@zoho_apptics/apptics-js-sdk 1.0.2 → 2.0.0-beta.1

package/dist/esm/core/consent.js

@@ -0,0 +1,122 @@
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta.1 | (c) Zoho Corporation Private Limited | see LICENSE */
+import { AP_TRACKING_STATUS } from './constants.js';
+import { _ZAP } from './state.js';
+import { Console } from './logger.js';
+import { isEmpty, isSuccess } from './utils.js';
+import { tracking_preference } from './storage.js';
+import { is_apptics_disabled, isDntOn } from './env.js';
+import { hooks } from './hooks.js';
+
+/**
+ * DNT counts only when not ignored; while it counts, tracking is NO_TRACKING (opt_in_status).
+ * Decided on every visit and never stored: storing it made one visit with DNT on look like the
+ * visitor's own choice, so tracking stayed off after DNT was turned off or ignore_do_not_track set.
+ */
+function hasDoNotTrackEnabled() {
+    if (_ZAP._ignoreDnt) {
+        return false;
+    }
+    if (isDntOn()) {
+        Console.warn('hasDoNotTrackEnabled: DoNotTrack is enabled, so nothing is tracked'); // no i18n
+        return true;
+    }
+    return false;
+}
+function opt_in_status() {
+    if (hasDoNotTrackEnabled()) {
+        Console.warn('opt_in_status: It seems "Do Not Track" is enabled in this browser. Please enable tracking in the browser settings to continue tracking.'); // no i18n
+        return AP_TRACKING_STATUS.NO_TRACKING;
+    }
+    var status = tracking_preference.opt_in_status();
+    if (status == -1) {
+        Console.warn('opt_in_status: You are opted out of Apptics tracking. This will prevent the our SDK from sending no data to our server.'); // no i18n
+    }
+    return status;
+}
+function shouldTrackOrSendData() {
+    var optInStatus = opt_in_status();
+    return optInStatus > -1 && _ZAP._shouldTrack;
+}
+/**
+ * The guard every tracking call starts with: init() has run, the client isn't a crawler,
+ * and consent / server flags allow tracking.
+ */
+function canTrack(caller) {
+    if (!_ZAP._token) {
+        Console.warn('apptics.' + caller + ': You must call Apptics.init() first'); // no i18n
+        return false;
+    }
+    if (is_apptics_disabled()) {
+        return false;
+    }
+    return shouldTrackOrSendData();
+}
+/** canTrack plus the server's `engagementtracking` flag from getupdates (events, screens, sessions, api calls). */
+function canTrackEngagement(caller) {
+    if (!canTrack(caller)) {
+        return false;
+    }
+    if (!_ZAP._engagementTracking) {
+        Console.log('apptics.' + caller + ': engagement tracking is turned off by the server'); // no i18n
+        return false;
+    }
+    return true;
+}
+/**
+ * canTrack plus the server's heatmap flag (getsdkconfig module 18).
+ *
+ * Heatmap rode the engagement flag until v2 gave it one of its own, which matters: an app may
+ * well want events while declining to have every click's coordinates recorded.
+ */
+function canTrackHeatmap(caller) {
+    if (!canTrack(caller)) {
+        return false;
+    }
+    if (!_ZAP._heatmapTracking) {
+        Console.log('apptics.' + caller + ': heatmap tracking is turned off by the server'); // no i18n
+        return false;
+    }
+    return true;
+}
+/** canTrack plus the server's `errortracking` flag from getupdates. */
+function canTrackErrors(caller) {
+    if (!canTrack(caller)) {
+        return false;
+    }
+    if (!_ZAP._errorTracking) {
+        Console.log('apptics.' + caller + ': error tracking is turned off by the server'); // no i18n
+        return false;
+    }
+    return true;
+}
+function setTrackingStatus(trackingState) {
+    if (isEmpty(trackingState)) {
+        Console.warn('setTrackingStatus: trackingStatus is Empty'); // no i18n
+        return;
+    }
+    if (tracking_preference.opt_in_status() == trackingState) {
+        return;
+    }
+    tracking_preference.update_status(trackingState);
+    _ZAP._devicestatus = tracking_preference.opt_in_status();
+    _ZAP._isanonrequired = tracking_preference.opt_in_status() == AP_TRACKING_STATUS.USAGE_TRACKING_WITH_PII ? false : _ZAP._isanonrequired;
+    if (tracking_preference.opt_in_status() != AP_TRACKING_STATUS.NO_TRACKING) {
+        Console.log('setTrackingStatus: Updating device info with new tracking status'); // no i18n
+        hooks.updateDevice(_ZAP._device_info).then(function (result) {
+            if (isSuccess(result)) {
+                Console.log('setTrackingStatus: Device info updated with new tracking status' + JSON.stringify(result.data)); // no i18n
+                Console.dir(result.data);
+            }
+            else {
+                Console.log('setTrackingStatus: Error updating device info with new tracking status: ' + JSON.stringify(result)); // no i18n
+            }
+        }).catch(function (err) {
+            Console.warn('setTrackingStatus: Error updating device info with new tracking status: ' + JSON.stringify(err)); // no i18n
+        });
+    }
+}
+function getTrackingStatus() {
+    return opt_in_status();
+}
+
+export { canTrack, canTrackEngagement, canTrackErrors, canTrackHeatmap, getTrackingStatus, hasDoNotTrackEnabled, opt_in_status, setTrackingStatus, shouldTrackOrSendData };

package/dist/esm/core/constants.d.ts

@@ -0,0 +1,237 @@
+/**
+ * A screen_routes entry as init() keeps it, ready to match: a route pattern, or an exact path or a
+ * regular expression with the name it records.
