@zoho_apptics/apptics-js-sdk 1.0.2 → 2.0.0-beta

package/dist/cjs/core/batch.js

@@ -0,0 +1,115 @@
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+'use strict';
+
+var state = require('./state.js');
+var logger = require('./logger.js');
+var utils = require('./utils.js');
+require('./constants.js');
+var consent = require('./consent.js');
+var attempts = require('./attempts.js');
+var transport = require('./transport.js');
+
+/** Retries `send` in 500 ms, replacing any retry already scheduled. */
+function defer(send) {
+    if (state._ZAP._deferSendTimer) {
+        clearTimeout(state._ZAP._deferSendTimer);
+    }
+    state._ZAP._deferSendTimer = setTimeout(send, 500);
+}
+function clearDefer() {
+    if (state._ZAP._deferSendTimer) {
+        clearTimeout(state._ZAP._deferSendTimer);
+        state._ZAP._deferSendTimer = null;
+    }
+}
+/** Only one tab sends a queue at a time. Without the Web Locks API, runs directly (1.x behaviour). */
+function withSendLock(name, run) {
+    var locks = typeof navigator !== 'undefined' ? navigator.locks : undefined; // no i18n
+    if (!locks || typeof locks.request !== 'function') { // no i18n
+        return run();
+    }
+    return locks.request('apptics-send-' + name, { ifAvailable: true }, function (lock) {
+        return lock ? run() : undefined;
+    }).then(function () { return undefined; });
+}
+/**
+ * The batch to send: closed items within batch_request_timeout days.
+ * Expired items are removed from the queue without being sent.
+ */
+function freshItems(queue, isClosed, timeOf) {
+    return queue.payload().then(function (items) {
+        var fresh = [];
+        var expired = [];
+        items.forEach(function (item) {
+            if (!isClosed(item)) {
+                return;
+            }
+            (state.isExpired(timeOf(item)) ? expired : fresh).push(item);
+        });
+        return expired.length ? queue.remove(expired).then(function () { return fresh; }) : fresh;
+    });
+}
+/**
+ * Sends one batch of queued items. Resolves only when the server has accepted it, so the caller
+ * removes the items then and not before: a batch that fails stays queued and goes again on the
+ * next pass, as attempt 2, which `attempt` and `firstattempttime` let the server recognise as a
+ * copy rather than store twice.
+ *
+ * With `forget` (the page is closing) it goes by keepalive, and the promise settles if the answer
+ * arrives before the page is gone. See postKeepalive.
+ *
+ * Five attempts is the cap, because `attempt` is declared regex="[1-5]" and a sixth would be
+ * refused for the param rather than for the payload.
+ */
+function sendBatch(path, label, _payload, forget) {
+    var blocked = transport.rejectIfDisabled(label);
+    if (blocked) {
+        return blocked;
+    }
+    if (!consent.shouldTrackOrSendData()) {
+        return Promise.reject(label + ': tracking is off'); // no i18n
+    }
+    if (utils.isEmptyObj(_payload)) {
+        return Promise.reject(label + ': nothing to send'); // no i18n
+    }
+    var missing = transport.rejectIfNoDeviceIds(label);
+    if (missing) {
+        return missing;
+    }
+    if (!_payload.hasOwnProperty('meta')) { // no i18n
+        _payload.meta = transport.getMetaObj();
+    }
+    if (attempts.attemptsExhausted(path)) {
+        // five passes without a confirmed landing. Keeping it would block every later batch
+        // behind a payload the proxy will now refuse for its attempt number alone
+        logger.warnAlways('apptics: dropping a ' + label + ' batch after ' + attempts.MAX_ATTEMPTS + ' attempts'); // no i18n
+        attempts.resetAttempts(path);
+        return Promise.resolve({ result: 'success' }); // no i18n
+    }
+    logger.Console.log(label + ': Payload size : ' + (utils.sizeof(_payload) / 1024)); // no i18n
+    var body = JSON.stringify(_payload);
+    return forget
+        ? transport.postKeepalive(path, body, transport.apiHeaders(), label)
+        : transport.postToApptics(path, body, transport.apiHeaders(), label);
+}
+/**
+ * Hands a send's outcome back to a sender. Normally the sender waits for it. While the page
+ * closes it does not: the request is already out, and waiting would hold the next queue's send
+ * until after the page has gone. The outcome is still handled whenever it arrives.
