@fireweaveai/web-sdk-cjs 0.0.0-reserve.0 → 0.0.0-stage

package/dist/infrastructure/adapters/local.d.ts

@@ -1,79 +0,0 @@
-/**
- * Local development adapter for the browser — the DEV substrate of a
- * scaffolded web harness, and the exact peer of the server SDK's
- * `FireweaveLocalAdapter`.
- *
- * A key present in `devFlags` resolves with reason `STATIC`; every other key
- * misses, which the runtime turns into the caller's own default. No network,
- * no credentials, nothing to configure.
- *
- * Call-site defaults stay `false` under RAMP-1. Never write `flag(key, true)`
- * to dogfood locally — that same `true` is the production fallback when a
- * control point is absent from the provider, so it silently ships the ON
- * branch. Use `devFlags`.
- */
-import type { AdapterRuntimeFeatures, PrefetchOptions, PrefetchResult, RegisterTargetOptions, RegisterTargetResult, WebBackendAdapter } from '../../application/ports.js';
-import type { TargetKind } from '../../domain/target.js';
-import type { CanonicalContext } from '../../domain/types.js';
-export interface FireweaveLocalWebAdapterOptions {
-    readonly devFlags?: Record<string, boolean>;
-    /**
-     * Sink for the `[fireweave:local]` registerTarget trace line
-     * (spec/modes.md "registerTarget in local mode"). Defaults to
-     * `console.info`.
-     */
-    readonly log?: (message: string) => void;
-}
-/** A target recorded by {@link FireweaveLocalWebAdapter.registerTarget}. */
-export interface LocalRegisteredTarget {
-    readonly targetingKey: string;
-    readonly kind: TargetKind;
-    readonly properties: Record<string, unknown>;
-    readonly environment?: string;
-}
-export declare class FireweaveLocalWebAdapter implements WebBackendAdapter {
-    /** Not `inmemory` — that name belongs to the fixture adapter. */
-    readonly name: "other";
-    /**
-     * spec/modes.md "Behaviour per mode": local's unknown-key row is
-     * `default`/reason `DEFAULT`, not an error. This is the strict `===` seam
-     * `FireweaveWebRuntime.evaluateSync` checks on a cache miss.
-     */
-    readonly missReason: "DEFAULT";
-    private readonly devFlags;
-    private readonly log;
-    private readonly targets;
-    private closed;
-    constructor(options?: FireweaveLocalWebAdapterOptions);
-    initialize(_signal?: AbortSignal): Promise<void>;
-    /**
-     * `enabled: true` alongside `reason: 'STATIC'` is deliberate: reporting
-     * `enabled: false` for an override of `false` would make the runtime label
-     * the decision `DISABLED`, which means "exists but switched off upstream" —
-     * not what a local override expresses.
-     */
-    prefetch(_context: CanonicalContext, _options?: PrefetchOptions): Promise<PrefetchResult>;
-    /**
-     * Records the target in-process and traces it, rather than reporting
-     * `UnsupportedCapability`.
-     *
-     * The capability could instead report Unsupported so a dev harness could
-     * not *silently* look registered — but the failure being guarded against
-     * is a developer believing their targeting works because nothing objected.
-     * A recorded target plus an explicit `[fireweave:local]` line preserves
-     * that guarantee by a different route: nothing is silent, and local dev
-     * can exercise targeting rules offline instead of only in production
-     * (spec/modes.md "registerTarget in local mode").
-     *
-     * The trace names the mode, so a line appearing in a production log is
-     * itself the signal that something booted in local mode by mistake.
-     *
-     * No network call is made and nothing reaches fw-server.
-     */
-    registerTarget(targetingKey: string, options?: RegisterTargetOptions): Promise<RegisterTargetResult>;
-    /** Targets recorded this process, for assertions and dev inspection. */
-    getRegisteredTargets(): readonly LocalRegisteredTarget[];
-    shutdown(): Promise<void>;
-    isClosed(): boolean;
-    features(): AdapterRuntimeFeatures;
-}

