@fireweaveai/web-sdk 2.1.0

package/dist/errors.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Error taxonomy for the browser SDK.
+ *
+ * Same kinds and same OpenFeature mapping as the server SDK, because the wire
+ * protocol and the failure modes are the same — a 401 is a 401 whether it is a
+ * server or a browser asking. Reimplemented here rather than shared so the
+ * browser package keeps zero cross-package coupling and can be audited on its
+ * own; `spec/errors.schema.json` is the source both follow.
+ *
+ * Messages are FIXED per kind. A browser error is visible in a devtools console
+ * on a machine we do not control, so nothing host-, key-, or response-derived
+ * is ever interpolated into one.
+ */
+export type FireweaveErrorKind = 'Configuration' | 'Authentication' | 'Authorization' | 'Network' | 'Timeout' | 'RateLimited' | 'BackendUnavailable' | 'MalformedResponse' | 'InvalidContext' | 'FlagNotFound' | 'TypeMismatch' | 'NotReady' | 'AlreadyClosed' | 'UnsupportedCapability' | 'Internal';
+export type OpenFeatureErrorCode = 'PROVIDER_NOT_READY' | 'PROVIDER_FATAL' | 'FLAG_NOT_FOUND' | 'PARSE_ERROR' | 'TYPE_MISMATCH' | 'TARGETING_KEY_MISSING' | 'INVALID_CONTEXT' | 'GENERAL';
+export interface ErrorKindSpec {
+    readonly message: string;
+    readonly openFeatureErrorCode: OpenFeatureErrorCode;
+    /** Whether an identical retry could plausibly succeed. */
+    readonly retryable: boolean;
+}
+export declare const ERROR_TAXONOMY: Readonly<Record<FireweaveErrorKind, ErrorKindSpec>>;
+export interface FireweaveErrorOptions {
+    /** Overrides the taxonomy's OpenFeature code (e.g. a missing targeting key). */
+    readonly openFeatureErrorCode?: OpenFeatureErrorCode;
+    readonly metadata?: Record<string, string | number | boolean>;
+    readonly cause?: unknown;
+}
+export declare class FireweaveError extends Error {
+    readonly kind: FireweaveErrorKind;
+    readonly openFeatureErrorCode: OpenFeatureErrorCode;
+    readonly retryable: boolean;
+    readonly metadata: Record<string, string | number | boolean>;
+    constructor(kind: FireweaveErrorKind, options?: FireweaveErrorOptions);
+}
+export declare function isFireweaveError(value: unknown): value is FireweaveError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,SAAS,GACT,SAAS,GACT,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,cAAc,GACd,UAAU,GACV,eAAe,GACf,uBAAuB,GACvB,UAAU,CAAC;AAEf,MAAM,MAAM,oBAAoB,GAC5B,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,uBAAuB,GACvB,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IACpD,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,aAAa,CAAC,CA4D7E,CAAC;AAEH,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;gBAEjD,IAAI,EAAE,kBAAkB,EAAE,OAAO,GAAE,qBAA0B;CAS1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAExE"}

