@zoho_apptics/apptics-js-sdk 1.0.1 → 2.0.0-beta

package/dist/esm/core/transport.js

@@ -0,0 +1,425 @@
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+import { API_VERSIONS, PATHS_WITHOUT_ORG, DEFAULT_API_PATHS, DEBUG_CAPABLE_PATHS, AP_TRACKING_STATUS, DEVICE_NAME_MAX } from './constants.js';
+import { getConfig, _ZAP } from './state.js';
+import { Console } from './logger.js';
+import { isEmpty, isSuccess } from './utils.js';
+import { getKeyFromDeviceInfo } from './storage.js';
+import { is_apptics_disabled } from './env.js';
+import { opt_in_status } from './consent.js';
+import { beginAttempt, attemptSucceeded } from './attempts.js';
+import { debugEnabled } from './debug.js';
+import { hooks } from './hooks.js';
+
+/**
+ * How long a request may take before it counts as failed. Without a limit a request the network
+ * never answers keeps its caller waiting for good, and with it the queue it was sending.
+ */
+const REQUEST_TIMEOUT_MS = 30000;
+// Function to make an asynchronous request
+function makeRequest(url, method, payload, headers) {
+    return new Promise((resolve, reject) => {
+        let xhr = new XMLHttpRequest();
+        xhr.open(method, url);
+        if (headers) {
+            Object.keys(headers).forEach((key) => {
+                xhr.setRequestHeader(key, headers[key]);
+            });
+        }
+        xhr.withCredentials = false;
+        xhr.timeout = REQUEST_TIMEOUT_MS;
+        xhr.onreadystatechange = function () {
+            if (xhr.readyState === 4) { // XMLHttpRequest.DONE == 4, except in safari 4
+                if (xhr.status == 200) {
+                    resolve(xhr.responseText);
+                }
+                else {
+                    reject(xhr.statusText);
+                }
+            }
+        };
+        xhr.onerror = function () {
+            reject('makeRequest:  Network Error'); // no i18n
+        };
+        xhr.ontimeout = function () {
+            reject('makeRequest: timed out after ' + REQUEST_TIMEOUT_MS + ' ms'); // no i18n
+        };
+        xhr.send(payload);
+    });
+}
+function getHeaderParams(key) {
+    if (key == 'zak') { // no i18n
+        return _ZAP._defaultoptions.zak;
+    }
+    else if (key == 'uuid') { // no i18n
+        return _ZAP._uuid;
+    }
+    else if (key == 'apid') { // no i18n
+        return _ZAP._apid || getKeyFromDeviceInfo(key);
+    }
+    else if (key == 'mapid') { // no i18n
+        return _ZAP._mapid || getKeyFromDeviceInfo(key);
+    }
+    else {
+        return ''; // no i18n
+    }
+}
+/**
+ * appversionid and frameworkid, which every v2 url but app/addversion declares min-occurrences="1".
+ *
+ * They are appended whatever else the path carries, including on a call made before the device is
+ * registered: leaving a mandatory param out gets the request refused for *that* param, which sends
+ * whoever reads the error looking for the wrong fault. frameworkid falls back to the SDK's own id
+ * because device_info has none until the first device/add answers.
+ *
+ * Returned with a leading separator chosen by the caller's query, so it appends to '' as well as
+ * to an existing '?...' string.
+ */
+function mandatoryParams(existing) {
+    var out = ''; // no i18n
+    var appversionid = _ZAP._device_info.appversionid;
+    var frameworkid = !isEmpty(_ZAP._device_info.frameworkid) ? _ZAP._device_info.frameworkid : _ZAP._frameworkID;
+    if (!isEmpty(appversionid)) {
+        out += '&appversionid=' + encodeURIComponent(String(appversionid)); // no i18n
+    }
+    if (!isEmpty(frameworkid)) {
+        out += '&frameworkid=' + encodeURIComponent(String(frameworkid)); // no i18n
+    }
+    if (out === '') {
+        return out;
+    }
+    // '&...' becomes '?...' when it is the whole query
+    return (existing === undefined || existing === '') ? '?' + out.slice(1) : out;
+}
+/**
+ * A label for this device built from what we already know about it: "Chrome 141 on macOS".
+ *
+ * safe_string accepts letters, digits and spaces, so nothing here needs escaping beyond the
+ * encoding every param gets. Parts we do not have are left out rather than written as 'unknown',
+ * which would read as a name in the list.
