Publish Score iOS SDK 0.6.0

INTEGRATION.md

@@ -8,57 +8,47 @@ identically — see [`conformance/CONTRACT.md`](conformance/CONTRACT.md).
 
 ---
 
-## Install — 0.1.0 beta (hosted on Gitea)
+## Install — 0.6.0 beta (public, no auth)
 
-Everything is hosted on the org's Gitea — no external registry. The Android
+Distributed publicly from **[`3HL-SCORE/public-sdks-score`](https://git.3halves-labs.com/3HL-SCORE/public-sdks-score)** (#284) — **no Gitea token / login required**. The iOS XCFramework is a public **release asset** (`mobile-v0.6.0`) on that repo; the Android artifacts live in the org's **Gitea Maven package registry** (anonymous read).
-artifacts live in **Gitea's Maven package registry**; the iOS XCFramework is a
-**Gitea release asset** (`mobile-v0.1.0`).
 
-### Android — Gradle (Gitea Maven registry)
+### Android — Gradle (public Maven registry)
 ```kotlin
 repositories {
-    maven {
+    maven { url = uri("https://git.3halves-labs.com/api/packages/3HL-SCORE/maven") } // public — no credentials
-        url = uri("https://git.3halves-labs.com/api/packages/3HL-SCORE/maven")
-        // If the package registry isn't public, add a Gitea token:
-        // credentials(HttpHeaderCredentials::class) { name = "Authorization"; value = "token ${'$'}giteaToken" }
-        // authentication { create<HttpHeaderAuthentication>("header") }
-    }
 }
 dependencies {
-    implementation("com.threehalveslabs.scoretracker:shared-android:0.1.0")
+    implementation("com.threehalveslabs.scoretracker:shared-android:0.6.0")
 }
 ```
 
-### iOS — CocoaPods (release asset)
+### iOS — CocoaPods (public release asset)
 ```ruby
 pod 'ScoreTracker',
-    :podspec => 'https://git.3halves-labs.com/3HL-SCORE/score-anything-loyalty/raw/branch/main/mobile/ios/ScoreTracker/ScoreTracker.podspec'
+    :podspec => 'https://git.3halves-labs.com/3HL-SCORE/public-sdks-score/raw/branch/main/ScoreTracker.podspec'
 ```
 
-### iOS — Swift Package Manager (Gitea Swift registry)
+### iOS — Swift Package Manager (public git URL)
-Published to Gitea's **Swift package registry** as `threehalveslabs.ScoreTracker`.
+The SPM package lives at the **root** of the public `public-sdks-score` repo, so
-Configure the registry once (per machine / CI), then add it as a normal
+add it by **git URL** — no registry config, no login:
-dependency by **id** — no git URL needed:
-```bash
-swift package-registry set https://git.3halves-labs.com/api/packages/3HL-SCORE/swift
-# private registry → log in with a Gitea token:
-swift package-registry login https://git.3halves-labs.com/api/packages/3HL-SCORE/swift --token <gitea-token>
-```
 ```swift
 // your app's Package.swift
-dependencies: [ .package(id: "threehalveslabs.ScoreTracker", from: "0.1.0") ]
+dependencies: [
-// then: .product(name: "ScoreTracker", package: "ScoreTracker")
+    .package(url: "https://git.3halves-labs.com/3HL-SCORE/public-sdks-score.git", from: "0.6.0")
+],
+// target: .product(name: "ScoreTracker", package: "public-sdks-score")
 ```
-The package's binary `ScoreTrackerKit` target pulls the XCFramework from the
+Or in Xcode: **File → Add Packages…** → paste the URL. The binary `ScoreTrackerKit`
-`mobile-v0.1.0` release asset (SPM verifies the checksum). For a private release
+target pulls the XCFramework from the **public** `mobile-v0.6.0` release asset (SPM
-asset, SPM reads credentials from `~/.netrc`.
+verifies the checksum) — no `~/.netrc` credentials needed. Verified with an
-
+anonymous `swift package resolve`.
-> Note: SPM-by-git-URL isn't available (the package lives in a monorepo subdir,
-> which SPM can't resolve) — the Swift registry above is the supported path.
 
 ### iOS — direct XCFramework
-Download `ScoreTrackerKit.xcframework.zip` from the **mobile-v0.1.0** release and
+Download `ScoreTracker-pod.zip` from the **mobile-v0.6.0** release on
-drag the `.xcframework` into your Xcode project; add `ScoreClient.swift`.
+[`public-sdks-score`](https://git.3halves-labs.com/3HL-SCORE/public-sdks-score/releases).
+It holds `ScoreTrackerKit.xcframework` and the Swift facade sources
+(`Sources/ScoreTracker/`: `ScoreClient.swift`, `Exports.swift`, `AppLifecycle.swift`).
+Drag the `.xcframework` into your Xcode project and add the Swift files to your app target.
 
