@adonis-agora/flags 0.0.0-beta-20261112141227

package/dist/src/http/subject_resolver.d.ts

@@ -0,0 +1,45 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { Subject, SubjectLike } from '../subject.js';
+/** The part of `@adonis-agora/authkit-client`'s `Identity` this package reads. */
+export interface AuthkitIdentityLike {
+    userId: string;
+    email?: string;
+    globalRoles?: string[];
+    profile?: {
+        name?: string;
+    };
+    orgId?: string | null;
+    orgSlug?: string | null;
+    orgRole?: string | null;
+}
+/**
+ * The subject for an authkit identity: the `sub` claim as id — the same person in every app, so a
+ * user lands in the same bucket everywhere — and the verified claims as targeting attributes:
+ *
+ * | Attribute | From |
+ * |---|---|
+ * | `email`, `emailDomain` | the `email` claim |
+ * | `globalRoles` | authkit global roles (an array: `in` matches any) |
+ * | `orgId`, `orgSlug`, `orgRole` | the session's active organization |
+ *
+ * Roll out per organization with `bucketBy: 'orgId'`.
+ */
+export declare function subjectFromIdentity(identity: AuthkitIdentityLike): Subject;
+/** The authkit identity of the request, from `@adonis-agora/authkit-client` (0.x or 1.x). */
+export declare function authkitIdentity(ctx: HttpContext): Promise<AuthkitIdentityLike | null>;
+/**
+ * A `subject` resolver for `config/flags.ts` that uses authkit only:
+ * `subject: authkitSubject`. The default resolver already prefers authkit when it is installed.
+ */
+export declare function authkitSubject(ctx: HttpContext): Promise<SubjectLike>;
+/**
+ * The default subject of `ctx.flags`:
+ *
+ * 1. the authkit identity (`ctx.authkit`, from `@adonis-agora/authkit-client`), with its claims as
+ *    attributes — see {@link subjectFromIdentity};
+ * 2. otherwise `ctx.auth.user` (`@adonisjs/auth`), checking the request's credentials silently when
+ *    no middleware authenticated it yet;
+ * 3. otherwise anonymous.
+ */
+export declare function defaultSubject(ctx: HttpContext): Promise<SubjectLike>;
+//# sourceMappingURL=subject_resolver.d.ts.map

package/dist/src/http/subject_resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject_resolver.d.ts","sourceRoot":"","sources":["../../../src/http/subject_resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAO1D,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAW1E;AAeD,6FAA6F;AAC7F,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAS3F;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAG3E;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAc3E"}

package/dist/src/http/subject_resolver.js

@@ -0,0 +1,93 @@
+/**
+ * The subject for an authkit identity: the `sub` claim as id — the same person in every app, so a
+ * user lands in the same bucket everywhere — and the verified claims as targeting attributes:
+ *
+ * | Attribute | From |
+ * |---|---|
+ * | `email`, `emailDomain` | the `email` claim |
+ * | `globalRoles` | authkit global roles (an array: `in` matches any) |
+ * | `orgId`, `orgSlug`, `orgRole` | the session's active organization |
+ *
+ * Roll out per organization with `bucketBy: 'orgId'`.
+ */
+export function subjectFromIdentity(identity) {
+    const attributes = {};
+    if (identity.email) {
+        attributes.email = identity.email;
+        attributes.emailDomain = identity.email.split('@')[1]?.toLowerCase();
+    }
+    if (identity.globalRoles)
+        attributes.globalRoles = identity.globalRoles;
+    if (identity.orgId)
+        attributes.orgId = identity.orgId;
+    if (identity.orgSlug)
+        attributes.orgSlug = identity.orgSlug;
+    if (identity.orgRole)
+        attributes.orgRole = identity.orgRole;
+    return { id: identity.userId, type: 'user', attributes };
+}
+/**
+ * The request's authkit surface: `ctx.authkit` (authkit-client 1.x), else `ctx.auth` when it is
+ * authkit's authenticator (authkit-client 0.x's `authkit_middleware` puts it there and never sets
+ * `ctx.authkit`). `@adonisjs/auth`'s authenticator has no `getIdentity`, so it is never mistaken
+ * for it.