+ */
+function derivedDeviceName() {
+    var info = _ZAP._device_info;
+    var browser = isEmpty(info.browser) ? '' : String(info.browser); // no i18n
+    var version = isEmpty(info.browserversion) ? '' : String(info.browserversion); // no i18n
+    var os = isEmpty(info.osversion) ? '' : String(info.osversion); // no i18n
+    var name = browser === '' ? '' : (version === '' ? browser : browser + ' ' + version); // no i18n
+    if (os === '') {
+        return name;
+    }
+    return name === '' ? os : name + ' on ' + os; // no i18n
+}
+/**
+ * `devicename`, which only engagement, exception and log declare. It is how the debug stream
+ * tells one tester's browser from another's, so it is sent when the app named this device, and
+ * otherwise only while tracing, where a derived label beats an unnamed row. safe_string needs at
+ * least one character, so an empty name is left out rather than sent as ''.
+ */
+function deviceNameParam(path, existing) {
+    if (!DEBUG_CAPABLE_PATHS[path]) {
+        return ''; // no i18n
+    }
+    var given = getConfig('device_name'); // no i18n
+    var name = !isEmpty(given) ? String(given) : (debugEnabled() ? derivedDeviceName() : ''); // no i18n
+    if (name === '') {
+        return ''; // no i18n
+    }
+    var param = 'devicename=' + encodeURIComponent(name.slice(0, DEVICE_NAME_MAX)); // no i18n
+    return (existing === '' ? '?' : '&') + param; // no i18n
+}
+function getParameters(path) {
+    let returnVal = ''; // no i18n
+    // app/addversion runs before any id exists: it identifies the build, not the device
+    if (path == 'addversion') { // no i18n
+        var frameworkid = !isEmpty(_ZAP._device_info.frameworkid) ? _ZAP._device_info.frameworkid : _ZAP._frameworkID;
+        return '?version=' + encodeURIComponent(_ZAP._defaultoptions.appversion)
+            + '&platform=' + encodeURIComponent(_ZAP._platform)
+            + '&identifier=' + encodeURIComponent(_ZAP._defaultoptions.identifier)
+            + '&frameworkid=' + encodeURIComponent(String(frameworkid)); // no i18n
+    }
+    // v2 device/add declares neither identifier, platform nor appversion: the build is already
+    // known from app/addversion, and sending an undeclared param is refused as EXTRA_PARAM_FOUND.
+    // What it does declare as mandatory is appversionid, which v1 treated as optional.
+    if (path == 'regdevice') { // no i18n
+        returnVal = '?isanonrequired=' + _ZAP._isanonrequired + '&devicestatus=' + _ZAP._devicestatus; // no i18n
+        if (!isEmpty(_ZAP._device_info.deviceid)) {
+            returnVal += '&deviceid=' + encodeURIComponent(String(_ZAP._device_info.deviceid)); // no i18n
+        }
+        return returnVal + mandatoryParams(returnVal);
+    }
+    // getsdkconfig is the one call that must NOT carry deviceid: it declares the param with
+    // decrypt-label="authenticate", which a web SDK cannot satisfy, and sending it is answered
+    // with NOT_AUTHENTICATED. getupdates declares the same param with plain paramdecrypt, so it
+    // does carry one. It still needs appversionid and frameworkid, added at the end.