+ */
+export type ScreenRouteRule = {
+    kind: 'pattern';
+    pattern: string;
+} | {
+    kind: 'equals';
+    path: string;
+    name: string;
+} | {
+    kind: 'regex';
+    regex: RegExp;
+    name: string;
+};
+export declare const AP_TRACKING_STATUS: Readonly<{
+    readonly USAGE_TRACKING_WITH_PII: 1;
+    readonly USAGE_TRACKING_WITHOUT_PII: 4;
+    readonly NO_TRACKING: -1;
+}>;
+export declare const AP_FEEDBACK_TYPE: Readonly<{
+    readonly BUG: 0;
+    readonly FEEDBACK: 1;
+    readonly HELP: 2;
+    readonly REPORT: 3;
+}>;
+export declare const AP_CONSTANTS: Readonly<{
+    readonly SCREEN: "screen";
+    readonly SESSION: "session";
+    readonly EVENT: "event";
+    readonly API: "api";
+    readonly ERROR: "error";
+    readonly SUCCESS: "success";
+    readonly BROWSER: "Browser";
+}>;
+export declare const DEFAULT_API_PATHS: Readonly<{
+    readonly addversion: "app/addversion";
+    readonly regdevice: "device/add";
+    readonly reguser: "user/register";
+    readonly engagement: "engagement/add";
+    readonly error: "exception/error";
+    readonly feedback: "feedback/add";
+    readonly sdkconfig: "getsdkconfig";
+    readonly getupdates: "getupdates";
+    readonly consolelog: "log/add";
+    readonly heatmap: "heatmap/add";
+}>;
+/**
+ * Which API version each path lives under.
+ *
+ * Every path the SDK calls is defined under v2 in the proxy's security-sdk.xml, and four of them —
+ * app/addversion, getsdkconfig, heatmap/add and log/add — are defined there *only* under v2: there
+ * is no v1 url for them to fall back to, so sending v1 reaches nothing. It stays a per-path map
+ * rather than one shared prefix because v1 urls do still exist for the other five, so a path can
+ * be moved back on its own if one of them turns out not to be ready.
+ */
+export declare const API_VERSIONS: Readonly<Record<keyof typeof DEFAULT_API_PATHS, string>>;
+/**
+ * The SDK subsystem a remote log line is about, as console/addlog's `module` param.
+ * These are the server's own names, so they are sent exactly as written here.
+ */
+export declare const AP_LOG_MODULE: Readonly<{
+    readonly SESSION: "Session";
+    readonly SCREEN: "Screen";
+    readonly EVENT: "Event";
+    readonly API: "API";
+    readonly HEATMAP: "Heatmap";
+    readonly PROPERTIES: "Properties";
+}>;
+/**
+ * The modules getsdkconfig reports on, by the ids it keys them with. The SDK acts on the ones it
+ * has something to switch off; anything else the server sends is stored but unused.
+ */
+export declare const SDK_MODULE: Readonly<{
+    /**
+     * Remote config. It is the one module both answers report on: getupdates names it in
+     * `moduleids` and reports its flag back, and getsdkconfig reports the same flag as the
+     * authority. Where they disagree, getsdkconfig wins.