+ */
+function awaitUnlessClosing(landed, forget, label) {
+    if (!forget) {
+        return landed.then(function () { return undefined; });
+    }
+    landed.catch(function (err) {
+        logger.Console.log(label + ': not confirmed before the page closed, kept for the next send: ' + String(err)); // no i18n
+    });
+    return undefined;
+}
+
+exports.awaitUnlessClosing = awaitUnlessClosing;
+exports.clearDefer = clearDefer;
+exports.defer = defer;
+exports.freshItems = freshItems;
+exports.sendBatch = sendBatch;
+exports.withSendLock = withSendLock;

package/dist/cjs/core/callsite.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Where a log line was raised, for logSDK's `filename` and `linenumber`.
+ *
+ * There is no caller introspection in a browser, so the only way to answer "which line was this"
+ * is to throw an Error nobody catches and read its stack. That is cheap enough for a channel that
+ * only carries the SDK's own failures, but it is never on the app's path: everything here is
+ * wrapped so a stack we cannot parse costs a line its call site and nothing more.
+ */
+export interface CallSite {
+    /** The script's basename, not its url: logSDK caps filename at 100 characters. */
+    filename: string;
+    /** 0 when the stack gave us nothing — see entryFor() for why it is still sent. */
+    linenumber: number;
+    /** The calling function's name, when the frame has one. Anonymous callers have none. */
+    fn?: string;
+}
+export declare const NO_CALL_SITE: CallSite;
+/**
+ * The frame `skip` frames down a stack, counting only the ones that name a file — V8 heads its
+ * stacks with an `Error` line and Firefox does not, so counting raw lines would read a different
+ * frame in each browser.
+ */
+export declare function callSiteFromStack(stack: string | undefined, skip: number): CallSite;
+/**
+ * Where the caller `skip` levels above this call sits. `skip` is 0 for this function's own
+ * caller; each wrapper between that caller and the place worth reporting adds one.
+ */
+export declare function callSite(skip: number): CallSite;

package/dist/cjs/core/callsite.js

@@ -0,0 +1,93 @@
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+'use strict';
+
+/**
+ * Where a log line was raised, for logSDK's `filename` and `linenumber`.
+ *
+ * There is no caller introspection in a browser, so the only way to answer "which line was this"
+ * is to throw an Error nobody catches and read its stack. That is cheap enough for a channel that
+ * only carries the SDK's own failures, but it is never on the app's path: everything here is
+ * wrapped so a stack we cannot parse costs a line its call site and nothing more.
+ */
+const NO_CALL_SITE = { filename: '', linenumber: 0, fn: '' };
+/** logSDK declares max-len="100" on filename. */
+const FILENAME_MAX = 100;
+/**
+ * The file and line out of one stack frame, in either shape a browser produces:
+ *   V8:              `    at doThing (https://host/app.js:12:34)`
+ *   Firefox/Safari:  `doThing@https://host/app.js:12:34`
+ * Both end in `:line:column`, which is the only part that is the same everywhere, so the match is
+ * anchored there and the column is read only so that it can be thrown away — without it the
+ * pattern would take the column for the line.