+    var identifiesDevice = path != 'sdkconfig'; // no i18n
+    if (identifiesDevice) {
+        if (isEmpty(_ZAP._device_info.deviceid)) {
+            hooks.refreshDeviceInfo();
+            // the device is missing, but appversionid and frameworkid are mandatory regardless:
+            // dropping them turns one missing id into a refusal that names the wrong param
+            return returnVal + mandatoryParams(returnVal);
+        }
+        returnVal = '?deviceid=' + encodeURIComponent(String(_ZAP._device_info.deviceid)); // no i18n
+    }
+    // feedback is attributed to whoever the form's user picker selected, not to the active user:
+    // the person reporting may not be the one the app last registered, and may choose Anonymous
+    if (path === 'feedback') { // no i18n
+        var picked = hooks.feedbackUser();
+        if (picked) {
+            returnVal += '&userid=' + encodeURIComponent(String(picked.userid)); // no i18n
+            if (!isEmpty(picked.groupid)) {
+                returnVal += '&customergroupid=' + encodeURIComponent(String(picked.groupid)); // no i18n
+            }
+        }
+        return returnVal + mandatoryParams(returnVal);
+    }
+    // add userid and groupid if opt_in_status is USAGE_TRACKING_WITH_PII
+    if (path != 'reguser' && identifiesDevice) { // no i18n
+        if (opt_in_status() == AP_TRACKING_STATUS.USAGE_TRACKING_WITH_PII) {
+            if (_ZAP._user_info.hasOwnProperty('userid') && !isEmpty(_ZAP._user_info.userid)) { // no i18n
+                returnVal += '&userid=' + encodeURIComponent(String(_ZAP._user_info.userid)); // no i18n
+            }
+            if (_ZAP._user_info.hasOwnProperty('groupid') && !isEmpty(_ZAP._user_info.groupid)) { // no i18n
+                returnVal += '&customergroupid=' + encodeURIComponent(String(_ZAP._user_info.groupid)); // no i18n
+            }
+        }
+    }
+    returnVal += deviceNameParam(path, returnVal);
+    return returnVal + mandatoryParams(returnVal);
+}
+/**
+ * `extra` appends params the path needs per call rather than per state, which console/addlog does
+ * (happenedtime and module change with every line). Values are encoded; the keys are our own.
+ */
+function getUrlWithParams(path, extra) {
+    var base = _ZAP._defaultoptions.base_domain + getConfig('endpoint') + API_VERSIONS[path] + '/'; // no i18n
+    var org = PATHS_WITHOUT_ORG[path] ? '' : _ZAP._defaultoptions.zsoid + '/' + _ZAP._defaultoptions.projectID + '/'; // no i18n
+    // the debug twin sits under the same version, as debug/engagement/add next to engagement/add
+    var leaf = (usesDebugApi(path) ? 'debug/' : '') + DEFAULT_API_PATHS[path]; // no i18n
+    var url = base + org + leaf + getParameters(path);
+    if (!extra) {
+        return url;
+    }
+    var joiner = url.indexOf('?') === -1 ? '?' : '&'; // no i18n
+    Object.keys(extra).forEach(function (key) {
+        if (extra[key] === undefined || extra[key] === null || extra[key] === '') { // no i18n
+            return;
+        }
+        url += joiner + key + '=' + encodeURIComponent(String(extra[key]));
+        joiner = '&'; // no i18n
+    });
+    return url;
+}
+/**
+ * Says where a debug request can be traced. The answer carries a request id and a link into the
+ * server's own logs, which is the whole reason for calling the debug twin — printing it is what
+ * makes it reachable.
+ */
+function reportDebugTrace(label, result) {
+    var data = result.data;
+    if (!data || isEmpty(data.req_id)) {
+        return;
+    }
+    Console.log(label + ': req_id ' + String(data.req_id)
+        + (isEmpty(data.path) ? '' : ', path ' + String(data.path))
+        + (isEmpty(data.producerLogsUrl) ? '' : ', logs ' + String(data.producerLogsUrl))); // no i18n
+}
+/** Whether this path should go to its debug twin. */
+function usesDebugApi(path) {
+    // debugEnabled(), not the raw flag: an expired debug session is off even though init() asked
+    // for it, and an expired session must stop reaching the twin
+    return debugEnabled() && DEBUG_CAPABLE_PATHS[path] === true; // no i18n
+}
+/**
+ * Headers for every call made after device registration.
+ *
+ * apid and mapid are the only two, because they are the only two every url allows: the v2
+ * endpoints declare Access-Control-Allow-Headers as exactly "apid,mapid", and a browser drops
+ * any header outside that list at the preflight. Asking for the debug twin is done with the url
+ * alone, which needs no permission to send.
+ */
+function apiHeaders() {
+    return { apid: getHeaderParams('apid'), mapid: getHeaderParams('mapid') }; // no i18n
+}
+/**
+ * Refusals that mean the payload itself is wrong. Sending it again cannot help, however many
+ * times it is tried — the proxy raises these before the server ever sees the body
+ * (JProxyExcepHandler: PATTERN_NOT_MATCHED and EXTRA_PARAM_FOUND share one message).
