@fireweaveai/web-sdk-cjs 0.0.0-reserve.0 → 0.0.0-stage

package/dist/build/node/vite.d.ts

@@ -1,53 +0,0 @@
-import { type BuildOptions } from './shared.js';
-export type FireweavePluginOptions = BuildOptions;
-/** The subset of Vite's types the plugin touches, so the package needs no vite types to build. */
-interface UserConfigLike {
-    readonly root?: string;
-    readonly envDir?: string | false;
-    readonly build?: {
-        readonly lib?: unknown;
-    };
-}
-interface ConfigEnvLike {
-    readonly command: 'serve' | 'build';
-    readonly mode: string;
-    readonly isPreview?: boolean;
-}
-interface ResolvedConfigLike {
-    readonly envPrefix?: string | readonly string[];
-    readonly build?: {
-        readonly ssr?: unknown;
-    };
-}
-type OutputFileLike = {
-    readonly type: 'chunk';
-    readonly code: string;
-} | {
-    readonly type: 'asset';
-    readonly source: string | Uint8Array;
-};
-interface PluginContextLike {
-    readonly environment?: {
-        readonly config?: {
-            readonly consumer?: string;
-        };
-    };
-}
-export type LoadEnv = (mode: string, envDir: string, prefixes: string[]) => Record<string, string> | Promise<Record<string, string>>;
-export interface FireweaveVitePlugin {
-    readonly name: 'fireweave';
-    readonly enforce: 'pre';
-    config(userConfig: UserConfigLike, env: ConfigEnvLike): Promise<Record<string, unknown> | undefined>;
-    configResolved(config: ResolvedConfigLike): void;
-    generateBundle(this: PluginContextLike, options: unknown, bundle: Readonly<Record<string, OutputFileLike>>): void;
-}
-/** Test seam: the env-file loader and the process environment. */
-export interface PluginDeps {
-    readonly loadEnv?: LoadEnv;
-    readonly env?: Readonly<Record<string, string | undefined>>;
-    readonly log?: (line: string) => void;
-}
-export declare function createFireweavePlugin(options?: FireweavePluginOptions, deps?: PluginDeps): FireweaveVitePlugin;
-/** The fireweave() Vite plugin. Add it to `plugins` in vite.config.ts (or a framework's `vite.plugins`). */
-export declare function fireweave(options?: FireweavePluginOptions): FireweaveVitePlugin;
-export {};