+ */
+const FRAME = /([^\s(@]+):(\d+):(\d+)\)?$/;
+/** `https://host/path/app.js?v=2` -> `app.js`. The url would not fit in 100 characters. */
+function basename(url) {
+    var path = url.split(/[?#]/)[0] || url;
+    var parts = path.split('/');
+    return (parts[parts.length - 1] || path).slice(0, FILENAME_MAX);
+}
+/**
+ * The function a frame names, in either shape:
+ *   V8:              `at doThing (` — or `at async doThing (`
+ *   Firefox/Safari:  `doThing@`
+ * A frame without one (`at https://…` or `@https://…`) is an anonymous caller, and gets ''.
+ */
+const FRAME_FN_V8 = /^at\s+(?:async\s+)?(.+?)\s+\(/;
+const FRAME_FN_OTHER = /^([^@\s]+)@/;
+function frameFunction(frame) {
+    var match = FRAME_FN_V8.exec(frame) || FRAME_FN_OTHER.exec(frame);
+    return match ? (match[1] || '') : ''; // no i18n
+}
+function parseFrame(line) {
+    var trimmed = line.trim();
+    var match = FRAME.exec(trimmed);
+    if (match === null) {
+        return null;
+    }
+    var line_no = Number(match[2]);
+    if (!isFinite(line_no)) {
+        return null;
+    }
+    return { filename: basename(match[1] || ''), linenumber: line_no, fn: frameFunction(trimmed) };
+}
+/**
+ * The frame `skip` frames down a stack, counting only the ones that name a file — V8 heads its
+ * stacks with an `Error` line and Firefox does not, so counting raw lines would read a different
+ * frame in each browser.
+ */
+function callSiteFromStack(stack, skip) {
+    if (!stack) {
+        return NO_CALL_SITE;
+    }
+    var lines = stack.split('\n');
+    var seen = 0;
+    for (var i = 0; i < lines.length; i++) {
+        var frame = parseFrame(lines[i] || '');
+        if (frame === null) {
+            continue;
+        }
+        if (seen++ < skip) {
+            continue;
+        }
+        return frame;
+    }
+    return NO_CALL_SITE;
+}
+/**
+ * Where the caller `skip` levels above this call sits. `skip` is 0 for this function's own
+ * caller; each wrapper between that caller and the place worth reporting adds one.
+ */
+function callSite(skip) {
+    try {
+        // +1 for this function's own frame, which is never the answer
+        return callSiteFromStack(new Error().stack, skip + 1);
+    }
+    catch (err) {
+        return NO_CALL_SITE;
+    }
+}
+
+exports.NO_CALL_SITE = NO_CALL_SITE;
+exports.callSite = callSite;
+exports.callSiteFromStack = callSiteFromStack;

package/dist/cjs/core/consent.d.ts

@@ -0,0 +1,23 @@
+import type { TrackingStatus } from '../types.js';
+/** DNT counts only when not ignored; when it counts, tracking switches to NO_TRACKING. */
+export declare function hasDoNotTrackEnabled(): boolean;
+export declare function opt_in_status(): TrackingStatus;
+export declare function shouldTrackOrSendData(): boolean;
+/**
+ * The guard every tracking call starts with: init() has run, the client isn't a crawler,
+ * and consent / server flags allow tracking.
+ */
+export declare function canTrack(caller: string): boolean;
+/** canTrack plus the server's `engagementtracking` flag from getupdates (events, screens, sessions, api calls). */
+export declare function canTrackEngagement(caller: string): boolean;
+/**
+ * canTrack plus the server's heatmap flag (getsdkconfig module 18).
+ *
+ * Heatmap rode the engagement flag until v2 gave it one of its own, which matters: an app may
+ * well want events while declining to have every click's coordinates recorded.