+ */
+function authkitOf(ctx) {
+    const holder = ctx;
+    if (holder.authkit && typeof holder.authkit.getIdentity === 'function')
+        return holder.authkit;
+    if (holder.auth && typeof holder.auth.getIdentity === 'function')
+        return holder.auth;
+    return undefined;
+}
+/** The authkit identity of the request, from `@adonis-agora/authkit-client` (0.x or 1.x). */
+export async function authkitIdentity(ctx) {
+    const authkit = authkitOf(ctx);
+    if (!authkit)
+        return null;
+    try {
+        return await authkit.getIdentity();
+    }
+    catch {
+        // An unreadable session is an anonymous visitor, not a flags error.
+        return null;
+    }
+}
+/**
+ * A `subject` resolver for `config/flags.ts` that uses authkit only:
+ * `subject: authkitSubject`. The default resolver already prefers authkit when it is installed.
+ */
+export async function authkitSubject(ctx) {
+    const identity = await authkitIdentity(ctx);
+    return identity ? subjectFromIdentity(identity) : undefined;
+}
+/**
+ * The default subject of `ctx.flags`:
+ *
+ * 1. the authkit identity (`ctx.authkit`, from `@adonis-agora/authkit-client`), with its claims as
+ *    attributes — see {@link subjectFromIdentity};
+ * 2. otherwise `ctx.auth.user` (`@adonisjs/auth`), checking the request's credentials silently when
+ *    no middleware authenticated it yet;
+ * 3. otherwise anonymous.
+ */
+export async function defaultSubject(ctx) {
+    const identity = await authkitIdentity(ctx);
+    if (identity)
+        return subjectFromIdentity(identity);
+    const auth = ctx.auth;
+    if (!auth)
+        return undefined;
+    if (auth.user)
+        return auth.user;
+    if (typeof auth.check === 'function') {
+        try {
+            if (await auth.check())
+                return (auth.user ?? undefined);
+        }
+        catch {
+            // A broken credential is an anonymous visitor, not a flags error.
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=subject_resolver.js.map

package/dist/src/http/subject_resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject_resolver.js","sourceRoot":"","sources":["../../../src/http/subject_resolver.ts"],"names":[],"mappings":"AAuBA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA6B;IAC/D,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW;QAAE,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;IACxE,IAAI,QAAQ,CAAC,KAAK;QAAE,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IACtD,IAAI,QAAQ,CAAC,OAAO;QAAE,UAAU,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC5D,IAAI,QAAQ,CAAC,OAAO;QAAE,UAAU,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC5D,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,GAA+D,CAAC;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IAC9F,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACrF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAgB;IACpD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAgB;IACnD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAgB;IACnD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAmB,CAAC;IAC/C,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAgB,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/identity.d.ts

@@ -0,0 +1,82 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { AdminAction, AdminAuthorizer } from './admin.js';
+import type { ConsoleAuthorizeResult } from './dashboard/console_authorize.js';
+import type { Actor } from './stores/store.js';
+import type { SubjectLike } from './subject.js';
+/**
+ * How flags learns who people are — the one contract between this package and your auth, the way
+ * a user provider is for `@adonisjs/auth`. Implement it for any auth setup, or use a built-in:
+ * `identities.authkit()` or `identities.adonisAuth()`.
+ *
+ * | Method | Used by |
+ * |---|---|
+ * | `subject` | `ctx.flags`, the route guard, Edge, the browser token endpoint |
+ * | `actor` | the console: audit log and approvals |
+ * | `authorizeConsole` | the console: who may open it |
+ * | `can` | every change — console, `node ace flags:*`, the admin API |
+ *
+ * Options set directly in the configs win over the provider: `subject` and `authorize` in
+ * `config/flags.ts`, `actor` and `authorize` in `config/flags_dashboard.ts`.
+ */
+export interface FlagsIdentityProvider {
+    /** Who flags are evaluated for in this request. `undefined`: an anonymous visitor. */
+    subject(ctx: HttpContext): SubjectLike | Promise<SubjectLike>;
+    /**
+     * The person acting in the console. `id` is what approvals compare: nobody approves their own
+     * change. `undefined`: anonymous, refused in environments that need approval.
+     */
+    actor?(ctx: HttpContext): Actor | undefined | Promise<Actor | undefined>;
+    /**
+     * Who may open the console. Same answers as every Agora console: `true`/`false`,
+     * `{ allowed: false, reason: 'unauthenticated' }` (401), `{ redirectTo: '/login' }`.
+     */
+    authorizeConsole?(ctx: HttpContext): ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>;
+    /**
+     * Whether `actor` may `read`, `write` or `approve` in an environment. Runs outside HTTP too
+     * (commands act as `cli:<os user>`), so load what you need from the actor's id.
