@namiml/sdk-core 3.4.12-dev.202609241021 → 3.4.12-dev.202609251500

package/dist/index.cjs

@@ -106,7 +106,7 @@ const {
 // version — stamped by scripts/version.sh
 NAMI_SDK_VERSION: exports.NAMI_SDK_VERSION = "3.4.12", 
 // full package version including dev suffix — stamped by scripts/version.sh
-NAMI_SDK_PACKAGE_VERSION: exports.NAMI_SDK_PACKAGE_VERSION = "3.4.12-dev.202609241021", 
+NAMI_SDK_PACKAGE_VERSION: exports.NAMI_SDK_PACKAGE_VERSION = "3.4.12-dev.202609251500", 
 // environments
 PRODUCTION: exports.PRODUCTION = "production", DEVELOPMENT: exports.DEVELOPMENT = "development", 
 // error messages
@@ -116,7 +116,7 @@ AUTH_DEVICE: exports.AUTH_DEVICE = "nami_auth_device", NAMI_CONFIGURATION: expor
 // API settings
 API_VERSION: exports.API_VERSION = "v3", BASE_URL_PATH: exports.BASE_URL_PATH = `sdk/${exports.API_VERSION}/platform`, BASE_URL: exports.BASE_URL = "https://app.namiml.com", BASE_STAGING_URL: exports.BASE_STAGING_URL = "https://app-staging.namiml.com", CUSTOM_HOST_PREFIX: exports.CUSTOM_HOST_PREFIX = "namiAPIHost=", USE_STAGING_API: exports.USE_STAGING_API = "useStagingAPI", 
 // // extended client info
-EXTENDED_CLIENT_INFO_PREFIX: exports.EXTENDED_CLIENT_INFO_PREFIX = "extendedClientInfo", EXTENDED_CLIENT_INFO_DELIMITER: exports.EXTENDED_CLIENT_INFO_DELIMITER = ":", VALIDATE_PRODUCT_GROUPS: exports.VALIDATE_PRODUCT_GROUPS = "validateProductGroups", LOG_HTTP_REQUESTS: exports.LOG_HTTP_REQUESTS = "logHTTPRequests", LOG_HTTP_TRAFFIC: exports.LOG_HTTP_TRAFFIC = "logHTTPTraffic", STARTUP_TELEMETRY: exports.STARTUP_TELEMETRY = "startupTelemetry", EXTENDED_PLATFORM: exports.EXTENDED_PLATFORM = "extended-platform", EXTENDED_PLATFORM_VERSION: exports.EXTENDED_PLATFORM_VERSION = "extended-platform-version", API_MAX_CALLS_LIMIT: exports.API_MAX_CALLS_LIMIT = 2, API_RETRY_DELAY_SEC: exports.API_RETRY_DELAY_SEC = 2, API_TIMEOUT_LIMIT: exports.API_TIMEOUT_LIMIT = 20000, DEVICE_API_TIMEOUT_LIMIT: exports.DEVICE_API_TIMEOUT_LIMIT = 2000, 
+EXTENDED_CLIENT_INFO_PREFIX: exports.EXTENDED_CLIENT_INFO_PREFIX = "extendedClientInfo", EXTENDED_CLIENT_INFO_DELIMITER: exports.EXTENDED_CLIENT_INFO_DELIMITER = ":", VALIDATE_PRODUCT_GROUPS: exports.VALIDATE_PRODUCT_GROUPS = "validateProductGroups", LOG_HTTP_REQUESTS: exports.LOG_HTTP_REQUESTS = "logHTTPRequests", LOG_HTTP_TRAFFIC: exports.LOG_HTTP_TRAFFIC = "logHTTPTraffic", API_TRAFFIC_OBSERVER: exports.API_TRAFFIC_OBSERVER = "apiTrafficObserver", STARTUP_TELEMETRY: exports.STARTUP_TELEMETRY = "startupTelemetry", EXTENDED_PLATFORM: exports.EXTENDED_PLATFORM = "extended-platform", EXTENDED_PLATFORM_VERSION: exports.EXTENDED_PLATFORM_VERSION = "extended-platform-version", API_MAX_CALLS_LIMIT: exports.API_MAX_CALLS_LIMIT = 2, API_RETRY_DELAY_SEC: exports.API_RETRY_DELAY_SEC = 2, API_TIMEOUT_LIMIT: exports.API_TIMEOUT_LIMIT = 20000, DEVICE_API_TIMEOUT_LIMIT: exports.DEVICE_API_TIMEOUT_LIMIT = 2000, 
 // status codes
 STATUS_SUCCESS: exports.STATUS_SUCCESS = 200, STATUS_BAD_REQUEST: exports.STATUS_BAD_REQUEST = 400, STATUS_NOT_FOUND: exports.STATUS_NOT_FOUND = 404, STATUS_CONFLICT: exports.STATUS_CONFLICT = 409, STATUS_INTERNAL_SERVER_ERROR: exports.STATUS_INTERNAL_SERVER_ERROR = 500, 
 // configuration states
@@ -6845,6 +6845,17 @@ const shouldLogHTTPTraffic = () => {
     const namiCommands = storageService.getNamiConfig()?.namiCommands;
     return namiCommands?.includes(exports.LOG_HTTP_TRAFFIC) ?? false;
 };
+/**
+ * Whether the SDK should build traffic records for the registered API traffic observer.
+ *
+ * Read per attempt at capture time, never once at registration: hosts register the
+ * observer before `Nami.configure()`, so a registration-time read would see an
+ * unpopulated config and disable capture for the life of the process.
+ */
+const shouldObserveAPITraffic = () => {
+    const namiCommands = storageService.getNamiConfig()?.namiCommands;
+    return namiCommands?.includes(exports.API_TRAFFIC_OBSERVER) ?? false;
+};
 function tryParseJson(str) {
     const trimmed = str.trim();
     if (!trimmed.startsWith("{") && !trimmed.startsWith("["))
@@ -6879,6 +6890,166 @@ function base64ToUint8(b64) {
     return bytes;
 }
 
+/** Maximum number of UTF-8 characters retained from a request or response body. */
+const BODY_LIMIT = 4096;
+/**
+ * Sentinel `statusCode` for a request that never produced an HTTP response.
+ *
+ * No HTTP status is ever 0, so it cannot collide with a real one. Prefer
+ * {@link didReceiveResponse} over comparing against this directly.
+ */
+const TRANSPORT_FAILURE_STATUS = 0;
+/**
+ * `true` when the attempt completed with an HTTP response, `false` when it failed in
+ * transport. Reads better than `statusCode !== 0` and keeps the sentinel an implementation
+ * detail.
+ */
+function didReceiveResponse(record) {
+    return record.statusCode !== TRANSPORT_FAILURE_STATUS;
+}
+let observer = null;
+/**
+ * Registers the traffic observer, or clears it when passed `null`.
+ *
+ * Intended for debug and QA tooling. A single observer is held — registering a second
+ * replaces the first, so a host that needs several should fan out itself.
+ *
+ * Capture additionally requires the `apiTrafficObserver` Nami command. That check happens
+ * at capture time rather than here on purpose: hosts register before `Nami.configure()`,
+ * so a registration-time gate would read an unpopulated config and silently no-op for the
+ * life of the process.
+ */
+function registerAPITrafficObserver(next) {
+    observer = next;
+}
+/**
+ * Whether a record should be built for this attempt.
+ *
+ * Both conditions are required, and both are evaluated per attempt so that enabling the
+ * command mid-session takes effect and an unobserved host pays nothing.
+ */
+function capturing() {
+    return observer !== null && shouldObserveAPITraffic();
+}
+function truncate(body) {
+    if (!body)
+        return undefined;
+    return body.length > BODY_LIMIT ? body.slice(0, BODY_LIMIT) : body;
+}
+/**
+ * The path portion of `url`, with its trailing slash intact.
+ *
+ * Every Nami endpoint is a trailing-slash route, so losing it renders `/device/` as
+ * `/device` — which is what Apple's port of this shipped before it was caught
+ * (NAM-4446). `URL.pathname` keeps the slash; the explicit test for it is what stops a
+ * future "tidy up the URL parsing" change from reintroducing the bug.
+ *
+ * Falls back to the raw string for anything unparseable rather than throwing: a record
+ * with an odd path is far more useful than an exception raised inside instrumentation.