package/dist/build/node/vite.js

@@ -1,106 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createFireweavePlugin = createFireweavePlugin;
-exports.fireweave = fireweave;
-/**
- * @fireweaveai/web-sdk/vite — the fireweave() Vite plugin.
- *
- *   // vite.config.ts
- *   import { fireweave } from '@fireweaveai/web-sdk/vite';
- *   export default defineConfig({ plugins: [fireweave()] });
- *
- * At config time (Node) it reads FIREWEAVE_BROWSER_KEY, FIREWEAVE_URL and the
- * environment name from the process environment and Vite's env files, applies
- * the start profile's policy, and either fails the dev server or build with a
- * message naming the variable, or injects the result as
- * __FIREWEAVE_WEB_CONFIG__ for start() to pick up. After a client build it
- * fails if a server key reached any output file.
- *
- * Environment name: FIREWEAVE_ENV, then APP_ENV; the dev server and Vitest
- * also fall back to Vite's mode. A build never infers local mode from
- * `--mode development`, so a production build without a key fails.
- *
- * Node build tooling: nothing here ships to the browser. vite is an optional
- * peer and is loaded lazily, so this file has no static import of it.
- */
-const node_path_1 = require("node:path");
-const names_js_1 = require("../src/start/names.js");
-const policy_js_1 = require("../src/start/policy.js");
-const shared_js_1 = require("./shared.js");
-const ENV_PREFIXES = ['FIREWEAVE_', names_js_1.ENVIRONMENT_FALLBACK];
-const SERVER_KEY_PATTERN = /project-api-key_[A-Za-z0-9_-]{8,}/;
-async function viteLoadEnv() {
-    const specifier = 'vite';
-    const vite = (await import(specifier));
-    return vite.loadEnv;
-}
-/** Mirror Vite's env-file location: envDir resolved against the resolved root; false disables files. */
-function envDirOf(userConfig) {
-    if (userConfig.envDir === false)
-        return false;
-    const root = (0, node_path_1.resolve)(userConfig.root ?? process.cwd());
-    return userConfig.envDir !== undefined ? (0, node_path_1.resolve)(root, userConfig.envDir) : root;
-}
-function createFireweavePlugin(options = {}, deps = {}) {
-    const env = deps.env ?? process.env;
-    const log = deps.log ?? ((line) => console.info(line));
-    let skip = false;
-    let clientSsr = false;
-    return {
-        name: 'fireweave',
-        enforce: 'pre',
-        async config(userConfig, configEnv) {
-            if (configEnv.isPreview === true) {
-                skip = true;
-                return undefined;
-            }
-            if (userConfig.build?.lib !== undefined && userConfig.build.lib !== false) {
-                skip = true;
-                log('[fireweave] build.lib: no config injected. A library must not bake in an app key; the app that bundles it runs fireweave().');
-                return undefined;
-            }
-            const envDir = envDirOf(userConfig);
-            const loadEnv = deps.loadEnv ?? (envDir === false ? undefined : await viteLoadEnv());
-            const files = envDir === false || loadEnv === undefined ? {} : await loadEnv(configEnv.mode, envDir, ENV_PREFIXES);
-            const lookup = (name) => (0, policy_js_1.sourced)(env[name], name) ?? (0, policy_js_1.sourced)(files[name], `${name} (.env files)`);
-            const viteMode = configEnv.command === 'serve' ? (0, policy_js_1.sourced)(configEnv.mode, `Vite mode '${configEnv.mode}'`) : undefined;
-            const resolved = (0, shared_js_1.resolveBuild)(options, lookup, names_js_1.BUILD_ENV.key, [names_js_1.BUILD_ENV.environment, names_js_1.ENVIRONMENT_FALLBACK], viteMode);
-            for (const w of resolved.warnings)
-                log(w);
-            log((0, shared_js_1.summaryLine)(resolved.config));
-            return {
-                define: { [names_js_1.INJECTED_CONFIG_NAME]: JSON.stringify(resolved.injected) },
-                // Keep the SDK out of the dep pre-bundle so the injected config is never cached stale.
-                optimizeDeps: { exclude: ['@fireweaveai/web-sdk'] },
-            };
-        },
-        configResolved(config) {
-            if (skip)
-                return;
-            const prefixes = config.envPrefix === undefined ? ['VITE_'] : typeof config.envPrefix === 'string' ? [config.envPrefix] : [...config.envPrefix];
-            const exposed = names_js_1.SERVER_KEY_NAMES.filter((name) => prefixes.some((p) => p !== '' && name.startsWith(p)));
-            if (exposed.length > 0) {
-                throw new Error(`[fireweave] envPrefix would expose ${exposed.join(' and ')} to the browser bundle. Remove that prefix; the browser key is injected by fireweave() as ${names_js_1.BUILD_ENV.key}.`);
-            }
-            clientSsr = config.build?.ssr !== undefined && config.build.ssr !== false;
-        },
-        generateBundle(_options, bundle) {
-            if (skip)
-                return;
-            const serverEnvironment = this.environment?.config?.consumer === 'server' || (this.environment === undefined && clientSsr);
-            if (serverEnvironment)
-                return;
-            const secrets = names_js_1.SERVER_KEY_NAMES.map((name) => env[name]?.trim()).filter((v) => v !== undefined && v.length >= 8);
-            for (const [fileName, file] of Object.entries(bundle)) {
-                const text = file.type === 'chunk' ? file.code : typeof file.source === 'string' ? file.source : '';
-                if (SERVER_KEY_PATTERN.test(text) || secrets.some((secret) => text.includes(secret))) {
-                    throw new Error(`[fireweave] ${fileName} contains a server key. Server keys must never ship to a browser: remove it from client code, and revoke it if this build was deployed.`);
-                }
-            }
-        },
-    };
-}
-/** The fireweave() Vite plugin. Add it to `plugins` in vite.config.ts (or a framework's `vite.plugins`). */
-function fireweave(options = {}) {
-    return createFireweavePlugin(options);
-}

