@zoho_apptics/apptics-js-sdk 2.0.0-beta → 2.0.0-beta.2

package/dist/cjs/engagement/api-rules.js

@@ -1,219 +1,206 @@
-/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta.2 | (c) Zoho Corporation Private Limited | see LICENSE */
 'use strict';
 
+var logger = require('../core/logger.js');
+
 /**
- * What API tracking records, and under what name — Android's AppticsApiTracker.configure, built
+ * Which API calls are recorded, and under what name: Android's AppticsApiTracker.configure, built
  * with ApiTrackingBuilder the way user properties are built with UserBuilder:
  *
  *   configureApiTracking(new ApiTrackingBuilder()
- *       .allowOnlyDomains('api.zylker.com', 'api.zylker.in')
- *       .groupDomains('api.zylker.*')
- *       .ignoreEndpoint('/health', '/internal/**')
- *       .addPattern('/v2/catalog/{categoryId}/items/{itemId}')
+ *       .allowRegex(/^https:\/\/api\.zylker\.(com|in)\//)
+ *       .ignoreEquals('https://api.zylker.com/health')
+ *       .ignoreRegex(/\/internal\//)
  *       .build());
  *
- * Two jobs. Filtering decides whether a call is recorded at all: ignore rules first, and they
- * always win, then the allow lists. Normalization decides the path it is recorded under, so that
- * `/users/42/orders` and `/users/43/orders` are one endpoint on the console rather than two: the
- * query string goes, an explicit pattern is used when one matches, and otherwise numeric ids,
- * UUIDs and JWTs become `*`.
+ * Four rules, two kinds by two: an exact URL (equals) or a regular expression (regex), to allow or
+ * to ignore. Each is tried on the call's URL as `scheme://host[:port]/path`, with its query and
+ * fragment removed, so one rule can name a host, a path or a single endpoint. Ignore rules are
+ * tried first and always win; then, when there are allow rules, a call must match one of them.
+ *
+ * The name a call is recorded under is not configured: the query goes, and numeric ids, UUIDs and
+ * JWTs in its path become `*`, so `/users/42/orders` and `/users/43/orders` are one endpoint.
  *
  * Both apply to every call, the ones the fetch/XHR wrappers catch and the ones the app reports
- * with trackApi() or startTrackApi(), so one set of rules decides what the API page shows.
+ * with startTrackApi(), so one set of rules decides what the API page shows.
  */
 function emptyConfig() {
-    return {
-        ignoreDomains: [], allowOnlyDomains: [], allowOnlyTLDs: [], ignoreTLDs: [],
-        ignoreDomainPrefixes: [], ignoreDomainSuffixes: [], groupDomains: [], ignoreEndpoints: [],
-        patterns: [], preserveSegments: [], autoDetection: true,
-    };
+    return { allowEquals: [], ignoreEquals: [], allowRegex: [], ignoreRegex: [] };
 }
-/** Lower-cased, trimmed, non-empty strings: a host list is compared case-insensitively. */
-function cleanList(values, lower) {
+/**
+ * A URL as the rules compare it: `scheme://host[:port]/path`, the scheme and host lower-cased,
+ * the default port dropped, the query, fragment and a trailing slash removed. '' when it is not
+ * an absolute http(s) URL.
+ */
+function ruleUrl(raw) {
+    try {
+        var url = new URL(String(raw).trim());
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') { // no i18n
+            return ''; // no i18n
+        }
+        var path = url.pathname.length > 1 ? url.pathname.replace(/\/+$/, '') : url.pathname; // no i18n
+        return url.protocol + '//' + url.host.toLowerCase() + path; // no i18n
+    }
+    catch (err) {
+        return ''; // no i18n
+    }
+}
+/** The exact URLs given, as rules compare them; anything that is not an absolute URL is refused, and said. */
+function cleanUrls(method, values) {
     var out = [];
     values.forEach(function (value) {
-        if (typeof value !== 'string') { // no i18n
+        var url = typeof value === 'string' ? ruleUrl(value) : ''; // no i18n
+        if (url === '') { // no i18n
+            logger.warnAlways('ApiTrackingBuilder.' + method + ': ' + JSON.stringify(value) + ' is not a full http(s) URL, as https://api.example.com/health, and is left out'); // no i18n
             return;
         }
-        var one = value.trim();
-        if (one !== '') { // no i18n
-            out.push(lower ? one.toLowerCase() : one);
+        if (out.indexOf(url) === -1) {
+            out.push(url);
         }
     });
     return out;
 }
-/** A TLD as `.com`, whether it was given as `.com` or `com`. */
-function asTld(value) {