+     */
+    readonly REMOTE_CONFIG: "2";
+    readonly SESSION: "11";
+    readonly FEEDBACK: "12";
+    readonly CRASH: "13";
+    readonly REMOTE_LOGGER: "17";
+    readonly HEATMAP: "18";
+}>;
+/** logSDK declares max-len="10000" on logmessage, so a line is trimmed to fit that. */
+export declare const CONSOLE_LOG_MAX_BODY = 10000;
+/** logSDK caps `function` at 100 characters. */
+export declare const LOG_FUNCTION_MAX = 100;
+/** logSDK caps `filename` at 100 too, which is why a call site carries a basename, not a url. */
+export declare const LOG_FILENAME_MAX = 100;
+/**
+ * How much of `devicename` is sent. The url declares no max-len, only safe_string, but this is a
+ * label a person reads in a list: anything longer is a paragraph, not a name.
+ */
+export declare const DEVICE_NAME_MAX = 100;
+/**
+ * The `level` every line goes out with. Everything the remote logger carries is a failure inside
+ * the SDK — logFailure is its only caller — so the level never varies. 3 is what the v2 reference
+ * shows in its only example; the scale itself is not documented anywhere we can see.
+ */
+export declare const REMOTE_LOG_LEVEL = 3;
+/**
+ * How long debug mode survives with nothing tracked, before switching itself off.
+ *
+ * An hour is long enough to cover reading a payload, changing the app and reloading, and short
+ * enough that a tab left open overnight is not still sending every call to its debug twin.
+ */
+export declare const DEBUG_IDLE_MS: number;
+/** Idle minutes that end a session. Lives on state, not in _config, but defaults here. */
+export declare const DEFAULT_INACTIVE_MINUTES = 30;
+/** Global defaults. `state._config` holds a mutable copy per init. */
+export declare const AP_CONFIG: Readonly<{
+    endpoint: "/sdk/web/";
+    method: "POST";
+    transport: "XHR";
+    track_link_timeout: 300;
+    cookie_expiration_days: 365;
+    storage_type: "localStorage";
+    enable_batch_requests: true;
+    batch_size: 50;
+    batch_flush_interval: 30000;
+    getupdates_interval: 120000;
+    batch_request_timeout: 7;
+    auto_starts_batch: true;
+    mode: 1;
+    default_group_name: "default";
+    default_optin_status: number;
+    enable_pageview_tracking: false;
+    save_referrer: true;
+    debug: boolean;
+    track_by_default: true;
+    ignore_do_not_track: boolean;
+    /**
+     * Wrap XHR and fetch to record the app's API calls without it calling startTrackApi(). Off by
+     * default: the hostnames and paths of every request an app makes is a wider grant than events
+     * and screens, so the app opts in.
+     */
+    track_api: boolean;
+    /**
+     * Record a screen view for the first page and every navigation after it, from the url. On by
+     * default; the app's own inScreen() during a navigation replaces that navigation's view.
+     */
+    track_screen: boolean;
+    /**
+     * How automatic screen tracking names a path, as init() keeps the config's screen_routes: route
+     * patterns (`/users/{id}/orders`, each id recorded as a star), exact paths and regular
+     * expressions with a name. Tried in order; a path none matches keeps its own name.
+     */
+    screen_routes: ScreenRouteRule[];
+    /**
+     * The feedback form's theme: 'light', 'dark', or 'auto' to follow the visitor's system setting.
+     * 'auto' by default.
+     */
+    feedback_theme: "light" | "dark" | "auto";
+    /**
+     * How long a visit must last before its session is stored, in milliseconds. A shorter visit with
+     * nothing tracked in it is dropped: a bounce or a crawler is not a session. Anything tracked
+     * inside the window writes the session immediately, keeping its original start time. 0 disables
+     * the wait and stores every session as it starts.
+     */
+    min_session_duration: number;
+    /**
+     * Record where people click and how far they scroll, for the console's heatmaps. Off by default:
+     * coordinates and element labels are a wider grant than events and screens, so the app opts in.
+     */
+    track_heatmap: boolean;
+    /**
+     * Send engagement, exception and log payloads to their `debug/` twins, which answer with a
+     * request id and a link to the server's own logs for that request. For tracing a payload that
+     * is not showing up in the console; off in normal use, and it does not change what is sent.
