@adonis-agora/flags 0.0.0-stage → 0.1.0

package/dist/src/http/browser_api.js

@@ -0,0 +1,273 @@
+import { createHash } from 'node:crypto';
+import { PassThrough } from 'node:stream';
+import { evaluate } from '@adonis-agora/flags-core';
+import { HOLDOUT_VARIANT } from '../analytics/results.js';
+import { EVENT_SCHEMA_VERSION, exposureId, uuidv7 } from '../events/event.js';
+import { toContext } from '../subject.js';
+import { verifyBrowserToken } from '../topology/browser_token.js';
+/** Untrusted attributes a browser may add (screen, locale): small, primitive, never identity. */
+function browserAttributes(input) {
+    const out = {};
+    if (typeof input !== 'object' || input === null || Array.isArray(input))
+        return out;
+    for (const [key, value] of Object.entries(input).slice(0, 20)) {
+        if (key === 'targetingKey' || key === 'subjectType')
+            continue;
+        if (typeof value === 'string' && value.length <= 200)
+            out[key] = value;
+        else if (typeof value === 'number' && Number.isFinite(value))
+            out[key] = value;
+        else if (typeof value === 'boolean')
+            out[key] = value;
+    }
+    return out;
+}
+/**
+ * Flags for frontends that talk to the flags server directly (SPAs, mobile, static sites):
+ *
+ * - `POST <prefix>/v1/client/evaluate` — values of the flags declared `client: true`, for the
+ *   verified user. ETag over ruleset + context.
+ * - `GET  <prefix>/v1/client/stream?token=…` — server-sent `ruleset` events.
+ * - `POST <prefix>/v1/client/events` — exposures (`{ type: 'exposure', flag }`, re-evaluated here)
+ *   and tracks (`{ type: 'track', name, value?, props? }`).
+ *
+ * Tokens are minted by the apps' token endpoints (`GET /_flags/token`) or, with `verifyUser`, by
+ * an identity provider. The identity always comes from the verified token. Attributes the browser sends are merged
+ * underneath the token's, so they can never change who the user is or what the token says.
+ */
+export class BrowserApi {
+    runtime;
+    rulesetOf;
+    options;
+    #clientFlags;
+    constructor(runtime, rulesetOf, options) {
+        this.runtime = runtime;
+        this.rulesetOf = rulesetOf;
+        this.options = options;
+    }
+    register(router, prefix) {
+        const base = `${prefix}/v1/client`;
+        router.post(`${base}/evaluate`, (ctx) => this.evaluate(ctx)).as('flags.client.evaluate');
+        router.get(`${base}/stream`, (ctx) => this.stream(ctx)).as('flags.client.stream');
+        router.post(`${base}/events`, (ctx) => this.events(ctx)).as('flags.client.events');
+        if (this.options.corsOrigins?.length && router.route) {
+            for (const path of ['evaluate', 'events', 'stream']) {
+                router.route(`${base}/${path}`, ['OPTIONS'], (ctx) => this.#preflight(ctx));
+            }
+        }
+    }
+    #cors(ctx) {
+        const origin = ctx.request.header('origin');
+        if (origin && this.options.corsOrigins?.includes(origin)) {
+            ctx.response.header('access-control-allow-origin', origin);
+            ctx.response.header('vary', 'Origin');
+            ctx.response.header('access-control-expose-headers', 'ETag');
+        }
+    }
+    #preflight(ctx) {
+        this.#cors(ctx);
+        ctx.response.header('access-control-allow-methods', 'GET, POST, OPTIONS');
+        ctx.response.header('access-control-allow-headers', 'authorization, content-type, if-none-match');
+        ctx.response.header('access-control-max-age', '600');
+        return ctx.response.status(204).send('');
+    }
+    async #auth(ctx, token) {
+        const header = ctx.request.header('authorization');
+        const bearer = token ??
+            (header && /^bearer\s+/i.test(header) ? header.replace(/^bearer\s+/i, '').trim() : undefined);
+        const verified = verifyBrowserToken(bearer, this.options.secret) ??
+            (bearer && this.options.verifyUser ? await this.options.verifyUser({ token: bearer }) : null);
+        if (!verified) {
+            ctx.response.status(401).send({ error: 'unauthorized' });
+            return null;
+        }
+        return verified;
+    }
+    #environment(user) {
+        return user.environment ?? this.runtime.manager.environment;
+    }
+    /** Keys the browser may see: declared `client: true` in the console, in code, or by a tenant. */
+    async #clientKeys(ruleset) {
+        const now = Date.now();
+        if (!this.#clientFlags || now - this.#clientFlags.at > 30_000) {
+            const keys = new Set();
+            for (const [key, declaration] of Object.entries(this.runtime.manager.declarations)) {
+                if (declaration.client)
+                    keys.add(key);
+            }
+            for (const row of (await this.runtime.store?.declarations()) ?? []) {
+                if (row.declaration.client)
+                    keys.add(row.key);
+            }
+            this.#clientFlags = { at: now, keys };
+        }
+        const keys = new Set(this.#clientFlags.keys);
+        for (const [key, definition] of Object.entries(ruleset.flags)) {
+            if (definition.declaration?.client)
+                keys.add(key);
+            else if (definition.declaration && definition.declaration.client !== true)
+                keys.delete(key);
+        }
+        return keys;
+    }
+    #defaultOf(ruleset, key) {
+        return (this.runtime.manager.declarations[key]?.default ??
+            ruleset.flags[key]?.declaration?.default ??
+            null);
+    }
+    async evaluate(ctx) {
+        this.#cors(ctx);
+        const user = await this.#auth(ctx);
+        if (!user)
+            return;
+        const environment = this.#environment(user);
+        const ruleset = await this.rulesetOf(environment);
+        const attributes = browserAttributes(ctx.request.body().attributes);
+        const context = toContext(user.subject, attributes);
+        const etag = `"${ruleset.version}-${createHash('sha1').update(JSON.stringify(context)).digest('hex').slice(0, 16)}"`;
+        ctx.response.header('etag', etag);
+        ctx.response.header('cache-control', 'no-store');
+        if (ctx.request.header('if-none-match') === etag)
+            return ctx.response.status(304).send('');
+        const values = {};
+        const variants = {};
+        const experiments = [];