-    return value.charAt(0) === '.' ? value : '.' + value; // no i18n
+/** The regular expressions given, a RegExp or its source as a string; an invalid one is refused, and said. */
+function cleanRegexes(method, values) {
+    var out = [];
+    values.forEach(function (value) {
+        if (value instanceof RegExp) {
+            out.push(value);
+            return;
+        }
+        if (typeof value === 'string' && value !== '') { // no i18n
+            try {
+                out.push(new RegExp(value));
+                return;
+            }
+            catch (err) {
+                // falls through to the warning
+            }
+        }
+        logger.warnAlways('ApiTrackingBuilder.' + method + ': ' + String(value) + ' is not a regular expression, and is left out'); // no i18n
+    });
+    return out;
 }
-/** Builds the rules for configureApiTracking, with AppticsApiTracker.configure's names. */
+/**
+ * Builds the rules configure takes. Each method may be called more than once, and takes any number
+ * of values: `new ApiTrackingBuilder().allowEquals(a, b).ignoreRegex(/x/).build()`.
+ */
 class ApiTrackingBuilder {
     constructor() {
         this.rules = emptyConfig();
     }
-    /** Never records these hosts. */
-    ignoreDomains(...domains) { this.rules.ignoreDomains.push(...cleanList(domains, true)); return this; }
-    /** Records only these hosts; every other is skipped. */
-    allowOnlyDomains(...domains) { this.rules.allowOnlyDomains.push(...cleanList(domains, true)); return this; }
-    /** Records only hosts ending in these TLDs, e.g. `.com`. */
-    allowOnlyTLDs(...tlds) { this.rules.allowOnlyTLDs.push(...cleanList(tlds, true).map(asTld)); return this; }
-    /** Never records hosts ending in these TLDs, e.g. `.local`. */
-    ignoreTLDs(...tlds) { this.rules.ignoreTLDs.push(...cleanList(tlds, true).map(asTld)); return this; }
-    /** Never records hosts starting with these, e.g. `dev.`. */
-    ignoreDomainPrefixes(...prefixes) { this.rules.ignoreDomainPrefixes.push(...cleanList(prefixes, true)); return this; }
-    /** Never records hosts ending with these, e.g. `.cdn.net`. */
-    ignoreDomainSuffixes(...suffixes) { this.rules.ignoreDomainSuffixes.push(...cleanList(suffixes, true)); return this; }
-    /** Records the hosts a pattern such as `api.myapp.*` matches under that one name. */
-    groupDomains(...patterns) { this.rules.groupDomains.push(...cleanList(patterns, true)); return this; }
-    /** Never records these paths: exact, `*` or `{name}` for one segment, `**` at the end for a prefix. */
-    ignoreEndpoint(...paths) { this.rules.ignoreEndpoints.push(...cleanList(paths, false)); return this; }
-    /** Records a path this pattern matches as the pattern, with each `{name}` as `*`. Tried before auto-detection. */
-    addPattern(...patterns) { this.rules.patterns.push(...cleanList(patterns, false)); return this; }
-    /** Segments never turned into `*`, e.g. `v1` or `404`. */
-    preserveSegments(...segments) { this.rules.preserveSegments.push(...cleanList(segments, false)); return this; }
-    /** `false`: only addPattern paths are normalized; every other path is recorded as it is. */
-    autoDetection(enabled) { this.rules.autoDetection = enabled !== false; return this; }
+    /** Records only these URLs (and those any allowRegex matches): `https://api.example.com/orders`. */
+    allowEquals(...urls) { this.rules.allowEquals.push(...cleanUrls('allowEquals', urls)); return this; }
+    /** Never records these URLs: `https://api.example.com/health`. */
+    ignoreEquals(...urls) { this.rules.ignoreEquals.push(...cleanUrls('ignoreEquals', urls)); return this; }
+    /** Records only URLs these match (and those any allowEquals names): `/^https:\/\/api\.example\.com\//`. */
+    allowRegex(...patterns) { this.rules.allowRegex.push(...cleanRegexes('allowRegex', patterns)); return this; }
+    /** Never records URLs these match: `/\/internal\//`. */
+    ignoreRegex(...patterns) { this.rules.ignoreRegex.push(...cleanRegexes('ignoreRegex', patterns)); return this; }
     build() {
-        var built = emptyConfig();
-        Object.keys(built).forEach((key) => {
-            var value = this.rules[key];
-            built[key] = Array.isArray(value) ? value.slice() : value;
-        });
-        return built;
+        return {
+            allowEquals: this.rules.allowEquals.slice(),
+            ignoreEquals: this.rules.ignoreEquals.slice(),
+            allowRegex: this.rules.allowRegex.slice(),