package/dist/build/src/start/build-info.d.ts

@@ -1,2 +0,0 @@
-export declare const SDK_VERSION = "3.0.0";
-export declare const SDK_CHANNEL: 'staging' | 'production';

package/dist/build/src/start/build-info.js

@@ -1,9 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SDK_CHANNEL = exports.SDK_VERSION = void 0;
-// GENERATED by tools/release/version.sh apply web — do not edit by hand.
-// The start profile reads SDK_CHANNEL to choose its default fw-server host
-// (docs/adr/0012-start-profile.md). test/unit/start-build-info.test.ts pins
-// SDK_VERSION to package.json, so a release that forgets to stamp fails CI.
-exports.SDK_VERSION = '3.0.0';
-exports.SDK_CHANNEL = 'production';

package/dist/build/src/start/names.d.ts

@@ -1,38 +0,0 @@
-/**
- * Every name the web start profile and its build helpers use, in one place, so
- * the README, the initialise skill and the error messages cannot drift apart.
- *
- * Imported by browser code and by the Node build helpers (node/), so it holds
- * constants only.
- */
-/** Build-time variables the Vite plugin and the define helper read. The browser reads none. */
-export declare const BUILD_ENV: Readonly<{
-    key: "FIREWEAVE_BROWSER_KEY";
-    url: "FIREWEAVE_URL";
-    environment: "FIREWEAVE_ENV";
-}>;
-/** Fallback environment name after FIREWEAVE_ENV, at build time. */
-export declare const ENVIRONMENT_FALLBACK = "APP_ENV";
-/** Server secrets the Vite plugin looks for in output chunks. Never injected, never printed. */
-export declare const SERVER_KEY_NAMES: readonly string[];
-/** Environment names that mean "local development" when no key is set. Case-insensitive. */
-export declare const DEV_ENVIRONMENTS: ReadonlySet<string>;
-/** fw-server host for each release channel of this package. */
-export declare const CHANNEL_URLS: Readonly<{
-    production: "https://app-server.fireweave.ai";
-    staging: "https://staging-app-server.fireweave.ai";
-}>;
-/** Hosts always allowed beside a custom endpoint, so local stacks keep working. */
-export declare const LOOPBACK_HOSTS: readonly string[];
-/** The only key family a browser may hold. */
-export declare const BROWSER_KEY_PREFIX = "fw_public_";
-/** localStorage keys. The device id key and its dev_ prefix match the scaffolded harness, so returning visitors keep their bucket. */
-export declare const STORAGE_KEYS: Readonly<{
-    deviceId: "fireweave.device-id";
-    identity: "fireweave.identity";
-    deviceRegistered: "fireweave.device-registered";
-}>;
-/** Where the control-points object lives by convention; named in warnings. */
-export declare const CONTROL_POINTS_FILE = "src/fireweave/control-points.ts";
-/** The identifier the build helpers define and the browser reads behind a typeof guard. */
-export declare const INJECTED_CONFIG_NAME = "__FIREWEAVE_WEB_CONFIG__";