+ */
+function pathOf(url) {
+    try {
+        return new URL(url).pathname;
+    }
+    catch {
+        return url;
+    }
+}
+/** The request body as a string, when it is one we can cheaply render. */
+function requestBodyOf(options) {
+    const body = options?.body;
+    return typeof body === "string" ? truncate(body) : undefined;
+}
+function emit(record) {
+    try {
+        observer?.(record);
+    }
+    catch {
+        // An observer that throws is a bug in the host's debug tooling, not a reason to fail
+        // the request that was being observed.
+    }
+}
+/**
+ * Runs `doFetch` and reports the attempt to the registered observer.
+ *
+ * Wraps both of the SDK's fetch sites — the API path in `withRetry` and the CDN path in
+ * `cdnFetch` — so timing, truncation and the transport-failure sentinel are defined once.
+ *
+ * Two properties matter and are easy to lose:
+ *
+ * - **The record is emitted before the caller branches on status.** `withRetry` throws
+ *   `ConflictError` on 409 and `RetryLimitExceededError` once retries are spent, and
+ *   `cdnFetch` throws `NonRetryableHttpError`; recording after any of those would drop the
+ *   record for exactly the failures worth seeing.
+ * - **Transport failures are recorded and rethrown unchanged.** `fetch` rejects with a
+ *   `TypeError` for DNS/TCP/TLS/CORS failures and an `AbortError` on timeout, and neither
+ *   ever becomes a `Response`. A hook that only saw responses structurally could not report
+ *   a connection that never opened — which is most of why this tab exists. (Android reached
+ *   the same conclusion choosing OkHttp's application interceptor over the network one,
+ *   NAM-4447.)
+ *
+ * The response is returned undisturbed: the body is read from a `clone()`, so callers still
+ * get an unconsumed stream.
+ */
+async function observeFetch(url, options, kind, doFetch) {
+    if (!capturing())
+        return doFetch();
+    const method = options?.method ?? "GET";
+    const startedAt = Date.now();
+    let response;
+    try {
+        response = await doFetch();
+    }
+    catch (error) {
+        emit({
+            method,
+            url,
+            path: pathOf(url),
+            statusCode: TRANSPORT_FAILURE_STATUS,
+            durationMs: Date.now() - startedAt,
+            timestamp: new Date(),
+            requestBody: requestBodyOf(options),
+            errorDescription: describeError(error),
+            kind,
+        });
+        throw error;
+    }
+    const durationMs = Date.now() - startedAt;
+    let responseBody;
+    try {
+        responseBody = truncate(await response.clone().text());
+    }
+    catch {
+        // A body that cannot be re-read (already disturbed, or an opaque response) is not
+        // worth failing the request over — the status line is still useful on its own.
+    }
+    emit({
+        method,
+        url,
+        path: pathOf(url),
+        statusCode: response.status,
+        durationMs,
+        timestamp: new Date(),
+        requestBody: requestBodyOf(options),
+        responseBody,
+        kind,
+    });
+    return response;
+}
+/**
+ * A human-readable description of a thrown fetch failure.
+ *
+ * Never returns undefined for a caught error: a record carrying the transport-failure
+ * sentinel and no reason reads as "no response, and no explanation either", which is worse
+ * than a generic string.
+ */
+function describeError(error) {
+    if (error instanceof Error) {
+        return error.name ? `${error.name}: ${error.message}` : error.message;
+    }
+    return String(error);
+}
+
 async function withRetry(url, options, timeout = exports.API_TIMEOUT_LIMIT, retries = exports.API_MAX_CALLS_LIMIT) {
     let retryCount = 0;
     const logRequests = shouldLogHTTPRequests();
@@ -6891,7 +7062,10 @@ async function withRetry(url, options, timeout = exports.API_TIMEOUT_LIMIT, retr
         if (logTraffic && options?.body) {
             logger.debug(`[HTTP] Request body: ${options.body}`);
         }
-        const response = await timeoutRequest$1(url, options, timeout);
+        // One record per attempt, emitted before the status branches below: `withRetry`
+        // throws on 409 and on exhausted retries, so recording afterwards would lose the
+        // record for exactly the failures worth seeing (NAM-4606).
+        const response = await observeFetch(url, options, "api", () => timeoutRequest$1(url, options, timeout));
         if (!response.ok) {
             if (logTraffic) {
                 const errorBody = await response.clone().text();
@@ -57666,7 +57840,9 @@ async function timeoutRequest(url, timeout) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), timeout);
     try {
-        return await fetch(url, { signal: controller.signal });
+        // Recorded as `cdn` rather than `api`. Without this the per-paywall body traffic is
+        // invisible to the traffic tab, which is the traffic NAM-4357 is about (NAM-4606).
+        return await observeFetch(url, { method: "GET" }, "cdn", () => fetch(url, { signal: controller.signal }));
     }
     finally {
         clearTimeout(timeoutId);
@@ -65874,6 +66050,7 @@ exports.SHOULD_SHOW_LOADING_INDICATOR = SHOULD_SHOW_LOADING_INDICATOR;
 exports.SessionService = SessionService;
 exports.SimpleEventTarget = SimpleEventTarget;
 exports.StorageService = StorageService;
+exports.TRANSPORT_FAILURE_STATUS = TRANSPORT_FAILURE_STATUS;
 exports._NamiProfileManager = NamiProfileManager$1;
 exports._internal = internal;
 exports.activateEntitlementByPurchase = activateEntitlementByPurchase;
@@ -65892,6 +66069,7 @@ exports.convertLocale = convertLocale;
 exports.convertOfferToPricingPhase = convertOfferToPricingPhase;
 exports.createNamiEntitlements = createNamiEntitlements;
 exports.currentSku = currentSku;
+exports.didReceiveResponse = didReceiveResponse;
 exports.empty = empty;
 exports.extractStandardPricingPhases = extractStandardPricingPhases;
 exports.formatDate = formatDate;
@@ -65948,6 +66126,7 @@ exports.normalizeLaunchContext = normalizeLaunchContext;
 exports.parseToSemver = parseToSemver;
 exports.postConversion = postConversion;
 exports.productDetail = productDetail;
+exports.registerAPITrafficObserver = registerAPITrafficObserver;
 exports.registerPlatformAdapters = registerPlatformAdapters;
 exports.registerPurchaseAdapter = registerPurchaseAdapter;
 exports.resolveLoopSource = resolveLoopSource;

package/dist/index.d.ts

@@ -2999,6 +2999,78 @@ declare class StorageService {
 }
 declare const storageService: StorageService;
 
+/**
+ * Sentinel `statusCode` for a request that never produced an HTTP response.
+ *
+ * No HTTP status is ever 0, so it cannot collide with a real one. Prefer
+ * {@link didReceiveResponse} over comparing against this directly.
+ */
+declare const TRANSPORT_FAILURE_STATUS = 0;
+/** Which network path produced a {@link NamiAPITrafficRecord}. */
+type NamiAPITrafficKind = "api" | "cdn";
+/**
+ * One completed request attempt observed by the SDK.
+ *
+ * Emitted once per attempt: a retried request produces one record per try rather than a
+ * single collapsed entry, because retry behaviour is itself frequently what is being
+ * debugged.
+ *
+ * Request and response bodies are captured verbatim to a 4 KB prefix, and some Nami
+ * endpoints carry sensitive payloads — `PUT /login/` sends the host-supplied `external_id`
+ * (often an email), and `POST /transaction/` sends purchase amounts and identifiers.
+ * Records are for local debugging only: do not persist them, ship them off-device, or
+ * render them anywhere they could be screenshotted into a support ticket.
+ *
+ * HTTP headers are deliberately not captured. This is data minimisation, **not** a
+ * credential defence — this SDK sends no authorization header at all, and the platform and
+ * device identifiers that authorize a request live in the URL path, which *is* captured.
+ */
+interface NamiAPITrafficRecord {
+    /** HTTP method, for example `POST`. */
+    method: string;
+    /** Absolute request URL, including any query string. */
+    url: string;
+    /** Request path, without scheme, host, or query string. Trailing slash preserved. */
+    path: string;
+    /**
+     * HTTP status code, or {@link TRANSPORT_FAILURE_STATUS} when the request never produced
+     * a response.
+     */
+    statusCode: number;
+    /** Wall-clock duration of this attempt, in milliseconds. */
+    durationMs: number;
+    /** When the response — or the failure — was observed. */
+    timestamp: Date;
+    /** UTF-8 request body, truncated to 4 KB. Absent when the request carried no body. */
+    requestBody?: string;
+    /** UTF-8 response body, truncated to 4 KB. Absent when the response carried no body. */
+    responseBody?: string;
+    /** Description of the transport error, when one occurred. */
+    errorDescription?: string;
+    /** Which network path produced this record. */
+    kind: NamiAPITrafficKind;
+}
+/**
+ * `true` when the attempt completed with an HTTP response, `false` when it failed in
+ * transport. Reads better than `statusCode !== 0` and keeps the sentinel an implementation
+ * detail.