+            ignoreRegex: this.rules.ignoreRegex.slice(),
+        };
     }
 }
+/**
+ * 2.0.0-beta's builder methods, now gone. Called, each throws a TypeError that names what to use
+ * instead: a rule silently missing would record what the app meant to leave out.
+ */
+const RETIRED_METHODS = Object.freeze({
+    ignoreDomains: 'ignoreRegex', // no i18n
+    allowOnlyDomains: 'allowRegex', // no i18n
+    allowOnlyTLDs: 'allowRegex', // no i18n
+    ignoreTLDs: 'ignoreRegex', // no i18n
+    ignoreDomainPrefixes: 'ignoreRegex', // no i18n
+    ignoreDomainSuffixes: 'ignoreRegex', // no i18n
+    groupDomains: '', // no i18n
+    ignoreEndpoint: 'ignoreEquals or ignoreRegex', // no i18n
+    addPattern: '', // no i18n
+    preserveSegments: '', // no i18n
+    autoDetection: '', // no i18n
+});
+Object.keys(RETIRED_METHODS).forEach(function (name) {
+    Object.defineProperty(ApiTrackingBuilder.prototype, name, {
+        configurable: true,
+        value: function () {
+            var instead = RETIRED_METHODS[name];
+            throw new TypeError('ApiTrackingBuilder.' + name + '() is no longer supported: ' // no i18n
+                + (instead ? 'use ' + instead + ', which match the URL without its query' : 'ids, UUIDs and tokens in a path become * on their own')); // no i18n
+        },
+    });
+});
 var current = emptyConfig();
+/** The values of `list` that are of the kind `keep` accepts. */
+function listOf(value, keep) {
+    return Array.isArray(value) ? value.filter(keep) : [];
+}
 /**
  * Applies the rules, replacing any given before. Takes what build() returned, or the builder
  * itself. Call it once, before the requests it should cover; it works before init().
  */
 function configureApiTracking(config) {
-    var built = config instanceof ApiTrackingBuilder ? config.build() : config;
-    var next = emptyConfig();
-    if (built && typeof built === 'object') { // no i18n
-        Object.keys(next).forEach(function (key) {
-            var value = built[key];
-            if (key === 'autoDetection') { // no i18n
-                next.autoDetection = value !== false;
-            }
-            else if (Array.isArray(value)) {
-                next[key] = value.slice();
-            }
-        });
+    var built = (config instanceof ApiTrackingBuilder ? config.build() : config);
+    if (!built || typeof built !== 'object') { // no i18n
+        current = emptyConfig();
+        return;
     }
-    current = next;
+    var isString = function (one) { return typeof one === 'string'; }; // no i18n
+    var isRegExp = function (one) { return one instanceof RegExp; };
+    current = {
+        // a hand-written object gets the same clean-up the builder gives
+        allowEquals: cleanUrls('allowEquals', listOf(built.allowEquals, isString)), // no i18n
+        ignoreEquals: cleanUrls('ignoreEquals', listOf(built.ignoreEquals, isString)), // no i18n
+        allowRegex: listOf(built.allowRegex, isRegExp).concat(cleanRegexes('allowRegex', listOf(built.allowRegex, isString))), // no i18n
+        ignoreRegex: listOf(built.ignoreRegex, isRegExp).concat(cleanRegexes('ignoreRegex', listOf(built.ignoreRegex, isString))), // no i18n
+    };
 }
-/* ---------------- hosts ---------------- */
-function endsWithAny(host, list) {
-    return list.some(function (one) { return host.length >= one.length && host.slice(host.length - one.length) === one; });
+/** Whether a regular expression matches, whatever its flags: a /g one keeps a position between tests. */
+function regexMatches(re, url) {
+    re.lastIndex = 0;
+    return re.test(url);
 }
-/** Whether calls to this host are recorded. Ignore rules are checked first and always win. */
-function hostAllowed(hostname) {
-    var host = String(hostname || '').toLowerCase(); // no i18n
-    if (current.ignoreDomains.indexOf(host) !== -1
-        || endsWithAny(host, current.ignoreTLDs)
-        || endsWithAny(host, current.ignoreDomainSuffixes)
-        || current.ignoreDomainPrefixes.some(function (prefix) { return host.indexOf(prefix) === 0; })) {
-        return false;
-    }
-    if (current.allowOnlyDomains.length > 0 && current.allowOnlyDomains.indexOf(host) === -1) {
+/**
+ * Whether a call to `url` is recorded. Ignore rules are tried first and always win; then, when
+ * there are allow rules, the URL must match one. A URL that cannot be read is not recorded.
+ */
+function urlTracked(url) {
+    var target = ruleUrl(url);
+    if (target === '') { // no i18n