 ---
 
@@ -71,7 +61,6 @@ let score = ScoreClient(
     publishableKey: "pk_live_…",
     siteId: "urc-ios",
     endpoint: "https://<middleware-host>",
-    sdkVersion: "0.1.0",
     appVersion: Bundle.main.shortVersion,
     os: "iOS \(UIDevice.current.systemVersion)",
     device: UIDevice.current.model,
@@ -81,14 +70,26 @@ let score = ScoreClient(
 // Nothing sends until consent is granted (see Consent below).
 score.grantAllConsent()
 
-// Track app earning events
+// Track app earning events with the generated `Events` taxonomy (preferred):
-score.track("poll_vote", props: ["pollId": "motm-r12", "choice": "player_7"])
+// the wire name and its consent `requires` come from the shared schema, so iOS,
+// Android and web emit byte-identical events (#206, #485).
+score.track(Events.shared.PollVote, props: ["pollId": "motm-r12", "choice": "player_7"])
+
+// …or by name, for an event not in `Events`. `requires:` gates it on consent.
+score.track("custom_badge_tap", props: ["badgeId": "b1"], requires: [.analytics])
 score.screen("match_centre")
 
 // Flush is async; the SDK also auto-flushes (see Offline & flushing)
 Task { try? await score.flush() }
 ```
 
+> The envelope's `sdk.name` and `sdk.version` are baked into the build: `…-ios`
+> or `…-android` from the platform, and the version from the release (#486).
+> There's nothing to pass. Read them with `ScoreClient.sdkName` /
+> `ScoreClient.sdkVersion` (Swift) or `SdkInfo.CURRENT` (Kotlin) when a support
+> conversation asks "which version are you on?". The old `sdkVersion:` argument
+> and `TrackerConfig(…, sdk = …)` still compile, but are deprecated and ignored.
+
 The durable offline queue and persistent `anonymousId` are handled natively
 (NSUserDefaults) — events survive app cold starts and flush when back online.
 
@@ -106,7 +107,6 @@ val score = newScoreTracker(
         publishableKey = "pk_live_…",
         siteId = "urc-android",
         endpoint = "https://<middleware-host>",
-        sdk = SdkInfo("@3halves-labs/score-tracker-android", "0.1.0"),
         device = DeviceDescriptor(os = "Android ${Build.VERSION.RELEASE}", device = Build.MODEL,
                                   appVersion = BuildConfig.VERSION_NAME, locale = Locale.getDefault().toLanguageTag()),
     ),
@@ -148,35 +148,226 @@ score.setConsent(analytics: groups.analytics, personalization: groups.personaliz
 score.setConsent(ConsentState(analytics = a, personalization = p, advertising = ad))
 ```
 
-Events declaring a category (e.g. `trackAdvertising(...)` on iOS, or
+Events declaring a category are dropped until that category is granted. A typed
-`requires = listOf(ConsentCategory.ADVERTISING)` on Android) are dropped until
+`Events` definition carries its own (`Events.PollVote` requires analytics,
-that category is granted.
+`Events.AdImpression` advertising), identically on iOS and Android. For a named
+event, pass it yourself: `requires: [.advertising]` on iOS (or the
+`trackAdvertising(...)` shorthand), `requires = listOf(ConsentCategory.ADVERTISING)`
+on Android.
+
+## Regional privacy policy (GDPR, Quebec, LGPD, CPRA)
+
+One `privacy` option sets the tracker's posture for the fan's region (#489),
+with the same policies and values as the web tracker's `privacy` option. For URC,
+which is UK/EU-facing, use **GDPR**:
+
+```swift
+// iOS
+let score = ScoreClient(publishableKey: pk, siteId: "urc-ios", endpoint: endpoint,
+                        privacy: PrivacyOptions(mode: .gdpr, region: nil, regionProvider: nil, overrides: nil))
+```
+```kotlin
+// Android
+val score = newScoreTracker(context, TrackerConfig(pk, "urc-android", endpoint,
+    privacy = PrivacyOptions(PrivacyMode.GDPR)))
+```
+
+| Policy | Starting consent | Queue kept at most | Drops `locale` / `device` |
+|---|---|---|---|
+| `GDPR` (EU, EEA, UK, CH) | nothing granted (opt-in) | 24 h | yes |
+| `QUEBEC` (Law 25) | nothing granted | 24 h | yes |
+| `LGPD` (Brazil) | nothing granted | 48 h | yes |
+| `CPRA` (US) | analytics + personalization; not advertising | 168 h (the tracker's 72 h still applies) | no |
+| `OFF` | no policy: as without the option | 72 h | no |
+
+What the policy changes:
+- **Starting consent:** applies only when you pass no `initialConsent`, and only until your first `setConsent`. A value you pass from your CMP always wins. Under GDPR nothing is sent until `setConsent`, as before.
+- **Retention:** queued events older than the cap are dropped instead of sent, including events saved before a cold start.
+- **Fingerprint-adjacent signals:** `locale` and the device model leave the envelope. `os` and `appVersion` stay.
+- **Declared only:** "no session replay" and "no geo enrichment" are reported by `inspect()`, but the SDK does neither anyway.
+
+`AUTO` picks the policy from `region` (ISO country, optionally with a subdivision: `GB`, `US-CA`, `CA-QC`) or a `regionProvider`; with neither, it uses GDPR, the strictest. The device locale is never used: it's a language setting, not a location. Resolve the region before creating the tracker; the policy is fixed for its lifetime. To tune a setting without forking the table, pass `overrides`, e.g. `PrivacyOverrides(retentionMaxHours = 12)`. `inspectJson()` shows the active policy under `privacy`.
+
+## PII scrubbing
+
+Same options as the web tracker's `pii` (#482). Scrubbing runs **when you call
+`track()`, before the event is queued**, so a raw value never reaches the
+on-device queue (NSUserDefaults / SharedPreferences) or the network.
+
+- **Denylist:** remove matching keys.
+- **Classify:** a per-key action. The first rule for a key wins.
+  - `DROP`: remove the key.
+  - `REDACT`: replace the value with `"<redacted>"`.
+  - `TOKENIZE`: replace it with `t:1`, `t:2`, …, stable for the tracker's lifetime.
+  - `HASH`: `h:` plus FNV-1a 32-bit hex. It's identical to the web tracker, so
+    the same value hashes the same on both platforms. **Not** cryptographic.
+
+Keys match exactly (case-sensitive) at any depth, including inside lists.
+
+```kotlin
+// Android
+val score = newScoreTracker(
+    context, config,
+    pii = PiiOptions.Classify(listOf(
+        PiiRule("email", PiiAction.HASH),         // joinable across web + app
+        PiiRule("phone", PiiAction.REDACT),
+        PiiRule("memberNumber", PiiAction.TOKENIZE),
+        PiiRule("dateOfBirth", PiiAction.DROP),
+    )),
+)
+score.track("profile_updated", mapOf("email" to "fan@example.com", "favouriteTeam" to "home-club"))
+// queued and sent as {"email":"h:141e28bb","favouriteTeam":"home-club"}
+```
+```swift
+// iOS
+let score = ScoreClient(
+    publishableKey: "pk_…", siteId: "app.example.com-1a2b3c",
+    endpoint: "https://api.example.com",
+    pii: PiiOptions.Classify(rules: [
+        PiiRule(field: "email", action: .hash_),     // `hash_`, not `hash`: that name is NSObject's
+        PiiRule(field: "phone", action: .redact),
+        PiiRule(field: "memberNumber", action: .tokenize),
+        PiiRule(field: "dateOfBirth", action: .drop),
+    ])
+)
+```
+
+To remove keys without per-field actions, use
+`PiiOptions.Denylist(listOf("email", "phone"))`.
 