+ */
+declare function didReceiveResponse(record: NamiAPITrafficRecord): boolean;
+/** Receives one {@link NamiAPITrafficRecord} per completed request attempt. */
+type NamiAPITrafficObserver = (record: NamiAPITrafficRecord) => void;
+/**
+ * Registers the traffic observer, or clears it when passed `null`.
+ *
+ * Intended for debug and QA tooling. A single observer is held — registering a second
+ * replaces the first, so a host that needs several should fan out itself.
+ *
+ * Capture additionally requires the `apiTrafficObserver` Nami command. That check happens
+ * at capture time rather than here on purpose: hosts register before `Nami.configure()`,
+ * so a registration-time gate would read an unpopulated config and silently no-op for the
+ * life of the process.
+ */
+declare function registerAPITrafficObserver(next: NamiAPITrafficObserver | null): void;
+
 declare class Logger {
     private currentLogLevel;
     setLogger: (level?: NamiLogLevel) => void;
@@ -3107,6 +3179,7 @@ declare const EXTENDED_CLIENT_INFO_DELIMITER: string;
 declare const VALIDATE_PRODUCT_GROUPS: string;
 declare const LOG_HTTP_REQUESTS: string;
 declare const LOG_HTTP_TRAFFIC: string;
+declare const API_TRAFFIC_OBSERVER: string;
 declare const STARTUP_TELEMETRY: string;
 declare const EXTENDED_PLATFORM: string;
 declare const EXTENDED_PLATFORM_VERSION: string;
@@ -4042,5 +4115,5 @@ declare namespace internal {
   };
 }
 
-export { ALREADY_CONFIGURED, ANONYMOUS_MODE, ANONYMOUS_MODE_ALREADY_OFF, ANONYMOUS_MODE_ALREADY_ON, ANONYMOUS_MODE_LOGIN_NOT_ALLOWED, ANONYMOUS_UUID, APIError, API_ACTIVE_ENTITLEMENTS, API_CAMPAIGN_RULES, API_CAMPAIGN_SESSION_TIMESTAMP, API_CONFIG, API_MAX_CALLS_LIMIT, API_PAYWALLS, API_PRODUCTS, API_RETRY_DELAY_SEC, API_TIMEOUT_LIMIT, API_VERSION, AUTH_DEVICE, AVAILABLE_ACTIVE_ENTITLEMENTS_CHANGED, AVAILABLE_CAMPAIGNS_CHANGED, AccountStateAction, AnonymousCDPError, AnonymousLoginError, AnonymousModeAlreadyOffError, AnonymousModeAlreadyOnError, BASE_STAGING_URL, BASE_URL, BASE_URL_PATH, BadRequestError, BasicNamiFlow, BorderMap, BorderSideMap, CAMPAIGN_NOT_AVAILABLE, CUSTOMER_ATTRIBUTES_KEY_PREFIX, CUSTOMER_JOURNEY_STATE_CHANGED, CUSTOM_HOST_PREFIX, CampaignNotAvailableError, CampaignRuleConversionEventType, CampaignRuleRepository, Capabilities, ClientError, ConfigRepository, ConflictError, CustomerJourneyRepository, DEFAULT_JOURNEY_SETTINGS, DEVELOPMENT, DEVICE_API_TIMEOUT_LIMIT, DEVICE_ID_NOT_SET, DEVICE_ID_REQUIRED, DISABLE_ASYNC_LOGIN_LOGOUT, DeviceIDRequiredError, DeviceRepository, EXTENDED_CLIENT_INFO_DELIMITER, EXTENDED_CLIENT_INFO_PREFIX, EXTENDED_PLATFORM, EXTENDED_PLATFORM_VERSION, EXTERNAL_ID_REQUIRED, EntitlementRepository, EntitlementUtils, ExternalIDRequiredError, FLOW_SCREENS_NOT_AVAILABLE, FlowScreensNotAvailableError, HTML_REGEX, INITIAL_APP_CONFIG, INITIAL_CAMPAIGN_RULES, INITIAL_PAYWALLS, INITIAL_PRODUCTS, INITIAL_SESSION_COUNTER_VALUE, INITIAL_SUCCESS, InternalServerError, KEY_SESSION_COUNTER, LIQUID_VARIABLE_REGEX, LOCAL_NAMI_ENTITLEMENTS, LOG_HTTP_REQUESTS, LOG_HTTP_TRAFFIC, LaunchCampaignError, LaunchContextResolver, LogLevel, NAMI_CONFIGURATION, NAMI_CUSTOMER_JOURNEY_STATE, NAMI_LANGUAGE_CODE, NAMI_LAST_IMPRESSION_ID, NAMI_LAUNCH_ID, NAMI_PROFILE, NAMI_PURCHASE_CHANNEL, NAMI_PURCHASE_IMPRESSION_ID, NAMI_SDK_PACKAGE_VERSION, NAMI_SDK_VERSION, NAMI_SESSION_ID, NAMI_STORAGE_KEYS, Nami, NamiAPI, NamiAnimationType, NamiCampaignManager$2 as NamiCampaignManager, NamiCampaignRuleType, NamiConditionEvaluator, NamiCustomerManager$2 as NamiCustomerManager, NamiEntitlementManager$2 as NamiEntitlementManager, NamiEventEmitter, NamiFlow, NamiFlowActionFunction, NamiFlowManager$1 as NamiFlowManager, NamiFlowStepType, NamiHandoffTag, NamiPaywallAction, NamiPaywallManager$2 as NamiPaywallManager, PaywallManagerEvents as NamiPaywallManagerEvents, NamiPermissionOutcome, NamiPurchaseManager$2 as NamiPurchaseManager, NamiRefs, NamiReservedActions, NotFoundError, PAYWALL_ACTION_EVENT, PLATFORM_ID_REQUIRED, PRODUCTION, PaywallManagerEvents, PaywallRepository, PaywallState, PlacementLabelResolver, PlatformIDRequiredError, ProductRepository, RECONFIG_SUCCESS, RetryLimitExceededError, SDKNotInitializedError, SDK_NOT_INITIALIZED, SERVER_NAMI_ENTITLEMENTS, SESSION_REQUIRED, SHOULD_SHOW_LOADING_INDICATOR, SKU_TEXT_REGEX, SMART_TEXT_PATTERN, STARTUP_TELEMETRY, STATUS_BAD_REQUEST, STATUS_CONFLICT, STATUS_INTERNAL_SERVER_ERROR, STATUS_NOT_FOUND, STATUS_SUCCESS, SessionService, SimpleEventTarget, StorageService, UNABLE_TO_UPDATE_CDP_ID, USE_STAGING_API, VALIDATE_PRODUCT_GROUPS, VAR_REGEX, NamiProfileManager$1 as _NamiProfileManager, internal as _internal, activateEntitlementByPurchase, activeEntitlements, aggregateScreenreaderText, allCampaigns, allPaywalls, applyEntitlementActivation, audienceSplitPosition, bestUrlCampaignMatch, bigintToUuid, checkAnySkuHasPromoOffer, checkAnySkuHasTrialOffer, convertISO8601PeriodToText, convertLocale, convertOfferToPricingPhase, createNamiEntitlements, currentSku, empty, extractStandardPricingPhases, formatDate, formattedPrice, generateUUID, getApiCampaigns, getApiPaywalls, getBaseUrl, getBillingPeriodNumber, getCurrencyFormat, getDeviceData, getDeviceFormFactor, getDeviceScaleFactor, getEffectiveWebStyle, getEntitlementRefIdsForSku, getExtendedClientInfo, getFreeTrialPeriod, getInitialCampaigns, getInitialPaywalls, getJourneySettings, getPaywall, getPaywallDataFromLabel, getPercentagePriceDifference, getPeriodNumberInDays, getPeriodNumberInWeeks, getPlatformAdapters, getPriceDifference, getPricePerMonth, getProductDetail, getPurchaseAdapter, getReferenceSku, getSkuProductDetailKeys, getSkuSmartTextValue, getSlideSmartTextValue, getStandardBillingPeriod, getTranslate, getUrlParams, handleErrors, hasAllPaywalls, hasCapability, hasPurchaseManagement, initialState, invokeHandler, isAnonymousMode, isInitialConfigCompressed, isNamiFlowCampaign, isSubscription, isValidISODate, isValidUrl, logger, mapAnonymousCampaigns, namiBuySKU, normalizeLaunchContext, parseToSemver, postConversion, productDetail, registerPlatformAdapters, registerPurchaseAdapter, resolveLoopSource, selectSegment, setActiveNamiEntitlements, shouldValidateProductGroups, skuItems, skuMapFromEntitlements, storageService, toDouble, toNamiEntitlements, toNamiSKU, tryParseB64Gzip, tryParseJson, updateRelatedSKUsForNamiEntitlement, uuidFromSplitPosition, validateForm, validateMinSDKVersion, validateTextInput };