         return false;
     }
-    if (current.allowOnlyTLDs.length > 0 && !endsWithAny(host, current.allowOnlyTLDs)) {
+    if (current.ignoreEquals.indexOf(target) !== -1 || current.ignoreRegex.some(function (re) { return regexMatches(re, target); })) {
         return false;
     }
-    return true;
-}
-function wildcardHost(pattern) {
-    var source = pattern.split('*').map(function (part) {
-        return part.replace(/[.+?^${}()|[\]\\]/g, '\\$&'); // no i18n
-    }).join('[a-z0-9.-]+'); // no i18n
-    return new RegExp('^' + source + '$'); // no i18n
-}
-/** The name a host is recorded under: the first groupDomains pattern it matches, or itself. */
-function groupedHost(hostname) {
-    var host = String(hostname || '').toLowerCase(); // no i18n
-    for (var i = 0; i < current.groupDomains.length; i++) {
-        var pattern = current.groupDomains[i];
-        if (pattern.indexOf('*') !== -1 && wildcardHost(pattern).test(host)) { // no i18n
-            return pattern;
-        }
+    if (current.allowEquals.length === 0 && current.allowRegex.length === 0) {
+        return true;
     }
-    return hostname;
+    return current.allowEquals.indexOf(target) !== -1 || current.allowRegex.some(function (re) { return regexMatches(re, target); });
 }
-/* ---------------- paths ---------------- */
+/* ---------------- the name a call is recorded under ---------------- */
 /** The path without its query string or fragment, which is where ids and tokens travel. */
 function withoutQuery(path) {
     var cut = String(path || '').split(/[?#]/)[0]; // no i18n
     return cut === '' ? '/' : cut; // no i18n
 }
-function segmentsOf(path) {
-    var trimmed = path.length > 1 ? path.replace(/\/+$/, '') : path; // no i18n
-    return trimmed.split('/').slice(1); // no i18n
-}
-const ONE_SEGMENT = /^(\*|\{[^/{}]*\})$/;
-/** Whether a path matches a pattern: `*` and `{name}` are one segment, a final `**` is the rest. */
-function matches(pattern, path) {
-    var want = segmentsOf(pattern);
-    var have = segmentsOf(path);
-    for (var i = 0; i < want.length; i++) {
-        var part = want[i];
-        if (part === '**' && i === want.length - 1) { // no i18n
-            return true;
-        }
-        if (i >= have.length) {
-            return false;
-        }
-        if (ONE_SEGMENT.test(part)) {
-            if (have[i] === '') { // no i18n
-                return false;
-            }
-            continue;
-        }
-        if (part !== have[i]) {
-            return false;
-        }
-    }
-    return want.length === have.length;
-}
-/** Whether ignoreEndpoint leaves this path out. Matched on the path as called, query removed. */
-function endpointIgnored(path) {
-    var bare = withoutQuery(path);
-    return current.ignoreEndpoints.some(function (pattern) { return matches(pattern, bare); });
-}
 const NUMERIC = /^\d+$/;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 // three base64url parts, the first starting eyJ — the encoding of '{"' every JWT header opens
 // with. Without that start, a file name such as jquery.min.js would pass for a token
 const JWT = /^eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
-/**
- * The path a call is recorded under. The query goes; then the first addPattern that matches is
- * used, with each `{name}` as `*` (the server's path rule has no room for braces); otherwise, with
- * autoDetection on, numeric ids, UUIDs and JWTs become `*`, except preserveSegments.
- */
+/** The path a call is recorded under: the query goes, and numeric ids, UUIDs and JWTs become `*`. */
 function normalizeApiPath(path) {
-    var bare = withoutQuery(path);
-    for (var i = 0; i < current.patterns.length; i++) {
-        var pattern = current.patterns[i];
-        if (matches(pattern, bare)) {
-            return pattern.replace(/\{[^/{}]*\}/g, '*'); // no i18n
-        }
-    }
-    if (!current.autoDetection) {
-        return bare;
-    }
-    return bare.split('/').map(function (segment) {
-        if (segment === '' || current.preserveSegments.indexOf(segment) !== -1) { // no i18n
-            return segment;
-        }
-        return NUMERIC.test(segment) || UUID.test(segment) || JWT.test(segment) ? '*' : segment; // no i18n
+    return withoutQuery(path).split('/').map(function (segment) {
+        return segment !== '' && (NUMERIC.test(segment) || UUID.test(segment) || JWT.test(segment)) ? '*' : segment; // no i18n
     }).join('/'); // no i18n
 }
 