 ## Auth0 (JWT)
 
-Mirrors the web tracker (#109): supply a token provider — it's consulted before
+Mirrors the web tracker's `getToken` (#109, #483): supply a token provider. It's
-each flush, so flushes carry a fresh access token. Failure → anonymous, never
+consulted before each flush, so flushes carry a fresh access token. It is
-halts.
+**async**, so hand it Auth0's own refresh call directly; there's nothing to block
+on or cache yourself.
 
 ```swift
-score.setTokenProvider { Auth0Session.shared.accessToken } // called before each flush
+// iOS — Auth0.swift's CredentialsManager renews the token when it's expired.
-score.identify(userId: "auth0|abc123")                     // optional: set userId now
+score.setTokenProvider { try await credentialsManager.credentials().accessToken }
+score.identify(userId: "auth0|abc123")   // optional: set userId now
 ```
 ```kotlin
-score.setTokenProvider { auth0.credentials?.accessToken }
+// Android — Auth0.Android's CredentialsManager has a suspend awaitCredentials().
+score.setTokenProvider { credentialsManager.awaitCredentials().accessToken }
 score.identify("auth0|abc123")
 ```
 
+### Signing in: traits and replay (#488)
+
+`identify` takes the fan's traits, sent on an `identify` event (consent-gated
+and PII-scrubbed like any props). Pass `replayAnonymousEvents` to re-send the
+events the app already sent while the fan was signed out, now with the fan
+attached, so a poll vote cast before sign-in still earns its karma:
+
+```swift
+score.identify(userId: "auth0|abc123", traits: ["team": "urc-leinster"], replayAnonymousEvents: true)
+```
+```kotlin
+score.identify("auth0|abc123", traits = mapOf("team" to "urc-leinster"), replayAnonymousEvents = true)
+```
+
+Replay is opt-in. It re-sends at most the last 100 anonymously sent events
+(`identifyReplayBufferSize` on the factory / `ScoreClient` init), only those
+current consent still allows, marked `_backfill: true` with `_originalEventId`.
+Events still waiting in the queue aren't replayed: they go out with the fan on
+the next flush. The buffer lives in memory only, so it's empty after a cold
+start.
+
+After `identify`, the tracker also links this device's `anonymousId` to the fan
+(`POST /api/identity/link-anonymous`, with the token from your provider or
+`setToken`), so the server can credit events that arrive with only the
+`anonymousId`. It happens once per fan per device, on the next flush, after the
+events; it needs `analytics` consent and a token, and a failure never affects
+event delivery. Android's `score.lastLinkSkipReason()` (`already_linked`,
+`consent`, `no_token`, `error`) says why a link hasn't happened. A custom
+`Transport` must implement `postWithHeaders` for this call to carry the token.
+
+How the provider is used:
+- **Before each flush**, and **single-flight**: overlapping flushes share one
+  in-flight call instead of starting several.
+- **Bounded:** if it hasn't answered within 5 s, the flush goes ahead without
+  waiting. The call keeps running, and its token is used once it arrives.
+  Android can change this with the `tokenRefreshTimeoutMs` parameter on
+  `ScoreTracker`.
+- **Never halts tracking:** if the provider throws or returns null, the flush
+  uses the last known token, or goes anonymous if there isn't one.
+- A synchronous closure still works (`{ cachedToken }`), so existing code
+  compiles unchanged.
+
 ## Offline & flushing
 