+     */
+    can?(actor: Actor, action: AdminAction, target: Parameters<AdminAuthorizer>[2]): boolean | Promise<boolean>;
+}
+export interface AuthkitIdentityOptions {
+    /** Global role required to open the console. Default `ADMIN`. */
+    consoleRole?: string;
+    /** Where to send people who are not signed in. Default: answer 401. */
+    loginPath?: string;
+    /** Who may change what. Default: anyone the console lets in (and every command). */
+    can?: FlagsIdentityProvider['can'];
+}
+export interface AdonisAuthIdentityOptions<User = Record<string, unknown>> {
+    /** The guard to read. Default: the default guard. */
+    guard?: string;
+    /** Subject type stored on events. Default `user`. */
+    type?: string;
+    /** Where to send people who are not signed in. Default: answer 401. */
+    loginPath?: string;
+    /**
+     * Who may open the console, once signed in — typically a Bouncer ability:
+     * `(user, ctx) => ctx.bouncer.allows(manageFlags)`. Without it, the console falls back to its
+     * default (open outside production, closed in production).
+     */
+    canOpenConsole?(user: User, ctx: HttpContext): boolean | Promise<boolean>;
+    /** Who may change what. Default: anyone the console lets in (and every command). */
+    can?: FlagsIdentityProvider['can'];
+}
+export declare const identities: {
+    /**
+     * `@adonis-agora/authkit-client`: the session's identity as subject (`sub`, email, global roles,
+     * active organization) and as the console actor; the console needs the `ADMIN` global role.
+     */
+    authkit(options?: AuthkitIdentityOptions): FlagsIdentityProvider;
+    /**
+     * `@adonisjs/auth`: `ctx.auth.user` as subject (its `id`) and as the console actor (its `id`, and
+     * `fullName`/`name`/`email`). Gate the console with `canOpenConsole` — a Bouncer ability, a role
+     * column, anything. Targeting attributes come from `attributes` in `config/flags.ts`.
+     */
+    adonisAuth<User = Record<string, unknown>>(options?: AdonisAuthIdentityOptions<User>): FlagsIdentityProvider;
+};
+/** The subject resolver in effect: `config.subject`, else the provider's, else the default. */
+export declare function subjectResolver(config: {
+    subject?: ((ctx: HttpContext) => SubjectLike | Promise<SubjectLike>) | undefined;
+    identity?: FlagsIdentityProvider | undefined;
+}): (ctx: HttpContext) => Promise<SubjectLike>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/src/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D;;;OAGG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;IACzE;;;OAGG;IACH,gBAAgB,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9F;;;OAGG;IACH,GAAG,CAAC,CACF,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/B;AAiBD,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,GAAG,CAAC,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACvE,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,oFAAoF;IACpF,GAAG,CAAC,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;CACpC;AAgBD,eAAO,MAAM,UAAU;IACrB;;;OAGG;IACH,OAAO,WAAU,sBAAsB,GAAQ,qBAAqB;IAyBpE;;;;OAIG;IACH,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAC9B,yBAAyB,CAAC,IAAI,CAAC,GACvC,qBAAqB;CA6BzB,CAAC;AAEF,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACtC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,SAAS,CAAC;IACjF,QAAQ,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC9C,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAQ7C"}

package/dist/src/identity.js

@@ -0,0 +1,100 @@
+import { authkitIdentity, defaultSubject, subjectFromIdentity } from './http/subject_resolver.js';
+function nameOf(user) {
+    return [user.fullName, user.name, user.email].find((value) => typeof value === 'string' && value !== '');
+}
+/** The signed-in user of `ctx.auth` (or one guard), checking the request silently. */
+async function signedInUser(ctx, guard) {
+    const auth = ctx.auth;
+    if (!auth)
+        return null;
+    const scoped = guard && auth.use ? auth.use(guard) : auth;
+    if (scoped.user)
+        return scoped.user;
+    if (typeof scoped.check !== 'function')
+        return null;
+    try {
+        return (await scoped.check()) ? (scoped.user ?? null) : null;
+    }
+    catch {
+        return null;
+    }
+}
+export const identities = {
+    /**
+     * `@adonis-agora/authkit-client`: the session's identity as subject (`sub`, email, global roles,
+     * active organization) and as the console actor; the console needs the `ADMIN` global role.