package/dist/infrastructure/adapters/local.js

@@ -1,98 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FireweaveLocalWebAdapter = void 0;
-class FireweaveLocalWebAdapter {
-    /** Not `inmemory` — that name belongs to the fixture adapter. */
-    name = 'other';
-    /**
-     * spec/modes.md "Behaviour per mode": local's unknown-key row is
-     * `default`/reason `DEFAULT`, not an error. This is the strict `===` seam
-     * `FireweaveWebRuntime.evaluateSync` checks on a cache miss.
-     */
-    missReason = 'DEFAULT';
-    devFlags;
-    log;
-    targets = new Map();
-    closed = false;
-    constructor(options = {}) {
-        this.devFlags = { ...(options.devFlags ?? {}) };
-        this.log = options.log ?? ((m) => console.info(m));
-    }
-    async initialize(_signal) {
-        // Nothing to connect to.
-    }
-    /**
-     * `enabled: true` alongside `reason: 'STATIC'` is deliberate: reporting
-     * `enabled: false` for an override of `false` would make the runtime label
-     * the decision `DISABLED`, which means "exists but switched off upstream" —
-     * not what a local override expresses.
-     */
-    async prefetch(_context, _options) {
-        const out = new Map();
-        for (const [key, value] of Object.entries(this.devFlags)) {
-            out.set(key, {
-                found: true,
-                enabled: true,
-                value,
-                variant: value ? 'on' : 'off',
-                reason: 'STATIC',
-                flagType: 'boolean',
-            });
-        }
-        return out;
-    }
-    /**
-     * Records the target in-process and traces it, rather than reporting
-     * `UnsupportedCapability`.
-     *
-     * The capability could instead report Unsupported so a dev harness could
-     * not *silently* look registered — but the failure being guarded against
-     * is a developer believing their targeting works because nothing objected.
-     * A recorded target plus an explicit `[fireweave:local]` line preserves
-     * that guarantee by a different route: nothing is silent, and local dev
-     * can exercise targeting rules offline instead of only in production
-     * (spec/modes.md "registerTarget in local mode").
-     *
-     * The trace names the mode, so a line appearing in a production log is
-     * itself the signal that something booted in local mode by mistake.
-     *
-     * No network call is made and nothing reaches fw-server.
-     */
-    async registerTarget(targetingKey, options = {}) {
-        const kind = options.kind ?? 'user';
-        const properties = { ...(options.properties ?? {}) };
-        const target = {
-            targetingKey,
-            kind,
-            properties,
-            ...(options.environment === undefined ? {} : { environment: options.environment }),
-        };
-        this.targets.set(targetingKey, target);
-        this.log(`[fireweave:local] registerTarget ${kind} ${targetingKey} ` +
-            `${JSON.stringify(properties)} — recorded in-process, NOT sent to fw-server`);
-        return { ok: true };
-    }
-    /** Targets recorded this process, for assertions and dev inspection. */
-    getRegisteredTargets() {
-        return [...this.targets.values()];
-    }
-    async shutdown() {
-        this.closed = true;
-    }
-    isClosed() {
-        return this.closed;
-    }
-    features() {
-        return {
-            remoteEvaluation: false,
-            localEvaluation: true,
-            localOnly: true,
-            // No exposure sink exists locally; claiming otherwise would advertise
-            // emission that silently goes nowhere.
-            exposureEmission: false,
-            sideEffectFreeReads: true,
-            groupAnalytics: false,
-        };
-    }
-}
-exports.FireweaveLocalWebAdapter = FireweaveLocalWebAdapter;