 - **Durable queue:** events persist (NSUserDefaults / SharedPreferences), survive
   cold start, are FIFO-capped (oldest dropped), and clear only on a successful
   POST (a failed flush retains them for retry).
-- **Auto-flush:** `score.startAutoFlush(everySeconds: 30)` (iOS) /
+- **Lifecycle & connectivity — one call (#484).** Bind the tracker once at
-  `score.startAutoFlush(scope, intervalMs)` (Android).
+  startup and it flushes when it should:
-- **Lifecycle hooks:** call `onForeground()` / `onNetworkAvailable()` to flush
+
-  promptly — wire them to `UIApplication`/`NWPathMonitor` (iOS) or
+  ```swift
-  `ProcessLifecycleOwner`/connectivity callbacks (Android).
+  // iOS — in application(_:didFinishLaunchingWithOptions:)
+  score.bindToAppLifecycle()
+  ```
+  ```kotlin
+  // Android — in Application.onCreate(), on the main thread
+  score.bindToAppLifecycle(this)
+  ```
+
+  | When | What the tracker does |
+  |---|---|
+  | App comes to the foreground (or is already there when you bind) | Flush, and flush every 30 s while it stays there |
+  | App goes to the background | Stop the periodic flush; one **best-effort flush bounded to 5 s**, so it can't hold up suspension (on iOS, inside a background task that ends as soon as the flush does) |
+  | Network comes back | Flush |
+
+  Both platforms run the same shared logic. Options: `autoFlushEverySeconds` /
+  `autoFlushIntervalMs` (`nil`/`null` to run your own auto-flush) and
+  `backgroundBudgetSeconds` / `backgroundBudgetMs`. Undo with
+  `unbindAppLifecycle()` (iOS) or `close()` on the returned binding (Android).
+  Android declares `ACCESS_NETWORK_STATE` in the library manifest, a normal
+  permission with no prompt. A bounded flush that runs out of time loses
+  nothing: events leave the queue only after their POST succeeds.
+- **Delivery tiers (#487).** Mark an event that must not be lost as critical:
+
+  ```swift
+  score.track(Events.shared.PollVote, props: […], delivery: .critical)        // iOS
+  ```
+  ```kotlin
+  score.track(Events.PollVote, mapOf(…), delivery = DeliveryMode.CRITICAL)    // Android
+  ```
+
+  Critical events go out first in every flush, survive app restarts as
+  critical, and are the last to go when the queue is full: best-effort
+  events, including new ones, are shed before any critical event. If a
+  critical event is lost anyway, because it aged past 72 h or the queue was
+  entirely critical, the SDK sends a `delivery_failed` event naming it
+  (`originalEventId`, `originalEventName`, `reason`: `age_evicted` or
+  `queue_full`), the same event the web tracker sends. The tier is local:
+  it never appears on the wire.
+- **Manual control instead:** binding is opt-in. Skip it and call
+  `onForeground()`, `onBackground()` and `onNetworkAvailable()` yourself, plus
+  `startAutoFlush(everySeconds: 30)` (iOS) / `startAutoFlush(scope, intervalMs)`
+  (Android).
+
+## Bug reports: attach `inspectJson()`
+
+When the tracker misbehaves in the field, the first thing to attach is its
+snapshot (#490), the counterpart of the web tracker's `inspect()`:
+
+```swift
+print(score.inspectJson())          // iOS
+```
+```kotlin
+Log.d("Score", score.inspectJson()) // Android
+```
+
+It covers:
+- the SDK name and version
+- consent: each category, and how many events the gate dropped
+- the queue: depth, caps, the oldest event's age, critical events, critical events lost
+- identity: `anonymousId`, `sessionId`, `userId`, whether a token is held, the `link-anonymous` state and the replay buffer
+- the last flush: when, whether it succeeded, how many events it sent, and how many failures in a row
+- site, endpoint and the number of PII rules
+
+**It never contains the token**, only `hasToken`, so it's safe to log or paste. `inspect()` returns the same data as a typed `InspectSnapshot`.
 
 ## Canonical app earning events
 

Package.swift

@@ -1,10 +1,11 @@
 // swift-tools-version:5.9
 import PackageDescription
 
-// Public SPM package for the Score iOS SDK. `ScoreTracker` (Swift facade,
+// SPM package for the iOS SDK (#178/#188). The `ScoreTracker` Swift facade
-// ScoreClient) wraps the binary `ScoreTrackerKit` XCFramework, hosted as a
+// (ScoreClient) wraps the binary `ScoreTrackerKit` XCFramework, hosted as a
-// public release asset on this repo. Consume via git URL:
+// **public** Gitea release asset on `3HL-SCORE/public-sdks-score` (#284).
-//   .package(url: "https://git.3halves-labs.com/3HL-SCORE/public-sdks-score.git", from: "0.1.0")
+// Build/refresh via `scripts/release.sh` (rebuild the XCFramework, re-zip,
+// recompute the checksum, re-upload to the public release).
 let package = Package(
     name: "ScoreTracker",
     platforms: [.iOS(.v14)],
@@ -14,8 +15,8 @@ let package = Package(
     targets: [
         .binaryTarget(
             name: "ScoreTrackerKit",
-            url: "https://git.3halves-labs.com/3HL-SCORE/public-sdks-score/releases/download/mobile-v0.1.0/ScoreTrackerKit.xcframework.zip",
+            url: "https://git.3halves-labs.com/3HL-SCORE/public-sdks-score/releases/download/mobile-v0.6.0/ScoreTrackerKit.xcframework.zip",
-            checksum: "ae4b4c9b2a7e386d58c1c1144d15c3b4e5f457099ac2677e7d22894a7e4ab3e5"
+            checksum: "dbf9bd9eec9e0c01cb28d7527e19e15909ddda95cf5fb48e50a1639e18ef1988"
         ),
         .target(
             name: "ScoreTracker",