+     */
+    authkit(options = {}) {
+        return {
+            async subject(ctx) {
+                const identity = await authkitIdentity(ctx);
+                return identity ? subjectFromIdentity(identity) : undefined;
+            },
+            async actor(ctx) {
+                const identity = await authkitIdentity(ctx);
+                if (!identity)
+                    return undefined;
+                const name = identity.profile?.name ?? identity.email;
+                return name ? { id: identity.userId, name } : { id: identity.userId };
+            },
+            async authorizeConsole(ctx) {
+                const identity = await authkitIdentity(ctx);
+                if (!identity) {
+                    return options.loginPath
+                        ? { redirectTo: options.loginPath }
+                        : { allowed: false, reason: 'unauthenticated' };
+                }
+                return (identity.globalRoles ?? []).includes(options.consoleRole ?? 'ADMIN');
+            },
+            ...(options.can ? { can: options.can } : {}),
+        };
+    },
+    /**
+     * `@adonisjs/auth`: `ctx.auth.user` as subject (its `id`) and as the console actor (its `id`, and
+     * `fullName`/`name`/`email`). Gate the console with `canOpenConsole` — a Bouncer ability, a role
+     * column, anything. Targeting attributes come from `attributes` in `config/flags.ts`.
+     */
+    adonisAuth(options = {}) {
+        return {
+            async subject(ctx) {
+                const user = await signedInUser(ctx, options.guard);
+                if (!user || (typeof user.id !== 'string' && typeof user.id !== 'number'))
+                    return undefined;
+                return { id: user.id, type: options.type ?? 'user' };
+            },
+            async actor(ctx) {
+                const user = await signedInUser(ctx, options.guard);
+                if (!user || user.id === undefined || user.id === null)
+                    return undefined;
+                const name = nameOf(user);
+                return name ? { id: String(user.id), name } : { id: String(user.id) };
+            },
+            ...(options.canOpenConsole
+                ? {
+                    async authorizeConsole(ctx) {
+                        const user = await signedInUser(ctx, options.guard);
+                        if (!user) {
+                            return options.loginPath
+                                ? { redirectTo: options.loginPath }
+                                : { allowed: false, reason: 'unauthenticated' };
+                        }
+                        return options.canOpenConsole(user, ctx);
+                    },
+                }
+                : {}),
+            ...(options.can ? { can: options.can } : {}),
+        };
+    },
+};
+/** The subject resolver in effect: `config.subject`, else the provider's, else the default. */
+export function subjectResolver(config) {
+    if (config.subject) {
+        const subject = config.subject;
+        return async (ctx) => subject(ctx);
+    }
+    const identity = config.identity;
+    if (identity)
+        return async (ctx) => identity.subject(ctx);
+    return defaultSubject;
+}
+//# sourceMappingURL=identity.js.map

package/dist/src/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAoDlG,SAAS,MAAM,CAAC,IAA6B;IAC3C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAChD,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CACtE,CAAC;AACJ,CAAC;AA4BD,sFAAsF;AACtF,KAAK,UAAU,YAAY,CAAC,GAAgB,EAAE,KAAc;IAC1D,MAAM,IAAI,GAAI,GAAsC,CAAC,IAAI,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACpC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;OAGG;IACH,OAAO,CAAC,OAAO,GAA2B,EAAE;QAC1C,OAAO;YACL,KAAK,CAAC,OAAO,CAAC,GAAG;gBACf,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC5C,OAAO,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,GAAG;gBACb,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC5C,IAAI,CAAC,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC;gBACtD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxE,CAAC;YACD,KAAK,CAAC,gBAAgB,CAAC,GAAG;gBACxB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,OAAO,CAAC,SAAS;wBACtB,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE;wBACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBACpD,CAAC;gBACD,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,UAAU,CACR,OAAO,GAAoC,EAAE;QAE7C,OAAO;YACL,KAAK,CAAC,OAAO,CAAC,GAAG;gBACf,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC;oBAAE,OAAO,SAAS,CAAC;gBAC5F,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;YACvD,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,GAAG;gBACb,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI;oBAAE,OAAO,SAAS,CAAC;gBACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACxE,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,cAAc;gBACxB,CAAC,CAAC;oBACE,KAAK,CAAC,gBAAgB,CAAC,GAAgB;wBACrC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;wBACpD,IAAI,CAAC,IAAI,EAAE,CAAC;4BACV,OAAO,OAAO,CAAC,SAAS;gCACtB,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE;gCACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;wBACpD,CAAC;wBACD,OAAO,OAAO,CAAC,cAAe,CAAC,IAAY,EAAE,GAAG,CAAC,CAAC;oBACpD,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,MAG/B;IACC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,QAAQ;QAAE,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,41 @@