+        for (const key of [...(await this.#clientKeys(ruleset))].sort()) {
+            const details = evaluate(ruleset, key, this.#defaultOf(ruleset, key), context);
+            values[key] = details.value;
+            if (details.variant !== undefined)
+                variants[key] = details.variant;
+            if (typeof details.flagMetadata.experiment === 'string')
+                experiments.push(key);
+        }
+        return ctx.response.json({ version: ruleset.version, values, variants, experiments });
+    }
+    /** `EventSource` cannot send headers, so the token comes in the query string. Keep it short-lived. */
+    async stream(ctx) {
+        this.#cors(ctx);
+        const user = await this.#auth(ctx, String(ctx.request.qs().token ?? '') || undefined);
+        if (!user)
+            return;
+        const environment = this.#environment(user);
+        const body = new PassThrough();
+        const send = (chunk) => {
+            if (!body.writableEnded)
+                body.write(chunk);
+        };
+        let last = (await this.rulesetOf(environment)).version;
+        send(`event: ruleset\ndata: ${JSON.stringify({ version: last })}\n\n`);
+        const cleanups = [];
+        const close = () => {
+            for (const fn of cleanups.splice(0))
+                fn();
+            if (!body.writableEnded)
+                body.end();
+        };
+        if (environment === this.runtime.manager.environment) {
+            cleanups.push(this.runtime.source.onChange((ruleset) => {
+                last = ruleset.version;
+                send(`event: ruleset\ndata: ${JSON.stringify({ version: ruleset.version })}\n\n`);
+            }));
+        }
+        else {
+            const poll = setInterval(async () => {
+                try {
+                    const version = (await this.rulesetOf(environment)).version;
+                    if (version !== last) {
+                        last = version;
+                        send(`event: ruleset\ndata: ${JSON.stringify({ version })}\n\n`);
+                    }
+                }
+                catch {
+                    // keep the stream; the client polls too
+                }
+            }, 5000);
+            cleanups.push(() => clearInterval(poll));
+        }
+        const heartbeat = setInterval(() => send(': ping\n\n'), 25_000);
+        cleanups.push(() => clearInterval(heartbeat));
+        if (user.expiresAt) {
+            const expiry = setTimeout(close, Math.max(0, user.expiresAt - Date.now()));
+            cleanups.push(() => clearTimeout(expiry));
+        }
+        ctx.request.request.once('close', close);
+        ctx.response.header('content-type', 'text/event-stream');
+        ctx.response.header('cache-control', 'no-cache, no-transform');
+        ctx.response.header('x-accel-buffering', 'no');
+        ctx.response.stream(body);
+    }
+    async events(ctx) {
+        this.#cors(ctx);
+        const user = await this.#auth(ctx);
+        if (!user)
+            return;
+        const raw = ctx.request.body().events;
+        if (!Array.isArray(raw) || raw.length > 200) {
+            return ctx.response.status(400).send({ error: 'events must be an array of at most 200' });
+        }
+        const environment = this.#environment(user);
+        const ruleset = await this.rulesetOf(environment);
+        const clientKeys = await this.#clientKeys(ruleset);
+        // Anonymous visitors have no targeting key: nothing to attribute.
+        if (!user.subject)
+            return ctx.response.status(202).send({ accepted: 0 });
+        const app = user.app ?? 'browser';
+        const subject = String(user.subject.id);
+        const subjectType = user.subject.type ?? 'user';
+        const context = toContext(user.subject);
+        const out = [];
+        for (const entry of raw) {
+            if (entry?.type === 'exposure' &&
+                typeof entry.flag === 'string' &&
+                clientKeys.has(entry.flag)) {
+                // Re-evaluated here: the browser says which flag it showed, never which variant.
+                const details = evaluate(ruleset, entry.flag, this.#defaultOf(ruleset, entry.flag), context);
+                const experiment = details.flagMetadata.experiment;
+                const holdout = details.flagMetadata.holdout === true;
+                if (typeof experiment !== 'string' || details.variant === undefined)
+                    continue;
+                if (details.reason !== 'SPLIT' && !holdout)
+                    continue;
+                out.push({
+                    id: exposureId(app, environment, experiment, subject),
+                    schemaVersion: EVENT_SCHEMA_VERSION,
+                    app,
+                    environment,
+                    type: 'exposure',
+                    flag: entry.flag,
+                    experiment,
+                    variant: holdout ? HOLDOUT_VARIANT : details.variant,
+                    subject,
+                    subjectType,
+                    ...(holdout ? { props: { holdout: true } } : {}),
+                    ts: Date.now(),
+                });
+            }
+            else if (entry?.type === 'track' &&
+                typeof entry.name === 'string' &&
+                entry.name.length <= 191) {
+                const value = typeof entry.value === 'number' && Number.isFinite(entry.value) ? entry.value : undefined;
+                const props = entry.props && typeof entry.props === 'object' && !Array.isArray(entry.props)
+                    ? entry.props
+                    : undefined;
+                out.push({
+                    id: uuidv7(),
+                    schemaVersion: EVENT_SCHEMA_VERSION,
+                    app,
+                    environment,
+                    type: 'track',
+                    name: entry.name,
+                    subject,
+                    subjectType,
+                    ...(value !== undefined ? { value } : {}),
+                    ...(props ? { props } : {}),
+                    ts: Date.now(),
+                });
+            }
+        }
+        if (out.length > 0)
+            await this.runtime.transport.publish(out);
+        return ctx.response.status(202).send({ accepted: out.length });
+    }
+}
+//# sourceMappingURL=browser_api.js.map