README.md

@@ -1,15 +1,26 @@
+<!--
+  Seed README for the PUBLIC distribution repo `3HL-SCORE/public-sdks-score` (#284).
+  Copy this to that repo's root as README.md when publishing. Source of truth for
+  the SDK lives in the private score-anything-loyalty repo under `mobile/`.
+-->
 # Score mobile SDKs (public distribution)
 
-Public, auth-free distribution of the **Score mobile tracker** SDKs for iOS and Android — the mobile counterpart of the web `@3halves-labs/score-tracker`.
+Public, auth-free distribution of the **Score mobile tracker** SDKs for iOS and Android — the mobile counterpart of the web `@3halves-labs/score-tracker`. Lightweight app analytics / fan-engagement tracking with a durable offline queue, consent gating, and Auth0 JWT support.
 
-## Install — 0.1.0 (no token / login required)
+> This repo hosts the **consumable artifacts** (release assets + package manifests). The SDK source lives in 3 Halves Labs' private platform repo.
 
-### iOS — Swift Package Manager (git URL)
+## Install — 0.6.0 (no token / login required)
+
+### iOS — Swift Package Manager
+Add this repo by git URL. There's no registry to configure and no login.
 ```swift
 // Package.swift
-dependencies: [ .package(url: "https://git.3halves-labs.com/3HL-SCORE/public-sdks-score.git", from: "0.1.0") ]
+dependencies: [ .package(url: "https://git.3halves-labs.com/3HL-SCORE/public-sdks-score.git", from: "0.6.0") ]
 // target: .product(name: "ScoreTracker", package: "public-sdks-score")
 ```
+Or in Xcode: **File → Add Packages…** and paste the URL. (The old Swift package
+*registry* route, `threehalveslabs.ScoreTracker`, was retired; that package no
+longer exists.)
 
 ### iOS — CocoaPods
 ```ruby
@@ -18,16 +29,22 @@ pod 'ScoreTracker',
 ```
 
 ### iOS — direct XCFramework
-Download `ScoreTrackerKit.xcframework.zip` from the [`mobile-v0.1.0` release](https://git.3halves-labs.com/3HL-SCORE/public-sdks-score/releases) and drag it into Xcode.
+Download `ScoreTracker-pod.zip` from the [`mobile-v0.6.0` release](https://git.3halves-labs.com/3HL-SCORE/public-sdks-score/releases). It contains `ScoreTrackerKit.xcframework` plus the Swift facade sources (`Sources/ScoreTracker/`). Drag the framework into Xcode and add the Swift files to your app target.
 
 ### Android — Gradle
 ```kotlin
-repositories { maven { url = uri("https://git.3halves-labs.com/api/packages/3HL-SCORE/maven") } } // public
+repositories {
-dependencies { implementation("com.threehalveslabs.scoretracker:shared-android:0.1.0") }
+    maven { url = uri("https://git.3halves-labs.com/api/packages/3HL-SCORE/maven") } // public — no credentials
+}
+dependencies {
+    implementation("com.threehalveslabs.scoretracker:shared-android:0.6.0")
+}
 ```
 
-## Docs
+## Quickstart & API
 
-Full integration guide (init, consent, Auth0, offline/flush, event catalogue): **[`INTEGRATION.md`](INTEGRATION.md)**.
+See the full integration guide (init, consent, Auth0, offline/flush, event catalogue): **`INTEGRATION.md`** in this repo (published alongside each release).
 
-SDK source lives in 3 Halves Labs' platform repo; this repo hosts the consumable artifacts. Versions tagged `0.1.0` (SPM) / `mobile-v0.1.0` (release asset).
+## Support
+
+Issues / integration questions: contact 3 Halves Labs. Versions are tagged `mobile-v<version>`.

ScoreTracker.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name             = 'ScoreTracker'
-  s.version          = '0.1.0'
+  s.version          = '0.6.0'
   s.summary          = 'Score mobile tracker (iOS) — KMP shared core + Swift facade.'
   s.description      = <<-DESC
     Lightweight app analytics / fan-engagement tracker. Emits the same event
@@ -13,8 +13,11 @@ Pod::Spec.new do |s|
   s.platform         = :ios, '14.0'
   s.swift_version    = '5.9'
 
-  # Release attaches the zipped XCFramework; point :http at that asset.
+  # release.sh attaches ScoreTracker-pod.zip — the XCFramework plus the Swift
-  s.source           = { :http => 'https://git.3halves-labs.com/3HL-SCORE/public-sdks-score/releases/download/mobile-v0.1.0/ScoreTrackerKit.xcframework.zip' }
+  # facade sources — as a PUBLIC asset on public-sdks-score (#284, #491), and
+  # stamps s.version above, which this URL is built from. (0.2.0's pod pointed
+  # at the SPM zip, which holds the framework alone, so it had no ScoreClient.)
+  s.source           = { :http => "https://git.3halves-labs.com/3HL-SCORE/public-sdks-score/releases/download/mobile-v#{s.version}/ScoreTracker-pod.zip" }
 
   s.vendored_frameworks = 'ScoreTrackerKit.xcframework'
   s.source_files        = 'Sources/ScoreTracker/**/*.swift'