+export declare const VERSION = "0.1.0";
+export type { EvaluationContext, EvaluationDetails, FlagDefinition, JsonValue, Ruleset, Segment, } from '@adonis-agora/flags-core';
+export { configure } from '../configure.js';
+export { type AdminAction, type AdminAuthorizer, type ApprovalsConfig, checkAgainstDeclarations, definitionFromDeclaration, FlagsAdmin, ForbiddenError, type ProposeResult, type StaleFlag, ValidationError, } from './admin.js';
+export type { AnalyticsBackend } from './analytics/backend.js';
+export { ClickHouseBackend } from './analytics/clickhouse_backend.js';
+export { DuckDbBackend } from './analytics/duckdb.js';
+export { LucidBackend } from './analytics/lucid_backend.js';
+export { type MetricDefinition, type MetricKind, metric } from './analytics/metrics.js';
+export { type Comparison, computeResults, type ExperimentResults, type MetricResult, } from './analytics/results.js';
+export { type FlagDeclaration, type FlagMeta, type FlagType, flag, type InferFlags, } from './declare.js';
+export { analytics, type BrowserConfig, type ControlPlaneConfig, defineConfig, type ExperimentConfig, type FactoryContext, type FlagsConfig, type StandaloneConfig, sinks, stores, type TenantConfig, transports, } from './define_config.js';
+export { DIAGNOSTICS_CHANNELS, type Enricher, enrichers } from './enrichers.js';
+export { EVENT_SCHEMA_VERSION, exposureId, type FlagEvent, uuidv7 } from './events/event.js';
+export { browserToken, registerBrowser } from './http/browser.js';
+export type { BrowserTokenResponse } from './http/browser_tokens.js';
+export { flagsCsrfExceptions } from './http/csrf.js';
+export { type AuthkitIdentityLike, authkitIdentity, authkitSubject, defaultSubject, subjectFromIdentity, } from './http/subject_resolver.js';
+export { type AdonisAuthIdentityOptions, type AuthkitIdentityOptions, type FlagsIdentityProvider, identities, } from './identity.js';
+export { FlagsManager, FlagsScope, type TrackOptions } from './manager.js';
+export { Relay } from './relay/relay.js';
+export { FlagsWorker } from './relay/worker.js';
+export { createRuntime, type FlagsRuntime, lucidContext } from './runtime.js';
+export { createFlagsTables, dropFlagsTables, ensureEventPartitions, FLAGS_TABLES, pruneEvents, } from './schema.js';
+export { ClickHouseSink } from './sinks/clickhouse.js';
+export { LucidSink } from './sinks/lucid_sink.js';
+export { ParquetSink } from './sinks/parquet_sink.js';
+export { PostHogSink } from './sinks/posthog_sink.js';
+export { CallbackSink, MemorySink, type Sink } from './sinks/sink.js';
+export { LucidStore, RULESET_CHANNEL } from './stores/lucid_store.js';
+export { MemoryStore } from './stores/memory_store.js';
+export type { Actor, AuditEntry, ChangeRequest, FlagsStore, RulesetChange, ScheduledChange, } from './stores/store.js';
+export type { Subject, SubjectLike } from './subject.js';
+export { TENANT_SCOPES, type TokenSource, tokens } from './topology/token.js';
+export { type TenantVerifier, type UserVerifier, userVerifiers, type VerifiedTenant, type VerifiedUser, verifiers, } from './topology/verify.js';
+export { DbTransport } from './transports/db_transport.js';
+export { MemoryTransport } from './transports/memory_transport.js';
+export { RedisTransport } from './transports/redis_transport.js';
+export type { Transport } from './transports/transport.js';
+export type { BooleanFlagKey, FlagKey, FlagsList, FlagValue } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,OAAO,EACP,OAAO,GACR,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,UAAU,EACV,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EACL,KAAK,UAAU,EACf,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,IAAI,EACJ,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,SAAS,EACT,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,YAAY,EACZ,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,EACL,MAAM,EACN,KAAK,YAAY,EACjB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,KAAK,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EACL,KAAK,mBAAmB,EACxB,eAAe,EACf,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,YAAY,EACV,KAAK,EACL,UAAU,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/src/index.js

@@ -0,0 +1,34 @@
+export const VERSION = '0.1.0';
+export { configure } from '../configure.js';
+export { checkAgainstDeclarations, definitionFromDeclaration, FlagsAdmin, ForbiddenError, ValidationError, } from './admin.js';
+export { ClickHouseBackend } from './analytics/clickhouse_backend.js';
+export { DuckDbBackend } from './analytics/duckdb.js';
+export { LucidBackend } from './analytics/lucid_backend.js';
+export { metric } from './analytics/metrics.js';
