@scalebun/react-native 2.0.0 → 2.0.1

package/lib/typescript/features/navigation/AutoScreenDetector.d.ts

@@ -30,6 +30,15 @@ export declare class AutoScreenDetector {
     private _manualScreen;
     private _manualScreenTs;
     private _autoScreen;
+    /**
+     * When `_autoScreen` was last written.
+     *
+     * Needed so `getCurrentScreen()` can prefer whichever source spoke MOST RECENTLY.
+     * Without a timestamp the only comparison available was "is the manual value still
+     * fresh", which is a different question and gave the wrong answer — see the note on
+     * `_currentScreen()`.
+     */
+    private _autoScreenTs;
     /** `name#key` of the last auto-detected screen VISIT — see _extractActiveVisit. */
     private _autoVisitSig;
     private _navigationRef;
@@ -72,8 +81,19 @@ export declare class AutoScreenDetector {
      */
     setNativeScreen(name: string): void;
     /**
-     * Check if a manual screen is currently active.
-     * Used by auto-detection to yield to manual overrides.
+     * Should a WRITER defer to the manual screen right now?
+     *
+     * THIS IS A PRECEDENCE GATE, NOT A VALIDITY TEST, and conflating the two was a real
+     * bug. Its job is what the cooldown constant says: for a short window after a manual
+     * beacon fires, an auto source must not overwrite it — the poller runs every 1500 ms
+     * and would otherwise clobber a fresh declaration with whatever it inferred.
+     *
+     * `getCurrentScreen()` used to reuse this as "is the manual screen still the current
+     * screen", which made a declared screen READABLE for only 2000 ms. Nothing called
+     * `setManualScreen` in production, so the effect was latent — but the moment the
+     * `<ScaleBunScreen>` beacon was wired to it (RN-8), every tap more than two seconds
+     * after a screen mounted would have lost its name, which is very nearly every tap. A
+     * fix that introduced that would have been worse than the gap it closed.
      */
     isManualScreenActive(): boolean;
     /**
@@ -144,6 +164,32 @@ export declare class AutoScreenDetector {
     teardown(): void;
     /** Get the current best-known screen name */
     getCurrentScreen(): string | null;
+    /**
+     * WHERE the current screen name came from, or 'none'.
+     *
+     * Recorded on every interaction (RN-8) so low screen coverage is DIAGNOSABLE rather
+     * than merely visible. Production shows 13.8% of Android interactions carrying a
+     * screen and 0.5% on iOS, and those numbers cannot today distinguish three different
+     * causes: the app never instrumented anything, the app instrumented manually and the
+     * value never reached interactions, or auto-detection ran and failed. Those have
+     * different owners and different fixes, and guessing between them is how a P0 stays
+     * open.
+     */
+    getCurrentScreenSource(): 'manual' | 'navigation' | 'none';
+    /**
+     * LAST WRITER WINS between the manual beacon and auto-detection.
+     *
+     * A screen declared by `<ScaleBunScreen name>` stays current until something else
+     * declares a different one — that is what mounting a screen means. It does not
+     * expire, which is the correction here: the previous rule returned the manual name
+     * only while it was under 2000 ms old and then silently fell back to the auto value,
+     * which in a manually-instrumented app is `null`.
+     *
+     * Comparing timestamps rather than hard-coding a priority also handles the real
+     * interleaving: an app can use React Navigation for most screens AND drop a manual
+     * beacon on one modal, and whichever spoke last is the truth.
+     */
+    private _currentScreen;
     private _emitScreenChange;
 }
 export {};

package/lib/typescript/features/ota/OtaOrchestrator.d.ts

@@ -34,6 +34,8 @@ export declare class OtaOrchestrator {
      */
     getCurrentBundle(): OtaBundlePayload | null;
     private isRestartRequiredState;
+    /** Root/jailbreak indicators observed at init; empty when none found. */
+    private integrityIndicators;
     private healthyTimer;
     private bootGuardConfig;
     private environment;
@@ -97,6 +99,11 @@ export declare class OtaOrchestrator {
      */
     private checkBootGuardRecovery;
     isEnabled(): boolean;
+    /**
+     * Root/jailbreak indicators detected on this device, as stable reason strings.
+     * Empty means nothing was detected — not proof the device is clean.
+     */
+    deviceIntegrityIndicators(): string[];
     isRestartRequired(): boolean;
     /**
      * Perform an OTA check against the backend endpoint.