+ */
+export declare function canTrackHeatmap(caller: string): boolean;
+/** canTrack plus the server's `errortracking` flag from getupdates. */
+export declare function canTrackErrors(caller: string): boolean;
+export declare function setTrackingStatus(trackingState: TrackingStatus): void;
+export declare function getTrackingStatus(): TrackingStatus;

package/dist/cjs/core/consent.js

@@ -0,0 +1,130 @@
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+'use strict';
+
+var constants = require('./constants.js');
+var state = require('./state.js');
+var logger = require('./logger.js');
+var utils = require('./utils.js');
+var storage = require('./storage.js');
+var env = require('./env.js');
+var hooks = require('./hooks.js');
+
+/** DNT counts only when not ignored; when it counts, tracking switches to NO_TRACKING. */
+function hasDoNotTrackEnabled() {
+    if (state._ZAP._ignoreDnt) {
+        return false;
+    }
+    if (env.isDntOn()) {
+        logger.Console.warn('hasDoNotTrackEnabled: DoNotTrack is enabled'); // no i18n
+        setTrackingStatus(constants.AP_TRACKING_STATUS.NO_TRACKING);
+        logger.Console.log('hasDoNotTrackEnabled: Setting tracking status to NO_TRACKING'); // no i18n
+        return true;
+    }
+    return false;
+}
+function opt_in_status() {
+    if (hasDoNotTrackEnabled()) {
+        logger.Console.warn('opt_in_status: It seems "Do Not Track" is enabled in this browser. Please enable tracking in the browser settings to continue tracking.'); // no i18n
+        return constants.AP_TRACKING_STATUS.NO_TRACKING;
+    }
+    var status = storage.tracking_preference.opt_in_status();
+    if (status == -1) {
+        logger.Console.warn('opt_in_status: You are opted out of Apptics tracking. This will prevent the our SDK from sending no data to our server.'); // no i18n
+    }
+    return status;
+}
+function shouldTrackOrSendData() {
+    var optInStatus = opt_in_status();
+    return optInStatus > -1 && state._ZAP._shouldTrack;
+}
+/**
+ * The guard every tracking call starts with: init() has run, the client isn't a crawler,
+ * and consent / server flags allow tracking.
+ */
+function canTrack(caller) {
+    if (!state._ZAP._token) {
+        logger.Console.warn('apptics.' + caller + ': You must call apptics.init() first'); // no i18n
+        return false;
+    }
+    if (env.is_apptics_disabled()) {
+        return false;
+    }
+    return shouldTrackOrSendData();
+}
+/** canTrack plus the server's `engagementtracking` flag from getupdates (events, screens, sessions, api calls). */
+function canTrackEngagement(caller) {
+    if (!canTrack(caller)) {
+        return false;
+    }
+    if (!state._ZAP._engagementTracking) {
+        logger.Console.log('apptics.' + caller + ': engagement tracking is turned off by the server'); // no i18n
+        return false;
+    }
+    return true;
+}
+/**
+ * canTrack plus the server's heatmap flag (getsdkconfig module 18).
+ *
+ * Heatmap rode the engagement flag until v2 gave it one of its own, which matters: an app may
+ * well want events while declining to have every click's coordinates recorded.