package/dist/errors.js

@@ -0,0 +1,93 @@
+/**
+ * Error taxonomy for the browser SDK.
+ *
+ * Same kinds and same OpenFeature mapping as the server SDK, because the wire
+ * protocol and the failure modes are the same — a 401 is a 401 whether it is a
+ * server or a browser asking. Reimplemented here rather than shared so the
+ * browser package keeps zero cross-package coupling and can be audited on its
+ * own; `spec/errors.schema.json` is the source both follow.
+ *
+ * Messages are FIXED per kind. A browser error is visible in a devtools console
+ * on a machine we do not control, so nothing host-, key-, or response-derived
+ * is ever interpolated into one.
+ */
+export const ERROR_TAXONOMY = Object.freeze({
+    Configuration: {
+        message: 'invalid configuration',
+        openFeatureErrorCode: 'PROVIDER_FATAL',
+        retryable: false,
+    },
+    Authentication: {
+        message: 'authentication failed',
+        openFeatureErrorCode: 'PROVIDER_FATAL',
+        retryable: false,
+    },
+    Authorization: {
+        message: 'not authorized',
+        openFeatureErrorCode: 'PROVIDER_FATAL',
+        retryable: false,
+    },
+    Network: { message: 'network error', openFeatureErrorCode: 'GENERAL', retryable: true },
+    Timeout: { message: 'request timed out', openFeatureErrorCode: 'GENERAL', retryable: true },
+    RateLimited: { message: 'rate limited', openFeatureErrorCode: 'GENERAL', retryable: true },
+    BackendUnavailable: {
+        message: 'backend unavailable',
+        openFeatureErrorCode: 'GENERAL',
+        retryable: true,
+    },
+    MalformedResponse: {
+        message: 'malformed response',
+        openFeatureErrorCode: 'PARSE_ERROR',
+        retryable: false,
+    },
+    InvalidContext: {
+        message: 'invalid evaluation context',
+        openFeatureErrorCode: 'INVALID_CONTEXT',
+        retryable: false,
+    },
+    FlagNotFound: {
+        message: 'flag not found',
+        openFeatureErrorCode: 'FLAG_NOT_FOUND',
+        retryable: false,
+    },
+    TypeMismatch: {
+        message: 'type mismatch',
+        openFeatureErrorCode: 'TYPE_MISMATCH',
+        retryable: false,
+    },
+    NotReady: {
+        message: 'provider not ready',
+        openFeatureErrorCode: 'PROVIDER_NOT_READY',
+        retryable: true,
+    },
+    AlreadyClosed: {
+        message: 'provider already closed',
+        openFeatureErrorCode: 'PROVIDER_FATAL',
+        retryable: false,
+    },
+    UnsupportedCapability: {
+        message: 'unsupported capability',
+        openFeatureErrorCode: 'GENERAL',
+        retryable: false,
+    },
+    Internal: { message: 'internal error', openFeatureErrorCode: 'GENERAL', retryable: false },
+});
+export class FireweaveError extends Error {
+    kind;
+    openFeatureErrorCode;
+    retryable;
+    metadata;
+    constructor(kind, options = {}) {
+        const spec = ERROR_TAXONOMY[kind];
+        super(spec.message, options.cause !== undefined ? { cause: options.cause } : undefined);
+        this.name = 'FireweaveError';
+        this.kind = kind;
+        this.openFeatureErrorCode = options.openFeatureErrorCode ?? spec.openFeatureErrorCode;
+        this.retryable = spec.retryable;
+        this.metadata = { ...(options.metadata ?? {}) };
+    }
+}
+export function isFireweaveError(value) {
+    return value instanceof FireweaveError;
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoCH,MAAM,CAAC,MAAM,cAAc,GAAwD,MAAM,CAAC,MAAM,CAAC;IAC/F,aAAa,EAAE;QACb,OAAO,EAAE,uBAAuB;QAChC,oBAAoB,EAAE,gBAAgB;QACtC,SAAS,EAAE,KAAK;KACjB;IACD,cAAc,EAAE;QACd,OAAO,EAAE,uBAAuB;QAChC,oBAAoB,EAAE,gBAAgB;QACtC,SAAS,EAAE,KAAK;KACjB;IACD,aAAa,EAAE;QACb,OAAO,EAAE,gBAAgB;QACzB,oBAAoB,EAAE,gBAAgB;QACtC,SAAS,EAAE,KAAK;KACjB;IACD,OAAO,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;IACvF,OAAO,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;IAC3F,WAAW,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;IAC1F,kBAAkB,EAAE;QAClB,OAAO,EAAE,qBAAqB;QAC9B,oBAAoB,EAAE,SAAS;QAC/B,SAAS,EAAE,IAAI;KAChB;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE,oBAAoB;QAC7B,oBAAoB,EAAE,aAAa;QACnC,SAAS,EAAE,KAAK;KACjB;IACD,cAAc,EAAE;QACd,OAAO,EAAE,4BAA4B;QACrC,oBAAoB,EAAE,iBAAiB;QACvC,SAAS,EAAE,KAAK;KACjB;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,gBAAgB;QACzB,oBAAoB,EAAE,gBAAgB;QACtC,SAAS,EAAE,KAAK;KACjB;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,eAAe;QACxB,oBAAoB,EAAE,eAAe;QACrC,SAAS,EAAE,KAAK;KACjB;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,oBAAoB;QAC7B,oBAAoB,EAAE,oBAAoB;QAC1C,SAAS,EAAE,IAAI;KAChB;IACD,aAAa,EAAE;QACb,OAAO,EAAE,yBAAyB;QAClC,oBAAoB,EAAE,gBAAgB;QACtC,SAAS,EAAE,KAAK;KACjB;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE,wBAAwB;QACjC,oBAAoB,EAAE,SAAS;QAC/B,SAAS,EAAE,KAAK;KACjB;IACD,QAAQ,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE;CAC3F,CAAC,CAAC;AASH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAqB;IACzB,oBAAoB,CAAuB;IAC3C,SAAS,CAAU;IACnB,QAAQ,CAA4C;IAE7D,YAAY,IAAwB,EAAE,UAAiC,EAAE;QACvE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,oBAAoB,CAAC;QACtF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IAClD,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,KAAK,YAAY,cAAc,CAAC;AACzC,CAAC"}