package/dist/infrastructure/adapters/remote.d.ts

@@ -1,44 +0,0 @@
-import type { AdapterRuntimeFeatures, PrefetchOptions, PrefetchResult, RegisterTargetOptions, RegisterTargetResult, WebBackendAdapter } from '../../application/ports.js';
-import type { CanonicalContext, Exposure, Signal } from '../../domain/types.js';
-export type FireweaveFetchLike = typeof fetch;
-export interface FireweaveRemoteWebAdapterOptions {
-    /** fw-server base URL, e.g. `https://app-server.fireweave.ai`. */
-    readonly apiUrl: string;
-    /** Fireweave project key. Public by construction — must be scoped accordingly. */
-    readonly apiKey: string;
-    /** SSRF/misconfiguration allowlist override. `['*']` opts out. */
-    readonly allowedHosts?: readonly string[];
-    readonly requestTimeoutMs?: number;
-    /** Injected fetch (tests). Defaults to the global. */
-    readonly fetch?: FireweaveFetchLike;
-}
-export declare class FireweaveRemoteWebAdapter implements WebBackendAdapter {
-    readonly name: "fireweave";
-    private readonly apiUrl;
-    private readonly apiKey;
-    private readonly allowedHosts;
-    private readonly requestTimeoutMs;
-    private readonly fetchImpl;
-    private readonly pending;
-    private ready;
-    private closed;
-    constructor(options: FireweaveRemoteWebAdapterOptions);
-    initialize(_signal?: AbortSignal): Promise<void>;
-    prefetch(context: CanonicalContext, options?: PrefetchOptions): Promise<PrefetchResult>;
-    registerTarget(targetingKey: string, options?: RegisterTargetOptions): Promise<RegisterTargetResult>;
-    recordExposure(exposure: Exposure): void;
-    recordSignal(signal: Signal): void;
-    /**
-     * `beacon: true` is the unload path. It must not await anything the browser
-     * will cancel, so it uses `sendBeacon` when available and a `keepalive`
-     * fetch otherwise, and it never re-queues on failure — there is no later.
-     */
-    flush(options?: {
-        beacon?: boolean;
-    }): Promise<void>;
-    private sendBeaconOrKeepalive;
-    shutdown(): Promise<void>;
-    features(): AdapterRuntimeFeatures;
-    private toResolution;
-    private requestJson;
-}