+ */
+function canTrackHeatmap(caller) {
+    if (!canTrack(caller)) {
+        return false;
+    }
+    if (!state._ZAP._heatmapTracking) {
+        logger.Console.log('apptics.' + caller + ': heatmap tracking is turned off by the server'); // no i18n
+        return false;
+    }
+    return true;
+}
+/** canTrack plus the server's `errortracking` flag from getupdates. */
+function canTrackErrors(caller) {
+    if (!canTrack(caller)) {
+        return false;
+    }
+    if (!state._ZAP._errorTracking) {
+        logger.Console.log('apptics.' + caller + ': error tracking is turned off by the server'); // no i18n
+        return false;
+    }
+    return true;
+}
+function setTrackingStatus(trackingState) {
+    if (utils.isEmpty(trackingState)) {
+        logger.Console.warn('setTrackingStatus: trackingStatus is Empty'); // no i18n
+        return;
+    }
+    if (storage.tracking_preference.opt_in_status() == trackingState) {
+        return;
+    }
+    storage.tracking_preference.update_status(trackingState);
+    state._ZAP._devicestatus = storage.tracking_preference.opt_in_status();
+    state._ZAP._isanonrequired = storage.tracking_preference.opt_in_status() == constants.AP_TRACKING_STATUS.USAGE_TRACKING_WITH_PII ? false : state._ZAP._isanonrequired;
+    if (storage.tracking_preference.opt_in_status() != constants.AP_TRACKING_STATUS.NO_TRACKING) {
+        logger.Console.log('setTrackingStatus: Updating device info with new tracking status'); // no i18n
+        hooks.hooks.updateDevice(state._ZAP._device_info).then(function (result) {
+            if (utils.isSuccess(result)) {
+                logger.Console.log('setTrackingStatus: Device info updated with new tracking status' + JSON.stringify(result.data)); // no i18n
+                logger.Console.dir(result.data);
+            }
+            else {
+                logger.Console.log('setTrackingStatus: Error updating device info with new tracking status: ' + JSON.stringify(result)); // no i18n
+            }
+        }).catch(function (err) {
+            logger.Console.warn('setTrackingStatus: Error updating device info with new tracking status: ' + JSON.stringify(err)); // no i18n
+        });
+    }
+}
+function getTrackingStatus() {
+    return opt_in_status();
+}
+
+exports.canTrack = canTrack;
+exports.canTrackEngagement = canTrackEngagement;
+exports.canTrackErrors = canTrackErrors;
+exports.canTrackHeatmap = canTrackHeatmap;
+exports.getTrackingStatus = getTrackingStatus;
+exports.hasDoNotTrackEnabled = hasDoNotTrackEnabled;
+exports.opt_in_status = opt_in_status;
+exports.setTrackingStatus = setTrackingStatus;
+exports.shouldTrackOrSendData = shouldTrackOrSendData;

package/dist/cjs/core/constants.d.ts

@@ -0,0 +1,212 @@
+export declare const AP_TRACKING_STATUS: Readonly<{
+    readonly USAGE_TRACKING_WITH_PII: 1;
+    readonly USAGE_TRACKING_WITHOUT_PII: 4;
+    readonly NO_TRACKING: -1;
+}>;
+export declare const AP_FEEDBACK_TYPE: Readonly<{
+    readonly BUG: 0;
+    readonly FEEDBACK: 1;
+    readonly HELP: 2;
+    readonly REPORT: 3;
+}>;
+export declare const AP_CONSTANTS: Readonly<{
+    readonly SCREEN: "screen";
+    readonly SESSION: "session";
+    readonly EVENT: "event";
+    readonly API: "api";
+    readonly ERROR: "error";
+    readonly SUCCESS: "success";
+    readonly BROWSER: "Browser";
+}>;
+export declare const DEFAULT_API_PATHS: Readonly<{
+    readonly addversion: "app/addversion";
+    readonly regdevice: "device/add";
+    readonly reguser: "user/register";
+    readonly engagement: "engagement/add";
+    readonly error: "exception/error";
+    readonly feedback: "feedback/add";
+    readonly sdkconfig: "getsdkconfig";
+    readonly getupdates: "getupdates";
+    readonly consolelog: "log/add";
+    readonly heatmap: "heatmap/add";
+}>;
+/**
+ * Which API version each path lives under.
+ *
+ * Every path the SDK calls is defined under v2 in the proxy's security-sdk.xml, and four of them —
+ * app/addversion, getsdkconfig, heatmap/add and log/add — are defined there *only* under v2: there
+ * is no v1 url for them to fall back to, so sending v1 reaches nothing. It stays a per-path map
+ * rather than one shared prefix because v1 urls do still exist for the other five, so a path can
+ * be moved back on its own if one of them turns out not to be ready.
+ */
+export declare const API_VERSIONS: Readonly<Record<keyof typeof DEFAULT_API_PATHS, string>>;
+/**
+ * The SDK subsystem a remote log line is about, as console/addlog's `module` param.
+ * These are the server's own names, so they are sent exactly as written here.