+     */
+    debug_api: boolean;
+    /**
+     * What to call this device in the debug stream. Engagement, exception and log are the three
+     * urls that declare `devicename`, and it is what tells one tester's browser from another's
+     * when several are tracing the same build. Empty by default: it rides on every one of those
+     * calls, so an app that is not tracing should not pay for it. With `debug_api` on and nothing
+     * set here, a label is derived from the browser and OS instead, since an unnamed row in the
+     * debug stream is no use to whoever is reading it.
+     */
+    device_name: string;
+    /**
+     * Most heatmap records one visit may produce. Clicks are cheap, but a page that scrolls a lot
+     * can produce them faster than they are sent, and an unbounded queue is a memory leak on a tab
+     * left open for a day. Reached, capture stops for the rest of the session.
+     */
+    heatmap_max_per_session: number;
+}>;
+export type ApConfig = {
+    -readonly [K in keyof typeof AP_CONFIG]: (typeof AP_CONFIG)[K];
+};
+/**
+ * Config keys `init()` refuses to start without (after the snippet aliases are resolved).
+ *
+ * `appversion` is here rather than defaulted on purpose. Every error, every device registration
+ * and every uploaded source map is only meaningful against the build it came from, and a default
+ * would answer that question wrongly and silently for every app that forgot to set it.
+ */
+/**
+ * What init() must be given. Everything else the SDK needs — aaid, the portal and project ids that
+ * go in every url — comes back from app/addversion, which these four are enough to call.
+ */
+export declare const REQUIRED_CONFIG: readonly ["base_url", "auth_key", "app_domain", "appversion"];
+/**
+ * The init() keys and the names the SDK keeps them under inside (and in app_version_info, which
+ * already-visited browsers have stored): base_url is the host, auth_key the `zak` header, and
+ * app_domain the app's identifier.
+ */
+export declare const CONFIG_KEYS: Readonly<Record<string, string>>;
+/**
+ * Paths with a `debug/` twin. The debug endpoints take the same body and answer with a request id
+ * and a link to the server-side logs for that request, which is how a payload is traced end to
+ * end when the console does not show what was expected.
+ */
+export declare const DEBUG_CAPABLE_PATHS: Readonly<Record<string, boolean>>;
+/**
+ * Paths that declare `attempt`, `firstattempttime` and `lst`.
+ *
+ * Every url that carries data declares all three. app/addversion and getsdkconfig declare none:
+ * they are start-up calls whose answers the SDK needs, not payloads it is pushing, and sending
+ * an undeclared param is refused outright as EXTRA_PARAM_FOUND.
+ */
+export declare const RETRY_CAPABLE_PATHS: Readonly<Record<string, boolean>>;
+/**
+ * Paths that live directly under the version, with no org and project segments. app/addversion is
+ * called before those ids are known, so it cannot carry them.
+ */
+export declare const PATHS_WITHOUT_ORG: Readonly<Record<string, boolean>>;
+/**
+ * Earlier names of the init() keys: 2.0.0-beta's serviceUrl, zak and identifier, and the 1.x
+ * console snippet's base_domain and token. Still read, with a warning naming the key to use.
+ */
+export declare const RETIRED_CONFIG_NAMES: Readonly<Record<string, string>>;
+export declare const BLOCKED_WS: readonly string[];

package/dist/esm/core/constants.js

@@ -0,0 +1,292 @@
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta.1 | (c) Zoho Corporation Private Limited | see LICENSE */
+const AP_TRACKING_STATUS = Object.freeze({
+    USAGE_TRACKING_WITH_PII: 1,
+    USAGE_TRACKING_WITHOUT_PII: 4,
+    NO_TRACKING: -1,
+});
+const AP_FEEDBACK_TYPE = Object.freeze({
+    BUG: 0,
+    FEEDBACK: 1,
+    HELP: 2,
+    REPORT: 3,
+});
+const AP_CONSTANTS = Object.freeze({
+    SCREEN: 'screen', // no i18n
+    SESSION: 'session', // no i18n
+    EVENT: 'event', // no i18n
+    API: 'api', // no i18n
+    ERROR: 'error', // no i18n
+    SUCCESS: 'success', // no i18n
+    BROWSER: 'Browser', // no i18n
+});
+const DEFAULT_API_PATHS = Object.freeze({
+    // the first call: registers the build and answers with the ids every later call needs
+    addversion: 'app/addversion', // no i18n
+    regdevice: 'device/add', // no i18n
+    reguser: 'user/register', // no i18n
+    engagement: 'engagement/add', // no i18n
+    // the exception group is part of the path, and the proxy matches it with [a-z]+ — no
+    // underscore, so js_error cannot route. 'error' is in the accepted set and is what we send
+    error: 'exception/error', // no i18n
+    feedback: 'feedback/add', // no i18n
+    // the source of truth for which modules are on. v2 replaced the old getupdates answer: it is
+    // per-module flags keyed by id now, not loose booleans
+    sdkconfig: 'getsdkconfig', // no i18n
+    // still its own endpoint, and not a synonym for the one above: it takes a body naming the
+    // modules being asked about, and answers with their payloads - remote config among them
+    getupdates: 'getupdates', // no i18n
+    // v2 replaced console/addlog: one call now carries a batch of lines, not one line
+    consolelog: 'log/add', // no i18n
+    heatmap: 'heatmap/add', // no i18n
+});
+/**
+ * Which API version each path lives under.