package/dist/infrastructure/adapters/remote.js

@@ -1,329 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FireweaveRemoteWebAdapter = void 0;
-/**
- * Fireweave remote adapter for browsers — the production path.
- *
- * Speaks only the vendor-neutral Fireweave remote protocol to fw-server:
- *   POST /v1/control-points/evaluate    (batch — one call per context, not per key)
- *   POST /v1/capture
- *   POST /v1/targets/register
- *
- * Auth: `Authorization: Bearer <project key>`. Never a vendor key: the
- * constructor rejects `phc_`/`phs_`/`phx_` shapes outright (ADR-0009).
- *
- * Credentials are EXPLICIT constructor options. This package never reads
- * `import.meta.env`, `process.env`, or any other ambient source — the embedding
- * app decides what goes into its bundle, and the SDK never picks something up
- * on its own.
- *
- * See spec/remote-protocol.md § Browser clients.
- */
-const errors_js_1 = require("../../domain/errors.js");
-const hosts_js_1 = require("../hosts.js");
-const validation_js_1 = require("../../domain/validation.js");
-const EVALUATE_PATH = '/v1/control-points/evaluate';
-const CAPTURE_PATH = '/v1/capture';
-const REGISTER_TARGET_PATH = '/v1/targets/register';
-const DEFAULT_REQUEST_TIMEOUT_MS = 3_000;
-const ALLOWED_REASONS = new Set([
-    'STATIC',
-    'DEFAULT',
-    'TARGETING_MATCH',
-    'SPLIT',
-    'CACHED',
-    'STALE',
-    'DISABLED',
-    'UNKNOWN',
-    'ERROR',
-]);
-function toReason(reason) {
-    return ALLOWED_REASONS.has(reason) ? reason : undefined;
-}
-function mapHttpStatus(status) {
-    if (status === 401)
-        return new errors_js_1.FireweaveError('Authentication');
-    if (status === 403)
-        return new errors_js_1.FireweaveError('Authorization');
-    if (status === 429)
-        return new errors_js_1.FireweaveError('RateLimited');
-    return new errors_js_1.FireweaveError('BackendUnavailable');
-}
-class FireweaveRemoteWebAdapter {
-    name = 'fireweave';
-    apiUrl;
-    apiKey;
-    allowedHosts;
-    requestTimeoutMs;
-    fetchImpl;
-    pending = [];
-    ready = false;
-    closed = false;
-    constructor(options) {
-        // Validate at construction, not at first use: a misconfigured key should
-        // fail where the developer can see it, not on a user's first evaluation.
-        (0, hosts_js_1.assertNotSecretKey)(options.apiKey);
-        this.apiUrl = options.apiUrl.trim().replace(/\/+$/, '');
-        this.apiKey = options.apiKey.trim();
-        this.allowedHosts = options.allowedHosts;
-        this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-        this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
-    }
-    async initialize(_signal) {
-        if (this.closed)
-            throw new errors_js_1.FireweaveError('AlreadyClosed');
-        if (this.apiUrl.length === 0)
-            throw new errors_js_1.FireweaveError('Configuration');
-        (0, hosts_js_1.assertHostAllowed)(this.apiUrl, this.allowedHosts);
-        this.ready = true;
-    }
-    async prefetch(context, options) {
-        if (this.closed)
-            throw new errors_js_1.FireweaveError('AlreadyClosed');
-        if (!this.ready)
-            throw new errors_js_1.FireweaveError('NotReady');
-        const targetingKeyResult = (0, validation_js_1.validateTargetingKey)(context.targetingKey, true);
-        if (!targetingKeyResult.ok)
-            throw targetingKeyResult.error;
-        const targetingKey = targetingKeyResult.value ?? '';
-        // `$`-prefixed and `fireweave.`-prefixed attributes are backend directives,
-        // not person properties, and groups travel in their own fields.
-        const attributes = {};
-        for (const [k, v] of Object.entries(context.attributes)) {
-            if (k === 'groups' || k === 'groupProperties')
-                continue;
-            if (k.startsWith('$') || k.startsWith('fireweave.'))
-                continue;
-            attributes[k] = v;
-        }
-        const body = { targetingKey };
-        if (Object.keys(attributes).length > 0)
-            body['attributes'] = attributes;
-        if (context.groups !== undefined)
-            body['groups'] = context.groups;
-        if (context.groupProperties !== undefined)
-            body['groupProperties'] = context.groupProperties;
-        if (options?.controlPointKeys !== undefined && options.controlPointKeys.length > 0) {
-            body['controlPointKeys'] = options.controlPointKeys;
-        }
-        const response = await this.requestJson(EVALUATE_PATH, body, options?.signal);
