Server-Driven UI (SSUI) Setup

In server-driven UI apps the view tree is inflated at runtime from server JSON, so there is no compile-time surface to annotate. The recommended pattern is to drive masking from a flag the server controls.

1. Extend the SSUI schema with an isPrivate boolean on any component that can render PII.
2. At render time, after a component is inflated, mark it private — Views via addPrivateViews(view), Compose via Modifier.luciqPrivate(isPrivate = ...).
3. Add a global safety net once at SDK init so a forgotten flag still can’t leak.
4. Verify in a dev build that masked regions render as solid blocks in repro-step screenshots.
5. Gate repro steps behind a feature flag, ideally per app version, for runtime control.

Example server-controlled node

// Json
{
"type": "text",
"value": "4111 2222 3333 4444",
"style": "card-number",
"isPrivate": true
}

Client handling when inflating the node

// Kotlin 

// Views
val view = inflateFromJson(node)
if (node.isPrivate) {
Luciq.addPrivateViews(view)
}
// Compose
Text(
text = node.value,
modifier = Modifier.luciqPrivate(isPrivate = node.isPrivate)
)