+ *
+ * Every path the SDK calls is defined under v2 in the proxy's security-sdk.xml, and four of them —
+ * app/addversion, getsdkconfig, heatmap/add and log/add — are defined there *only* under v2: there
+ * is no v1 url for them to fall back to, so sending v1 reaches nothing. It stays a per-path map
+ * rather than one shared prefix because v1 urls do still exist for the other five, so a path can
+ * be moved back on its own if one of them turns out not to be ready.
+ */
+const API_VERSIONS = Object.freeze({
+    addversion: 'v2', // no i18n
+    regdevice: 'v2', // no i18n
+    engagement: 'v2', // no i18n
+    error: 'v2', // no i18n
+    reguser: 'v2', // no i18n
+    feedback: 'v2', // no i18n
+    sdkconfig: 'v2', // no i18n
+    getupdates: 'v2', // no i18n
+    consolelog: 'v2', // no i18n
+    heatmap: 'v2', // no i18n
+});
+/**
+ * The SDK subsystem a remote log line is about, as console/addlog's `module` param.
+ * These are the server's own names, so they are sent exactly as written here.
+ */
+const AP_LOG_MODULE = Object.freeze({
+    SESSION: 'Session', // no i18n
+    SCREEN: 'Screen', // no i18n
+    EVENT: 'Event', // no i18n
+    API: 'API', // no i18n
+    HEATMAP: 'Heatmap', // no i18n
+    PROPERTIES: 'Properties', // no i18n
+});
+/**
+ * The modules getsdkconfig reports on, by the ids it keys them with. The SDK acts on the ones it
+ * has something to switch off; anything else the server sends is stored but unused.
+ */
+const SDK_MODULE = Object.freeze({
+    /**
+     * Remote config. It is the one module both answers report on: getupdates names it in
+     * `moduleids` and reports its flag back, and getsdkconfig reports the same flag as the
+     * authority. Where they disagree, getsdkconfig wins.
+     */
+    REMOTE_CONFIG: '2', // no i18n
+    SESSION: '11', // no i18n
+    FEEDBACK: '12', // no i18n
+    CRASH: '13', // no i18n
+    REMOTE_LOGGER: '17', // no i18n
+    HEATMAP: '18', // no i18n
+});
+/** logSDK declares max-len="10000" on logmessage, so a line is trimmed to fit that. */
+const CONSOLE_LOG_MAX_BODY = 10000;
+/** logSDK caps `function` at 100 characters. */
+const LOG_FUNCTION_MAX = 100;
+/** logSDK caps `filename` at 100 too, which is why a call site carries a basename, not a url. */
+const LOG_FILENAME_MAX = 100;
+/**
+ * How much of `devicename` is sent. The url declares no max-len, only safe_string, but this is a
+ * label a person reads in a list: anything longer is a paragraph, not a name.
+ */
+const DEVICE_NAME_MAX = 100;
+/**
+ * The `level` every line goes out with. Everything the remote logger carries is a failure inside
+ * the SDK — logFailure is its only caller — so the level never varies. 3 is what the v2 reference
+ * shows in its only example; the scale itself is not documented anywhere we can see.
+ */
+const REMOTE_LOG_LEVEL = 3;
+/**
+ * How long debug mode survives with nothing tracked, before switching itself off.