+export { computeResults, } from './analytics/results.js';
+export { flag, } from './declare.js';
+export { analytics, defineConfig, sinks, stores, transports, } from './define_config.js';
+export { DIAGNOSTICS_CHANNELS, enrichers } from './enrichers.js';
+export { EVENT_SCHEMA_VERSION, exposureId, uuidv7 } from './events/event.js';
+export { browserToken, registerBrowser } from './http/browser.js';
+export { flagsCsrfExceptions } from './http/csrf.js';
+export { authkitIdentity, authkitSubject, defaultSubject, subjectFromIdentity, } from './http/subject_resolver.js';
+export { identities, } from './identity.js';
+export { FlagsManager, FlagsScope } from './manager.js';
+export { Relay } from './relay/relay.js';
+export { FlagsWorker } from './relay/worker.js';
+export { createRuntime, lucidContext } from './runtime.js';
+export { createFlagsTables, dropFlagsTables, ensureEventPartitions, FLAGS_TABLES, pruneEvents, } from './schema.js';
+export { ClickHouseSink } from './sinks/clickhouse.js';
+export { LucidSink } from './sinks/lucid_sink.js';
+export { ParquetSink } from './sinks/parquet_sink.js';
+export { PostHogSink } from './sinks/posthog_sink.js';
+export { CallbackSink, MemorySink } from './sinks/sink.js';
+export { LucidStore, RULESET_CHANNEL } from './stores/lucid_store.js';
+export { MemoryStore } from './stores/memory_store.js';
+export { TENANT_SCOPES, tokens } from './topology/token.js';
+export { userVerifiers, verifiers, } from './topology/verify.js';
+export { DbTransport } from './transports/db_transport.js';
+export { MemoryTransport } from './transports/memory_transport.js';
+export { RedisTransport } from './transports/redis_transport.js';
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAU/B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAIL,wBAAwB,EACxB,yBAAyB,EACzB,UAAU,EACV,cAAc,EAGd,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAA0C,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAEL,cAAc,GAGf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAIL,IAAI,GAEL,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,SAAS,EAGT,YAAY,EAKZ,KAAK,EACL,MAAM,EAEN,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAiB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAkB,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAEL,eAAe,EACf,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAIL,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAqB,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAqB,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAa,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAUvD,OAAO,EAAE,aAAa,EAAoB,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAGL,aAAa,EAGb,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/src/manager.d.ts

@@ -0,0 +1,154 @@
+import { type EvaluateOptions, type EvaluationContext, type EvaluationDetails, type JsonValue, type Ruleset } from '@adonis-agora/flags-core';
+import type { FlagsAdmin } from './admin.js';
+import { type ExperimentResults } from './analytics/results.js';
+import { type FlagDeclaration } from './declare.js';
+import { type Enricher } from './enrichers.js';
+import type { EventBuffer } from './events/buffer.js';
+import type { RulesetSource } from './ruleset_source.js';
+import type { SqlClient } from './sql.js';
+import { type Subject, type SubjectLike } from './subject.js';
+import type { Transport } from './transports/transport.js';
+import type { BooleanFlagKey, FlagKey, FlagValue } from './types.js';
+import type { UsageCounter } from './usage.js';
+export interface TrackOptions {
+    /** Numeric value (revenue, duration). */
+    value?: number;
+    props?: Record<string, unknown>;
+    /**
+     * A Lucid transaction: with the `db` transport the event commits or rolls back with it. Other
+     * transports send it after the transaction commits.
+     */
+    client?: SqlClient & {
+        after?(event: 'commit', handler: () => void | Promise<void>): void;
+    };
+}
+export interface ManagerDeps {
+    app: string;
+    environment: string;
+    declarations: Record<string, FlagDeclaration>;
+    source: RulesetSource;
+    buffer?: EventBuffer;
+    transport?: Transport;
+    enrichers?: Enricher[];
+    usage?: UsageCounter;
+    /** Sticky assignments of a subject: flag key → variant (from the exposures table). */
+    sticky?: (subject: string) => Promise<Record<string, string>>;
+    /** Extra targeting attributes resolved for every subject (plan, org, …). */
+    attributes?: (subject: Subject) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    admin?: FlagsAdmin;
+    results?: (experiment: string, environment?: string) => Promise<ExperimentResults | null>;
+    forget?: (subject: string) => Promise<void>;
+    logger?: {
+        warn(message: string): void;
+        error(message: string): void;
+    };
+}
+/**
+ * The entry point: `flags.for(user).enabled('new_player')`. Evaluation is in memory against the
+ * ruleset the source keeps fresh; nothing here waits on the database except an opt-in sticky lookup
+ * (once per scope).