package/dist/hosts.d.ts

@@ -0,0 +1,11 @@
+export declare const DEFAULT_ALLOWED_HOSTS: readonly string[];
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Validate a backend URL against the allowlist.
+ * Throws `FireweaveError('Configuration')` — fixed message, no host echoed,
+ * because this message can land in a shared browser console.
+ */
+export declare function assertHostAllowed(host: string, allowedHosts?: readonly string[]): void;
+/** Throw if `apiKey` looks like a vendor or secret key rather than a Fireweave project key. */
+export declare function assertNotSecretKey(apiKey: string): void;
+//# sourceMappingURL=hosts.d.ts.map

package/dist/hosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosts.d.ts","sourceRoot":"","sources":["../src/hosts.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAMjD,CAAC;AAEH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO5D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CA0BtF;AAYD,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQvD"}

package/dist/hosts.js

@@ -0,0 +1,79 @@
+/**
+ * Backend host allowlist — the same SSRF guard the server SDK applies, kept
+ * for a different reason.
+ *
+ * A browser cannot be tricked into reaching a cloud metadata endpoint the way a
+ * server can; the browser's own origin model already prevents that. What this
+ * guard buys here is narrower and still worth having: a mistyped or tampered
+ * `apiUrl` cannot quietly send a project key, a targeting key, and a user's
+ * evaluation attributes to an unintended host. The allowlist is ON by default,
+ * so reaching a self-hosted fw-server is a deliberate, explicit act.
+ *
+ * Scheme policy matches the server SDK: https everywhere except loopback,
+ * where plain http is allowed for local development against a dev server.
+ */
+import { FireweaveError } from './errors.js';
+export const DEFAULT_ALLOWED_HOSTS = Object.freeze([
+    'app-server.fireweave.ai',
+    'staging-app-server.fireweave.ai',
+    'localhost',
+    '127.0.0.1',
+    '::1',
+]);
+export function isLoopbackHostname(hostname) {
+    return (hostname === 'localhost' ||
+        hostname === '127.0.0.1' ||
+        hostname === '::1' ||
+        hostname === '[::1]');
+}
+/**
+ * Validate a backend URL against the allowlist.
+ * Throws `FireweaveError('Configuration')` — fixed message, no host echoed,
+ * because this message can land in a shared browser console.
+ */
+export function assertHostAllowed(host, allowedHosts) {
+    let url;
+    try {
+        url = new URL(host);
+    }
+    catch {
+        throw new FireweaveError('Configuration');
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new FireweaveError('Configuration');
+    }
+    const loopback = isLoopbackHostname(url.hostname);
+    if (url.protocol === 'http:' && !loopback) {
+        throw new FireweaveError('Configuration');
+    }
+    const list = allowedHosts !== undefined && allowedHosts.length > 0 ? allowedHosts : DEFAULT_ALLOWED_HOSTS;
+    if (list.includes('*'))
+        return; // explicit opt-out
+    const allowed = list.some((h) => url.hostname === h ||
+        (h === 'localhost' && loopback) ||
+        (h === '::1' && url.hostname === '[::1]'));
+    if (!allowed) {
+        throw new FireweaveError('Configuration');
+    }
+}
+/**
+ * Key shapes this SDK refuses to accept.
+ *
+ * The whole security argument for a browser package (ADR-0009) is that it never
+ * wants a secret. Enforcing that at the door — rather than trusting that no
+ * code path asks for one — turns the claim into something a caller cannot
+ * accidentally violate by pasting the wrong value into their bundle config.
+ */
+const FORBIDDEN_KEY_PREFIXES = Object.freeze(['phs_', 'phx_', 'phc_']);
+/** Throw if `apiKey` looks like a vendor or secret key rather than a Fireweave project key. */
+export function assertNotSecretKey(apiKey) {
+    const key = apiKey.trim();
+    if (key.length === 0)
+        throw new FireweaveError('Configuration');
+    for (const prefix of FORBIDDEN_KEY_PREFIXES) {
+        if (key.startsWith(prefix)) {
+            throw new FireweaveError('Configuration');
+        }
+    }
+}
+//# sourceMappingURL=hosts.js.map