package/dist/src/http/browser_api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser_api.js","sourceRoot":"","sources":["../../../src/http/browser_api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAgC,MAAM,0BAA0B,CAAC;AAElF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAkB,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE9F,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAkBlE,iGAAiG;AACjG,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,GAAG,GAA8C,EAAE,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACpF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,aAAa;YAAE,SAAS;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1E,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,UAAU;IAIF,OAAO;IACP,SAAS;IACT,OAAO;IAL1B,YAAY,CAAgD;IAE5D,YACmB,OAAqB,EACrB,SAAoD,EACpD,OAA0B;uBAF1B,OAAO;yBACP,SAAS;uBACT,OAAO;IACvB,CAAC;IAEJ,QAAQ,CAAC,MAAkB,EAAE,MAAc;QACzC,MAAM,IAAI,GAAG,GAAG,MAAM,YAAY,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACrD,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAgB;QACpB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YAC3D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,UAAU,CAAC,GAAgB;QACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC,MAAM,CACjB,8BAA8B,EAC9B,4CAA4C,CAC7C,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAgB,EAAE,KAAc;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,MAAM,GACV,KAAK;YACL,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChG,MAAM,QAAQ,GACZ,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAC/C,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,YAAY,CAAC,IAAkB;QAC7B,OAAO,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9D,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,WAAW,CAAC,OAAgB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBACnF,IAAI,WAAW,CAAC,MAAM;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnE,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,UAAU,CAAC,WAAW,EAAE,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;iBAC7C,IAAI,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CAAC,OAAgB,EAAE,GAAW;QACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,OAAO;YACrD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO;YACxC,IAAI,CAAc,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAgB;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,iBAAiB,CACjC,GAAG,CAAC,OAAO,CAAC,IAAI,EAA+B,CAAC,UAAU,CAC5D,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QACrH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,MAAM,MAAM,GAA8B,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;YACnE,IAAI,OAAO,OAAO,CAAC,YAAY,CAAC,UAAU,KAAK,QAAQ;gBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,sGAAsG;IACtG,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,CAAC,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC;QACF,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QACvD,IAAI,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACtC,CAAC,CAAC;QACF,IAAI,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CACX,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACvC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;gBACvB,IAAI,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YACpF,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;gBAClC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;oBAC5D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;wBACrB,IAAI,GAAG,OAAO,CAAC;wBACf,IAAI,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;oBACnE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;gBAC1C,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QAC/D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAC/C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,GAAG,GAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAA2B,CAAC,MAAM,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnD,kEAAkE;QAClE,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;QAChD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,GAAqC,EAAE,CAAC;YAC1D,IACE,KAAK,EAAE,IAAI,KAAK,UAAU;gBAC1B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAC9B,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAC1B,CAAC;gBACD,iFAAiF;gBACjF,MAAM,OAAO,GAAG,QAAQ,CACtB,OAAO,EACP,KAAK,CAAC,IAAI,EACV,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EACpC,OAAO,CACR,CAAC;gBACF,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC;gBACnD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,KAAK,IAAI,CAAC;gBACtD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;oBAAE,SAAS;gBAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACrD,GAAG,CAAC,IAAI,CAAC;oBACP,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC;oBACrD,aAAa,EAAE,oBAAoB;oBACnC,GAAG;oBACH,WAAW;oBACX,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,UAAU;oBACV,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;oBACpD,OAAO;oBACP,WAAW;oBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;iBACf,CAAC,CAAC;YACL,CAAC;iBAAM,IACL,KAAK,EAAE,IAAI,KAAK,OAAO;gBACvB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,EACxB,CAAC;gBACD,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5F,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;oBAC3E,CAAC,CAAE,KAAK,CAAC,KAAiC;oBAC1C,CAAC,CAAC,SAAS,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC;oBACP,EAAE,EAAE,MAAM,EAAE;oBACZ,aAAa,EAAE,oBAAoB;oBACnC,GAAG;oBACH,WAAW;oBACX,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO;oBACP,WAAW;oBACX,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,SAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/src/http/browser_tokens.d.ts