+ */
+export declare class FlagsManager {
+    #private;
+    readonly deps: ManagerDeps;
+    constructor(deps: ManagerDeps);
+    get environment(): string;
+    get app(): string;
+    get admin(): FlagsAdmin;
+    /** Flags declared in code. */
+    get declarations(): Record<string, FlagDeclaration<JsonValue>>;
+    /** Every known flag: declared in code or created in the console (code wins). */
+    effectiveDeclarations(): Record<string, FlagDeclaration<JsonValue> & {
+        source: import("./declare.js").DeclarationSource;
+    }>;
+    /** The ruleset this process evaluates against. */
+    ruleset(): Ruleset;
+    status(): {
+        app: string;
+        environment: string;
+        source: import("./ruleset_source.js").SourceStatus;
+        buffer: {
+            pending: number;
+            published: number;
+            dropped: number;
+        } | null;
+        transport: {
+            transactional: boolean;
+            durable: boolean;
+            name: string;
+        } | null;
+    };
+    /** Reloads the ruleset now (after an edit in this process, or from a command). */
+    refresh(): Promise<boolean>;
+    /** A scope for one subject. In HTTP handlers prefer `ctx.flags`, which the middleware builds. */
+    for(subject?: SubjectLike, attributes?: Record<string, unknown>): FlagsScope;
+    /** A scope whose subject is resolved on the first flag read. */
+    forLazy(resolve: () => Promise<SubjectLike> | SubjectLike, attributes?: Record<string, unknown>): FlagsScope;
+    /** The declared default: from code, else from the console declaration in the ruleset. */
+    declaredDefault(key: string): JsonValue | undefined;
+    /** @internal Evaluation with fakes, usage counting and enrichers. */
+    evaluateFor<T extends JsonValue>(key: string, fallback: T, context: EvaluationContext, options: EvaluateOptions): EvaluationDetails<T>;
+    /** @internal Records an exposure for an experiment assignment. */
+    expose(subject: Subject, details: EvaluationDetails): void;
+    /** Records a tracked event (a conversion) for a subject. */
+    track(subject: SubjectLike, name: string, options?: TrackOptions): Promise<void>;
+    /** Experiment results as last computed by the worker (or `null`), for this process's environment by default. */
+    results(experiment: string, environment?: string): Promise<ExperimentResults | null>;
+    /** Deletes everything stored about a subject in every sink that supports it. */
+    forget(subject: SubjectLike): Promise<void>;
+    /** @internal */
+    attributesFor(subject: Subject | undefined): Promise<Record<string, unknown>>;
+    /** @internal */
+    stickyFor(subject: Subject | undefined): Promise<Record<string, string>> | undefined;
+    /**
+     * Replaces flag values for the duration of a test. Every evaluation of a faked key returns the
+     * given value; tracked events are dropped. Returns a function that restores real evaluation.
+     *
+     * ```ts
+     * const restore = flags.fake({ checkout_v2: 'b' })
+     * // …
+     * restore()
+     * ```
+     */
+    fake(values: Partial<Record<FlagKey, JsonValue>>): () => void;
+    restore(): void;
+}
+/**
+ * Flags for one subject. Results are memoized for the life of the scope (one request), so a flag
+ * cannot change value halfway through rendering a page. The subject may be given directly or as a
+ * resolver that runs on the first read (what `ctx.flags` uses).
+ */
+export declare class FlagsScope {
+    #private;
+    readonly manager: FlagsManager;
+    readonly attributes: Record<string, unknown>;
+    constructor(manager: FlagsManager, subject: Subject | undefined | (() => Promise<SubjectLike> | SubjectLike), attributes?: Record<string, unknown>);
+    /** The subject this scope evaluates for (resolved on first use). */
+    subject(): Promise<Subject | undefined>;
+    /** Full evaluation details (value, variant, reason, error). Records an exposure for experiments. */
+    details<K extends FlagKey>(key: K): Promise<EvaluationDetails<FlagValue<K>>>;
+    /** The flag's value. */
+    value<K extends FlagKey>(key: K): Promise<FlagValue<K>>;
+    /** Whether a boolean flag is on. */
+    enabled<K extends BooleanFlagKey>(key: K): Promise<boolean>;
+    disabled<K extends BooleanFlagKey>(key: K): Promise<boolean>;
+    /**
+     * `true` when a boolean flag is on, or — given variants — when the flag serves one of them.
