII. Returns list of warnings.
+ * Scan an object deeply for PII. Returns a bounded list of warnings.
  * Never throws.
  */
 export declare function scanObjectForPII(obj: unknown, basePath?: string, maxDepth?: number): PIIWarning[];

package/lib/typescript/features/navigation/AutoScreenDetector.d.ts

@@ -30,12 +30,22 @@ export declare class AutoScreenDetector {
     private _manualScreen;
     private _manualScreenTs;
     private _autoScreen;
+    /** `name#key` of the last auto-detected screen VISIT — see _extractActiveVisit. */
+    private _autoVisitSig;
     private _navigationRef;
     private _navListenerRemover;
     private _navListenerWired;
     private _heuristicTimer;
     private _started;
     private _lastEmittedScreen;
+    private _lastEmittedTs;
+    /**
+     * Cross-source emit dedup window — see _emitScreenChange. Long enough to absorb the manual
+     * beacon and the navRef listener both reporting the SAME transition (they land within the
+     * 30ms nav debounce plus a render), short enough that a genuine re-visit of the same route
+     * a moment later is a new screen view rather than silence.
+     */
+    private static readonly EMIT_DEDUP_WINDOW_MS;
     private _navDebounceTimer;
     /** Whether the React Navigation exports were actually replaced — see _autoHookReactNavigation. */
     private _autoHookInstalled;
@@ -90,6 +100,21 @@ export declare class AutoScreenDetector {
      * Handles nested navigators by walking to the deepest active route.
      */
     private _extractActiveRoute;
+    /**
+     * Extract the active route's name AND its React Navigation route `key`.
+     *
+     * The key is what makes re-VISITS detectable. Comparing names alone collapses two
+     * different visits to the same route into one screen view: leave Details, open Details
+     * again, and `name === _autoScreen` swallowed the second visit entirely (QA: "opened the
+     * same route again and no screen event was recorded"). React Navigation mints a fresh
+     * `key` for every pushed route instance, so a re-push of the same name is a NEW key —
+     * name+key comparison records each visit while a mere re-render of the same instance
+     * (same key) still emits nothing. States without keys degrade to name-only, i.e. the
+     * old behaviour, never worse.
+     */
+    private _extractActiveVisit;
+    /** `name#key` signature of one screen VISIT — what the auto paths dedup on. */
+    private _visitSig;
     /** Start auto-detection (idempotent) */
     start(): void;
     /**

package/lib/typescript/features/session/BackendSessionAdapter.d.ts

@@ -119,6 +119,8 @@ export declare class BackendSessionAdapter implements SessionTransport {
     private _nativeOutboxReady;
     private currentSessionId;
     private readonly _startedSessionIds;
+    private readonly _pendingStartPayloads;
+    private _startRetryInFlight;
     private pendingFrames;
     private pendingEvents;
     private pendingNetworkRequests;
@@ -170,6 +172,13 @@ export declare class BackendSessionAdapter implements SessionTransport {
          *  backend so the dashboard uses the same value to draw idle bands. */
         idleThresholdMs?: number;
     }): Promise<void>;
+    /**
+     * Re-attempt any INGESTION_START whose POST failed (offline app launch). Runs on every
+     * flush tick of BOTH lanes — cheap no-op when the map is empty, single-flight guarded.
+     * On ack: opens the row-ready gate and drains whichever lane the id belongs to, which is
+     * exactly what un-sticks a replay that started offline once connectivity returns.
+     */
+    private _retryPendingStarts;
     /**
      * Enqueue a user track() event. Buffers (bounded, drop-oldest) when the
      * analytics session is not yet open; flushes at >=20 once it is.