@@ -0,0 +1,27 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { BrowserConfig } from '../define_config.js';
+import type { FlagsRuntime } from '../runtime.js';
+import { type BrowserKeySource, type IssuedBrowserToken } from '../topology/browser_token.js';
+export interface BrowserTokenResponse extends IssuedBrowserToken {
+    /** The flags API the token is for. */
+    url: string;
+}
+/**
+ * Issues browser tokens for the request's subject — the same one `ctx.flags` uses: the authkit
+ * identity when `@adonis-agora/authkit-client` is installed, else your `subject` resolver, else
+ * `ctx.auth.user`, else an anonymous visitor (static values only). The `attributes` resolver of
+ * `config/flags.ts` runs too, so server-side attributes travel signed with the token.
+ */
+export declare class BrowserTokens {
+    private readonly runtime;
+    private readonly keys;
+    private readonly url;
+    private readonly config;
+    private readonly logger?;
+    constructor(runtime: FlagsRuntime, keys: BrowserKeySource, url: string, config: BrowserConfig, logger?: {
+        warn(message: string): void;
+    } | undefined);
+    issue(ctx: HttpContext): Promise<BrowserTokenResponse>;
+    handle(ctx: HttpContext): Promise<void>;
+}
+//# sourceMappingURL=browser_tokens.d.ts.map