Sources/ScoreTracker/AppLifecycle.swift

@@ -0,0 +1,104 @@
+import Foundation
+import Network
+import ScoreTrackerKit
+import UIKit
+
+/// Everything `bindToAppLifecycle()` installed, so `unbindAppLifecycle()` can
+/// remove exactly that (#484).
+final class AppBindings {
+    let controller: AppLifecycleController
+    var observers: [NSObjectProtocol] = []
+    var pathMonitor: NWPathMonitor?
+    var networkWasSatisfied = true
+
+    init(controller: AppLifecycleController) { self.controller = controller }
+}
+
+extension ScoreClient {
+
+    /// Flush on the app's lifecycle and connectivity, so you don't wire them by
+    /// hand (#484). One call, opt-in — typically in
+    /// `application(_:didFinishLaunchingWithOptions:)`:
+    ///
+    ///     score.bindToAppLifecycle()
+    ///
+    /// - Foreground (`willEnterForeground`, or already active when you bind):
+    ///   flush, and flush every `autoFlushEverySeconds` (nil: leave auto-flush
+    ///   to you).
+    /// - Background (`didEnterBackground`): stop the periodic flush, then a
+    ///   best-effort flush bounded by `backgroundBudgetSeconds`, inside a
+    ///   background task that ends as soon as the flush does.
+    /// - Network back (`NWPathMonitor` turns satisfied): flush.
+    ///
+    /// The behaviour is the shared `AppLifecycleController`, the same one the
+    /// Android binding drives. Call on the main thread. If you use
+    /// `startAutoFlush(everySeconds:)` yourself, binding with an interval
+    /// replaces it; pass `autoFlushEverySeconds: nil` to keep yours.
+    @available(iOSApplicationExtension, unavailable, message: "App lifecycle notifications aren't delivered to extensions; flush manually.")
+    public func bindToAppLifecycle(autoFlushEverySeconds: Double? = 30, backgroundBudgetSeconds: Double = 5) {
+        dispatchPrecondition(condition: .onQueue(.main))
+        unbindAppLifecycle()
+        if autoFlushEverySeconds != nil { stopAutoFlush() }   // one periodic flush, not two
+
+        let controller = IosPlatformKt.doNewAppLifecycleController(
+            tracker: tracker,
+            autoFlushIntervalMs: Int64((autoFlushEverySeconds ?? 0) * 1000),   // 0 → none
+            backgroundBudgetMs: Int64(backgroundBudgetSeconds * 1000)
+        )
+        let bindings = AppBindings(controller: controller)
+        let center = NotificationCenter.default
+
+        bindings.observers.append(center.addObserver(
+            forName: UIApplication.willEnterForegroundNotification, object: nil, queue: .main
+        ) { _ in controller.appDidEnterForeground() })
+
+        bindings.observers.append(center.addObserver(
+            forName: UIApplication.didEnterBackgroundNotification, object: nil, queue: .main
+        ) { _ in
+            // Ask iOS for time to finish the flush; hand it back the moment the
+            // bounded flush is done (or, if iOS's own deadline comes first, then).
+            var task = UIBackgroundTaskIdentifier.invalid
+            let end = {
+                guard task != .invalid else { return }
+                UIApplication.shared.endBackgroundTask(task)
+                task = .invalid
+            }
+            task = UIApplication.shared.beginBackgroundTask(withName: "ScoreTracker.flush", expirationHandler: end)
+            controller.appDidEnterBackground(onDone: end)
+        })
+
+        // Android parity: binding while already in the foreground counts as one.
+        if UIApplication.shared.applicationState == .active {
+            controller.appDidEnterForeground()
+        }
+
+        // Flush on the transition to "satisfied", not on every path update.
+        let monitor = NWPathMonitor()
+        monitor.pathUpdateHandler = { [weak bindings] path in
+            DispatchQueue.main.async {
+                guard let bindings else { return }
+                let satisfied = path.status == .satisfied
+                if satisfied && !bindings.networkWasSatisfied { bindings.controller.networkDidBecomeAvailable() }
+                bindings.networkWasSatisfied = satisfied
+            }
+        }
+        monitor.start(queue: DispatchQueue(label: "com.threehalveslabs.scoretracker.network"))
+        bindings.pathMonitor = monitor
+
+        appBindings = bindings
+    }
+
+    /// Remove everything `bindToAppLifecycle()` installed. Safe to call when not bound.
+    public func unbindAppLifecycle() {
+        dispatchPrecondition(condition: .onQueue(.main))
+        unbindAppLifecycleFromAnyContext()
+    }
+
+    func unbindAppLifecycleFromAnyContext() {
+        guard let bindings = appBindings else { return }
+        bindings.observers.forEach { NotificationCenter.default.removeObserver($0) }
+        bindings.pathMonitor?.cancel()
+        bindings.controller.close()
+        appBindings = nil
+    }
+}