-export type { AccountStateHandler$1 as AccountStateHandler, AlignmentType, AmazonProduct, ApiResponse, AppleProduct, AvailableCampaignsResponseHandler, BorderLocationType, BorderSideType, Callback$1 as Callback, CloseHandler, CustomerJourneyState, DeepLinkUrlHandler, Device, DevicePayload, DeviceProfile, DirectionType, ExtendedPlatformInfo, FlexDirectionObject, FlowNavigationOptions, FontCollection, FontDetails, FormFactor, FormFieldValidator, GoogleProduct, IConfig, IDeviceAdapter, IEntitlements$1 as IEntitlements, IPaywall, IPlatformAdapters, IProductsWithComponents, IPurchaseAdapter, ISkuMenu, IStorageAdapter, IUIAdapter, Impression, InitialConfig, InitialConfigCompressed, InitiateStateGroup, JourneySettings, LoginResponse, NamiAnimation, NamiAnimationObjectSpec, NamiAnimationSpec, NamiAnonymousCampaign, NamiAppSuppliedVideoDetails, NamiCampaign, NamiCampaignManagerStatic, NamiCampaignSegment, NamiCompletionResult, NamiConfiguration, NamiConfigurationState, NamiCustomAttributeValue, NamiCustomerManagerStatic, NamiEntitlement$1 as NamiEntitlement, NamiEntitlementManagerStatic, NamiFlowAction, NamiFlowAnimation, NamiFlowCampaign, NamiFlowCompletionCondition, NamiFlowDTO, NamiFlowEventHandler, NamiFlowHandoffStepHandler, NamiFlowManagerStatic, NamiFlowObjectDTO, NamiFlowOn, NamiFlowStep, NamiFlowTransition, NamiFlowTransitionDirection, NamiFlowWithObject, NamiHandoffAttributeValue, NamiHandoffComplete, NamiHandoffOutcome, NamiHandoffTagValue, NamiInitialConfig, NamiKnownHandoffTag, NamiLanguageCodes, NamiLogLevel, NamiLoginSuccess, NamiPaywallActionHandler, NamiPaywallComponentChange, NamiPaywallEvent, NamiPaywallEventVideoMetadata, NamiPaywallLaunchContext, NamiPaywallManagerStatic, NamiPresentationStyle, NamiProductDetails, NamiProductOffer, NamiProfile, NamiPurchase, NamiPurchaseCompleteResult, NamiPurchaseDetails, NamiPurchaseManagerStatic, NamiPurchaseSuccess, NamiPurchasesState, NamiSKU, NamiSKUType, NamiSubscriptionInterval, NamiSubscriptionPeriod, NamiUserDataEnvelope, None, NoneSpec, PaywallActionEvent, PaywallHandle, PaywallResultHandler, PaywallSKU, PricingPhase, ProductGroup, Pulse, PulseSpec, PurchaseContext, PurchaseResult, PurchaseValidationRequest, SKU, SKUActionHandler, ScreenInfo, Session, TBaseComponent, TButtonContainer, TCarouselContainer, TCarouselSlide, TCarouselSlidesState, TCollapseContainer, TComponent, TConditionalAttributes, TConditionalComponent, TContainer, TContainerPosition, TCountdownTimerTextComponent, TDevice, TDisabledButton, TField, TFieldSettings, TFlexProductContainer, THeaderFooter, TImageComponent, TInitialState, TMediaTypes, TOffer, TPages, TPaywallContext, TPaywallLaunchContext, TPaywallMedia, TPaywallTemplate, TPlayPauseButton, TProductContainer, TProductGroup, TProgressBarComponent, TProgressIndicatorComponent, TQRCodeComponent, TRadioButton, TRepeatingGrid, TResponsiveGrid, TSegmentPicker, TSegmentPickerItem, TSemverObj, TSlot, TSlotGroupSelector, TSpacerComponent, TStack, TSvgImageComponent, TSymbolComponent, TTestObject, TTextComponent, TTextInputComponent, TTextInputType, TTextLikeComponent, TTextListComponent, TTimelineRail, TToggleButtonComponent, TToggleSwitch, TVariablePattern, TVideoComponent, TVolumeButton, TimerState, TransactionRequest, UserAction, UserActionParameters, Wave, WaveSpec };
+export { ALREADY_CONFIGURED, ANONYMOUS_MODE, ANONYMOUS_MODE_ALREADY_OFF, ANONYMOUS_MODE_ALREADY_ON, ANONYMOUS_MODE_LOGIN_NOT_ALLOWED, ANONYMOUS_UUID, APIError, API_ACTIVE_ENTITLEMENTS, API_CAMPAIGN_RULES, API_CAMPAIGN_SESSION_TIMESTAMP, API_CONFIG, API_MAX_CALLS_LIMIT, API_PAYWALLS, API_PRODUCTS, API_RETRY_DELAY_SEC, API_TIMEOUT_LIMIT, API_TRAFFIC_OBSERVER, API_VERSION, AUTH_DEVICE, AVAILABLE_ACTIVE_ENTITLEMENTS_CHANGED, AVAILABLE_CAMPAIGNS_CHANGED, AccountStateAction, AnonymousCDPError, AnonymousLoginError, AnonymousModeAlreadyOffError, AnonymousModeAlreadyOnError, BASE_STAGING_URL, BASE_URL, BASE_URL_PATH, BadRequestError, BasicNamiFlow, BorderMap, BorderSideMap, CAMPAIGN_NOT_AVAILABLE, CUSTOMER_ATTRIBUTES_KEY_PREFIX, CUSTOMER_JOURNEY_STATE_CHANGED, CUSTOM_HOST_PREFIX, CampaignNotAvailableError, CampaignRuleConversionEventType, CampaignRuleRepository, Capabilities, ClientError, ConfigRepository, ConflictError, CustomerJourneyRepository, DEFAULT_JOURNEY_SETTINGS, DEVELOPMENT, DEVICE_API_TIMEOUT_LIMIT, DEVICE_ID_NOT_SET, DEVICE_ID_REQUIRED, DISABLE_ASYNC_LOGIN_LOGOUT, DeviceIDRequiredError, DeviceRepository, EXTENDED_CLIENT_INFO_DELIMITER, EXTENDED_CLIENT_INFO_PREFIX, EXTENDED_PLATFORM, EXTENDED_PLATFORM_VERSION, EXTERNAL_ID_REQUIRED, EntitlementRepository, EntitlementUtils, ExternalIDRequiredError, FLOW_SCREENS_NOT_AVAILABLE, FlowScreensNotAvailableError, HTML_REGEX, INITIAL_APP_CONFIG, INITIAL_CAMPAIGN_RULES, INITIAL_PAYWALLS, INITIAL_PRODUCTS, INITIAL_SESSION_COUNTER_VALUE, INITIAL_SUCCESS, InternalServerError, KEY_SESSION_COUNTER, LIQUID_VARIABLE_REGEX, LOCAL_NAMI_ENTITLEMENTS, LOG_HTTP_REQUESTS, LOG_HTTP_TRAFFIC, LaunchCampaignError, LaunchContextResolver, LogLevel, NAMI_CONFIGURATION, NAMI_CUSTOMER_JOURNEY_STATE, NAMI_LANGUAGE_CODE, NAMI_LAST_IMPRESSION_ID, NAMI_LAUNCH_ID, NAMI_PROFILE, NAMI_PURCHASE_CHANNEL, NAMI_PURCHASE_IMPRESSION_ID, NAMI_SDK_PACKAGE_VERSION, NAMI_SDK_VERSION, NAMI_SESSION_ID, NAMI_STORAGE_KEYS, Nami, NamiAPI, NamiAnimationType, NamiCampaignManager$2 as NamiCampaignManager, NamiCampaignRuleType, NamiConditionEvaluator, NamiCustomerManager$2 as NamiCustomerManager, NamiEntitlementManager$2 as NamiEntitlementManager, NamiEventEmitter, NamiFlow, NamiFlowActionFunction, NamiFlowManager$1 as NamiFlowManager, NamiFlowStepType, NamiHandoffTag, NamiPaywallAction, NamiPaywallManager$2 as NamiPaywallManager, PaywallManagerEvents as NamiPaywallManagerEvents, NamiPermissionOutcome, NamiPurchaseManager$2 as NamiPurchaseManager, NamiRefs, NamiReservedActions, NotFoundError, PAYWALL_ACTION_EVENT, PLATFORM_ID_REQUIRED, PRODUCTION, PaywallManagerEvents, PaywallRepository, PaywallState, PlacementLabelResolver, PlatformIDRequiredError, ProductRepository, RECONFIG_SUCCESS, RetryLimitExceededError, SDKNotInitializedError, SDK_NOT_INITIALIZED, SERVER_NAMI_ENTITLEMENTS, SESSION_REQUIRED, SHOULD_SHOW_LOADING_INDICATOR, SKU_TEXT_REGEX, SMART_TEXT_PATTERN, STARTUP_TELEMETRY, STATUS_BAD_REQUEST, STATUS_CONFLICT, STATUS_INTERNAL_SERVER_ERROR, STATUS_NOT_FOUND, STATUS_SUCCESS, SessionService, SimpleEventTarget, StorageService, TRANSPORT_FAILURE_STATUS, UNABLE_TO_UPDATE_CDP_ID, USE_STAGING_API, VALIDATE_PRODUCT_GROUPS, VAR_REGEX, NamiProfileManager$1 as _NamiProfileManager, internal as _internal, activateEntitlementByPurchase, activeEntitlements, aggregateScreenreaderText, allCampaigns, allPaywalls, applyEntitlementActivation, audienceSplitPosition, bestUrlCampaignMatch, bigintToUuid, checkAnySkuHasPromoOffer, checkAnySkuHasTrialOffer, convertISO8601PeriodToText, convertLocale, convertOfferToPricingPhase, createNamiEntitlements, currentSku, didReceiveResponse, empty, extractStandardPricingPhases, formatDate, formattedPrice, generateUUID, getApiCampaigns, getApiPaywalls, getBaseUrl, getBillingPeriodNumber, getCurrencyFormat, getDeviceData, getDeviceFormFactor, getDeviceScaleFactor, getEffectiveWebStyle, getEntitlementRefIdsForSku, getExtendedClientInfo, getFreeTrialPeriod, getInitialCampaigns, getInitialPaywalls, getJourneySettings, getPaywall, getPaywallDataFromLabel, getPercentagePriceDifference, getPeriodNumberInDays, getPeriodNumberInWeeks, getPlatformAdapters, getPriceDifference, getPricePerMonth, getProductDetail, getPurchaseAdapter, getReferenceSku, getSkuProductDetailKeys, getSkuSmartTextValue, getSlideSmartTextValue, getStandardBillingPeriod, getTranslate, getUrlParams, handleErrors, hasAllPaywalls, hasCapability, hasPurchaseManagement, initialState, invokeHandler, isAnonymousMode, isInitialConfigCompressed, isNamiFlowCampaign, isSubscription, isValidISODate, isValidUrl, logger, mapAnonymousCampaigns, namiBuySKU, normalizeLaunchContext, parseToSemver, postConversion, productDetail, registerAPITrafficObserver, registerPlatformAdapters, registerPurchaseAdapter, resolveLoopSource, selectSegment, setActiveNamiEntitlements, shouldValidateProductGroups, skuItems, skuMapFromEntitlements, storageService, toDouble, toNamiEntitlements, toNamiSKU, tryParseB64Gzip, tryParseJson, updateRelatedSKUsForNamiEntitlement, uuidFromSplitPosition, validateForm, validateMinSDKVersion, validateTextInput };
+export type { AccountStateHandler$1 as AccountStateHandler, AlignmentType, AmazonProduct, ApiResponse, AppleProduct, AvailableCampaignsResponseHandler, BorderLocationType, BorderSideType, Callback$1 as Callback, CloseHandler, CustomerJourneyState, DeepLinkUrlHandler, Device, DevicePayload, DeviceProfile, DirectionType, ExtendedPlatformInfo, FlexDirectionObject, FlowNavigationOptions, FontCollection, FontDetails, FormFactor, FormFieldValidator, GoogleProduct, IConfig, IDeviceAdapter, IEntitlements$1 as IEntitlements, IPaywall, IPlatformAdapters, IProductsWithComponents, IPurchaseAdapter, ISkuMenu, IStorageAdapter, IUIAdapter, Impression, InitialConfig, InitialConfigCompressed, InitiateStateGroup, JourneySettings, LoginResponse, NamiAPITrafficKind, NamiAPITrafficObserver, NamiAPITrafficRecord, NamiAnimation, NamiAnimationObjectSpec, NamiAnimationSpec, NamiAnonymousCampaign, NamiAppSuppliedVideoDetails, NamiCampaign, NamiCampaignManagerStatic, NamiCampaignSegment, NamiCompletionResult, NamiConfiguration, NamiConfigurationState, NamiCustomAttributeValue, NamiCustomerManagerStatic, NamiEntitlement$1 as NamiEntitlement, NamiEntitlementManagerStatic, NamiFlowAction, NamiFlowAnimation, NamiFlowCampaign, NamiFlowCompletionCondition, NamiFlowDTO, NamiFlowEventHandler, NamiFlowHandoffStepHandler, NamiFlowManagerStatic, NamiFlowObjectDTO, NamiFlowOn, NamiFlowStep, NamiFlowTransition, NamiFlowTransitionDirection, NamiFlowWithObject, NamiHandoffAttributeValue, NamiHandoffComplete, NamiHandoffOutcome, NamiHandoffTagValue, NamiInitialConfig, NamiKnownHandoffTag, NamiLanguageCodes, NamiLogLevel, NamiLoginSuccess, NamiPaywallActionHandler, NamiPaywallComponentChange, NamiPaywallEvent, NamiPaywallEventVideoMetadata, NamiPaywallLaunchContext, NamiPaywallManagerStatic, NamiPresentationStyle, NamiProductDetails, NamiProductOffer, NamiProfile, NamiPurchase, NamiPurchaseCompleteResult, NamiPurchaseDetails, NamiPurchaseManagerStatic, NamiPurchaseSuccess, NamiPurchasesState, NamiSKU, NamiSKUType, NamiSubscriptionInterval, NamiSubscriptionPeriod, NamiUserDataEnvelope, None, NoneSpec, PaywallActionEvent, PaywallHandle, PaywallResultHandler, PaywallSKU, PricingPhase, ProductGroup, Pulse, PulseSpec, PurchaseContext, PurchaseResult, PurchaseValidationRequest, SKU, SKUActionHandler, ScreenInfo, Session, TBaseComponent, TButtonContainer, TCarouselContainer, TCarouselSlide, TCarouselSlidesState, TCollapseContainer, TComponent, TConditionalAttributes, TConditionalComponent, TContainer, TContainerPosition, TCountdownTimerTextComponent, TDevice, TDisabledButton, TField, TFieldSettings, TFlexProductContainer, THeaderFooter, TImageComponent, TInitialState, TMediaTypes, TOffer, TPages, TPaywallContext, TPaywallLaunchContext, TPaywallMedia, TPaywallTemplate, TPlayPauseButton, TProductContainer, TProductGroup, TProgressBarComponent, TProgressIndicatorComponent, TQRCodeComponent, TRadioButton, TRepeatingGrid, TResponsiveGrid, TSegmentPicker, TSegmentPickerItem, TSemverObj, TSlot, TSlotGroupSelector, TSpacerComponent, TStack, TSvgImageComponent, TSymbolComponent, TTestObject, TTextComponent, TTextInputComponent, TTextInputType, TTextLikeComponent, TTextListComponent, TTimelineRail, TToggleButtonComponent, TToggleSwitch, TVariablePattern, TVideoComponent, TVolumeButton, TimerState, TransactionRequest, UserAction, UserActionParameters, Wave, WaveSpec };

package/dist/index.mjs

@@ -104,7 +104,7 @@ const {
 // version — stamped by scripts/version.sh
 NAMI_SDK_VERSION = "3.4.12", 
 // full package version including dev suffix — stamped by scripts/version.sh
-NAMI_SDK_PACKAGE_VERSION = "3.4.12-dev.202609241021", 
+NAMI_SDK_PACKAGE_VERSION = "3.4.12-dev.202609251500", 
 // environments
 PRODUCTION = "production", DEVELOPMENT = "development", 
 // error messages
@@ -114,7 +114,7 @@ AUTH_DEVICE = "nami_auth_device", NAMI_CONFIGURATION = "nami_configuration", NAM
 // API settings
 API_VERSION = "v3", BASE_URL_PATH = `sdk/${API_VERSION}/platform`, BASE_URL = "https://app.namiml.com", BASE_STAGING_URL = "https://app-staging.namiml.com", CUSTOM_HOST_PREFIX = "namiAPIHost=", USE_STAGING_API = "useStagingAPI", 
 // // extended client info
-EXTENDED_CLIENT_INFO_PREFIX = "extendedClientInfo", EXTENDED_CLIENT_INFO_DELIMITER = ":", VALIDATE_PRODUCT_GROUPS = "validateProductGroups", LOG_HTTP_REQUESTS = "logHTTPRequests", LOG_HTTP_TRAFFIC = "logHTTPTraffic", STARTUP_TELEMETRY = "startupTelemetry", EXTENDED_PLATFORM = "extended-platform", EXTENDED_PLATFORM_VERSION = "extended-platform-version", API_MAX_CALLS_LIMIT = 2, API_RETRY_DELAY_SEC = 2, API_TIMEOUT_LIMIT = 20000, DEVICE_API_TIMEOUT_LIMIT = 2000, 
+EXTENDED_CLIENT_INFO_PREFIX = "extendedClientInfo", EXTENDED_CLIENT_INFO_DELIMITER = ":", VALIDATE_PRODUCT_GROUPS = "validateProductGroups", LOG_HTTP_REQUESTS = "logHTTPRequests", LOG_HTTP_TRAFFIC = "logHTTPTraffic", API_TRAFFIC_OBSERVER = "apiTrafficObserver", STARTUP_TELEMETRY = "startupTelemetry", EXTENDED_PLATFORM = "extended-platform", EXTENDED_PLATFORM_VERSION = "extended-platform-version", API_MAX_CALLS_LIMIT = 2, API_RETRY_DELAY_SEC = 2, API_TIMEOUT_LIMIT = 20000, DEVICE_API_TIMEOUT_LIMIT = 2000, 
 // status codes