+     * What the Edge `@flag` tag compiles to.
+     */
+    matches<K extends FlagKey>(key: K, ...variants: string[]): Promise<boolean>;
+    /** The variant name served (experiments). Falls back to the value as a string. */
+    variant<K extends FlagKey>(key: K): Promise<string>;
+    /**
+     * Values of several flags at once — for the frontend. Without `keys`, only flags declared with
+     * `client: true` are included, so internal flag names never reach the browser by accident.
+     * Experiment exposures are NOT recorded here unless `expose: true`: values sent to a page are not
+     * necessarily seen.
+     */
+    all(keys?: FlagKey[], options?: {
+        expose?: boolean;
+    }): Promise<Record<string, JsonValue>>;
+    /** Records a tracked event for this scope's subject. */
+    track(name: string, options?: TrackOptions): Promise<void>;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/src/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAEtB,KAAK,SAAS,EACd,KAAK,OAAO,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,iBAAiB,EAAmB,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAwB,MAAM,cAAc,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,GAAG;QAAE,KAAK,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;CAC7F;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC9C,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,4EAA4E;IAC5E,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9F,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC1F,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACxE;AAID;;;;GAIG;AACH,qBAAa,YAAY;;IAIX,QAAQ,CAAC,IAAI,EAAE,WAAW;IAAtC,YAAqB,IAAI,EAAE,WAAW,EAAI;IAE1C,IAAI,WAAW,WAEd;IAED,IAAI,GAAG,WAEN;IAED,IAAI,KAAK,IAAI,UAAU,CAOtB;IAED,8BAA8B;IAC9B,IAAI,YAAY,+CAEf;IAED,gFAAgF;IAChF,qBAAqB;;OAEpB;IAED,kDAAkD;IAClD,OAAO,IAAI,OAAO,CAEjB;IAED,MAAM;QAEF,GAAG;QACH,WAAW;QACX,MAAM;QACN,MAAM;;;;;QAON,SAAS;;;;;MAIZ;IAED,kFAAkF;IAClF,OAAO,qBAEN;IAED,iGAAiG;IACjG,GAAG,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,UAAU,CAE/E;IAED,gEAAgE;IAChE,OAAO,CACL,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,EACjD,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACvC,UAAU,CAEZ;IAED,yFAAyF;IACzF,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAElD;IAED,qEAAqE;IACrE,WAAW,CAAC,CAAC,SAAS,SAAS,EAC7B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,eAAe,GACvB,iBAAiB,CAAC,CAAC,CAAC,CAiCtB;IAED,kEAAkE;IAClE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAuBzD;IAED,4DAA4D;IACtD,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCzF;IAED,gHAAgH;IAChH,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAEnF;IAED,gFAAgF;IAC1E,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhD;IAED,gBAAgB;IACV,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAGlF;IAED,gBAAgB;IAChB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAGnF;IAED;;;;;;;;;OASG;IACH,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,GAAG,MAAM,IAAI,CAG5D;IAED,OAAO,SAEN;CACF;AAED;;;;GAIG;AACH,qBAAa,UAAU;;IASnB,QAAQ,CAAC,OAAO,EAAE,YAAY;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAH9C,YACW,OAAO,EAAE,YAAY,EAC9B,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,EAChE,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EASlD;IAED,oEAAoE;IACpE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAItC;IAiCD,oGAAoG;IAC9F,OAAO,CAAC,CAAC,SAAS,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAKjF;IAED,wBAAwB;IAClB,KAAK,CAAC,CAAC,SAAS,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAE5D;IAED,oCAAoC;IAC9B,OAAO,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhE;IAEK,QAAQ,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjE;IAED;;;OAGG;IACG,OAAO,CAAC,CAAC,SAAS,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;IAED,kFAAkF;IAC5E,OAAO,CAAC,CAAC,SAAS,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxD;IAED;;;;;OAKG;IACG,GAAG,CACP,IAAI,CAAC,EAAE,OAAO,EAAE,EAChB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAWpC;IAED,wDAAwD;IAClD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAInE;CACF"}