package/dist/build/src/start/names.js

@@ -1,41 +0,0 @@
-"use strict";
-/**
- * Every name the web start profile and its build helpers use, in one place, so
- * the README, the initialise skill and the error messages cannot drift apart.
- *
- * Imported by browser code and by the Node build helpers (node/), so it holds
- * constants only.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.INJECTED_CONFIG_NAME = exports.CONTROL_POINTS_FILE = exports.STORAGE_KEYS = exports.BROWSER_KEY_PREFIX = exports.LOOPBACK_HOSTS = exports.CHANNEL_URLS = exports.DEV_ENVIRONMENTS = exports.SERVER_KEY_NAMES = exports.ENVIRONMENT_FALLBACK = exports.BUILD_ENV = void 0;
-/** Build-time variables the Vite plugin and the define helper read. The browser reads none. */
-exports.BUILD_ENV = Object.freeze({
-    key: 'FIREWEAVE_BROWSER_KEY',
-    url: 'FIREWEAVE_URL',
-    environment: 'FIREWEAVE_ENV',
-});
-/** Fallback environment name after FIREWEAVE_ENV, at build time. */
-exports.ENVIRONMENT_FALLBACK = 'APP_ENV';
-/** Server secrets the Vite plugin looks for in output chunks. Never injected, never printed. */
-exports.SERVER_KEY_NAMES = Object.freeze(['FIREWEAVE_KEY', 'FW_PROJECT_API_KEY']);
-/** Environment names that mean "local development" when no key is set. Case-insensitive. */
-exports.DEV_ENVIRONMENTS = new Set(['development', 'dev', 'local', 'test']);
-/** fw-server host for each release channel of this package. */
-exports.CHANNEL_URLS = Object.freeze({
-    production: 'https://app-server.fireweave.ai',
-    staging: 'https://staging-app-server.fireweave.ai',
-});
-/** Hosts always allowed beside a custom endpoint, so local stacks keep working. */
-exports.LOOPBACK_HOSTS = Object.freeze(['localhost', '127.0.0.1', '::1']);
-/** The only key family a browser may hold. */
-exports.BROWSER_KEY_PREFIX = 'fw_public_';
-/** localStorage keys. The device id key and its dev_ prefix match the scaffolded harness, so returning visitors keep their bucket. */
-exports.STORAGE_KEYS = Object.freeze({
-    deviceId: 'fireweave.device-id',
-    identity: 'fireweave.identity',
-    deviceRegistered: 'fireweave.device-registered',
-});
-/** Where the control-points object lives by convention; named in warnings. */
-exports.CONTROL_POINTS_FILE = 'src/fireweave/control-points.ts';
-/** The identifier the build helpers define and the browser reads behind a typeof guard. */
-exports.INJECTED_CONFIG_NAME = '__FIREWEAVE_WEB_CONFIG__';