 STATUS_SUCCESS = 200, STATUS_BAD_REQUEST = 400, STATUS_NOT_FOUND = 404, STATUS_CONFLICT = 409, STATUS_INTERNAL_SERVER_ERROR = 500, 
 // configuration states
@@ -6843,6 +6843,17 @@ const shouldLogHTTPTraffic = () => {
     const namiCommands = storageService.getNamiConfig()?.namiCommands;
     return namiCommands?.includes(LOG_HTTP_TRAFFIC) ?? false;
 };
+/**
+ * Whether the SDK should build traffic records for the registered API traffic observer.
+ *
+ * Read per attempt at capture time, never once at registration: hosts register the
+ * observer before `Nami.configure()`, so a registration-time read would see an
+ * unpopulated config and disable capture for the life of the process.
+ */
+const shouldObserveAPITraffic = () => {
+    const namiCommands = storageService.getNamiConfig()?.namiCommands;
+    return namiCommands?.includes(API_TRAFFIC_OBSERVER) ?? false;
+};
 function tryParseJson(str) {
     const trimmed = str.trim();
     if (!trimmed.startsWith("{") && !trimmed.startsWith("["))
@@ -6877,6 +6888,166 @@ function base64ToUint8(b64) {
     return bytes;
 }
 
+/** Maximum number of UTF-8 characters retained from a request or response body. */
+const BODY_LIMIT = 4096;
+/**
+ * Sentinel `statusCode` for a request that never produced an HTTP response.
+ *
+ * No HTTP status is ever 0, so it cannot collide with a real one. Prefer
+ * {@link didReceiveResponse} over comparing against this directly.
+ */
+const TRANSPORT_FAILURE_STATUS = 0;
+/**
+ * `true` when the attempt completed with an HTTP response, `false` when it failed in
+ * transport. Reads better than `statusCode !== 0` and keeps the sentinel an implementation
+ * detail.
+ */
+function didReceiveResponse(record) {
+    return record.statusCode !== TRANSPORT_FAILURE_STATUS;
+}
+let observer = null;
+/**
+ * Registers the traffic observer, or clears it when passed `null`.
+ *
+ * Intended for debug and QA tooling. A single observer is held — registering a second
+ * replaces the first, so a host that needs several should fan out itself.
+ *
+ * Capture additionally requires the `apiTrafficObserver` Nami command. That check happens
+ * at capture time rather than here on purpose: hosts register before `Nami.configure()`,
+ * so a registration-time gate would read an unpopulated config and silently no-op for the
+ * life of the process.
+ */
+function registerAPITrafficObserver(next) {
+    observer = next;
+}
+/**
+ * Whether a record should be built for this attempt.
+ *
+ * Both conditions are required, and both are evaluated per attempt so that enabling the
+ * command mid-session takes effect and an unobserved host pays nothing.
+ */
+function capturing() {
+    return observer !== null && shouldObserveAPITraffic();
+}
+function truncate(body) {
+    if (!body)
+        return undefined;
+    return body.length > BODY_LIMIT ? body.slice(0, BODY_LIMIT) : body;
+}
+/**
+ * The path portion of `url`, with its trailing slash intact.
+ *
+ * Every Nami endpoint is a trailing-slash route, so losing it renders `/device/` as
+ * `/device` — which is what Apple's port of this shipped before it was caught
+ * (NAM-4446). `URL.pathname` keeps the slash; the explicit test for it is what stops a
+ * future "tidy up the URL parsing" change from reintroducing the bug.
+ *
+ * Falls back to the raw string for anything unparseable rather than throwing: a record
+ * with an odd path is far more useful than an exception raised inside instrumentation.
+ */
+function pathOf(url) {
+    try {
+        return new URL(url).pathname;
+    }
+    catch {
+        return url;
+    }
+}
+/** The request body as a string, when it is one we can cheaply render. */
+function requestBodyOf(options) {
+    const body = options?.body;
+    return typeof body === "string" ? truncate(body) : undefined;
+}
+function emit(record) {
+    try {
+        observer?.(record);
+    }
+    catch {
+        // An observer that throws is a bug in the host's debug tooling, not a reason to fail
+        // the request that was being observed.
+    }
+}
+/**
+ * Runs `doFetch` and reports the attempt to the registered observer.
+ *
+ * Wraps both of the SDK's fetch sites — the API path in `withRetry` and the CDN path in
+ * `cdnFetch` — so timing, truncation and the transport-failure sentinel are defined once.
+ *
+ * Two properties matter and are easy to lose:
+ *
+ * - **The record is emitted before the caller branches on status.** `withRetry` throws
+ *   `ConflictError` on 409 and `RetryLimitExceededError` once retries are spent, and
+ *   `cdnFetch` throws `NonRetryableHttpError`; recording after any of those would drop the
+ *   record for exactly the failures worth seeing.
+ * - **Transport failures are recorded and rethrown unchanged.** `fetch` rejects with a
+ *   `TypeError` for DNS/TCP/TLS/CORS failures and an `AbortError` on timeout, and neither
+ *   ever becomes a `Response`. A hook that only saw responses structurally could not report
+ *   a connection that never opened — which is most of why this tab exists. (Android reached
+ *   the same conclusion choosing OkHttp's application interceptor over the network one,
+ *   NAM-4447.)
+ *
+ * The response is returned undisturbed: the body is read from a `clone()`, so callers still
+ * get an unconsumed stream.
+ */
+async function observeFetch(url, options, kind, doFetch) {
+    if (!capturing())
+        return doFetch();
+    const method = options?.method ?? "GET";
+    const startedAt = Date.now();
+    let response;
+    try {
+        response = await doFetch();
+    }
+    catch (error) {
+        emit({
+            method,
+            url,
+            path: pathOf(url),
+            statusCode: TRANSPORT_FAILURE_STATUS,
+            durationMs: Date.now() - startedAt,
+            timestamp: new Date(),
+            requestBody: requestBodyOf(options),
+            errorDescription: describeError(error),
+            kind,
+        });
+        throw error;
+    }
+    const durationMs = Date.now() - startedAt;
+    let responseBody;
+    try {
+        responseBody = truncate(await response.clone().text());
+    }
+    catch {
+        // A body that cannot be re-read (already disturbed, or an opaque response) is not
+        // worth failing the request over — the status line is still useful on its own.
+    }
+    emit({
+        method,
+        url,
+        path: pathOf(url),
+        statusCode: response.status,
+        durationMs,
+        timestamp: new Date(),
+        requestBody: requestBodyOf(options),
+        responseBody,
+        kind,
+    });
+    return response;
+}
+/**
+ * A human-readable description of a thrown fetch failure.