+ */
+const PERMANENT_REFUSALS = {
+    PATTERN_NOT_MATCHED: true, // no i18n
+    EXTRA_PARAM_FOUND: true, // no i18n
+    INVALID_INPUTSTREAM: true, // no i18n
+    INVALID_PARAM: true, // no i18n
+};
+/**
+ * Whether a rejection is the server saying "never": the batch is malformed and keeping it would
+ * block every later batch behind it, for good. Anything else — a 5xx, a timeout, no network — is
+ * worth retrying and must not be treated this way.
+ */
+function isPermanentRefusal(err) {
+    var result = err ? err.serverResult : undefined;
+    var code = result ? result.error_code : undefined;
+    return !isEmpty(code) && PERMANENT_REFUSALS[String(code)] === true;
+}
+/** The reason a response gives, preferring its error_code over the bare "failure". */
+function refusalOf(label, result, raw) {
+    var reason = result && !isEmpty(result.error_code) ? String(result.error_code)
+        : (result ? String(result.result) : String(raw));
+    var err = new Error(label + ': ' + reason);
+    if (result) {
+        err.serverResult = result;
+    }
+    return err;
+}
+/**
+ * What an answer means: the parsed result when it reports success, otherwise a rejection that
+ * carries the server's own answer. Success also resets the path's attempt counter.
+ */
+function settle(path, label, response) {
+    var _result = JSON.parse(response);
+    if (isSuccess(_result)) {
+        attemptSucceeded(path);
+        reportDebugTrace(label, _result);
+        return Promise.resolve(_result);
+    }
+    var refused = refusalOf(label, _result, response);
+    return Promise.reject(refused);
+}
+/**
+ * Sends one request. Resolves with the parsed response when it reports success; otherwise
+ * rejects with an Error carrying the server's answer. Requests are independent of each other:
+ * nothing orders one behind another.
+ */
+function postToApptics(path, payload, headers, label, extra) {
+    var url = getUrlWithParams(path, Object.assign(beginAttempt(path), {}));
+    return makeRequest(url, getConfig('method'), payload, headers).then(function (response) {
+        return settle(path, label, response);
+    }, function (err) {
+        return Promise.reject(label + ': ' + err); // no i18n
+    });
+}
+/**
+ * The most a page may have in flight as keepalive bodies at once. Browsers refuse a keepalive
+ * request once the bodies still in flight would pass 64 KiB; this stays under that with room for
+ * the url and headers.
+ */
+const KEEPALIVE_BUDGET = 60 * 1024;
+/** Bytes of keepalive bodies sent and not yet answered. */
+var keepaliveInFlight = 0;
+function byteLength(payload) {
+    if (payload === null || payload === undefined) {
+        return 0;
+    }
+    if (typeof payload === 'string') { // no i18n
+        return typeof TextEncoder === 'function' ? new TextEncoder().encode(payload).length : payload.length * 3; // no i18n
+    }
+    var sized = payload;
+    return Number(sized.size || sized.byteLength || 0);
+}
+/**
+ * Sends as the page goes away, where a normal XHR would be cancelled with the document.
+ *
+ * `keepalive` is what lets the request outlive the page. fetch is used rather than sendBeacon
+ * because sendBeacon cannot carry the apid and mapid headers these urls require.
+ *
+ * The request leaves before this returns, so a caller never has to wait on it to send the next
+ * thing. The promise settles when the answer arrives, if the page is still there to see it: a
+ * caller removes what it sent only then. Data whose answer never comes stays stored and goes
+ * again on the next visit as attempt 2, which `attempt` and `firstattempttime` let the server
+ * recognise as a copy rather than store twice.
+ *
+ * A body that would take the page past the keepalive budget is not sent at all: the browser would
+ * refuse it, and it is better kept for the next visit than lost.