+ *
+ * An hour is long enough to cover reading a payload, changing the app and reloading, and short
+ * enough that a tab left open overnight is not still sending every call to its debug twin.
+ */
+const DEBUG_IDLE_MS = 60 * 60 * 1000;
+/** Idle minutes that end a session. Lives on state, not in _config, but defaults here. */
+const DEFAULT_INACTIVE_MINUTES = 30;
+/** Global defaults. `state._config` holds a mutable copy per init. */
+const AP_CONFIG = Object.freeze({
+    // the version is per path (API_VERSIONS); this is only the part before it
+    endpoint: '/sdk/web/', // no i18n
+    method: 'POST', // no i18n
+    transport: 'XHR', // no i18n
+    track_link_timeout: 300,
+    cookie_expiration_days: 365,
+    storage_type: 'localStorage', // no i18n
+    enable_batch_requests: true,
+    batch_size: 50,
+    batch_flush_interval: 30000,
+    getupdates_interval: 120000, // 2 minutes in milliseconds
+    batch_request_timeout: 7,
+    auto_starts_batch: true,
+    mode: 1,
+    default_group_name: 'default', // no i18n
+    default_optin_status: AP_TRACKING_STATUS.USAGE_TRACKING_WITHOUT_PII,
+    enable_pageview_tracking: false,
+    save_referrer: true,
+    debug: false,
+    track_by_default: true,
+    ignore_do_not_track: false,
+    /**
+     * Wrap XHR and fetch to record the app's API calls without it calling startTrackApi(). Off by
+     * default: the hostnames and paths of every request an app makes is a wider grant than events
+     * and screens, so the app opts in.
+     */
+    track_api: false,
+    /**
+     * Record a screen view for the first page and every navigation after it, from the url. On by
+     * default; the app's own inScreen() during a navigation replaces that navigation's view.
+     */
+    track_screen: true,
+    /**
+     * How automatic screen tracking names a path, as init() keeps the config's screen_routes: route
+     * patterns (`/users/{id}/orders`, each id recorded as a star), exact paths and regular
+     * expressions with a name. Tried in order; a path none matches keeps its own name.
+     */
+    screen_routes: [],
+    /**
+     * The feedback form's theme: 'light', 'dark', or 'auto' to follow the visitor's system setting.
+     * 'auto' by default.
+     */
+    feedback_theme: 'auto',
+    /**
+     * How long a visit must last before its session is stored, in milliseconds. A shorter visit with
+     * nothing tracked in it is dropped: a bounce or a crawler is not a session. Anything tracked
+     * inside the window writes the session immediately, keeping its original start time. 0 disables
+     * the wait and stores every session as it starts.
+     */
+    min_session_duration: 5000,
+    /**
+     * Record where people click and how far they scroll, for the console's heatmaps. Off by default:
+     * coordinates and element labels are a wider grant than events and screens, so the app opts in.
+     */
+    track_heatmap: false,
+    /**
+     * Send engagement, exception and log payloads to their `debug/` twins, which answer with a
+     * request id and a link to the server's own logs for that request. For tracing a payload that
+     * is not showing up in the console; off in normal use, and it does not change what is sent.
+     */
+    debug_api: false,
+    /**
+     * What to call this device in the debug stream. Engagement, exception and log are the three
+     * urls that declare `devicename`, and it is what tells one tester's browser from another's
+     * when several are tracing the same build. Empty by default: it rides on every one of those
+     * calls, so an app that is not tracing should not pay for it. With `debug_api` on and nothing
+     * set here, a label is derived from the browser and OS instead, since an unnamed row in the
+     * debug stream is no use to whoever is reading it.
+     */
+    device_name: '',
+    /**
+     * Most heatmap records one visit may produce. Clicks are cheap, but a page that scrolls a lot
+     * can produce them faster than they are sent, and an unbounded queue is a memory leak on a tab
+     * left open for a day. Reached, capture stops for the rest of the session.
+     */
+    heatmap_max_per_session: 500,
+});
+/**
+ * Config keys `init()` refuses to start without (after the snippet aliases are resolved).
+ *
+ * `appversion` is here rather than defaulted on purpose. Every error, every device registration
+ * and every uploaded source map is only meaningful against the build it came from, and a default
+ * would answer that question wrongly and silently for every app that forgot to set it.
+ */
+/**
+ * What init() must be given. Everything else the SDK needs — aaid, the portal and project ids that
+ * go in every url — comes back from app/addversion, which these four are enough to call.