+ *
+ * Never returns undefined for a caught error: a record carrying the transport-failure
+ * sentinel and no reason reads as "no response, and no explanation either", which is worse
+ * than a generic string.
+ */
+function describeError(error) {
+    if (error instanceof Error) {
+        return error.name ? `${error.name}: ${error.message}` : error.message;
+    }
+    return String(error);
+}
+
 async function withRetry(url, options, timeout = API_TIMEOUT_LIMIT, retries = API_MAX_CALLS_LIMIT) {
     let retryCount = 0;
     const logRequests = shouldLogHTTPRequests();
@@ -6889,7 +7060,10 @@ async function withRetry(url, options, timeout = API_TIMEOUT_LIMIT, retries = AP
         if (logTraffic && options?.body) {
             logger.debug(`[HTTP] Request body: ${options.body}`);
         }
-        const response = await timeoutRequest$1(url, options, timeout);
+        // One record per attempt, emitted before the status branches below: `withRetry`
+        // throws on 409 and on exhausted retries, so recording afterwards would lose the
+        // record for exactly the failures worth seeing (NAM-4606).
+        const response = await observeFetch(url, options, "api", () => timeoutRequest$1(url, options, timeout));
         if (!response.ok) {
             if (logTraffic) {
                 const errorBody = await response.clone().text();
@@ -57664,7 +57838,9 @@ async function timeoutRequest(url, timeout) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), timeout);
     try {
-        return await fetch(url, { signal: controller.signal });
+        // Recorded as `cdn` rather than `api`. Without this the per-paywall body traffic is
+        // invisible to the traffic tab, which is the traffic NAM-4357 is about (NAM-4606).
+        return await observeFetch(url, { method: "GET" }, "cdn", () => fetch(url, { signal: controller.signal }));
     }
     finally {
         clearTimeout(timeoutId);
@@ -65816,4 +65992,4 @@ var internal = /*#__PURE__*/Object.freeze({
     NamiPurchaseManager: NamiPurchaseManager
 });
 
-export { ALREADY_CONFIGURED, ANONYMOUS_MODE, ANONYMOUS_MODE_ALREADY_OFF, ANONYMOUS_MODE_ALREADY_ON, ANONYMOUS_MODE_LOGIN_NOT_ALLOWED, ANONYMOUS_UUID, APIError, API_ACTIVE_ENTITLEMENTS, API_CAMPAIGN_RULES, API_CAMPAIGN_SESSION_TIMESTAMP, API_CONFIG, API_MAX_CALLS_LIMIT, API_PAYWALLS, API_PRODUCTS, API_RETRY_DELAY_SEC, API_TIMEOUT_LIMIT, API_VERSION, AUTH_DEVICE, AVAILABLE_ACTIVE_ENTITLEMENTS_CHANGED, AVAILABLE_CAMPAIGNS_CHANGED, AccountStateAction, AnonymousCDPError, AnonymousLoginError, AnonymousModeAlreadyOffError, AnonymousModeAlreadyOnError, BASE_STAGING_URL, BASE_URL, BASE_URL_PATH, BadRequestError, BasicNamiFlow, BorderMap, BorderSideMap, CAMPAIGN_NOT_AVAILABLE, CUSTOMER_ATTRIBUTES_KEY_PREFIX, CUSTOMER_JOURNEY_STATE_CHANGED, CUSTOM_HOST_PREFIX, CampaignNotAvailableError, CampaignRuleConversionEventType, CampaignRuleRepository, Capabilities, ClientError, ConfigRepository, ConflictError, CustomerJourneyRepository, DEFAULT_JOURNEY_SETTINGS, DEVELOPMENT, DEVICE_API_TIMEOUT_LIMIT, DEVICE_ID_NOT_SET, DEVICE_ID_REQUIRED, DISABLE_ASYNC_LOGIN_LOGOUT, DeviceIDRequiredError, DeviceRepository, EXTENDED_CLIENT_INFO_DELIMITER, EXTENDED_CLIENT_INFO_PREFIX, EXTENDED_PLATFORM, EXTENDED_PLATFORM_VERSION, EXTERNAL_ID_REQUIRED, EntitlementRepository, EntitlementUtils, ExternalIDRequiredError, FLOW_SCREENS_NOT_AVAILABLE, FlowScreensNotAvailableError, HTML_REGEX, INITIAL_APP_CONFIG, INITIAL_CAMPAIGN_RULES, INITIAL_PAYWALLS, INITIAL_PRODUCTS, INITIAL_SESSION_COUNTER_VALUE, INITIAL_SUCCESS, InternalServerError, KEY_SESSION_COUNTER, LIQUID_VARIABLE_REGEX, LOCAL_NAMI_ENTITLEMENTS, LOG_HTTP_REQUESTS, LOG_HTTP_TRAFFIC, LaunchCampaignError, LaunchContextResolver, LogLevel, NAMI_CONFIGURATION, NAMI_CUSTOMER_JOURNEY_STATE, NAMI_LANGUAGE_CODE, NAMI_LAST_IMPRESSION_ID, NAMI_LAUNCH_ID, NAMI_PROFILE, NAMI_PURCHASE_CHANNEL, NAMI_PURCHASE_IMPRESSION_ID, NAMI_SDK_PACKAGE_VERSION, NAMI_SDK_VERSION, NAMI_SESSION_ID, NAMI_STORAGE_KEYS, Nami, NamiAPI, NamiAnimationType, NamiCampaignManager$1 as NamiCampaignManager, NamiCampaignRuleType, NamiConditionEvaluator, NamiCustomerManager$1 as NamiCustomerManager, NamiEntitlementManager$1 as NamiEntitlementManager, NamiEventEmitter, NamiFlow, NamiFlowActionFunction, NamiFlowManager$1 as NamiFlowManager, NamiFlowStepType, NamiHandoffTag, NamiPaywallAction, NamiPaywallManager$1 as NamiPaywallManager, PaywallManagerEvents as NamiPaywallManagerEvents, NamiPermissionOutcome, NamiPurchaseManager$1 as NamiPurchaseManager, NamiRefs, NamiReservedActions, NotFoundError, PAYWALL_ACTION_EVENT, PLATFORM_ID_REQUIRED, PRODUCTION, PaywallManagerEvents, PaywallRepository, PaywallState, PlacementLabelResolver, PlatformIDRequiredError, ProductRepository, RECONFIG_SUCCESS, RetryLimitExceededError, SDKNotInitializedError, SDK_NOT_INITIALIZED, SERVER_NAMI_ENTITLEMENTS, SESSION_REQUIRED, SHOULD_SHOW_LOADING_INDICATOR, SKU_TEXT_REGEX, SMART_TEXT_PATTERN, STARTUP_TELEMETRY, STATUS_BAD_REQUEST, STATUS_CONFLICT, STATUS_INTERNAL_SERVER_ERROR, STATUS_NOT_FOUND, STATUS_SUCCESS, SessionService, SimpleEventTarget, StorageService, UNABLE_TO_UPDATE_CDP_ID, USE_STAGING_API, VALIDATE_PRODUCT_GROUPS, VAR_REGEX, NamiProfileManager$1 as _NamiProfileManager, internal as _internal, activateEntitlementByPurchase, activeEntitlements, aggregateScreenreaderText, allCampaigns, allPaywalls, applyEntitlementActivation, audienceSplitPosition, bestUrlCampaignMatch, bigintToUuid, checkAnySkuHasPromoOffer, checkAnySkuHasTrialOffer, convertISO8601PeriodToText, convertLocale, convertOfferToPricingPhase, createNamiEntitlements, currentSku, empty, extractStandardPricingPhases, formatDate, formattedPrice, generateUUID, getApiCampaigns, getApiPaywalls, getBaseUrl, getBillingPeriodNumber, getCurrencyFormat, getDeviceData, getDeviceFormFactor, getDeviceScaleFactor, getEffectiveWebStyle, getEntitlementRefIdsForSku, getExtendedClientInfo, getFreeTrialPeriod, getInitialCampaigns, getInitialPaywalls, getJourneySettings, getPaywall, getPaywallDataFromLabel, getPercentagePriceDifference, getPeriodNumberInDays, getPeriodNumberInWeeks, getPlatformAdapters, getPriceDifference, getPricePerMonth, getProductDetail, getPurchaseAdapter, getReferenceSku, getSkuProductDetailKeys, getSkuSmartTextValue, getSlideSmartTextValue, getStandardBillingPeriod, getTranslate, getUrlParams, handleErrors, hasAllPaywalls, hasCapability, hasPurchaseManagement, initialState, invokeHandler, isAnonymousMode, isInitialConfigCompressed, isNamiFlowCampaign, isSubscription, isValidISODate, isValidUrl, logger, mapAnonymousCampaigns, namiBuySKU, normalizeLaunchContext, parseToSemver, postConversion, productDetail, registerPlatformAdapters, registerPurchaseAdapter, resolveLoopSource, selectSegment, setActiveNamiEntitlements, shouldValidateProductGroups, skuItems, skuMapFromEntitlements, storageService, toDouble, toNamiEntitlements, toNamiSKU, tryParseB64Gzip, tryParseJson, updateRelatedSKUsForNamiEntitlement, uuidFromSplitPosition, validateForm, validateMinSDKVersion, validateTextInput };
