@ezghcloud/flags-openfeature 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,168 @@
-# Temporary Holding Version
+# @ezghcloud/flags-openfeature
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[OpenFeature](https://openfeature.dev) providers for **EZGH Feature Flags**, in TypeScript:
+
+- `@ezghcloud/flags-openfeature/server`: `EzghProvider`, for backends on Node (20+), Bun and Deno.
+  It keeps the environment's compiled flags in memory and evaluates locally with flagd's
+  open-source core, so an evaluation never makes a network call.
+- `@ezghcloud/flags-openfeature/web`: `EzghWebProvider`, for browsers (React through OpenFeature's
+  React SDK). It evaluates remotely, so rules never reach the browser.
+
+You write against the OpenFeature API; the provider connects it to EZGH. Licensed Apache-2.0.
+
+## Install
+
+```bash
+npm install @ezghcloud/flags-openfeature
+bun add @ezghcloud/flags-openfeature
+pnpm add @ezghcloud/flags-openfeature
+```
+
+Install the OpenFeature SDK you use alongside it: `@openfeature/server-sdk` for the server
+provider, `@openfeature/web-sdk` (and `@openfeature/react-sdk` for React) for the web provider.
+
+## Server provider
+
+Create a **server key** (`ezgh_fs_…`) for an environment in the console or with
+`ezgh flags sdk-keys create`, and keep it secret: it can read every flag's rules.
+
+```ts
+import { OpenFeature } from "@openfeature/server-sdk"
+import { EzghProvider } from "@ezghcloud/flags-openfeature/server"
+
+await OpenFeature.setProviderAndWait(new EzghProvider({ sdkKey: process.env.EZGH_FLAGS_KEY! }))
+const flags = OpenFeature.getClient()
+
+if (await flags.getBooleanValue("new-checkout", false, { targetingKey: user.id, plan: user.plan })) {
+  // …
+}
+```
+
+- **Startup:** the provider fetches the environment's snapshot and is ready once it has it, then
+  follows the data plane's sync stream. If the stream fails three times in a row, it polls the
+  snapshot every 30 seconds while it keeps retrying the stream (exponential backoff with jitter,
+  honouring `Retry-After`).
+- **Changes:** every new snapshot version emits `PROVIDER_CONFIGURATION_CHANGED` with
+  `metadata.snapshotVersion` and `flagsChanged`: the flags whose configuration changed, appeared
+  or disappeared (a segment edit counts for the flags using it; the list can be empty).
+- **Disconnected** for 30 seconds: it keeps evaluating the last snapshot and emits
+  `PROVIDER_STALE`, then `PROVIDER_READY` once it reaches the data plane again.
+- **A revoked or unknown key** is fatal (a stream ending with `revoked` or `environmentDeleted`,
+  or a `401`/`403`):
+  `PROVIDER_ERROR` with `PROVIDER_FATAL`, the client status becomes `FATAL` (OpenFeature then
+  answers defaults), and the provider stops.
+- **Reasons:** `TARGETING_MATCH`, `STATIC`, `DEFAULT`, and `DISABLED` for a flag that's off in
+  the environment (with its off value). `flagMetadata.flagVersion` is the flag's config version.
+
+### Options
+
+| Option | Default | |
+| --- | --- | --- |
+| `sdkKey` | | A server key. Required unless `offline`. |
+| `endpoint` | `https://flags.ezghcloud.com` | The data plane. |
+| `bootstrapPath` | | A snapshot file from `ezgh flags export`. The provider is ready from it without the network, then syncs; the data plane's snapshot replaces it whatever its version. |
+| `offline` | `false` | Use only `bootstrapPath` and never call the network (tests, CI, air-gapped runs). |
+| `timeoutMs` | `10000` | How long `initialize` waits for the first snapshot. On a timeout it fails (status `ERROR`) and keeps trying; it emits `PROVIDER_READY` when the snapshot arrives. |
+| `pollIntervalMs` | `30000` | The snapshot poll interval while the stream is down. |
+| `staleAfterMs` | `30000` | How long without reaching the data plane before `PROVIDER_STALE`. |
+| `minBackoffMs`, `maxBackoffMs` | `1000`, `60000` | Stream reconnect backoff. A `Retry-After` is honoured up to the maximum. A stream ending with `rotate` reconnects at once; `shutdown` after a little jitter; any other reason backs off like a failure. |
+| `idleTimeoutMs` | `45000` | A stream silent this long (the data plane sends a heartbeat every 15 s) is reconnected. |
+| `fetch`, `logger` | global `fetch`, console | |
+
+### Offline and tests
+
+```ts
+// A file from `ezgh flags export --env production > flags.json`; no network at all.