-        const out = new Map();
-        for (const item of response.decisions ?? []) {
-            out.set(item.controlPointKey, this.toResolution(item, response.quotaLimited === true));
-        }
-        return out;
-    }
-    async registerTarget(targetingKey, options = {}) {
-        if (this.closed)
-            return { ok: false, error: new errors_js_1.FireweaveError('AlreadyClosed') };
-        if (!this.ready)
-            return { ok: false, error: new errors_js_1.FireweaveError('NotReady') };
-        const targetingKeyResult = (0, validation_js_1.validateTargetingKey)(targetingKey.trim() === '' ? undefined : targetingKey, true);
-        if (!targetingKeyResult.ok)
-            return { ok: false, error: targetingKeyResult.error };
-        const body = { targetingKey };
-        if (options.kind !== undefined)
-            body['kind'] = options.kind;
-        if (options.environment !== undefined)
-            body['environment'] = options.environment;
-        if (options.properties !== undefined && Object.keys(options.properties).length > 0) {
-            body['properties'] = options.properties;
-        }
-        // Retried once, and only when the taxonomy says a retry could succeed: a
-        // rejected payload or a bad key would be rejected identically.
-        let lastError;
-        for (let attempt = 0; attempt < 2; attempt += 1) {
-            try {
-                await this.requestJson(REGISTER_TARGET_PATH, body, options.signal);
-                return { ok: true };
-            }
-            catch (err) {
-                lastError = err instanceof errors_js_1.FireweaveError ? err : new errors_js_1.FireweaveError('BackendUnavailable');
-                if (!lastError.retryable)
-                    break;
-            }
-        }
-        return { ok: false, ...(lastError !== undefined ? { error: lastError } : {}) };
-    }
-    recordExposure(exposure) {
-        if (this.closed || !this.ready)
-            return;
-        const event = {
-            type: 'exposure',
-            targetingKey: exposure.targetingKey,
-            controlPointKey: exposure.controlPointKey,
-            value: exposure.value,
-        };
-        if (exposure.variant !== undefined)
-            event.variant = exposure.variant;
-        if (exposure.rolloutId !== undefined)
-            event.rolloutId = exposure.rolloutId;
-        if (exposure.changeId !== undefined)
-            event.changeId = exposure.changeId;
-        if (exposure.stampId !== undefined)
-            event.stampId = exposure.stampId;
-        this.pending.push(event);
-    }
-    recordSignal(signal) {
-        if (this.closed || !this.ready)
-            return;
-        const event = {
-            type: 'signal',
-            targetingKey: signal.targetingKey ?? signal.rolloutId ?? 'fireweave-web-sdk',
-            name: signal.name,
-            properties: {
-                kind: signal.kind,
-                ...(signal.status !== undefined ? { status: signal.status } : {}),
-                ...(signal.errorKind !== undefined ? { errorKind: signal.errorKind } : {}),
-                ...(signal.message !== undefined ? { message: signal.message } : {}),
-                ...(signal.value !== undefined ? { value: signal.value } : {}),
-            },
-        };
-        if (signal.controlPointKey !== undefined)
-            event.controlPointKey = signal.controlPointKey;
-        if (signal.variant !== undefined)
-            event.variant = signal.variant;
-        if (signal.rolloutId !== undefined)
-            event.rolloutId = signal.rolloutId;
-        if (signal.timestamp !== undefined)
-            event.timestamp = signal.timestamp;
-        this.pending.push(event);
-    }
-    /**
-     * `beacon: true` is the unload path. It must not await anything the browser
-     * will cancel, so it uses `sendBeacon` when available and a `keepalive`
-     * fetch otherwise, and it never re-queues on failure — there is no later.
-     */
-    async flush(options = {}) {
-        if (this.closed || this.pending.length === 0)
-            return;
-        const batch = this.pending.splice(0, this.pending.length);
-        const payload = JSON.stringify({ events: batch });
-        if (options.beacon === true) {
-            this.sendBeaconOrKeepalive(payload);
-            return;
-        }
-        try {
-            await this.requestJson(CAPTURE_PATH, { events: batch });
-        }
-        catch {