package/dist/src/http/browser_tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser_tokens.d.ts","sourceRoot":"","sources":["../../../src/http/browser_tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EAExB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAL1B,YACmB,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,YAAA,EACvD;IAEE,KAAK,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAe3D;IAEK,MAAM,CAAC,GAAG,EAAE,WAAW,iBAS5B;CACF"}

package/dist/src/http/browser_tokens.js

@@ -0,0 +1,48 @@
+import { subjectResolver } from '../identity.js';
+import { toSubject } from '../subject.js';
+import { signBrowserToken, } from '../topology/browser_token.js';
+/**
+ * Issues browser tokens for the request's subject — the same one `ctx.flags` uses: the authkit
+ * identity when `@adonis-agora/authkit-client` is installed, else your `subject` resolver, else
+ * `ctx.auth.user`, else an anonymous visitor (static values only). The `attributes` resolver of
+ * `config/flags.ts` runs too, so server-side attributes travel signed with the token.
+ */
+export class BrowserTokens {
+    runtime;
+    keys;
+    url;
+    config;
+    logger;
+    constructor(runtime, keys, url, config, logger) {
+        this.runtime = runtime;
+        this.keys = keys;
+        this.url = url;
+        this.config = config;
+        this.logger = logger;
+    }
+    async issue(ctx) {
+        const resolve = subjectResolver(this.runtime.config);
+        const subject = toSubject(await resolve(ctx));
+        const resolved = await this.runtime.manager.attributesFor(subject);
+        const { key, app, environment } = await this.keys.get();
+        const issued = signBrowserToken(subject && { ...subject, attributes: { ...resolved, ...subject.attributes } }, {
+            key,
+            app,
+            environment,
+            ...(this.config.ttlSeconds !== undefined ? { ttlSeconds: this.config.ttlSeconds } : {}),
+        });
+        return { ...issued, url: this.url };
+    }
+    async handle(ctx) {
+        try {
+            const body = await this.issue(ctx);
+            ctx.response.header('cache-control', 'no-store');
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            this.logger?.warn(`[flags] issuing a browser token failed: ${error.message}`);
+            return ctx.response.status(503).send({ error: 'flags unavailable' });
+        }
+    }
+}
+//# sourceMappingURL=browser_tokens.js.map

package/dist/src/http/browser_tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser_tokens.js","sourceRoot":"","sources":["../../../src/http/browser_tokens.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAGL,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AAOtC;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IAEL,OAAO;IACP,IAAI;IACJ,GAAG;IACH,MAAM;IACN,MAAM;IALzB,YACmB,OAAqB,EACrB,IAAsB,EACtB,GAAW,EACX,MAAqB,EACrB,MAAwC;uBAJxC,OAAO;oBACP,IAAI;mBACJ,GAAG;sBACH,MAAM;sBACN,MAAM;IACtB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,GAAgB;QAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,gBAAgB,CAC7B,OAAO,IAAI,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,EAAE,EAC7E;YACE,GAAG;YACH,GAAG;YACH,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CACF,CAAC;QACF,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACjD,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,2CAA4C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACzF,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;CACF"}