package/lib/typescript/features/session/SessionManager.d.ts

@@ -268,6 +268,61 @@ export declare class SessionManager {
         targetId?: string;
         screenName?: string;
         emitAutomaticAnalytics?: boolean;
+        /**
+         * RN-6 — the native↔JS join's own verdict, and it MUST be declared here.
+         *
+         * This signature ENUMERATES its fields rather than spreading, and the only caller
+         * (ScaleBunDebugRoot's native listener) invokes it through `(sm as any)`. So a field
+         * added at the call site and not added here is dropped in silence, with no type
+         * error anywhere — which is precisely how these three nearly shipped as a no-op.
+         *
+         * 'exact' = one JS start was clearly closest. 'ambiguous' = two were within
+         * CORRELATION_MARGIN_MS of each other, so target/ui/screenName were deliberately
+         * withheld rather than guessed. 'none' = no start within tolerance, meaning the JS
+         * handler never fired. The last two are kept distinct because they have different
+         * fixes and collapsing them would hide which is happening in production.
+         */
+        correlation?: 'exact' | 'ambiguous' | 'none';
+        correlationDeltaMs?: number | null;
+        correlationRunnerUpDeltaMs?: number | null;
+        /**
+         * RN-1/RN-2 — which kind of identity `targetId` is. Declared here for the same reason as
+         * the correlation fields above: this signature enumerates, and its only caller goes
+         * through `(sm as any)`, so an undeclared field is dropped in silence.
+         */
+        targetSource?: 'testID' | 'path' | 'component' | 'none';
+        /** RN-8: where the screen name came from. Declared here because this signature enumerates. */
+        screenSource?: 'manual' | 'navigation' | 'none';
+        /**
+         * RN-13: the target control's rectangle in capture-base fractions. Declared here because
+         * this signature ENUMERATES — the sixth field to need it, after three correlation fields,
+         * targetSource and screenSource.
+         */
+        targetRect?: {
+            x: number;
+            y: number;
+            width: number;
+            height: number;
+        };
+        /**
+         * RN-3: content offset of the nearest ancestor scroller. Declared here because this
+         * signature ENUMERATES — the seventh field to need it.
+         */
+        scrollX?: number;
+        scrollY?: number;
+        scrollSource?: 'wrapper' | 'none';
+        /**
+         * RN-4: list row identity. Declared here because this signature ENUMERATES — the eighth
+         * and ninth fields to need it.
+         */
+        itemKey?: string;
+        itemIndex?: number;
+        /**
+         * RN-15: tap position within the target control. Declared here because this signature
+         * ENUMERATES — the tenth and eleventh fields to need it.
+         */
+        localU?: number;
+        localV?: number;
     }): void;
     /**
      * Manual frame capture — triggered by Desktop "Capture Step" button.

package/lib/typescript/public/types.d.ts

@@ -287,6 +287,16 @@ export interface SimplifiedInitConfig {
     appId?: string;
     /** SDK client key (SaaS mode). Also used to authenticate the envelope lane. */
     clientKey?: string;
+    /**
+     * Patch React Native's ScrollView export so every scroll view reports its scroll offset,
+     * giving taps their content depth without the app swapping to ScaleBunScrollView.
+     *
+     * OFF BY DEFAULT because it changes what the host renders, not merely what the SDK records:
+     * every scroll view in the app — including ones inside libraries you did not write — routes
+     * through an SDK wrapper. Turn it on deliberately. With it off, taps on a plain ScrollView
+     * report no content depth and say so, rather than reporting a fabricated offset of 0.
+     */
+    autoInstrumentScrollViews?: boolean;
     /** Platform OVERRIDE — auto-detected from Platform.OS when omitted (integrations should omit it). */
     platform?: 'ios' | 'android' | 'web' | 'react_native';
     /**

package/lib/typescript/specs/NativeScaleBunOta.d.ts

@@ -30,6 +30,8 @@ export interface Spec extends TurboModule {
      * Empty array when no keys are embedded.
      */
     getTrustedKeyIds(): string;
+    /** JSON array of root/jailbreak indicator strings; [] when none found. */
+    getDeviceIntegrity(): string;
     /**
      * Returns JSON with current slot state:
      * { current: { bundleId, version, sha256, installedAt } | null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalebun/react-native",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "React Native SDK for ScaleBun",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
@@ -111,7 +111,7 @@
     "@babel/runtime": "^7.25.0",
     "@jridgewell/sourcemap-codec": "1.5.5",
     "@jridgewell/trace-mapping": "0.3.31",
-    "@scalebun/cli": "^2.0.0"
+    "@scalebun/cli": "^2.0.1"
   },
   "codegenConfig": {
     "name": "ScaleBunSpec",