Sources/ScoreTracker/Exports.swift

@@ -0,0 +1,27 @@
+import ScoreTrackerKit
+
+// The types in ScoreClient's public API live in the ScoreTrackerKit framework.
+// The integration guide has apps `import ScoreTracker` only, which left them
+// unable to name any of these, so `Events.shared.PollVote` and
+// `requires: [ConsentCategory.advertising]` didn't compile in an app (#485).
+// Re-exported by name; an app that also imports ScoreTrackerKit sees the same
+// types, because a module's declarations shadow those of the modules it imports.
+
+/// Generated loyalty event definitions (`Events.shared.PollVote`, …), shared
+/// with the web and Android trackers.
+public typealias Events = ScoreTrackerKit.Events
+public typealias EventDefinition = ScoreTrackerKit.EventDefinition
+public typealias ConsentCategory = ScoreTrackerKit.ConsentCategory
+public typealias ConsentState = ScoreTrackerKit.ConsentState
+public typealias DeliveryMode = ScoreTrackerKit.DeliveryMode
+public typealias PiiOptions = ScoreTrackerKit.PiiOptions
+public typealias PiiRule = ScoreTrackerKit.PiiRule
+public typealias PiiAction = ScoreTrackerKit.PiiAction
+/// The support snapshot returned by `ScoreClient.inspect()` (#490); its nested
+/// types are reached through it (`snapshot.identity.hasToken`).
+public typealias InspectSnapshot = ScoreTrackerKit.InspectSnapshot
+/// Regional privacy policy (#489): pass `PrivacyOptions(mode: .gdpr, …)` as
+/// `ScoreClient(privacy:)`.
+public typealias PrivacyOptions = ScoreTrackerKit.PrivacyOptions
+public typealias PrivacyMode = ScoreTrackerKit.PrivacyMode
+public typealias PrivacyOverrides = ScoreTrackerKit.PrivacyOverrides

Sources/ScoreTracker/ScoreClient.swift

@@ -7,13 +7,53 @@ import ScoreTrackerKit
 /// and persistent `anonymousId` are handled natively (NSUserDefaults) — see #176.
 public final class ScoreClient {
 
-    private let tracker: ScoreTracker
+    let tracker: ScoreTracker
     private var autoFlushTask: Task<Void, Never>?
+    /// Set while `bindToAppLifecycle()` is in effect (AppLifecycle.swift, #484).
+    var appBindings: AppBindings?
 
     /// - Parameters:
     ///   - endpoint: middleware base URL; events POST to `<endpoint>/api/tracking/website`.
     ///   - initialConsent: defaults to "none" — nothing fires until `setConsent(...)`.
+    ///   - pii: field-level PII handling (#482), scrubbed before events are queued on the device.
+    ///   - tokenRefreshTimeoutSeconds: how long a flush waits for the token provider (#483).
+    ///
+    /// The envelope's `sdk.name` / `sdk.version` are baked into the framework
+    /// (#486); there is nothing to pass.
     public init(
+        publishableKey: String,
+        siteId: String,
+        endpoint: String,
+        appVersion: String? = nil,
+        os: String? = nil,
+        device: String? = nil,
+        locale: String? = nil,
+        initialConsent: ConsentState? = nil,
+        privacy: PrivacyOptions? = nil,
+        pii: PiiOptions? = nil,
+        tokenRefreshTimeoutSeconds: Double = 5,
+        identifyReplayBufferSize: Int = 100
+    ) {
+        let config = TrackerConfig(
+            publishableKey: publishableKey,
+            siteId: siteId,
+            endpoint: endpoint,
+            device: DeviceDescriptor(os: os, device: device, appVersion: appVersion, locale: locale),
+            privacy: privacy
+        )
+        tracker = IosPlatformKt.doNewScoreTracker(
+            config: config,
+            initialConsent: initialConsent,
+            pii: pii,
+            tokenRefreshTimeoutMs: Int64(tokenRefreshTimeoutSeconds * 1000),
+            identifyReplayBufferSize: Int32(identifyReplayBufferSize)
+        )
+    }
+
+    /// The pre-#486 signature. `sdkVersion` is ignored: the SDK reports the
+    /// version it was built as.
+    @available(*, deprecated, message: "The SDK reports its own version now (#486); sdkVersion is ignored. Drop the argument.")
+    public convenience init(
         publishableKey: String,
         siteId: String,
         endpoint: String,
@@ -22,18 +62,20 @@ public final class ScoreClient {
         os: String? = nil,
         device: String? = nil,
         locale: String? = nil,
-        initialConsent: ConsentState = ConsentState.companion.NONE
+        initialConsent: ConsentState = ConsentState.companion.NONE,
+        pii: PiiOptions? = nil
     ) {
-        let config = TrackerConfig(
+        self.init(
-            publishableKey: publishableKey,
+            publishableKey: publishableKey, siteId: siteId, endpoint: endpoint,
-            siteId: siteId,
+            appVersion: appVersion, os: os, device: device, locale: locale,
-            endpoint: endpoint,
+            initialConsent: initialConsent, pii: pii
-            sdk: SdkInfo(name: "@3halves-labs/score-tracker-ios", version: sdkVersion),
-            device: DeviceDescriptor(os: os, device: device, appVersion: appVersion, locale: locale)
         )
-        tracker = IosPlatformKt.doNewScoreTracker(config: config, initialConsent: initialConsent)
     }
 
+    /// What this build reports as `sdk.name` / `sdk.version` — for support and logs.
+    public static var sdkName: String { SdkInfo.companion.CURRENT.name }
+    public static var sdkVersion: String { SdkInfo.companion.CURRENT.version }
+
     // MARK: - Consent (wire to your CMP / OneTrust)
 
     public func setConsent(analytics: Bool, personalization: Bool, advertising: Bool) {
@@ -44,31 +86,80 @@ public final class ScoreClient {
 