+ */
+export declare const AP_LOG_MODULE: Readonly<{
+    readonly SESSION: "Session";
+    readonly SCREEN: "Screen";
+    readonly EVENT: "Event";
+    readonly API: "API";
+    readonly HEATMAP: "Heatmap";
+    readonly PROPERTIES: "Properties";
+}>;
+/**
+ * The modules getsdkconfig reports on, by the ids it keys them with. The SDK acts on the ones it
+ * has something to switch off; anything else the server sends is stored but unused.
+ */
+export declare const SDK_MODULE: Readonly<{
+    /**
+     * Remote config. It is the one module both answers report on: getupdates names it in
+     * `moduleids` and reports its flag back, and getsdkconfig reports the same flag as the
+     * authority. Where they disagree, getsdkconfig wins.
+     */
+    readonly REMOTE_CONFIG: "2";
+    readonly SESSION: "11";
+    readonly FEEDBACK: "12";
+    readonly CRASH: "13";
+    readonly REMOTE_LOGGER: "17";
+    readonly HEATMAP: "18";
+}>;
+/** logSDK declares max-len="10000" on logmessage, so a line is trimmed to fit that. */
+export declare const CONSOLE_LOG_MAX_BODY = 10000;
+/** logSDK caps `function` at 100 characters. */
+export declare const LOG_FUNCTION_MAX = 100;
+/** logSDK caps `filename` at 100 too, which is why a call site carries a basename, not a url. */
+export declare const LOG_FILENAME_MAX = 100;
+/**
+ * How much of `devicename` is sent. The url declares no max-len, only safe_string, but this is a
+ * label a person reads in a list: anything longer is a paragraph, not a name.
+ */
+export declare const DEVICE_NAME_MAX = 100;
+/**
+ * The `level` every line goes out with. Everything the remote logger carries is a failure inside
+ * the SDK — logFailure is its only caller — so the level never varies. 3 is what the v2 reference
+ * shows in its only example; the scale itself is not documented anywhere we can see.
+ */
+export declare const REMOTE_LOG_LEVEL = 3;
+/**
+ * How long debug mode survives with nothing tracked, before switching itself off.
+ *
+ * An hour is long enough to cover reading a payload, changing the app and reloading, and short
+ * enough that a tab left open overnight is not still sending every call to its debug twin.
+ */
+export declare const DEBUG_IDLE_MS: number;
+/** Idle minutes that end a session. Lives on state, not in _config, but defaults here. */
+export declare const DEFAULT_INACTIVE_MINUTES = 30;
+/** Global defaults. `state._config` holds a mutable copy per init. */
+export declare const AP_CONFIG: Readonly<{
+    endpoint: "/sdk/web/";
+    method: "POST";
+    transport: "XHR";
+    track_link_timeout: 300;
+    cookie_expiration_days: 365;
+    storage_type: "localStorage";
+    enable_batch_requests: true;
+    batch_size: 50;
+    batch_flush_interval: 30000;
+    getupdates_interval: 120000;
+    batch_request_timeout: 7;
+    auto_starts_batch: true;
+    mode: 1;
+    default_group_name: "default";
+    default_optin_status: number;
+    enable_pageview_tracking: false;
+    save_referrer: true;
+    debug: boolean;
+    track_by_default: true;
+    ignore_do_not_track: boolean;
+    remote_log: boolean;
+    /**
+     * Wrap XHR and fetch to record the app's API calls without it calling startTrackApi(). Off by
+     * default: the hostnames and paths of every request an app makes is a wider grant than events
+     * and screens, so the app opts in.
+     */
+    track_api: boolean;
+    /**
+     * Record a screen view for the first page and every navigation after it, from the url. On by
+     * default; the app's own inScreen() during a navigation replaces that navigation's view.
+     */
+    track_screen: boolean;
+    /**
+     * Print each app logger line to the browser console as well, as Android's showLogs prints to
+     * Logcat. Off by default; console_log is the SDK's own activity, this is the app's lines.