package/dist/hosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosts.js","sourceRoot":"","sources":["../src/hosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,yBAAyB;IACzB,iCAAiC;IACjC,WAAW;IACX,WAAW;IACX,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,KAAK,OAAO,CACrB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,YAAgC;IAC9E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GACR,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAC/F,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,mBAAmB;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,QAAQ,KAAK,CAAC;QAClB,CAAC,CAAC,KAAK,WAAW,IAAI,QAAQ,CAAC;QAC/B,CAAC,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAC5C,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1F,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @fireweaveai/web-sdk — Fireweave control points for the browser (ADR-0009).
+ *
+ * Remote-only and secret-free by construction: it never evaluates locally, has
+ * no vendor SDK dependency, reads no environment, and rejects vendor/secret key
+ * shapes at the door. Credentials are passed in explicitly by the embedding app.
+ *
+ * ```ts
+ * import { OpenFeature } from '@openfeature/web-sdk';
+ * import {
+ *   FireweaveRemoteWebAdapter,
+ *   FireweaveWebProvider,
+ *   FireweaveWebRuntime,
+ * } from '@fireweaveai/web-sdk';
+ *
+ * const runtime = new FireweaveWebRuntime(
+ *   new FireweaveRemoteWebAdapter({ apiUrl, apiKey }),
+ *   { globalContext: { targetingKey: 'anonymous' } }
+ * );
+ * await OpenFeature.setProviderAndWait(new FireweaveWebProvider(runtime));
+ *
+ * // Reads are SYNCHRONOUS — no await, safe inside render.
+ * const on = OpenFeature.getClient().getBooleanValue('new-checkout', false);
+ * ```
+ */
+export { FireweaveError, ERROR_TAXONOMY, isFireweaveError, } from './errors.js';
+export type { FireweaveErrorKind, FireweaveErrorOptions, OpenFeatureErrorCode, ErrorKindSpec, } from './errors.js';
+export type { JsonValue, FlagValueType, Decision, DecisionReason, CanonicalContext, LifecycleState, Signal, SignalKind, Exposure, ReleaseContext, ReleaseState, Capabilities, } from './types.js';
+export { DEFAULT_CONTEXT_LIMITS, DEFAULT_RESERVED_ATTRIBUTE_KEYS, canonicalizeContext, mergeContexts, } from './context.js';
+export type { ContextInput, ContextLimits } from './context.js';
+export { DEFAULT_ALLOWED_HOSTS, assertHostAllowed, assertNotSecretKey, isLoopbackHostname, } from './hosts.js';
+export type { WebBackendAdapter, AdapterResolution, AdapterRuntimeFeatures, PrefetchOptions, PrefetchResult, RegisterTargetOptions, RegisterTargetResult, TargetKind, } from './adapter.js';
+export { FireweaveRemoteWebAdapter } from './adapters/remote.js';
+export type { FireweaveRemoteWebAdapterOptions, FireweaveFetchLike, } from './adapters/remote.js';
+export { InMemoryWebAdapter } from './adapters/inmemory.js';
+export type { InMemoryWebAdapterOptions, InMemoryFlagDefinition, InMemoryFault, } from './adapters/inmemory.js';
+export { FireweaveLocalWebAdapter } from './adapters/local.js';
+export type { FireweaveLocalWebAdapterOptions } from './adapters/local.js';
+export { FireweaveWebRuntime, DEFAULT_FLAGS_READY_TIMEOUT_MS } from './runtime.js';
+export type { FireweaveWebRuntimeConfig, ExpectedFlagType } from './runtime.js';