+await OpenFeature.setProviderAndWait(new EzghProvider({ offline: true, bootstrapPath: "flags.json" }))
+```
+
+## Browsers and React
+
+Create a **client key** (`ezgh_fc_…`) for the environment. It's publishable: ship it in your
+bundle. A client key only sees flags marked **client-side** (`clientSide: true`); any other flag
+answers `FLAG_NOT_FOUND` exactly as a flag that doesn't exist, and rules never leave EZGH.
+
+```ts
+import { OpenFeature } from "@openfeature/web-sdk"
+import { EzghWebProvider } from "@ezghcloud/flags-openfeature/web"
+
+await OpenFeature.setContext({ targetingKey: user.id, plan: user.plan })
+OpenFeature.setProvider(new EzghWebProvider({ clientKey: "ezgh_fc_…" }))
+```
+
+- **Evaluation:** one bulk evaluation of every client-side flag at startup and on every
+  `OpenFeature.setContext`; flags are then answered synchronously from those results.
+- **Refresh:** when the page becomes visible again and every 5 minutes (`refreshMs`), with
+  `If-None-Match`, so an unchanged answer costs a `304`. Changes emit
+  `PROVIDER_CONFIGURATION_CHANGED` with the flags whose value or variant changed.
+- **Live updates** are opt-in: `new EzghWebProvider({ clientKey, live: true })` keeps one stream
+  per tab open and refetches as soon as a client-side flag changes.
+- Nothing is stored in `localStorage` or `sessionStorage`; results live in memory only.
+- A revoked key or a deleted environment is fatal (`PROVIDER_FATAL`), as for the server provider.
+
+With React, use OpenFeature's React SDK; there's no EZGH React package:
+
+```tsx
+import { OpenFeatureProvider, useBooleanFlagValue } from "@openfeature/react-sdk"
+
+function App() {
+  return (
+    <OpenFeatureProvider>
+      <Checkout />
+    </OpenFeatureProvider>
+  )
+}
+
+function Checkout() {
+  const newCheckout = useBooleanFlagValue("new-checkout", false)
+  return newCheckout ? <NewCheckout /> : <OldCheckout />
+}
+```
+
+Options: `clientKey`, `endpoint`, `live` (`false`), `refreshMs` (5 minutes), `timeoutMs` (10 s for
+the first evaluation; it keeps retrying after and emits `PROVIDER_READY`), `minBackoffMs`,
+`maxBackoffMs`, `idleTimeoutMs`, `changedRetryMs` (1 s: after a `changed` whose refetch is a `304`,
+one more refetch this much later), `fetch`, `logger`. A context the data plane refuses (`400
+INVALID_CONTEXT`) isn't retried; the provider answers defaults until the context changes. Each
+live-stream connection refreshes once (conditionally), the first included.
+
+## Conformance
+
+`test/vectors/` holds flags-stack's conformance vectors (`protocol/vectors/eval`) verbatim, at the
+commit in `.flags-stack-rev`. Every case is evaluated through this package's evaluator and must
+match the value, variant, reason, flag version and error code that flags-stack, the Go provider
+and the Python provider answer. CI checks the copy against flags-stack with a read-only deploy key.
+
+To update them: `scripts/sync-vectors.sh ~/code/flags-stack <commit>`, then `bun run check`. Don't
+edit the vectors here; a failing vector is a cross-core disagreement to fix in flags-stack.