     // MARK: - Identity / Auth0
 
-    public func identify(userId: String, token: String? = nil) {
+    /// Bind events to the fan (#488). Sends an `identify` event carrying
-        tracker.identify(userId: userId, token: token)
+    /// `traits` (consent-gated and PII-scrubbed like any props). With
+    /// `replayAnonymousEvents`, events already sent before sign-in are re-sent
+    /// with the fan attached, marked `_backfill`, so a vote cast while signed
+    /// out earns its karma. Events still queued need no replay: they go out
+    /// with the user on the next flush.
+    public func identify(
+        userId: String,
+        token: String? = nil,
+        traits: [String: Any] = [:],
+        replayAnonymousEvents: Bool = false
+    ) {
+        tracker.identify(userId: userId, token: token, traits: traits, replayAnonymousEvents: replayAnonymousEvents)
     }
     public func setToken(_ token: String?) { tracker.setToken(token: token) }
 
-    /// Provider is consulted before each flush — wire to your Auth0 access token.
+    /// Supply the fan's access token on demand — wire to Auth0's
-    public func setTokenProvider(_ provider: @escaping () -> String?) {
+    /// `credentialsManager.credentials()` (#483). `async`, so a silent refresh
-        tracker.setTokenProvider(provider: provider)
+    /// needs no blocking; a plain synchronous closure works too. Consulted
+    /// before each flush, single-flight. If it throws, returns nil or takes
+    /// longer than the tracker's timeout (5 s), the flush goes ahead with the
+    /// last known token — anonymous if there is none.
+    public func setTokenProvider(_ provider: @escaping () async throws -> String?) {
+        tracker.setCallbackTokenProvider { complete in
+            Task { complete(try? await provider()) }   // a throw counts as "no token"
+        }
+    }
+
+    /// Stop consulting a provider; the last token set stays until replaced.
+    public func clearTokenProvider() {
+        tracker.setCallbackTokenProvider(provider: nil)
     }
 
     public var anonymousId: String { tracker.anonymousId }
     public var pending: Int { Int(tracker.pending()) }
 
+    /// The tracker's state for support (#490): consent, queue depth and oldest
+    /// event, identity (the token only as `hasToken`), the last flush, and the
+    /// link and replay state. Attach `inspectJson()` to any bug report.
+    public func inspect() -> InspectSnapshot { tracker.inspect() }
+    /// `inspect()` as JSON, ready to paste into a bug report.
+    public func inspectJson() -> String { tracker.inspectJson() }
+
     // MARK: - Tracking
 
-    /// Track an app event. Returns false if dropped by the consent gate.
+    /// Track a typed loyalty event — the preferred form (#485). `Events` is
+    /// generated from the same schemas as the web and Android trackers, so the
+    /// name and its consent contract (`requires`) are identical on every
+    /// platform. Returns false if dropped by the consent gate.
+    ///
+    ///     score.track(Events.shared.PollVote, props: ["pollId": "motm-r12", "choice": "player_7"])
     @discardableResult
-    public func track(_ name: String, props: [String: Any] = [:]) -> Bool {
+    public func track(_ event: EventDefinition, props: [String: Any] = [:], delivery: DeliveryMode = .bestEffort) -> Bool {
-        tracker.track(name: name, props: props, type: .track, requires: [], delivery: .bestEffort)
+        tracker.track(event: event, props: props, delivery: delivery)
+    }
+
+    /// Track an app event by name, for events not in `Events`. `requires` gates
+    /// it on consent categories — it is dropped unless every one is granted.
+    /// Returns false if dropped by the consent gate.
+    @discardableResult
+    public func track(
+        _ name: String,
+        props: [String: Any] = [:],
+        requires: [ConsentCategory] = [],
+        delivery: DeliveryMode = .bestEffort
+    ) -> Bool {
+        tracker.track(name: name, props: props, type: .track, requires: requires, delivery: delivery)
     }
 
     /// Track an event gated on advertising consent (dropped until granted).
+    /// Shorthand for `track(name, props:, requires: [.advertising])`.
     @discardableResult
     public func trackAdvertising(_ name: String, props: [String: Any] = [:]) -> Bool {
-        tracker.track(name: name, props: props, type: .track, requires: [ConsentCategory.advertising], delivery: .bestEffort)
+        track(name, props: props, requires: [ConsentCategory.advertising])
     }
 
     /// Record an app-screen view.
@@ -89,9 +180,18 @@ public final class ScoreClient {
     public func onForeground() async throws { _ = try await tracker.onForeground() }
     /// Call when network connectivity is regained.
     public func onNetworkAvailable() async throws { _ = try await tracker.onNetworkAvailable() }
+    /// Best-effort flush as the app goes to the background (#484), bounded by
+    /// `budgetSeconds` so it cannot hold up suspension. Returns false if it ran
+    /// out of time; unsent events stay queued. `bindToAppLifecycle()` calls this
+    /// for you.
+    @discardableResult
+    public func onBackground(budgetSeconds: Double = 5) async throws -> Bool {
+        try await tracker.onBackground(budgetMs: Int64(budgetSeconds * 1000)).boolValue
+    }
 
     public func shutdown() async throws {
         stopAutoFlush()
+        await MainActor.run { unbindAppLifecycleFromAnyContext() }
         try await tracker.shutdown()
     }