+     */
+    show_logs: boolean;
+    /**
+     * Record sessions automatically. On by default; false is Android's
+     * automaticSessionsTrackingStatus = false: no sessions, while events and screens still are.
+     */
+    track_session: boolean;
+    /**
+     * How long a visit must last before its session is stored, in milliseconds. A shorter visit with
+     * nothing tracked in it is dropped: a bounce or a crawler is not a session. Anything tracked
+     * inside the window writes the session immediately, keeping its original start time. 0 disables
+     * the wait and stores every session as it starts.
+     */
+    min_session_duration: number;
+    /**
+     * Record where people click and how far they scroll, for the console's heatmaps. Off by default:
+     * coordinates and element labels are a wider grant than events and screens, so the app opts in.
+     */
+    track_heatmap: boolean;
+    /**
+     * Send engagement, exception and log payloads to their `debug/` twins, which answer with a
+     * request id and a link to the server's own logs for that request. For tracing a payload that
+     * is not showing up in the console; off in normal use, and it does not change what is sent.
+     */
+    debug_api: boolean;
+    /**
+     * What to call this device in the debug stream. Engagement, exception and log are the three
+     * urls that declare `devicename`, and it is what tells one tester's browser from another's
+     * when several are tracing the same build. Empty by default: it rides on every one of those
+     * calls, so an app that is not tracing should not pay for it. With `debug_api` on and nothing
+     * set here, a label is derived from the browser and OS instead, since an unnamed row in the
+     * debug stream is no use to whoever is reading it.
+     */
+    device_name: string;
+    /**
+     * Most heatmap records one visit may produce. Clicks are cheap, but a page that scrolls a lot
+     * can produce them faster than they are sent, and an unbounded queue is a memory leak on a tab
+     * left open for a day. Reached, capture stops for the rest of the session.
+     */
+    heatmap_max_per_session: number;
+}>;
+export type ApConfig = {
+    -readonly [K in keyof typeof AP_CONFIG]: (typeof AP_CONFIG)[K];
+};
+/**
+ * Config keys `init()` refuses to start without (after the snippet aliases are resolved).
+ *
+ * `appversion` is here rather than defaulted on purpose. Every error, every device registration
+ * and every uploaded source map is only meaningful against the build it came from, and a default
+ * would answer that question wrongly and silently for every app that forgot to set it.
+ */
+/**
+ * What init() must be given. Everything else the SDK needs — aaid, the portal and project ids that
+ * go in every url — comes back from app/addversion, which these four are enough to call.
+ */
+export declare const REQUIRED_CONFIG: readonly ["serviceUrl", "zak", "identifier", "appversion"];
+/**
+ * Paths with a `debug/` twin. The debug endpoints take the same body and answer with a request id
+ * and a link to the server-side logs for that request, which is how a payload is traced end to
+ * end when the console does not show what was expected.
+ */
+export declare const DEBUG_CAPABLE_PATHS: Readonly<Record<string, boolean>>;
+/**
+ * Paths that declare `attempt`, `firstattempttime` and `lst`.
+ *
+ * Every url that carries data declares all three. app/addversion and getsdkconfig declare none:
+ * they are start-up calls whose answers the SDK needs, not payloads it is pushing, and sending
+ * an undeclared param is refused outright as EXTRA_PARAM_FOUND.
+ */
+export declare const RETRY_CAPABLE_PATHS: Readonly<Record<string, boolean>>;
+/**
+ * Paths that live directly under the version, with no org and project segments. app/addversion is
+ * called before those ids are known, so it cannot carry them.
+ */
+export declare const PATHS_WITHOUT_ORG: Readonly<Record<string, boolean>>;
+/** Console-snippet names accepted for the canonical keys above. */
+export declare const CONFIG_ALIASES: Readonly<Record<string, string>>;
+export declare const BLOCKED_WS: readonly string[];