package/src/bootstrap/SDKBootstrapper.ts

@@ -91,6 +91,24 @@ export class SDKBootstrapper {
         // apiBaseUrl is LOCKED: whatever an integrator passed (or the schema default) is
         // discarded here so the SDK can never be repointed away from the ScaleBun cloud.
         // Change DEFAULT_API_BASE_URL at build time to target a different backend.
+        // Say so when we discard it. The value was accepted by the schema, silently
+        // overwritten here, and the SDK then talked to a different server than the
+        // integrator configured — with no log, no warning, and no error. Someone
+        // pointing the SDK at a staging or local backend would watch requests arrive
+        // at production and have nothing to go on.
+        const requestedApiBaseUrl = (rawConfig as any)?.apiBaseUrl;
+        if (
+          typeof requestedApiBaseUrl === 'string' &&
+          requestedApiBaseUrl &&
+          requestedApiBaseUrl !== DEFAULT_API_BASE_URL
+        ) {
+          logger.warn(
+            `[ScaleBun] Ignoring apiBaseUrl '${requestedApiBaseUrl}' — the endpoint is ` +
+              `locked at build time and this build targets ${DEFAULT_API_BASE_URL}. To ` +
+              `target another backend, change DEFAULT_API_BASE_URL in the SDK source and ` +
+              `rebuild.`,
+          );
+        }
         this.config.apiBaseUrl = DEFAULT_API_BASE_URL;
         // Explicit logLevel wins; otherwise debug:true implies verbose 'debug'.
         if (this.config.logLevel) {
@@ -340,6 +358,28 @@ export class SDKBootstrapper {
         await this.featureRegistry.initializeAll(featureContext);
 
         // ── Session Replay Initialization (Core) ───────────────
+        /**
+ * RN-3 zero-config scroll instrumentation, opt-in.
+ *
+ * Placed before replay init because it patches a module export and must be in place before the
+ * host renders its first scroll view. Reports rather than assumes: the equivalent React
+ * Navigation hook once claimed success it had not verified and left a whole pipeline silently
+ * empty, so a failure here is said out loud with a reason an integrator can act on.
+ */
+        if (this.config.autoInstrumentScrollViews === true) {
+            try {
+                const { autoInstrumentScrollViews } = require('../features/journey/autoInstrumentScroll');
+                const outcome = autoInstrumentScrollViews();
+                if (!outcome.installed) {
+                    logger.warn(
+                        '[Bootstrap] autoInstrumentScrollViews was requested but could not be ' +
+                            'installed: ' + outcome.reason + ' — taps will carry no content depth.',
+                    );
+                } else {
+                    __DEV__ && logger.debug('[Bootstrap] ScrollView auto-instrumentation installed');
+                }
+            } catch { /* no-throw */ }
+        }
         if (features.replay !== false) {
             try {
                 __DEV__ && logger.debug('[Bootstrap] Initializing unified SessionManager');

package/src/core/config/schema.ts

@@ -188,6 +188,22 @@ const SHAPE: Record<string, Field> = {
         },
     },
     captureInteractionHeatmap: bool(true),
+    /**
+     * RN-3 zero-config: patch React Native's ScrollView export so EVERY scroll view reports its
+     * offset, not just ones wrapped in ScaleBunScrollView.
+     *
+     * DEFAULT FALSE, unlike captureInteractionHeatmap above, and the difference is deliberate.
+     * That flag changes what the SDK records about the host; this one changes what the HOST
+     * RENDERS — every scroll view in the app, including ones inside third-party libraries the app
+     * did not write, starts routing through an SDK component. The failure mode is not a wrong
+     * number in a dashboard, it is the host's UI behaving differently because an analytics SDK
+     * replaced a primitive. That is a decision an integrator makes deliberately, not one they
+     * discover afterwards.
+     *
+     * With it off, a plain <ScrollView> yields no content depth and the tap says so
+     * (scroll_source: 'none') rather than defaulting its offset to 0.
+     */
+    autoInstrumentScrollViews: bool(false),
     // Opt-in: intercept console.* and ship the lines to the Diagnose → Logs lane in SaaS
     // mode. OFF by default — console output can carry PII/secrets and adds ingest volume,
     // so capturing it is the host's explicit choice, not a silent default. When true and a
@@ -396,6 +412,8 @@ export interface ScaleBunConfig {
         redactBodies?: boolean;
     };
     captureInteractionHeatmap: boolean;
+    /** RN-3 zero-config scroll instrumentation. OFF by default — it changes what the HOST renders. */
+    autoInstrumentScrollViews: boolean;
     /** Opt-in: capture console.* into the Logs lane in SaaS mode. Default false. */
     captureConsoleLogs: boolean;
     ota?: {

package/src/core/constants/version.ts

@@ -8,4 +8,4 @@
  * value, so a stale one makes a rollout unobservable — which is the exact problem sending an SDK
  * version was introduced to solve.
  */
-export const SDK_VERSION = '2.0.0';
+export const SDK_VERSION = '2.0.1';