+ */
+const REQUIRED_CONFIG = Object.freeze(['base_url', 'auth_key', 'app_domain', 'appversion']); // no i18n
+/**
+ * The init() keys and the names the SDK keeps them under inside (and in app_version_info, which
+ * already-visited browsers have stored): base_url is the host, auth_key the `zak` header, and
+ * app_domain the app's identifier.
+ */
+const CONFIG_KEYS = Object.freeze({
+    base_url: 'serviceUrl', // no i18n
+    auth_key: 'zak', // no i18n
+    app_domain: 'identifier', // no i18n
+});
+/**
+ * Paths with a `debug/` twin. The debug endpoints take the same body and answer with a request id
+ * and a link to the server-side logs for that request, which is how a payload is traced end to
+ * end when the console does not show what was expected.
+ */
+const DEBUG_CAPABLE_PATHS = Object.freeze({
+    engagement: true, // no i18n
+    error: true, // no i18n
+    consolelog: true, // no i18n
+});
+/**
+ * Paths that declare `attempt`, `firstattempttime` and `lst`.
+ *
+ * Every url that carries data declares all three. app/addversion and getsdkconfig declare none:
+ * they are start-up calls whose answers the SDK needs, not payloads it is pushing, and sending
+ * an undeclared param is refused outright as EXTRA_PARAM_FOUND.
+ */
+const RETRY_CAPABLE_PATHS = Object.freeze({
+    regdevice: true, // no i18n
+    reguser: true, // no i18n
+    engagement: true, // no i18n
+    error: true, // no i18n
+    heatmap: true, // no i18n
+    consolelog: true, // no i18n
+    feedback: true, // no i18n
+    getupdates: true, // no i18n
+});
+/**
+ * Paths that live directly under the version, with no org and project segments. app/addversion is
+ * called before those ids are known, so it cannot carry them.
+ */
+const PATHS_WITHOUT_ORG = Object.freeze({
+    addversion: true, // no i18n
+});
+/**
+ * Earlier names of the init() keys: 2.0.0-beta's serviceUrl, zak and identifier, and the 1.x
+ * console snippet's base_domain and token. Still read, with a warning naming the key to use.
+ */
+const RETIRED_CONFIG_NAMES = Object.freeze({
+    serviceUrl: 'base_url', // no i18n
+    base_domain: 'base_url', // no i18n
+    zak: 'auth_key', // no i18n
+    token: 'auth_key', // no i18n
+    identifier: 'app_domain', // no i18n
+});
+// crawlers reference
+// https://developers.google.com/search/docs/advanced/crawling/overview-google-crawlers
+const BLOCKED_WS = Object.freeze([
+    'ahrefsbot', // no i18n
+    'ahrefssiteaudit', // no i18n
+    'baiduspider', // no i18n
+    'bingbot', // no i18n
+    'bingpreview', // no i18n
+    'chrome-lighthouse', // no i18n
+    'facebookexternal', // no i18n
+    'petalbot', // no i18n
+    'pinterest', // no i18n
+    'screaming frog', // no i18n
+    'yahoo! slurp', // no i18n
+    'yandexbot', // no i18n
+    'adsbot-google', // no i18n
+    'apis-google', // no i18n
+    'duplexweb-google', // no i18n
+    'feedfetcher-google', // no i18n
+    'google favicon', // no i18n
+    'google web preview', // no i18n
+    'google-read-aloud', // no i18n
+    'googlebot', // no i18n
+    'googleweblight', // no i18n
+    'mediapartners-google', // no i18n
+    'storebot-google', // no i18n
+]);
+
+export { API_VERSIONS, AP_CONFIG, AP_CONSTANTS, AP_FEEDBACK_TYPE, AP_LOG_MODULE, AP_TRACKING_STATUS, BLOCKED_WS, CONFIG_KEYS, CONSOLE_LOG_MAX_BODY, DEBUG_CAPABLE_PATHS, DEBUG_IDLE_MS, DEFAULT_API_PATHS, DEFAULT_INACTIVE_MINUTES, DEVICE_NAME_MAX, LOG_FILENAME_MAX, LOG_FUNCTION_MAX, PATHS_WITHOUT_ORG, REMOTE_LOG_LEVEL, REQUIRED_CONFIG, RETIRED_CONFIG_NAMES, RETRY_CAPABLE_PATHS, SDK_MODULE };