Publish Score iOS SDK 0.6.0

This commit is contained in:
bdot
2026-10-07 20:38:39 -04:00
parent 84b3a4cb20
commit b898a75fde
6 changed files with 55 additions and 15 deletions

View File

@@ -8,9 +8,9 @@ identically — see [`conformance/CONTRACT.md`](conformance/CONTRACT.md).
---
## Install — 0.5.0 beta (public, no auth)
## Install — 0.6.0 beta (public, no auth)
Distributed publicly from **[`3HL-SCORE/public-sdks-score`](https://git.3halves-labs.com/3HL-SCORE/public-sdks-score)** (#284) — **no Gitea token / login required**. The iOS XCFramework is a public **release asset** (`mobile-v0.5.0`) on that repo; the Android artifacts live in the org's **Gitea Maven package registry** (anonymous read).
Distributed publicly from **[`3HL-SCORE/public-sdks-score`](https://git.3halves-labs.com/3HL-SCORE/public-sdks-score)** (#284) — **no Gitea token / login required**. The iOS XCFramework is a public **release asset** (`mobile-v0.6.0`) on that repo; the Android artifacts live in the org's **Gitea Maven package registry** (anonymous read).
### Android — Gradle (public Maven registry)
```kotlin
@@ -18,7 +18,7 @@ repositories {
maven { url = uri("https://git.3halves-labs.com/api/packages/3HL-SCORE/maven") } // public — no credentials
}
dependencies {
implementation("com.threehalveslabs.scoretracker:shared-android:0.5.0")
implementation("com.threehalveslabs.scoretracker:shared-android:0.6.0")
}
```
@@ -34,17 +34,17 @@ add it by **git URL** — no registry config, no login:
```swift
// your app's Package.swift
dependencies: [
.package(url: "https://git.3halves-labs.com/3HL-SCORE/public-sdks-score.git", from: "0.5.0")
.package(url: "https://git.3halves-labs.com/3HL-SCORE/public-sdks-score.git", from: "0.6.0")
],
// target: .product(name: "ScoreTracker", package: "public-sdks-score")
```
Or in Xcode: **File → Add Packages…** → paste the URL. The binary `ScoreTrackerKit`
target pulls the XCFramework from the **public** `mobile-v0.5.0` release asset (SPM
target pulls the XCFramework from the **public** `mobile-v0.6.0` release asset (SPM
verifies the checksum) — no `~/.netrc` credentials needed. Verified with an
anonymous `swift package resolve`.
### iOS — direct XCFramework
Download `ScoreTracker-pod.zip` from the **mobile-v0.5.0** release on
Download `ScoreTracker-pod.zip` from the **mobile-v0.6.0** release on
[`public-sdks-score`](https://git.3halves-labs.com/3HL-SCORE/public-sdks-score/releases).
It holds `ScoreTrackerKit.xcframework` and the Swift facade sources
(`Sources/ScoreTracker/`: `ScoreClient.swift`, `Exports.swift`, `AppLifecycle.swift`).
@@ -155,6 +155,39 @@ event, pass it yourself: `requires: [.advertising]` on iOS (or the
`trackAdvertising(...)` shorthand), `requires = listOf(ConsentCategory.ADVERTISING)`
on Android.
## Regional privacy policy (GDPR, Quebec, LGPD, CPRA)
One `privacy` option sets the tracker's posture for the fan's region (#489),
with the same policies and values as the web tracker's `privacy` option. For URC,
which is UK/EU-facing, use **GDPR**:
```swift
// iOS
let score = ScoreClient(publishableKey: pk, siteId: "urc-ios", endpoint: endpoint,
privacy: PrivacyOptions(mode: .gdpr, region: nil, regionProvider: nil, overrides: nil))
```
```kotlin
// Android
val score = newScoreTracker(context, TrackerConfig(pk, "urc-android", endpoint,
privacy = PrivacyOptions(PrivacyMode.GDPR)))
```
| Policy | Starting consent | Queue kept at most | Drops `locale` / `device` |
|---|---|---|---|
| `GDPR` (EU, EEA, UK, CH) | nothing granted (opt-in) | 24 h | yes |
| `QUEBEC` (Law 25) | nothing granted | 24 h | yes |
| `LGPD` (Brazil) | nothing granted | 48 h | yes |
| `CPRA` (US) | analytics + personalization; not advertising | 168 h (the tracker's 72 h still applies) | no |
| `OFF` | no policy: as without the option | 72 h | no |
What the policy changes:
- **Starting consent:** applies only when you pass no `initialConsent`, and only until your first `setConsent`. A value you pass from your CMP always wins. Under GDPR nothing is sent until `setConsent`, as before.
- **Retention:** queued events older than the cap are dropped instead of sent, including events saved before a cold start.
- **Fingerprint-adjacent signals:** `locale` and the device model leave the envelope. `os` and `appVersion` stay.
- **Declared only:** "no session replay" and "no geo enrichment" are reported by `inspect()`, but the SDK does neither anyway.
`AUTO` picks the policy from `region` (ISO country, optionally with a subdivision: `GB`, `US-CA`, `CA-QC`) or a `regionProvider`; with neither, it uses GDPR, the strictest. The device locale is never used: it's a language setting, not a location. Resolve the region before creating the tracker; the policy is fixed for its lifetime. To tune a setting without forking the table, pass `overrides`, e.g. `PrivacyOverrides(retentionMaxHours = 12)`. `inspectJson()` shows the active policy under `privacy`.
## PII scrubbing
Same options as the web tracker's `pii` (#482). Scrubbing runs **when you call