package/dist/build/src/start/policy.d.ts

@@ -1,70 +0,0 @@
-export type StartMode = 'remote' | 'local';
-export type SdkChannel = 'staging' | 'production';
-/** A value and where it came from ('start({ key })', 'FIREWEAVE_BROWSER_KEY', ...). */
-export interface Sourced {
-    readonly value: string;
-    readonly source: string;
-}
-export type PolicyReason = 'invalid-mode' | 'missing-key' | 'server-key' | 'wrong-key-family' | 'insecure-url';
-export interface PolicyInput {
-    readonly mode?: unknown;
-    readonly key?: Sourced | undefined;
-    readonly url?: Sourced | undefined;
-    readonly environment?: Sourced | undefined;
-    readonly channel: SdkChannel;
-    /** The variable or option a fix should name, e.g. FIREWEAVE_BROWSER_KEY. */
-    readonly keyVariable: string;
-    /** Where an environment name was looked for, for the missing-key message. */
-    readonly environmentChecked: string;
-}
-export interface PolicyConfig {
-    readonly mode: StartMode;
-    /** Why this mode: the mode option, a present key, or the environment name. */
-    readonly modeSource: 'option' | 'key' | 'environment';
-    /** Remote only. A value starting with '/' is a same-origin proxy path. */
-    readonly url?: string;
-    readonly urlSource?: string;
-    /** Remote only, and absent for the channel default (the core's own list covers it). */
-    readonly allowedHosts?: readonly string[];
-    /** Remote only. Never logged. */
-    readonly key?: string;
-    readonly keySource: string;
-    readonly environment?: string;
-    readonly environmentSource?: string;
-}
-export type PolicyResult = {
-    readonly ok: true;
-    readonly config: PolicyConfig;
-    readonly warnings: readonly string[];
-} | {
-    readonly ok: false;
-    readonly reason: PolicyReason;
-    readonly variable: string;
-    readonly message: string;
-};
-/** A trimmed, non-empty string with its source, or undefined. Non-strings count as unset. */
-export declare function sourced(value: unknown, source: string): Sourced | undefined;
-/** The first candidate that is set. */
-export declare function firstOf(...candidates: ReadonlyArray<Sourced | undefined>): Sourced | undefined;
-/**
- * Resolve mode, key and endpoint.
- *
- * An explicit mode wins. Otherwise a key means remote; no key and a
- * development environment name means local; anything else fails closed, so a
- * missing key never turns into silent local evaluation for real visitors.
- */
-export declare function resolvePolicy(input: PolicyInput): PolicyResult;
-/**
- * What the build helpers inject as __FIREWEAVE_WEB_CONFIG__: raw values and
- * their source names, re-resolved in the browser so explicit start() options
- * still win. Never carries a server key or the control-points object.
- */
-export interface InjectedConfig {
-    readonly v: 1;
-    readonly key?: string;
-    readonly keySource?: string;
-    readonly url?: string;
-    readonly urlSource?: string;
-    readonly environment?: string;
-    readonly environmentSource?: string;
-}