 exports.ApiTrackingBuilder = ApiTrackingBuilder;
 exports.configureApiTracking = configureApiTracking;
-exports.endpointIgnored = endpointIgnored;
-exports.groupedHost = groupedHost;
-exports.hostAllowed = hostAllowed;
 exports.normalizeApiPath = normalizeApiPath;
+exports.ruleUrl = ruleUrl;
+exports.urlTracked = urlTracked;
 exports.withoutQuery = withoutQuery;

package/dist/cjs/engagement/auto-api.js

@@ -1,4 +1,4 @@
-/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta.2 | (c) Zoho Corporation Private Limited | see LICENSE */
 'use strict';
 
 var state = require('../core/state.js');
@@ -66,7 +66,7 @@ function shouldTrack(rawUrl) {
     }
     // configureApiTracking's rules: checked here too so a call left out is not even timed. trackApi checks them again, for the
     // calls an app reports itself
-    return apiRules.hostAllowed(absolute.hostname) && !apiRules.endpointIgnored(absolute.pathname);
+    return apiRules.urlTracked(absolute.href);
 }
 /** One finished call. Never throws: a tracking failure must not surface in the app's call. */
 function record(method, url, starttime, responsecode, responsemessage) {

package/dist/cjs/engagement/auto-screen.d.ts

@@ -1,3 +1,5 @@
+/** A path as screen_routes compares it: no query or fragment, no trailing slash but on the root. */
+export declare function routePath(path: string): string;
 /**
  * Starts or stops automatic screen tracking. Starting records the screen the page is on, unless
  * the app has already called inScreen() for it. Safe to call repeatedly: wrapping history twice

package/dist/cjs/engagement/auto-screen.js

@@ -1,4 +1,4 @@
-/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta.2 | (c) Zoho Corporation Private Limited | see LICENSE */
 'use strict';
 