+export { ALREADY_CONFIGURED, ANONYMOUS_MODE, ANONYMOUS_MODE_ALREADY_OFF, ANONYMOUS_MODE_ALREADY_ON, ANONYMOUS_MODE_LOGIN_NOT_ALLOWED, ANONYMOUS_UUID, APIError, API_ACTIVE_ENTITLEMENTS, API_CAMPAIGN_RULES, API_CAMPAIGN_SESSION_TIMESTAMP, API_CONFIG, API_MAX_CALLS_LIMIT, API_PAYWALLS, API_PRODUCTS, API_RETRY_DELAY_SEC, API_TIMEOUT_LIMIT, API_TRAFFIC_OBSERVER, API_VERSION, AUTH_DEVICE, AVAILABLE_ACTIVE_ENTITLEMENTS_CHANGED, AVAILABLE_CAMPAIGNS_CHANGED, AccountStateAction, AnonymousCDPError, AnonymousLoginError, AnonymousModeAlreadyOffError, AnonymousModeAlreadyOnError, BASE_STAGING_URL, BASE_URL, BASE_URL_PATH, BadRequestError, BasicNamiFlow, BorderMap, BorderSideMap, CAMPAIGN_NOT_AVAILABLE, CUSTOMER_ATTRIBUTES_KEY_PREFIX, CUSTOMER_JOURNEY_STATE_CHANGED, CUSTOM_HOST_PREFIX, CampaignNotAvailableError, CampaignRuleConversionEventType, CampaignRuleRepository, Capabilities, ClientError, ConfigRepository, ConflictError, CustomerJourneyRepository, DEFAULT_JOURNEY_SETTINGS, DEVELOPMENT, DEVICE_API_TIMEOUT_LIMIT, DEVICE_ID_NOT_SET, DEVICE_ID_REQUIRED, DISABLE_ASYNC_LOGIN_LOGOUT, DeviceIDRequiredError, DeviceRepository, EXTENDED_CLIENT_INFO_DELIMITER, EXTENDED_CLIENT_INFO_PREFIX, EXTENDED_PLATFORM, EXTENDED_PLATFORM_VERSION, EXTERNAL_ID_REQUIRED, EntitlementRepository, EntitlementUtils, ExternalIDRequiredError, FLOW_SCREENS_NOT_AVAILABLE, FlowScreensNotAvailableError, HTML_REGEX, INITIAL_APP_CONFIG, INITIAL_CAMPAIGN_RULES, INITIAL_PAYWALLS, INITIAL_PRODUCTS, INITIAL_SESSION_COUNTER_VALUE, INITIAL_SUCCESS, InternalServerError, KEY_SESSION_COUNTER, LIQUID_VARIABLE_REGEX, LOCAL_NAMI_ENTITLEMENTS, LOG_HTTP_REQUESTS, LOG_HTTP_TRAFFIC, LaunchCampaignError, LaunchContextResolver, LogLevel, NAMI_CONFIGURATION, NAMI_CUSTOMER_JOURNEY_STATE, NAMI_LANGUAGE_CODE, NAMI_LAST_IMPRESSION_ID, NAMI_LAUNCH_ID, NAMI_PROFILE, NAMI_PURCHASE_CHANNEL, NAMI_PURCHASE_IMPRESSION_ID, NAMI_SDK_PACKAGE_VERSION, NAMI_SDK_VERSION, NAMI_SESSION_ID, NAMI_STORAGE_KEYS, Nami, NamiAPI, NamiAnimationType, NamiCampaignManager$1 as NamiCampaignManager, NamiCampaignRuleType, NamiConditionEvaluator, NamiCustomerManager$1 as NamiCustomerManager, NamiEntitlementManager$1 as NamiEntitlementManager, NamiEventEmitter, NamiFlow, NamiFlowActionFunction, NamiFlowManager$1 as NamiFlowManager, NamiFlowStepType, NamiHandoffTag, NamiPaywallAction, NamiPaywallManager$1 as NamiPaywallManager, PaywallManagerEvents as NamiPaywallManagerEvents, NamiPermissionOutcome, NamiPurchaseManager$1 as NamiPurchaseManager, NamiRefs, NamiReservedActions, NotFoundError, PAYWALL_ACTION_EVENT, PLATFORM_ID_REQUIRED, PRODUCTION, PaywallManagerEvents, PaywallRepository, PaywallState, PlacementLabelResolver, PlatformIDRequiredError, ProductRepository, RECONFIG_SUCCESS, RetryLimitExceededError, SDKNotInitializedError, SDK_NOT_INITIALIZED, SERVER_NAMI_ENTITLEMENTS, SESSION_REQUIRED, SHOULD_SHOW_LOADING_INDICATOR, SKU_TEXT_REGEX, SMART_TEXT_PATTERN, STARTUP_TELEMETRY, STATUS_BAD_REQUEST, STATUS_CONFLICT, STATUS_INTERNAL_SERVER_ERROR, STATUS_NOT_FOUND, STATUS_SUCCESS, SessionService, SimpleEventTarget, StorageService, TRANSPORT_FAILURE_STATUS, UNABLE_TO_UPDATE_CDP_ID, USE_STAGING_API, VALIDATE_PRODUCT_GROUPS, VAR_REGEX, NamiProfileManager$1 as _NamiProfileManager, internal as _internal, activateEntitlementByPurchase, activeEntitlements, aggregateScreenreaderText, allCampaigns, allPaywalls, applyEntitlementActivation, audienceSplitPosition, bestUrlCampaignMatch, bigintToUuid, checkAnySkuHasPromoOffer, checkAnySkuHasTrialOffer, convertISO8601PeriodToText, convertLocale, convertOfferToPricingPhase, createNamiEntitlements, currentSku, didReceiveResponse, empty, extractStandardPricingPhases, formatDate, formattedPrice, generateUUID, getApiCampaigns, getApiPaywalls, getBaseUrl, getBillingPeriodNumber, getCurrencyFormat, getDeviceData, getDeviceFormFactor, getDeviceScaleFactor, getEffectiveWebStyle, getEntitlementRefIdsForSku, getExtendedClientInfo, getFreeTrialPeriod, getInitialCampaigns, getInitialPaywalls, getJourneySettings, getPaywall, getPaywallDataFromLabel, getPercentagePriceDifference, getPeriodNumberInDays, getPeriodNumberInWeeks, getPlatformAdapters, getPriceDifference, getPricePerMonth, getProductDetail, getPurchaseAdapter, getReferenceSku, getSkuProductDetailKeys, getSkuSmartTextValue, getSlideSmartTextValue, getStandardBillingPeriod, getTranslate, getUrlParams, handleErrors, hasAllPaywalls, hasCapability, hasPurchaseManagement, initialState, invokeHandler, isAnonymousMode, isInitialConfigCompressed, isNamiFlowCampaign, isSubscription, isValidISODate, isValidUrl, logger, mapAnonymousCampaigns, namiBuySKU, normalizeLaunchContext, parseToSemver, postConversion, productDetail, registerAPITrafficObserver, registerPlatformAdapters, registerPurchaseAdapter, resolveLoopSource, selectSegment, setActiveNamiEntitlements, shouldValidateProductGroups, skuItems, skuMapFromEntitlements, storageService, toDouble, toNamiEntitlements, toNamiSKU, tryParseB64Gzip, tryParseJson, updateRelatedSKUsForNamiEntitlement, uuidFromSplitPosition, validateForm, validateMinSDKVersion, validateTextInput };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namiml/sdk-core",
-  "version": "3.4.12-dev.202609241021",
+  "version": "3.4.12-dev.202609251500",
   "description": "Platform-agnostic core for the Nami SDK — business logic, API, types, and state management",
   "type": "module",
   "main": "./dist/index.cjs",