package/dist/src/http/control_plane.d.ts

@@ -0,0 +1,58 @@
+import { type Ruleset } from '@adonis-agora/flags-core';
+import type { HttpContext } from '@adonisjs/core/http';
+import type { FlagDeclaration } from '../declare.js';
+import type { ControlPlaneConfig } from '../define_config.js';
+import type { FlagsRuntime } from '../runtime.js';
+interface RouterLike {
+    get(pattern: string, handler: (ctx: HttpContext) => unknown): {
+        as(name: string): unknown;
+    };
+    post(pattern: string, handler: (ctx: HttpContext) => unknown): {
+        as(name: string): unknown;
+    };
+    any?(pattern: string, handler: (ctx: HttpContext) => unknown): unknown;
+    route?(pattern: string, methods: string[], handler: (ctx: HttpContext) => unknown): unknown;
+}
+/** What the control-plane knows about each tenant that called it (shown in the console). */
+export interface TenantInfo {
+    partition: string;
+    environment: string;
+    capabilities: string[];
+    lastSeenAt: string;
+    lastRulesetVersion?: string;
+}
+export declare function knownTenants(): TenantInfo[];
+/**
+ * Serves tenants: the ruleset (ETag + SSE), event ingestion, declarations and usage, plus OFREP.
+ * Every request is authenticated by `verifyTenant`; the tenant identity and environment come from
+ * the verified token, never from the request body.
+ */
+export declare class ControlPlane {
+    #private;
+    private readonly runtime;
+    private readonly options;
+    /** Set when `browser` is configured: tenants fetch their browser signing keys. */
+    private readonly browserSecret?;
+    readonly prefix: string;
+    constructor(runtime: FlagsRuntime, options: ControlPlaneConfig<Record<string, FlagDeclaration>>['controlPlane'], 
+    /** Set when `browser` is configured: tenants fetch their browser signing keys. */
+    browserSecret?: string | undefined);
+    /** The ruleset of an environment: the live one for ours, a version-checked cache for others. */
+    ruleset(environment: string): Promise<Ruleset>;
+    register(router: RouterLike): void;
+    /**
+     * A tenant's browser signing key, for its own partition and environment only. Requires the
+     * events scope: a browser token lets the browser send events in the tenant's name.
+     */
+    browserKey(ctx: HttpContext): Promise<void>;
+    getRuleset(ctx: HttpContext): Promise<void>;
+    /** SSE: an `event: ruleset` message on every change; closes when the token expires. */
+    stream(ctx: HttpContext): Promise<void>;
+    events(ctx: HttpContext): Promise<void>;
+    declarations(ctx: HttpContext): Promise<void>;
+    usage(ctx: HttpContext): Promise<void>;
+    ofrepOne(ctx: HttpContext): Promise<void>;
+    ofrepBulk(ctx: HttpContext): Promise<void>;
+}
+export {};
+//# sourceMappingURL=control_plane.d.ts.map

package/dist/src/http/control_plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control_plane.d.ts","sourceRoot":"","sources":["../../../src/http/control_plane.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,OAAO,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAKlD,UAAU,UAAU;IAClB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG;QAAE,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC5F,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG;QAAE,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC7F,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC;IACvE,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC;CAC7F;AAED,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID,wBAAgB,YAAY,IAAI,UAAU,EAAE,CAE3C;AAQD;;;;GAIG;AACH,qBAAa,YAAY;;IAKrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAPjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAGxB,YACmB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7F,kFAAkF;IACjE,aAAa,CAAC,EAAE,MAAM,YAAA,EAGxC;IAiCD,gGAAgG;IAC1F,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASnD;IAED,QAAQ,CAAC,MAAM,EAAE,UAAU,QAsB1B;IAED;;;OAGG;IACG,UAAU,CAAC,GAAG,EAAE,WAAW,iBAUhC;IAEK,UAAU,CAAC,GAAG,EAAE,WAAW,iBAWhC;IAED,uFAAuF;IACjF,MAAM,CAAC,GAAG,EAAE,WAAW,iBAiD5B;IAEK,MAAM,CAAC,GAAG,EAAE,WAAW,iBAiB5B;IAEK,YAAY,CAAC,GAAG,EAAE,WAAW,iBASlC;IAEK,KAAK,CAAC,GAAG,EAAE,WAAW,iBAyB3B;IAyCK,QAAQ,CAAC,GAAG,EAAE,WAAW,iBAwB9B;IAEK,SAAS,CAAC,GAAG,EAAE,WAAW,iBAyB/B;CACF"}