package/lib/typescript/features/session/SessionManager.d.ts

@@ -77,6 +77,21 @@ export declare class SessionManager {
      * differently across devices and pushes markers ~10% off vertically).
      */
     private _lastNativeViewportJsUnits;
+    /**
+     * Exact-duplicate gesture suppression (QA: one physical tap recorded 2–3×).
+     *
+     * Measured in production data: the native tracker re-emitted the SAME tap — identical
+     * gestureType and identical coordinates to the SUB-PIXEL (e.g. x=466.962890625) — at
+     * 160–240ms gaps, sometimes twice. A human re-tap cannot reproduce a sub-pixel float
+     * exactly, so exact coordinate equality within the window is a safe discriminator: real
+     * double-taps land on at least slightly different pixels and pass through untouched.
+     * The pipeline's own 100ms dedup was too narrow for these; this window covers what was
+     * actually observed with margin. Sits at the ONE entry point every gesture source funnels
+     * through, so recording and analytics lanes are protected equally.
+     */
+    private _lastGestureSig;
+    private _lastGestureTs;
+    private static readonly GESTURE_DEDUP_WINDOW_MS;
     private _nativeCapture;
     private _rawTransport;
     /** Memoized native file-outbox frame adapter (gated by the backend transport). */

package/lib/typescript/public/ScaleBunFacade.d.ts

@@ -80,6 +80,14 @@ declare class ScaleBunFacade {
     private _autoEnableDebug;
     /** Boot the Phase 1 envelope tracking lane if an appId is configured. */
     private _maybeStartEventTracker;
+    /**
+     * Fold the native bridge's device facts into the analytics context once it answers.
+     *
+     * Detected values never overwrite a populated one with an empty one — `nativeDeviceContext`
+     * drops absent keys and `applyDetectedContext` ignores an empty patch — so a bridge that
+     * cannot answer leaves whatever `Platform.constants` already found.
+     */
+    private _applyNativeDeviceContext;
     /**
      * Android-only: read the Play Install Referrer once per install and route it into
      * attribution. `scalebun_click_id` → the deterministic click path; the full
@@ -165,8 +173,42 @@ declare class ScaleBunFacade {
     private _callIngestionIdentify;
     /** Set user identity (for session context) */
     setUser(user: ScaleBunUser): void | undefined;
-    /** Clear user identity */
-    clearUser(): void | undefined;
+    /**
+     * Clear user identity.
+     *
+     * SB-11: pass `{ purgeLocal: true }` on logout / consent withdrawal to also
+     * erase all locally-stored SDK data (see {@link eraseLocalData}). Without it,
+     * behaviour is unchanged (identity-only clear).
+     */
+    clearUser(options?: {
+        purgeLocal?: boolean;
+    }): void | undefined;
+    /**
+     * SB-11: erase all locally-stored SDK data from the device — the durable event
+     * queue, the pre-init buffer, and the first-party KV store (cached install /
+     * anonymous / session IDs, plus any queued payloads including SB-26 disk data).
+     *
+     * Order matters: capture is stopped FIRST so nothing is written back in behind
+     * the delete. Best-effort and never throws.
+     *
+     * Note: native replay frames written to disk on iOS are addressed separately
+     * (SB-15); this covers every store reachable from JS today.
+     */
+    eraseLocalData(): Promise<void>;
+    /**
+     * SB-11: record the user's data-collection consent. When `enabled` is false,
+     * capture is stopped immediately; pass `{ purgeLocal: true }` to also erase
+     * everything already stored locally. Never throws.
+     */
+    setConsent(enabled: boolean, options?: {
+        purgeLocal?: boolean;
+    }): void;
+    /**
+     * SB-10: return the effective privacy policy actually in force, resolving the
+     * public config against the SDK's safe defaults. Lets callers and tests assert
+     * what is active rather than guessing from the (previously dead) config object.
+     */
+    getEffectivePrivacyPolicy(): Required<Pick<PrivacyConfig, 'maskTextInputs' | 'maskImages' | 'redactAuth' | 'redactCookies' | 'redactBodies'>>;
     /**
      * Submit in-app rating (1-5 stars).
      * Attaches to current session when available; otherwise sends standalone.