package/dist/build/src/start/policy.js

@@ -1,128 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.sourced = sourced;
-exports.firstOf = firstOf;
-exports.resolvePolicy = resolvePolicy;
-/**
- * The web start-profile policy: one pure resolver shared by the browser
- * start() and the Node build helpers (node/vite.ts, node/define.ts), so a
- * build and the page it produces can never disagree about mode, key or URL.
- *
- * Pure on purpose: no DOM, no env, no core import. Callers hand in values
- * with their source names; the result is a config, or a failure carrying a
- * fixed reason code and a message that names sources and variables, never a
- * value.
- */
-const names_js_1 = require("./names.js");
-/** A trimmed, non-empty string with its source, or undefined. Non-strings count as unset. */
-function sourced(value, source) {
-    if (typeof value !== 'string')
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed === '' ? undefined : { value: trimmed, source };
-}
-/** The first candidate that is set. */
-function firstOf(...candidates) {
-    return candidates.find((c) => c !== undefined);
-}
-const fail = (reason, variable, message) => ({
-    ok: false,
-    reason,
-    variable,
-    message: `[fireweave] ${message}`,
-});
-/** Key family check. Messages name the source, never the value. */
-function checkKey(key) {
-    const v = key.value;
-    if (v.startsWith(names_js_1.BROWSER_KEY_PREFIX))
-        return undefined;
-    if (v.startsWith('project-api-key_')) {
-        return fail('server-key', key.source, `The key from ${key.source} is a server key (project-api-key_…), which must never ship to a browser. Use a browser key (fw_public_…) from Project settings, API keys. If a bundle built with this key was deployed, revoke the key.`);
-    }
-    if (/^ph[a-z]_/.test(v)) {
-        return fail('wrong-key-family', key.source, `The key from ${key.source} is an analytics vendor key, not a FireWeave browser key (fw_public_…).`);
-    }
-    if (v.startsWith('fw_org_') || v.startsWith('cli_at_')) {
-        return fail('wrong-key-family', key.source, `The key from ${key.source} is an organisation or CLI token, not a FireWeave browser key (fw_public_…).`);
-    }
-    return fail('wrong-key-family', key.source, `The key from ${key.source} is not a FireWeave browser key (fw_public_…).`);
-}
-const isLoopback = (hostname) => hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '[::1]';
-function resolveUrl(url, channel) {
-    if (url === undefined)
-        return { url: names_js_1.CHANNEL_URLS[channel], urlSource: `SDK channel (${channel})` };
-    const value = url.value.replace(/\/+$/, '');
-    if (value.startsWith('//')) {
-        return fail('insecure-url', url.source, `The endpoint from ${url.source} is protocol-relative. Use an https URL or a same-origin path such as '/fw'.`);
-    }
-    // A same-origin proxy path: the browser resolves it against location.origin.
-    if (value.startsWith('/'))
-        return { url: value, urlSource: url.source };
-    let parsed;
-    try {
-        parsed = new URL(value);
-    }
-    catch {
-        return fail('insecure-url', url.source, `The endpoint from ${url.source} is not a valid URL.`);
-    }
-    const httpsOk = parsed.protocol === 'https:';
-    const loopbackHttp = parsed.protocol === 'http:' && isLoopback(parsed.hostname);
-    if (!httpsOk && !loopbackHttp) {
-        return fail('insecure-url', url.source, `The endpoint from ${url.source} must use https (http is allowed only for localhost).`);
-    }
-    return { url: value, urlSource: url.source, allowedHosts: [parsed.hostname.replace(/^\[|\]$/g, ''), ...names_js_1.LOOPBACK_HOSTS] };
-}
-function remote(input, key, modeSource, warnings) {
-    const keyProblem = checkKey(key);
-    if (keyProblem !== undefined)
-        return keyProblem;
-    const url = resolveUrl(input.url, input.channel);
-    if ('ok' in url)
-        return url;
-    return { ok: true, config: { mode: 'remote', modeSource, ...url, key: key.value, keySource: key.source }, warnings };
-}
-/**
- * Resolve mode, key and endpoint.
- *
- * An explicit mode wins. Otherwise a key means remote; no key and a
- * development environment name means local; anything else fails closed, so a
- * missing key never turns into silent local evaluation for real visitors.
- */
-function resolvePolicy(input) {
-    const warnings = [];
-    const { mode, key, environment } = input;
-    if (mode !== undefined && mode !== 'remote' && mode !== 'local') {
-        return fail('invalid-mode', 'mode', `start({ mode }) must be 'remote' or 'local'.`);
-    }
-    if (mode === 'local') {
-        if (key !== undefined) {
-            warnings.push(`[fireweave] mode 'local' ignores the key from ${key.source}; nothing is sent to fw-server.`);
-        }
-        return { ok: true, config: { mode: 'local', modeSource: 'option', keySource: 'none' }, warnings };
-    }
-    if (mode === 'remote') {
-        if (key === undefined) {
-            return fail('missing-key', input.keyVariable, `mode 'remote' needs a browser key. Set ${input.keyVariable} to a browser key (fw_public_…).`);
-        }
-        return remote(input, key, 'option', warnings);
-    }
-    if (key !== undefined)
-        return remote(input, key, 'key', warnings);
-    if (environment !== undefined && names_js_1.DEV_ENVIRONMENTS.has(environment.value.toLowerCase())) {
-        return {
-            ok: true,
-            config: {
-                mode: 'local',
-                modeSource: 'environment',
-                keySource: 'none',
-                environment: environment.value,
-                environmentSource: environment.source,
-            },
-            warnings,
-        };
-    }
-    const where = environment === undefined
-        ? `no environment name is set (checked ${input.environmentChecked})`
-        : `the environment is '${environment.value}' (from ${environment.source}), which is not a development name`;
-    return fail('missing-key', input.keyVariable, `${input.keyVariable} is not set and ${where}. Set ${input.keyVariable} to a browser key (fw_public_…), or for local work set FIREWEAVE_ENV=development or pass start({ mode: 'local' }).`);
-}