+export { FireweaveWebProvider } from './provider.js';
+export type { FireweaveWebProviderOptions } from './provider.js';
+export { FireweaveWebClient, WebControlPointsApi, WebExposuresApi, WebSignalsApi, WebReleasesApi, DEFAULT_SIGNAL_ATTRIBUTE_ALLOWLIST, } from './client.js';
+export type { FireweaveWebClientOptions, ExtensionResult, ReleaseResult } from './client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,SAAS,EACT,aAAa,EACb,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,MAAM,EACN,UAAU,EACV,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,mBAAmB,EACnB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,GACX,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,YAAY,EACV,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EACV,yBAAyB,EACzB,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAC;AACnF,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,cAAc,EACd,kCAAkC,GACnC,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,yBAAyB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,35 @@
+/**
+ * @fireweaveai/web-sdk — Fireweave control points for the browser (ADR-0009).
+ *
+ * Remote-only and secret-free by construction: it never evaluates locally, has
+ * no vendor SDK dependency, reads no environment, and rejects vendor/secret key
+ * shapes at the door. Credentials are passed in explicitly by the embedding app.
+ *
+ * ```ts
+ * import { OpenFeature } from '@openfeature/web-sdk';
+ * import {
+ *   FireweaveRemoteWebAdapter,
+ *   FireweaveWebProvider,
+ *   FireweaveWebRuntime,
+ * } from '@fireweaveai/web-sdk';
+ *
+ * const runtime = new FireweaveWebRuntime(
+ *   new FireweaveRemoteWebAdapter({ apiUrl, apiKey }),
+ *   { globalContext: { targetingKey: 'anonymous' } }
+ * );
+ * await OpenFeature.setProviderAndWait(new FireweaveWebProvider(runtime));
+ *
+ * // Reads are SYNCHRONOUS — no await, safe inside render.
+ * const on = OpenFeature.getClient().getBooleanValue('new-checkout', false);
+ * ```
+ */
+export { FireweaveError, ERROR_TAXONOMY, isFireweaveError, } from './errors.js';
+export { DEFAULT_CONTEXT_LIMITS, DEFAULT_RESERVED_ATTRIBUTE_KEYS, canonicalizeContext, mergeContexts, } from './context.js';
+export { DEFAULT_ALLOWED_HOSTS, assertHostAllowed, assertNotSecretKey, isLoopbackHostname, } from './hosts.js';
+export { FireweaveRemoteWebAdapter } from './adapters/remote.js';
+export { InMemoryWebAdapter } from './adapters/inmemory.js';
+export { FireweaveLocalWebAdapter } from './adapters/local.js';
+export { FireweaveWebRuntime, DEFAULT_FLAGS_READY_TIMEOUT_MS } from './runtime.js';
+export { FireweaveWebProvider } from './provider.js';
+export { FireweaveWebClient, WebControlPointsApi, WebExposuresApi, WebSignalsApi, WebReleasesApi, DEFAULT_SIGNAL_ATTRIBUTE_ALLOWLIST, } from './client.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAuBrB,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAC/B,mBAAmB,EACnB,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAapB,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAMjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAO5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAC;AAGnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,cAAc,EACd,kCAAkC,GACnC,MAAM,aAAa,CAAC"}