+ */
+function postKeepalive(path, payload, headers, label, extra) {
+    var size = byteLength(payload);
+    if (typeof fetch === 'function' && keepaliveInFlight + size > KEEPALIVE_BUDGET) { // no i18n
+        Console.log(label + ': ' + size + ' bytes is over the keepalive budget, kept for the next send'); // no i18n
+        return Promise.reject(label + ': too large to send while the page closes'); // no i18n
+    }
+    var url = getUrlWithParams(path, Object.assign(beginAttempt(path), {}));
+    if (typeof fetch === 'function') { // no i18n
+        var answer;
+        try {
+            answer = fetch(url, {
+                method: getConfig('method'),
+                headers: Object.assign({ 'content-type': 'text/plain' }, headers), // no i18n
+                body: payload,
+                keepalive: true,
+                credentials: 'omit', // no i18n
+            });
+        }
+        catch (err) {
+            return Promise.reject(label + ': keepalive send not accepted: ' + String(err)); // no i18n
+        }
+        keepaliveInFlight += size;
+        var release = function () {
+            keepaliveInFlight = Math.max(0, keepaliveInFlight - size);
+        };
+        return answer.then(function (response) {
+            release();
+            if (!response || response.ok !== true) {
+                var status = response ? String(response.status) : ''; // no i18n
+                return Promise.reject(label + ': ' + status); // no i18n
+            }
+            var read = typeof response.text === 'function' ? response.text() : Promise.resolve(''); // no i18n
+            return read.then(function (text) {
+                // an ok answer with no readable body is taken at its status
+                if (isEmpty(text)) {
+                    return settle(path, label, JSON.stringify({ result: 'success' })); // no i18n
+                }
+                return settle(path, label, text);
+            });
+        }, function (err) {
+            release();
+            return Promise.reject(label + ': ' + String(err)); // no i18n
+        });
+    }
+    // no fetch at all: a normal request, which the browser may cancel as the page goes away
+    return makeRequest(url, getConfig('method'), payload, headers).then(function (response) {
+        return settle(path, label, response);
+    }, function (err) {
+        return Promise.reject(label + ': ' + err); // no i18n
+    });
+}
+/** A labelled rejection for crawlers (the SDK does nothing for them), otherwise null. */
+function rejectIfDisabled(label) {
+    return is_apptics_disabled() ? Promise.reject(label + ': apptics is disabled for this client') : null; // no i18n
+}
+/** A labelled rejection when the browser is offline, otherwise null. */
+function rejectIfOffline(label) {
+    if (navigator.onLine == false) {
+        Console.warn(label + ': No Network'); // no i18n
+        return Promise.reject(label + ': No Network'); // no i18n
+    }
+    return null;
+}
+/** Device ids sent alongside every payload. */
+function getMetaObj() {
+    return {
+        frameworkid: _ZAP._device_info.frameworkid || getKeyFromDeviceInfo('frameworkid'), // no i18n
+        aaid: _ZAP._device_info.aaid || getKeyFromDeviceInfo('aaid'), // no i18n
+        apid: _ZAP._device_info.apid || getKeyFromDeviceInfo('apid'), // no i18n
+        appversionid: _ZAP._device_info.appversionid || getKeyFromDeviceInfo('appversionid'), // no i18n
+        modelid: _ZAP._device_info.modelid || getKeyFromDeviceInfo('modelid'), // no i18n
+        appreleaseversionid: _ZAP._device_info.appreleaseversionid || getKeyFromDeviceInfo('appreleaseversionid'), // no i18n
+        osversionid: _ZAP._device_info.osversionid || getKeyFromDeviceInfo('osversionid'), // no i18n
+        timezoneid: _ZAP._device_info.timezoneid || getKeyFromDeviceInfo('timezoneid'), // no i18n
+        platformid: _ZAP._device_info.platformid || getKeyFromDeviceInfo('platformid'), // no i18n
+        devicetypeid: _ZAP._device_info.devicetypeid || getKeyFromDeviceInfo('devicetypeid') // no i18n
+    };
+}
+/**
+ * Calls made after registration need apid/mapid. Without them this asks device.ts to
+ * refresh device info (which registers) and returns a labelled rejection; otherwise null. Shared by sender, user
+ * and feedback (P11).