package/dist/domain/context.d.ts

@@ -1,51 +0,0 @@
-/**
- * Evaluation-context merge & normalization — pure, no validation.
- *
- * Bound/reserved-key ENFORCEMENT (the Validated<T>-returning checks) lives in
- * validation.ts (`validateContext`) — spec/control-points.md "Validation,
- * before any I/O" rule 3. This module has no throwing/failing surface of its
- * own, mirroring the split sdks/node/src/domain/{context,validation}.ts
- * makes.
- *
- * A browser context is smaller than a server one — there is one user per
- * page, not one per request — but the same shape applies: `targetingKey` plus
- * a flat bag of attributes, later layers winning key by key (the OpenFeature
- * merge order).
- */
-export interface ContextLimits {
-    readonly maxAttributeCount: number;
-    readonly maxKeyBytes: number;
-    readonly maxValueBytes: number;
-    readonly maxSerializedBytes: number;
-    readonly maxNestingDepth: number;
-}
-export declare const DEFAULT_CONTEXT_LIMITS: ContextLimits;
-/**
- * Keys the backend owns. A client that could set these could claim another
- * tenant's identity, so they are rejected rather than dropped — silently
- * discarding them would leave the caller believing targeting was applied.
- */
-export declare const DEFAULT_RESERVED_ATTRIBUTE_KEYS: readonly string[];
-export interface ContextPolicy {
-    readonly limits: ContextLimits;
-    readonly reservedAttributeKeys: readonly string[];
-    readonly requireTargetingKey: boolean;
-}
-export type ContextInput = Record<string, unknown> & {
-    targetingKey?: string;
-};
-/** One raw layer → {targetingKey?, attributes}. No validation, no copying beyond Object.entries. */
-export declare function normalizeContextInput(input: ContextInput | undefined): {
-    targetingKey?: string;
-    attributes: Record<string, unknown>;
-};
-/**
- * Merge context layers with later layers winning at the attribute-key level.
- * Layers are raw inputs; output is a plain {targetingKey?, attributes} bag —
- * validation (limits, reserved keys, cycle-safety) happens downstream in
- * validation.ts's `validateContext`.
- */
-export declare function mergeContexts(...layers: ReadonlyArray<ContextInput | undefined>): {
-    targetingKey?: string;
-    attributes: Record<string, unknown>;
-};

package/dist/domain/context.js

@@ -1,72 +0,0 @@
-"use strict";
-/**
- * Evaluation-context merge & normalization — pure, no validation.
- *
- * Bound/reserved-key ENFORCEMENT (the Validated<T>-returning checks) lives in
- * validation.ts (`validateContext`) — spec/control-points.md "Validation,
- * before any I/O" rule 3. This module has no throwing/failing surface of its
- * own, mirroring the split sdks/node/src/domain/{context,validation}.ts
- * makes.
- *
- * A browser context is smaller than a server one — there is one user per
- * page, not one per request — but the same shape applies: `targetingKey` plus
- * a flat bag of attributes, later layers winning key by key (the OpenFeature
- * merge order).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_RESERVED_ATTRIBUTE_KEYS = exports.DEFAULT_CONTEXT_LIMITS = void 0;
-exports.normalizeContextInput = normalizeContextInput;
-exports.mergeContexts = mergeContexts;
-exports.DEFAULT_CONTEXT_LIMITS = Object.freeze({
-    maxAttributeCount: 100,
-    maxKeyBytes: 256,
-    maxValueBytes: 8_192,
-    maxSerializedBytes: 32_768,
-    maxNestingDepth: 8,
-});
-/**
- * Keys the backend owns. A client that could set these could claim another
- * tenant's identity, so they are rejected rather than dropped — silently
- * discarding them would leave the caller believing targeting was applied.
- */
-exports.DEFAULT_RESERVED_ATTRIBUTE_KEYS = Object.freeze([
-    'fireweave.orgId',
-    'fireweave.projectId',
-    'fireweave.tenant',
-]);
-/** One raw layer → {targetingKey?, attributes}. No validation, no copying beyond Object.entries. */
-function normalizeContextInput(input) {
-    if (input === undefined || input === null)
-        return { attributes: {} };
-    const attributes = {};
-    let targetingKey;
-    for (const [key, value] of Object.entries(input)) {
-        if (key === 'targetingKey') {
-            if (typeof value === 'string' && value.length > 0)
-                targetingKey = value;
-            continue;
-        }
-        if (value !== undefined)
-            attributes[key] = value;
-    }
-    return targetingKey !== undefined ? { targetingKey, attributes } : { attributes };
-}
-/**
- * Merge context layers with later layers winning at the attribute-key level.
- * Layers are raw inputs; output is a plain {targetingKey?, attributes} bag —
- * validation (limits, reserved keys, cycle-safety) happens downstream in
- * validation.ts's `validateContext`.
- */
-function mergeContexts(...layers) {
-    let targetingKey;
-    const attributes = {};
-    for (const layer of layers) {
-        const { targetingKey: tk, attributes: attrs } = normalizeContextInput(layer);
-        if (tk !== undefined)
-            targetingKey = tk;
-        for (const [k, v] of Object.entries(attrs)) {
-            attributes[k] = v;
-        }
-    }
-    return targetingKey !== undefined ? { targetingKey, attributes } : { attributes };
-}