 var logger = require('../core/logger.js');
@@ -32,9 +32,14 @@ var track = require('./track.js');
  * On by default: most apps never call inScreen() themselves, and a screen-less session says
  * little. An app that wants only its own calls sets `track_screen: false`.
  */
+/** A path as screen_routes compares it: no query or fragment, no trailing slash but on the root. */
+function routePath(path) {
+    var bare = String(path || '').split(/[?#]/)[0] || '/'; // no i18n
+    return bare.length > 1 ? bare.replace(/\/+$/, '') : bare; // no i18n
+}
 /** The most a screen name may be, and the characters it may hold (see validateScreenName). */
 const NAME_MAX = 99;
-const NAME_DISALLOWED = /[^\w\s.\-&/:]/g;
+const NAME_DISALLOWED = /[^\w\s.\-&/:*]/g;
 /** How long an automatic view waits for the app's own inScreen() of the same navigation. */
 const SETTLE_MS = 300;
 var installed = false;
@@ -82,13 +87,61 @@ function cleanName(raw) {
     }
     return name.replace(NAME_DISALLOWED, '_').trim().slice(0, NAME_MAX); // no i18n
 }
+/** Whether a pattern segment is a wildcard: `{id}`, `:id` or `*`. */
+function isWildcard(segment) {
+    return segment === '*' || /^\{[^/]*\}$/.test(segment) || /^:[^/]+$/.test(segment); // no i18n
+}
+/** Whether a route pattern matches a path: every segment, `{id}`, `:id` and `*` matching any one. */
+function patternMatches(pattern, path) {
+    var segments = routePath(pattern).split('/'); // no i18n
+    var actual = path.split('/'); // no i18n
+    if (segments.length !== actual.length) {
+        return false;
+    }
+    for (var j = 0; j < segments.length; j++) {
+        var seg = segments[j];
+        if (!isWildcard(seg) && seg !== actual[j]) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * The name screen_routes gives a path, or the path itself when no entry matches. Tried in order:
+ * a route pattern records the path with its variable segments as `*` (`/users/{id}/orders`
+ * claims `/users/1/orders`, not `/users/1/orders/2`); an exact path or a regular expression
+ * records the name the entry gives. Matched on the path without its query.
+ */
+function applyRoutes(path) {
+    var routes = state._ZAP._config.screen_routes;
+    if (!routes || routes.length === 0) {
+        return path;
+    }
+    var bare = routePath(path);
+    for (var i = 0; i < routes.length; i++) {
+        var route = routes[i];
+        if (route.kind === 'equals' && route.path === bare) { // no i18n
+            return route.name;
+        }
+        if (route.kind === 'regex') { // no i18n
+            route.regex.lastIndex = 0; // a /g regular expression keeps a position between tests
+            if (route.regex.test(bare)) {
+                return route.name;
+            }
+        }
+        if (route.kind === 'pattern' && patternMatches(route.pattern, bare)) { // no i18n
+            return routePath(route.pattern).split('/').map((s) => (isWildcard(s) ? '*' : s)).join('/'); // no i18n
+        }
+    }
+    return path;
+}
 /**
  * The name for the page as it is now, from its url, or '' to record nothing. Never throws. An app
  * that wants its own names calls inScreen() as the route changes, which replaces this view.
  */
 function currentName() {
     try {
-        return cleanName(nameFromUrl(new URL(window.location.href)));
+        return cleanName(applyRoutes(nameFromUrl(new URL(window.location.href))));
     }
     catch (err) {
         return ''; // no i18n
@@ -140,8 +193,18 @@ function cancelPending() {
  * Collects the history calls and events of one navigation into a single check. The first call of
  * a navigation starts it afresh: a inScreen() from before it belonged to the previous screen,
  * and a view still waiting is a page left too soon to count.
+ *
+ * A history call that leaves the screen where it is, is not a navigation. Next.js and other
+ * routers replaceState the same url right after a route change, to store their state or the
+ * scroll position. Treated as one, it cancelled the view still waiting to settle, and the check
+ * that followed found the url already seen and recorded nothing: the page went untracked and the
+ * view before it was never ended.
  */
 function navigated() {
+    var name = currentName();
+    if (name !== '' && (name === pendingName || (pendingName === '' && name === lastName))) { // no i18n
+        return;
+    }
     if (timer === null) {
         claimed = false;
         cancelPending();
@@ -239,3 +302,4 @@ hooks.hooks.screenTrackedByApp = screenTrackedByApp;
 
 exports.automaticScreenName = automaticScreenName;
 exports.enableScreenTracking = enableScreenTracking;
+exports.routePath = routePath;

package/dist/cjs/engagement/defined-events.js

@@ -1,4 +1,4 @@
-/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta.2 | (c) Zoho Corporation Private Limited | see LICENSE */
 'use strict';
 