+ */
+function rejectIfNoDeviceIds(label) {
+    if (isEmpty(getHeaderParams('apid')) && isEmpty(getHeaderParams('mapid'))) { // no i18n
+        hooks.refreshDeviceInfo();
+        return Promise.reject(label + ': You must call apptics.init() first'); // no i18n
+    }
+    return null;
+}
+
+export { KEEPALIVE_BUDGET, REQUEST_TIMEOUT_MS, apiHeaders, getHeaderParams, getMetaObj, getParameters, getUrlWithParams, isPermanentRefusal, makeRequest, postKeepalive, postToApptics, rejectIfDisabled, rejectIfNoDeviceIds, rejectIfOffline, usesDebugApi };

package/dist/esm/core/utils.d.ts

@@ -0,0 +1,26 @@
+import type { Dict } from '../types.js';
+/** Returned from an `each` iterator to stop iterating objects and array-likes. */
+export declare const BREAKER: {};
+/** Current time in epoch milliseconds, the unit of every SDK timestamp. */
+export declare function nowMs(): number;
+/** True when an Apptics API response reports success. */
+export declare function isSuccess(result: unknown): boolean;
+export declare function isEmpty(val: unknown): boolean;
+export declare function isEmptyObj(obj: unknown): boolean;
+export declare function objectsAreEqual(obj1: unknown, obj2: unknown): boolean;
+export declare function compareTwoObjects(_newmap: Dict, _oldmap: Dict): boolean;
+export declare function cloneMapExcludingKeys(originalObj: Dict, excludeKeys: readonly string[]): Dict;
+/** Clones a JSON-compatible value. */
+export declare function cloneObject<T>(obj: T): T;
+/** Approximate size of a value in bytes (2 bytes per character). */
+export declare function sizeof(obj: unknown): number;
+/** True if `needle` occurs in the string or array. */
+export declare function includes(haystack: {
+    indexOf(needle: any): number;
+}, needle: unknown): boolean;
+export declare function each(obj: any, iterator: (value: any, key: any, collection: any) => unknown, context?: unknown): void;
+/**
+ * Generates a new distinct id (code lifted from apptics js).
+ * Busy-waits until Date.now() ticks.
+ */
+export declare function getNewUUID(): string;

package/dist/esm/core/utils.js

@@ -0,0 +1,161 @@
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+import { AP_CONSTANTS } from './constants.js';
+
+/** Returned from an `each` iterator to stop iterating objects and array-likes. */
+const BREAKER = {};
+/** Current time in epoch milliseconds, the unit of every SDK timestamp. */
+function nowMs() {
+    return Math.round(new Date().getTime());
+}
+/** True when an Apptics API response reports success. */
+function isSuccess(result) {
+    return !!result && typeof result === 'object' && result.result == AP_CONSTANTS.SUCCESS;
+}
+function isEmpty(val) {
+    // Check if val is empty
+    return val === undefined || val === null || val === ''; // no i18n
+}
+function isEmptyObj(obj) {
+    return !!obj && typeof obj === 'object' && Object.keys(obj).length === 0 && obj.constructor === Object;
+}
+function objectsAreEqual(obj1, obj2) {
+    // Compare the objects' properties
+    return JSON.stringify(obj1) === JSON.stringify(obj2);
+}
+function compareTwoObjects(_newmap, _oldmap) {
+    // Check if the number of keys is the same.
+    if (Object.keys(_newmap).length !== Object.keys(_oldmap).length) {
+        return false;
+    }
+    // Check if keys are the same
+    for (let key in _newmap) {
+        if (!_oldmap.hasOwnProperty(key)) {
+            return false;
+        }
+    }
+    // Check if objects associated with each key are the same
+    for (let key in _newmap) {
+        if (!objectsAreEqual(_newmap[key], _oldmap[key])) {
+            return false;
+        }
+    }
+    // Hash maps have the same keys and objects
+    return true;
+}
+function cloneMapExcludingKeys(originalObj, excludeKeys) {
+    const clonedObj = {};
+    for (let key in originalObj) {
+        if (!excludeKeys.includes(key)) {
+            clonedObj[key] = originalObj[key];
+        }
+    }
+    return clonedObj;
+}
+/** Clones a JSON-compatible value. */
+function cloneObject(obj) {
+    return JSON.parse(JSON.stringify(obj));
+}
+/** Approximate size of a value in bytes (2 bytes per character). */
+function sizeof(obj) {
+    let bytes = 0;
+    function sizeOf(value) {
+        if (value !== null && typeof value === 'object') { // no i18n
+            for (const key in value) {
+                if (Object.prototype.hasOwnProperty.call(value, key)) {
+                    bytes += key.length * 2; // 2 bytes per character
+                    sizeOf(value[key]);
+                }
+            }
+        }
+        else if (typeof value === 'string') { // no i18n
+            bytes += value.length * 2; // 2 bytes per character
+        }
+        else if (typeof value === 'number') { // no i18n
+            bytes += 8; // 8 bytes for a number
+        }
+        else if (typeof value === 'boolean') { // no i18n
+            bytes += 4; // 4 bytes for a boolean
+        }
+    }
+    sizeOf(obj);
+    return bytes;
+}
+/** True if `needle` occurs in the string or array. */
+function includes(haystack, needle) {
+    return haystack.indexOf(needle) !== -1;
+}
+function each(obj, iterator, context) {
+    if (obj === null || obj === undefined) {
+        return;
+    }
+    if (Array.prototype.forEach && obj.forEach === Array.prototype.forEach) {
+        obj.forEach(iterator, context);
+    }
+    else if (obj.length === +obj.length) {
+        for (var i = 0, l = obj.length; i < l; i++) {
+            if (i in obj && iterator.call(context, obj[i], i, obj) === BREAKER) {
+                return;
+            }
+        }
+    }
+    else {
+        for (var key in obj) {
+            if (Object.prototype.hasOwnProperty.call(obj, key)) {
+                if (iterator.call(context, obj[key], key, obj) === BREAKER) {
+                    return;
+                }
+            }
+        }
+    }
+}
+/**
+ * Generates a new distinct id (code lifted from apptics js).