package/dist/domain/errors.d.ts

@@ -1,36 +0,0 @@
-/**
- * Error taxonomy for the browser SDK.
- *
- * Same kinds and same OpenFeature mapping as the server SDK, because the wire
- * protocol and the failure modes are the same — a 401 is a 401 whether it is a
- * server or a browser asking. Reimplemented here rather than shared so the
- * browser package keeps zero cross-package coupling and can be audited on its
- * own; `spec/errors.schema.json` is the source both follow.
- *
- * Messages are FIXED per kind. A browser error is visible in a devtools console
- * on a machine we do not control, so nothing host-, key-, or response-derived
- * is ever interpolated into one.
- */
-export type FireweaveErrorKind = 'Configuration' | 'Authentication' | 'Authorization' | 'Network' | 'Timeout' | 'RateLimited' | 'BackendUnavailable' | 'MalformedResponse' | 'InvalidContext' | 'ControlPointNotFound' | 'TypeMismatch' | 'NotReady' | 'AlreadyClosed' | 'UnsupportedCapability' | 'Internal';
-export type OpenFeatureErrorCode = 'PROVIDER_NOT_READY' | 'PROVIDER_FATAL' | 'FLAG_NOT_FOUND' | 'PARSE_ERROR' | 'TYPE_MISMATCH' | 'TARGETING_KEY_MISSING' | 'INVALID_CONTEXT' | 'GENERAL';
-export interface ErrorKindSpec {
-    readonly message: string;
-    readonly openFeatureErrorCode: OpenFeatureErrorCode;
-    /** Whether an identical retry could plausibly succeed. */
-    readonly retryable: boolean;
-}
-export declare const ERROR_TAXONOMY: Readonly<Record<FireweaveErrorKind, ErrorKindSpec>>;
-export interface FireweaveErrorOptions {
-    /** Overrides the taxonomy's OpenFeature code (e.g. a missing targeting key). */
-    readonly openFeatureErrorCode?: OpenFeatureErrorCode;
-    readonly metadata?: Record<string, string | number | boolean>;
-    readonly cause?: unknown;
-}
-export declare class FireweaveError extends Error {
-    readonly kind: FireweaveErrorKind;
-    readonly openFeatureErrorCode: OpenFeatureErrorCode;
-    readonly retryable: boolean;
-    readonly metadata: Record<string, string | number | boolean>;
-    constructor(kind: FireweaveErrorKind, options?: FireweaveErrorOptions);
-}
-export declare function isFireweaveError(value: unknown): value is FireweaveError;