+
+## Development
+
+```bash
+bun install
+bun run check   # typecheck, tests (vectors included), build, a Node import smoke test
+```
+
+**End to end:** `scripts/e2e.sh <flags-stack checkout>` builds flags-stack and its fake org-api,
+runs `flags-stack all` on `DATABASE_URL` (a database of its own) and `REDIS_URL`, and runs
+`test/e2e/e2e.test.ts`: an environment, a client-side flag and both kinds of key through the API;
+both providers see it off, then on within seconds of a config write; revoking the server key makes
+its provider fatal. CI runs it in the E2E workflow against flags-stack at `.flags-stack-rev`.
+
+## Releasing
+
+Releases go to npm as `@ezghcloud/flags-openfeature`, published by the Release workflow
+(`.github/workflows/release.yml`) with npm trusted publishing: GitHub Actions OIDC, no npm token,
+provenance attached automatically.
+
+1. Bump `version` in `package.json` and commit it on `main`.
+2. Push the tag: `git tag vX.Y.Z && git push origin vX.Y.Z`.
+
+On the tag, the workflow checks the tag equals `package.json`'s version, runs `bun run check`,
+builds, packs `dist/`, publishes (skipping a version already on npm) and creates the GitHub
+release. `main` never holds `dist/`.
+
+First-time owner setup (once, logged in to npm with 2FA): `scripts/npm-trust.sh
+@ezghcloud/flags-openfeature` publishes a placeholder if the package doesn't exist yet, trusts this
+repository's `release.yml` to publish it, and requires 2FA with tokens disallowed. Keep the
+workflow's filename: the npm trust entry names it.

package/dist/server.d.ts

@@ -0,0 +1,42 @@
+import { OpenFeatureEventEmitter, type EvaluationContext, type JsonValue, type Logger, type Provider, type ResolutionDetails } from "@openfeature/server-sdk";
+export { DEFAULT_ENDPOINT } from "./shared/http.ts";
+export interface EzghProviderOptions {
+    /** A server SDK key (`ezgh_fs_…`). Required unless `offline`. */
+    sdkKey?: string;
+    /** The data plane; defaults to https://flags.ezghcloud.com. */
+    endpoint?: string;
+    /** A snapshot file (`ezgh flags export`): the provider is ready from it without the network. */
+    bootstrapPath?: string;
+    /** Use only `bootstrapPath`; never call the network (tests, CI, air-gapped runs). */
+    offline?: boolean;
+    /** The fetch to use; defaults to the global one. */
+    fetch?: typeof fetch;
+    /** Logs snapshot and connection problems; defaults to console warnings and errors. */
+    logger?: Logger;
+    /** How long `initialize` waits for the first snapshot (default 10 s). Syncing continues after. */
+    timeoutMs?: number;
+    /** The snapshot poll interval while the stream is down (default 30 s). */
+    pollIntervalMs?: number;
+    /** Stale after this long without reaching the data plane (default 30 s). */
+    staleAfterMs?: number;
+    /** Stream reconnect backoff bounds (default 1 s to 60 s, with jitter). */
+    minBackoffMs?: number;
+    maxBackoffMs?: number;
+    /** A stream that sends nothing (not even a heartbeat) for this long is reconnected (default 45 s). */
+    idleTimeoutMs?: number;
+}
+export declare class EzghProvider implements Provider {
+    #private;
+    readonly metadata: {
+        readonly name: "ezgh-flags";
+    };
+    readonly runsOn: "server";
+    readonly events: OpenFeatureEventEmitter;
+    constructor(options: EzghProviderOptions);
+    initialize(): Promise<void>;
+    onClose(): Promise<void>;
+    resolveBooleanEvaluation(flagKey: string, defaultValue: boolean, context: EvaluationContext): Promise<ResolutionDetails<boolean>>;
+    resolveStringEvaluation(flagKey: string, defaultValue: string, context: EvaluationContext): Promise<ResolutionDetails<string>>;
+    resolveNumberEvaluation(flagKey: string, defaultValue: number, context: EvaluationContext): Promise<ResolutionDetails<number>>;
+    resolveObjectEvaluation<T extends JsonValue>(flagKey: string, defaultValue: T, context: EvaluationContext): Promise<ResolutionDetails<T>>;
+}