package/dist/provider.d.ts

@@ -0,0 +1,39 @@
+/**
+ * OpenFeature web provider — the SYNCHRONOUS surface.
+ *
+ * `resolve*Evaluation` returns `ResolutionDetails` directly, never a Promise.
+ * That is the load-bearing web invariant: browser call sites read control
+ * points without `await`, inside render paths where awaiting is not an option.
+ * Everything asynchronous happens in `initialize` / `onContextChange`, which
+ * the OpenFeature web SDK is explicitly allowed to await.
+ *
+ * Per ADR-0003 the provider is a mapping layer only: OpenFeature types in,
+ * runtime decisions out. It owns error-code translation and nothing else.
+ */
+import { OpenFeatureEventEmitter, type EvaluationContext, type JsonValue as OFJsonValue, type Paradigm, type Provider, type ProviderMetadata, type ResolutionDetails } from '@openfeature/web-sdk';
+import type { FireweaveWebRuntime } from './runtime.js';
+export interface FireweaveWebProviderOptions {
+    /** Provider name reported to OpenFeature. Defaults to `fireweave-web`. */
+    readonly name?: string;
+}
+export declare class FireweaveWebProvider implements Provider {
+    readonly metadata: ProviderMetadata;
+    readonly runsOn: Paradigm;
+    readonly events: OpenFeatureEventEmitter;
+    readonly runtime: FireweaveWebRuntime;
+    constructor(runtime: FireweaveWebRuntime, options?: FireweaveWebProviderOptions);
+    initialize(context?: EvaluationContext): Promise<void>;
+    /**
+     * The identity-change path. Emits ConfigurationChanged with only the control
+     * points whose decisions actually moved, so subscribers re-render on real
+     * changes rather than on every sign-in.
+     */
+    onContextChange(_oldContext: EvaluationContext, newContext: EvaluationContext): Promise<void>;
+    onClose(): Promise<void>;
+    resolveBooleanEvaluation(flagKey: string, defaultValue: boolean, context: EvaluationContext): ResolutionDetails<boolean>;
+    resolveStringEvaluation(flagKey: string, defaultValue: string, context: EvaluationContext): ResolutionDetails<string>;
+    resolveNumberEvaluation(flagKey: string, defaultValue: number, context: EvaluationContext): ResolutionDetails<number>;
+    resolveObjectEvaluation<T extends OFJsonValue>(flagKey: string, defaultValue: T, context: EvaluationContext): ResolutionDetails<T>;
+    private resolve;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAEL,uBAAuB,EAEvB,KAAK,iBAAiB,EACtB,KAAK,SAAS,IAAI,WAAW,EAC7B,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,mBAAmB,EAAoB,MAAM,cAAc,CAAC;AAkC1E,MAAM,WAAW,2BAA2B;IAC1C,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,oBAAqB,YAAW,QAAQ;IACnD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAY;IACrC,QAAQ,CAAC,MAAM,0BAAiC;IAChD,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAE1B,OAAO,EAAE,mBAAmB,EAAE,OAAO,GAAE,2BAAgC;IAK7E,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5D;;;;OAIG;IACG,eAAe,CACnB,WAAW,EAAE,iBAAiB,EAC9B,UAAU,EAAE,iBAAiB,GAC5B,OAAO,CAAC,IAAI,CAAC;IAOV,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B,wBAAwB,CACtB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,EACrB,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,CAAC,OAAO,CAAC;IAI7B,uBAAuB,CACrB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,CAAC,MAAM,CAAC;IAI5B,uBAAuB,CACrB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,CAAC,MAAM,CAAC;IAI5B,uBAAuB,CAAC,CAAC,SAAS,WAAW,EAC3C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,CAAC,EACf,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,CAAC,CAAC,CAAC;IAIvB,OAAO,CAAC,OAAO;CAchB"}