 /**

package/dist/cjs/engagement/send.js

@@ -1,4 +1,4 @@
-/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta | (c) Zoho Corporation Private Limited | see LICENSE */
+/*! @zoho_apptics/apptics-js-sdk v2.0.0-beta.2 | (c) Zoho Corporation Private Limited | see LICENSE */
 'use strict';
 
 var constants = require('../core/constants.js');
@@ -15,8 +15,7 @@ var transport = require('../core/transport.js');
  * Sends pending engagements to the Apptics API.
  */
 function sendEngagementData(forget) {
-    // engagementtracking off (getupdates): queued items stay until tracking is back on or they expire
-    if (env.is_apptics_disabled() || !consent.shouldTrackOrSendData() || !state._ZAP._engagementTracking) {
+    if (env.is_apptics_disabled() || !consent.shouldTrackOrSendData()) {
         return Promise.resolve();
     }
     if (navigator.onLine == false) {
@@ -39,6 +38,11 @@ function sendEngagementData(forget) {
             var _payload = {};
             var sent = [];
             utils.cloneObject(engagement_items).forEach(function (item) {
+                // a kind the server has turned off (getsdkconfig's event, api, screen or session
+                // module) stays queued until it is back on or the item expires
+                if (state._ZAP._engagementTracking[item.type] === false) {
+                    return;
+                }
                 const itemWithId = { ...item };
                 if (item.type == constants.AP_CONSTANTS.EVENT) {
                     eventObj.push(item);
@@ -58,6 +62,11 @@ function sendEngagementData(forget) {
                 sent.push(itemWithId);
                 delete item.id;
                 delete item.type;
+                // which tabs share a session, which tab shows a screen and when it was last seen: the
+                // SDK's own bookkeeping, not part of the payload
+                delete item.tabs;
+                delete item.tab;
+                delete item.lastseen;
             });
             if (eventObj.length > 0)
                 _payload.events = eventObj;

package/dist/cjs/engagement/session.d.ts

@@ -15,8 +15,16 @@ export declare function updateScreenWithEndtime(): Promise<void>;
  * @param sessionData A set of properties belonging to the session.
  */
 export declare function trackSession(sessionData: Dict): Promise<void>;
-/** This tab's session when it has one, otherwise the newest open session in storage. */
+/**
+ * This tab's session while it is open, otherwise the newest open session in storage: the one the
+ * site's other tabs are on, which this tab joins rather than starting a second session beside it.
+ */
 export declare function currentSession(): Promise<QueueItem | undefined>;
+export declare function tabId(): string;
+/** Takes this tab's lock, held until the page is gone. Once per page. */
+export declare function holdTabLock(): void;
+/** Ends the open screen views of tabs that are gone. Resolves right away without Web Locks. */
+export declare function closeScreensOfGoneTabs(): Promise<void>;
 /**
  * Writes the waiting session, if there is one. Called by the timer and by anything that tracks an
  * item, so an event in the first seconds takes its session with it.
@@ -28,8 +36,26 @@ export declare function dropPendingSession(): boolean;
 export declare function hasPendingSession(): boolean;
 export declare function startNewSession(time: number): Promise<void>;
 /**
- * Closes this tab's session, so it can be sent: the tab is closing or the page is being replaced.
- * Nothing happens when the session is already closed.
+ * The tab went inactive. That moment becomes the session's lastactivetime, the time it ends at if
+ * the user does not come back within inactiveduration. If they do not, the session is ended at it
+ * then, and `onEnded` sends it, rather than staying open until they return or the tab closes.
+ * Going inactive twice (a window blur, then the tab hidden) keeps the first moment.
+ */
+export declare function markTabInactive(onEnded: () => void): Promise<void>;
+/**
+ * The tab is active again. The caller then settles the session (checkAndUpdateSession): back
+ * within inactiveduration it continues, later it has ended and a new one starts.
+ */
+export declare function markTabActive(): void;
+/** reset(): no timer left running, and the tab counts as active. */
+export declare function resetInactivity(): void;
+/**
+ * This tab is closing, or the page is being replaced. The session ends here when this is the last
+ * tab using it, so it can be sent; while another tab of the site is still on it, this tab only
+ * leaves it, and the last tab to close ends it. Nothing happens when it is already closed.
+ *
+ * A tab closed while inactive ends the session when the user left (its lastactivetime), not when
+ * the tab closed: the time it sat hidden or in the background is not session time.
  */
 export declare function endCurrentSession(): Promise<void>;
 /**