package/lib/typescript/public/types.d.ts

@@ -167,7 +167,7 @@ export interface PrivacyConfig {
     redactCookies?: boolean;
     /** Redact request/response bodies in network capture. Default: false */
     redactBodies?: boolean;
-    /** Mask text input values in session replay. Default: false */
+    /** Mask text input values in session replay. Default: true */
     maskTextInputs?: boolean;
     /** Mask image content in session replay. Default: false */
     maskImages?: boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@scalebun/react-native",
-  "version": "1.10.4",
-  "description": "Production-grade React Native SDK for ScaleBun",
+  "version": "1.10.6",
+  "description": "React Native SDK for ScaleBun",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
   "types": "lib/typescript/index.d.ts",
@@ -24,6 +24,10 @@
     "!**/__tests__",
     "!**/__fixtures__",
     "!**/__mocks__",
+    "!android/build",
+    "!android/.cxx",
+    "!android/.gradle",
+    "!**/*.map",
     "!**/.*"
   ],
   "exports": {

package/src/analytics/EventTracker.ts

@@ -387,6 +387,25 @@ export class EventTracker {
         this.persistQueue();
     }
 
+    /**
+     * Fold in device facts that were not knowable at init.
+     *
+     * `Platform.constants` answers Android synchronously, so its model and manufacturer ride the
+     * very first event. iOS exposes neither there — only the native bridge knows, and the bridge is
+     * async and may not be installed at all. Without this the iOS half of every install reported no
+     * model whatsoever.
+     *
+     * `buildEnvelope` reads `cfg.context` per event, so applying it here reaches every event from
+     * the next one onward. Detected keys WIN over whatever the integrator configured, for the same
+     * reason `mergeDeviceContext` inverts the usual precedence: a measurement must not be
+     * overridable by a guess. Empty patches are ignored so a bridge that answered with nothing
+     * cannot blank a value the static path already found.
+     */
+    applyDetectedContext(patch: Record<string, string>): void {
+        if (!patch || Object.keys(patch).length === 0) return;
+        this.cfg.context = { ...(this.cfg.context ?? {}), ...patch };
+    }
+
     // ─── internals ─────────────────────────────────────────────────────────────
 
     private buildEnvelope(eventName: string, properties?: Record<string, any>): Envelope {

package/src/bootstrap/SDKBootstrapper.ts

@@ -36,6 +36,7 @@ import { PerformanceFeature } from '../features/performance/PerformanceFeature';
 import { PersistentQueue } from '../pipeline/queue/persistentQueue';
 import { createStorageBackend, MemoryBackend } from '../storage/StorageBackend';
 import { SessionManager } from '../features/session/SessionManager';
+import type { SessionReplayConfig } from '../features/session/sessionTypes';
 import { nativeCapture } from '../features/session/nativeCapture';
 import { installAlertInstrumentation, uninstallAlertInstrumentation } from '../features/replay/integrations/alert/alertInstrumentation';
 import { installConsoleIntegration, uninstallConsoleIntegration } from '../features/replay/integrations/logs/consoleIntegration';
@@ -342,6 +343,21 @@ export class SDKBootstrapper {
         if (features.replay !== false) {
             try {
                 __DEV__ && logger.debug('[Bootstrap] Initializing unified SessionManager');
+                // SB-10: map the public top-level privacy config onto the replay
+                // privacy policy — the field the native capture path actually reads.
+                // Unspecified fields fall back to the SDK's safe defaults
+                // (redactTextInputs: true), so this only ever tightens masking.
+                const pub = this.config.privacy ?? {};
+                const sessionReplay: Record<string, unknown> = { ...(this.config.replay ?? {}) };
+                if (typeof pub.maskTextInputs === 'boolean' || typeof pub.maskImages === 'boolean') {
+                    sessionReplay.privacyPolicy = {
+                        redactTextInputs: pub.maskTextInputs ?? true,
+                        redactImages: pub.maskImages ?? false,
+                        blockTestIds: [],
+                        captureExclusions: [],
+                    };
+                }
+
                 const sessionManager = SessionManager.getInstance(
                     null, // No desktop transport initially
                     nativeCapture,
@@ -351,7 +367,7 @@ export class SDKBootstrapper {
                     // Also flow the Feature #4 heatmap flag so tap/gesture coords
                     // route to the analytics lane even when no recording is active.
                     {
-                        ...(this.config.replay ? { sessionReplay: this.config.replay } : {}),
+                        sessionReplay: sessionReplay as Partial<SessionReplayConfig>,
                         captureInteractionHeatmap: this.config.captureInteractionHeatmap === true,
                     }
                 );