-            // Never throw out of flush; re-queue so a later flush can retry.
-            this.pending.unshift(...batch);
-        }
-    }
-    sendBeaconOrKeepalive(payload) {
-        const url = `${this.apiUrl}${CAPTURE_PATH}`;
-        const nav = globalThis.navigator;
-        // sendBeacon cannot set an Authorization header, so it is only usable where
-        // the server accepts the key another way. Prefer keepalive fetch, which
-        // can, and fall back to a beacon only if fetch is unavailable.
-        try {
-            void this.fetchImpl(url, {
-                method: 'POST',
-                headers: { 'content-type': 'application/json', authorization: `Bearer ${this.apiKey}` },
-                body: payload,
-                keepalive: true,
-            }).catch(() => undefined);
-            return;
-        }
-        catch {
-            // fall through to beacon
-        }
-        if (typeof nav?.sendBeacon === 'function') {
-            try {
-                nav.sendBeacon(url, new Blob([payload], { type: 'application/json' }));
-            }
-            catch {
-                // Unload-time delivery is best-effort by definition.
-            }
-        }
-    }
-    async shutdown() {
-        if (this.closed)
-            return;
-        await this.flush();
-        this.closed = true;
-        this.ready = false;
-    }
-    features() {
-        return {
-            remoteEvaluation: true,
-            // Structural, not configurable — the browser never evaluates locally.
-            localEvaluation: false,
-            localOnly: false,
-            exposureEmission: true,
-            sideEffectFreeReads: true,
-            groupAnalytics: true,
-        };
-    }
-    toResolution(item, quotaLimited) {
-        if (item.found === false) {
-            return quotaLimited ? { found: false, quotaLimited: true } : { found: false };
-        }
-        const resolution = {
-            found: true,
-            value: item.value,
-            enabled: item.enabled ?? true,
-        };
-        if (item.variant != null)
-            resolution.variant = item.variant;
-        const reason = toReason(item.reason);
-        if (reason !== undefined)
-            resolution.reason = reason;
-        if (item.payload !== undefined)
-            resolution.payload = item.payload;
-        const meta = item.controlPointMetadata ?? {};
-        if (typeof meta['fireweave.controlPointVersion'] === 'number') {
-            resolution.version = meta['fireweave.controlPointVersion'];
-        }
-        if (typeof meta['fireweave.reasonCode'] === 'string') {
-            resolution.reasonCode = meta['fireweave.reasonCode'];
-        }
-        if (quotaLimited || meta['fireweave.quotaLimited'] === true)
-            resolution.quotaLimited = true;
-        return resolution;
-    }
-    async requestJson(path, body, outerSignal) {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs);
-        const onOuterAbort = () => controller.abort();
-        if (outerSignal !== undefined) {
-            if (outerSignal.aborted)
-                controller.abort();
-            else
-                outerSignal.addEventListener('abort', onOuterAbort, { once: true });
-        }
-        try {
-            let response;
-            try {
-                response = await this.fetchImpl(`${this.apiUrl}${path}`, {
-                    method: 'POST',
-                    headers: {
-                        'content-type': 'application/json',
-                        authorization: `Bearer ${this.apiKey}`,
-                    },
-                    body: JSON.stringify(body),
-                    signal: controller.signal,
-                });
-            }
-            catch (err) {
-                const aborted = err instanceof Error && err.name === 'AbortError';
-                throw aborted ? new errors_js_1.FireweaveError('Timeout') : new errors_js_1.FireweaveError('Network');
-            }
-            if (response.status >= 400)
-                throw mapHttpStatus(response.status);
-            try {
-                return (await response.json());
-            }
-            catch {
-                throw new errors_js_1.FireweaveError('MalformedResponse');
-            }
-        }
-        finally {
-            clearTimeout(timer);
-            if (outerSignal !== undefined)
-                outerSignal.removeEventListener('abort', onOuterAbort);
-        }
-    }
-}
-exports.FireweaveRemoteWebAdapter = FireweaveRemoteWebAdapter;