+ * Busy-waits until Date.now() ticks.
+ */
+function getNewUUID() {
+    // Time/ticks information
+    var T = function () {
+        var d = Date.now(), i = 0;
+        // this while loop figures how many browser ticks go by
+        // before Date.now() returns a new number, ie the amount
+        // of ticks that go by per millisecond
+        while (d == Date.now()) {
+            i++;
+        }
+        return d.toString(16) + i.toString(16);
+    };
+    // Math.Random entropy
+    var R = function () {
+        return Math.random().toString(16).replace('.', ''); // no i18n
+    };
+    // User agent entropy
+    // This function takes the user agent string, and then xors
+    // together each sequence of 8 bytes.  This produces a final
+    // sequence of 8 bytes which it returns as hex.
+    var UA = function () {
+        var ua = navigator.userAgent, i, ch, buffer = [], ret = 0;
+        function xor(result, byte_array) {
+            var j, tmp = 0;
+            for (j = 0; j < byte_array.length; j++) {
+                tmp |= buffer[j] << (j * 8);
+            }
+            return result ^ tmp;
+        }
+        for (i = 0; i < ua.length; i++) {
+            ch = ua.charCodeAt(i);
+            buffer.unshift(ch & 0xff);
+            if (buffer.length >= 4) {
+                ret = xor(ret, buffer);
+                buffer = [];
+            }
+        }
+        if (buffer.length > 0) {
+            ret = xor(ret, buffer);
+        }
+        return ret.toString(16);
+    };
+    var se = (screen.height * screen.width).toString(16);
+    return T() + '-' + R() + '-' + UA() + '-' + se + '-' + T(); // no i18n
+}
+
+export { BREAKER, cloneMapExcludingKeys, cloneObject, compareTwoObjects, each, getNewUUID, includes, isEmpty, isEmptyObj, isSuccess, nowMs, objectsAreEqual, sizeof };

package/dist/esm/core/validate.d.ts

@@ -0,0 +1,18 @@
+import type { Dict, Properties, UserValidationResult } from '../types.js';
+export declare function validateEventOrGroup(str: string | null | undefined): boolean;
+/**
+ * Event, screen and error properties as the payload carries them: `{ data, datatype, isvalid }`.
+ *
+ * Each property is judged on its own, as on Android: a bad key (wrong characters, too long, the
+ * reserved ap_ prefix) or a value over 250 characters drops that property, and the rest are kept
+ * and the event is still logged. Past 24 properties, or 7,666 characters in all, the later ones are
+ * dropped. When nothing valid is left the result says why, in the shape the server has always taken
+ * for a refused set: `{ isvalid: false, message: { code, keys, valuekeys } }`.
+ */
+export declare function validateJSON(jsonObj: Properties | Dict | null | undefined): Dict;
+/** user/register accepts at most 10000 characters of body (max-len on its inputstream). */
+export declare const USER_PROPERTIES_MAX_LENGTH = 10000;
+/** user/register accepts at most this many user properties. */
+export declare const USER_PROPERTIES_MAX_COUNT = 45;
+export declare function userValidateJSON(obj: Dict): UserValidationResult;
+export declare function validateScreenName(str: string | null | undefined): boolean;