package/src/core/config/schema.ts

@@ -169,6 +169,20 @@ const SHAPE: Record<string, Field> = {
             deltaKeyframeInterval: num({ min: 1, int: true, opt: true }),
         },
     },
+    // SB-10: the public, documented top-level privacy config. Previously only the
+    // nested replay privacy took effect; this is validated here and mapped onto the
+    // effective replay privacy policy in the bootstrapper so it actually masks.
+    privacy: {
+        kind: 'obj',
+        opt: true,
+        shape: {
+            maskTextInputs: { kind: 'bool', opt: true },
+            maskImages: { kind: 'bool', opt: true },
+            redactAuth: { kind: 'bool', opt: true },
+            redactCookies: { kind: 'bool', opt: true },
+            redactBodies: { kind: 'bool', opt: true },
+        },
+    },
     captureInteractionHeatmap: bool(true),
     // Opt-in: intercept console.* and ship the lines to the Diagnose → Logs lane in SaaS
     // mode. OFF by default — console output can carry PII/secrets and adds ingest volume,
@@ -351,6 +365,14 @@ export interface ScaleBunConfig {
         deltaEncoding?: boolean;
         deltaKeyframeInterval?: number;
     };
+    /** SB-10: public top-level privacy config, mapped onto the replay privacy policy. */
+    privacy?: {
+        maskTextInputs?: boolean;
+        maskImages?: boolean;
+        redactAuth?: boolean;
+        redactCookies?: boolean;
+        redactBodies?: boolean;
+    };
     captureInteractionHeatmap: boolean;
     /** Opt-in: capture console.* into the Logs lane in SaaS mode. Default false. */
     captureConsoleLogs: boolean;

package/src/core/constants/version.ts

@@ -3,4 +3,4 @@
  * can attribute telemetry to the SDK build that produced it.
  * Keep in sync with package.json "version".
  */
-export const SDK_VERSION = '1.10.4';
+export const SDK_VERSION = '1.10.6';

package/src/core/context/device.ts

@@ -114,6 +114,10 @@ export function staticDeviceContext(): Record<string, string> {
     if (c.Model) out.device_model = String(c.Model);
     if (c.Manufacturer) out.manufacturer = String(c.Manufacturer);
     else if (c.Brand) out.manufacturer = String(c.Brand);
+    // iOS exposes no manufacturer because it does not need to: every device running iOS is Apple's.
+    // A tautology, not a guess — and it means the field is populated on event #1 rather than waiting
+    // for a bridge that may never answer.
+    else if (out.platform_os === 'ios') out.manufacturer = 'Apple';
     return out;
 }
 
@@ -122,11 +126,13 @@ export function nativeDeviceContext(info: {
     platform?: string;
     osVersion?: string;
     deviceModel?: string;
+    manufacturer?: string;
 } | null): Record<string, string> {
     const out: Record<string, string> = {};
     if (!info) return out;
     if (info.osVersion) out.os_version = info.osVersion;
     if (info.deviceModel) out.device_model = info.deviceModel;
+    if (info.manufacturer) out.manufacturer = info.manufacturer;
     return out;
 }