package/dist/infrastructure/hosts.d.ts

@@ -1,10 +0,0 @@
-export declare const DEFAULT_ALLOWED_HOSTS: readonly string[];
-export declare function isLoopbackHostname(hostname: string): boolean;
-/**
- * Validate a backend URL against the allowlist.
- * Throws `FireweaveError('Configuration')` — fixed message, no host echoed,
- * because this message can land in a shared browser console.
- */
-export declare function assertHostAllowed(host: string, allowedHosts?: readonly string[]): void;
-/** Throw if `apiKey` looks like a vendor or secret key rather than a Fireweave project key. */
-export declare function assertNotSecretKey(apiKey: string): void;

package/dist/infrastructure/hosts.js

@@ -1,84 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_ALLOWED_HOSTS = void 0;
-exports.isLoopbackHostname = isLoopbackHostname;
-exports.assertHostAllowed = assertHostAllowed;
-exports.assertNotSecretKey = assertNotSecretKey;
-/**
- * Backend host allowlist — the same SSRF guard the server SDK applies, kept
- * for a different reason.
- *
- * A browser cannot be tricked into reaching a cloud metadata endpoint the way a
- * server can; the browser's own origin model already prevents that. What this
- * guard buys here is narrower and still worth having: a mistyped or tampered
- * `apiUrl` cannot quietly send a project key, a targeting key, and a user's
- * evaluation attributes to an unintended host. The allowlist is ON by default,
- * so reaching a self-hosted fw-server is a deliberate, explicit act.
- *
- * Scheme policy matches the server SDK: https everywhere except loopback,
- * where plain http is allowed for local development against a dev server.
- */
-const errors_js_1 = require("../domain/errors.js");
-exports.DEFAULT_ALLOWED_HOSTS = Object.freeze([
-    'app-server.fireweave.ai',
-    'staging-app-server.fireweave.ai',
-    'localhost',
-    '127.0.0.1',
-    '::1',
-]);
-function isLoopbackHostname(hostname) {
-    return (hostname === 'localhost' ||
-        hostname === '127.0.0.1' ||
-        hostname === '::1' ||
-        hostname === '[::1]');
-}
-/**
- * Validate a backend URL against the allowlist.
- * Throws `FireweaveError('Configuration')` — fixed message, no host echoed,
- * because this message can land in a shared browser console.
- */
-function assertHostAllowed(host, allowedHosts) {
-    let url;
-    try {
-        url = new URL(host);
-    }
-    catch {
-        throw new errors_js_1.FireweaveError('Configuration');
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new errors_js_1.FireweaveError('Configuration');
-    }
-    const loopback = isLoopbackHostname(url.hostname);
-    if (url.protocol === 'http:' && !loopback) {
-        throw new errors_js_1.FireweaveError('Configuration');
-    }
-    const list = allowedHosts !== undefined && allowedHosts.length > 0 ? allowedHosts : exports.DEFAULT_ALLOWED_HOSTS;
-    if (list.includes('*'))
-        return; // explicit opt-out
-    const allowed = list.some((h) => url.hostname === h ||
-        (h === 'localhost' && loopback) ||
-        (h === '::1' && url.hostname === '[::1]'));
-    if (!allowed) {
-        throw new errors_js_1.FireweaveError('Configuration');
-    }
-}
-/**
- * Key shapes this SDK refuses to accept.
- *
- * The whole security argument for a browser package (ADR-0009) is that it never
- * wants a secret. Enforcing that at the door — rather than trusting that no
- * code path asks for one — turns the claim into something a caller cannot
- * accidentally violate by pasting the wrong value into their bundle config.
- */
-const FORBIDDEN_KEY_PREFIXES = Object.freeze(['phs_', 'phx_', 'phc_']);
-/** Throw if `apiKey` looks like a vendor or secret key rather than a Fireweave project key. */
-function assertNotSecretKey(apiKey) {
-    const key = apiKey.trim();
-    if (key.length === 0)
-        throw new errors_js_1.FireweaveError('Configuration');
-    for (const prefix of FORBIDDEN_KEY_PREFIXES) {
-        if (key.startsWith(prefix)) {
-            throw new errors_js_1.FireweaveError('Configuration');
-        }
-    }
-}

package/dist/start/build-info.d.ts

@@ -1,2 +0,0 @@
-export declare const SDK_VERSION = "3.0.0";
-export declare const SDK_CHANNEL: 'staging' | 'production';

package/dist/start/build-info.js

@@ -1,9 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SDK_CHANNEL = exports.SDK_VERSION = void 0;
-// GENERATED by tools/release/version.sh apply web — do not edit by hand.
-// The start profile reads SDK_CHANNEL to choose its default fw-server host
-// (docs/adr/0012-start-profile.md). test/unit/start-build-info.test.ts pins
-// SDK_VERSION to package.json, so a release that forgets to stamp fails CI.
-exports.SDK_VERSION = '3.0.0';
-exports.SDK_CHANNEL = 'production';