package/dist/provider.js

@@ -0,0 +1,93 @@
+/**
+ * OpenFeature web provider — the SYNCHRONOUS surface.
+ *
+ * `resolve*Evaluation` returns `ResolutionDetails` directly, never a Promise.
+ * That is the load-bearing web invariant: browser call sites read control
+ * points without `await`, inside render paths where awaiting is not an option.
+ * Everything asynchronous happens in `initialize` / `onContextChange`, which
+ * the OpenFeature web SDK is explicitly allowed to await.
+ *
+ * Per ADR-0003 the provider is a mapping layer only: OpenFeature types in,
+ * runtime decisions out. It owns error-code translation and nothing else.
+ */
+import { ErrorCode, OpenFeatureEventEmitter, ProviderEvents, } from '@openfeature/web-sdk';
+const ERROR_CODE_MAP = Object.freeze({
+    PROVIDER_NOT_READY: ErrorCode.PROVIDER_NOT_READY,
+    PROVIDER_FATAL: ErrorCode.PROVIDER_FATAL,
+    FLAG_NOT_FOUND: ErrorCode.FLAG_NOT_FOUND,
+    PARSE_ERROR: ErrorCode.PARSE_ERROR,
+    TYPE_MISMATCH: ErrorCode.TYPE_MISMATCH,
+    TARGETING_KEY_MISSING: ErrorCode.TARGETING_KEY_MISSING,
+    INVALID_CONTEXT: ErrorCode.INVALID_CONTEXT,
+    GENERAL: ErrorCode.GENERAL,
+});
+function toResolutionDetails(decision, defaultValue) {
+    if (decision.errorCode !== undefined) {
+        const details = {
+            value: defaultValue,
+            reason: decision.reason,
+            errorCode: ERROR_CODE_MAP[decision.errorCode] ?? ErrorCode.GENERAL,
+            flagMetadata: { ...decision.metadata },
+        };
+        return decision.errorMessage !== undefined
+            ? { ...details, errorMessage: decision.errorMessage }
+            : details;
+    }
+    const details = {
+        value: decision.value,
+        reason: decision.reason,
+        flagMetadata: { ...decision.metadata },
+    };
+    return decision.variant !== undefined ? { ...details, variant: decision.variant } : details;
+}
+export class FireweaveWebProvider {
+    metadata;
+    runsOn = 'client';
+    events = new OpenFeatureEventEmitter();
+    runtime;
+    constructor(runtime, options = {}) {
+        this.runtime = runtime;
+        this.metadata = Object.freeze({ name: options.name ?? 'fireweave-web' });
+    }
+    async initialize(context) {
+        await this.runtime.initialize(context);
+        if (this.runtime.getState() === 'STALE') {
+            // Surfaced, not swallowed: the app booted, but on defaults. A host that
+            // cares (a kill-switch, say) can react instead of silently shipping OFF.
+            this.events.emit(ProviderEvents.Stale, {
+                message: 'fireweave: flag prefetch did not complete; serving defaults',
+            });
+        }
+    }
+    /**
+     * The identity-change path. Emits ConfigurationChanged with only the control
+     * points whose decisions actually moved, so subscribers re-render on real
+     * changes rather than on every sign-in.
+     */
+    async onContextChange(_oldContext, newContext) {
+        const changed = await this.runtime.setContext(newContext);
+        if (changed.length > 0) {
+            this.events.emit(ProviderEvents.ConfigurationChanged, { flagsChanged: [...changed] });
+        }
+    }
+    async onClose() {
+        await this.runtime.shutdown();
+    }
+    resolveBooleanEvaluation(flagKey, defaultValue, context) {
+        return this.resolve(flagKey, 'boolean', defaultValue, context);
+    }
+    resolveStringEvaluation(flagKey, defaultValue, context) {
+        return this.resolve(flagKey, 'string', defaultValue, context);
+    }
+    resolveNumberEvaluation(flagKey, defaultValue, context) {
+        return this.resolve(flagKey, 'number', defaultValue, context);
+    }
+    resolveObjectEvaluation(flagKey, defaultValue, context) {
+        return this.resolve(flagKey, 'object', defaultValue, context);
+    }
+    resolve(flagKey, expectedType, defaultValue, context) {
+        const decision = this.runtime.evaluateSync(flagKey, expectedType, defaultValue, context);
+        return toResolutionDetails(decision, defaultValue);
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,cAAc,GAOf,MAAM,sBAAsB,CAAC;AAK9B,MAAM,cAAc,GAAwC,MAAM,CAAC,MAAM,CAAC;IACxE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;IAChD,cAAc,EAAE,SAAS,CAAC,cAAc;IACxC,cAAc,EAAE,SAAS,CAAC,cAAc;IACxC,WAAW,EAAE,SAAS,CAAC,WAAW;IAClC,aAAa,EAAE,SAAS,CAAC,aAAa;IACtC,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;IACtD,eAAe,EAAE,SAAS,CAAC,eAAe;IAC1C,OAAO,EAAE,SAAS,CAAC,OAAO;CAC3B,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAI,QAAkB,EAAE,YAAe;IACjE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAyB;YACpC,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,OAAO;YAClE,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE;SACvC,CAAC;QACF,OAAO,QAAQ,CAAC,YAAY,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE;YACrD,CAAC,CAAC,OAAO,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAyB;QACpC,KAAK,EAAE,QAAQ,CAAC,KAAqB;QACrC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE;KACvC,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9F,CAAC;AAOD,MAAM,OAAO,oBAAoB;IACtB,QAAQ,CAAmB;IAC3B,MAAM,GAAa,QAAQ,CAAC;IAC5B,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACvC,OAAO,CAAsB;IAEtC,YAAY,OAA4B,EAAE,UAAuC,EAAE;QACjF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAA2B;QAC1C,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAmC,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YACxC,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE;gBACrC,OAAO,EAAE,6DAA6D;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,WAA8B,EAC9B,UAA6B;QAE7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAA0B,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED,wBAAwB,CACtB,OAAe,EACf,YAAqB,EACrB,OAA0B;QAE1B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,uBAAuB,CACrB,OAAe,EACf,YAAoB,EACpB,OAA0B;QAE1B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,uBAAuB,CACrB,OAAe,EACf,YAAoB,EACpB,OAA0B;QAE1B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,uBAAuB,CACrB,OAAe,EACf,YAAe,EACf,OAA0B;QAE1B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAEO,OAAO,CACb,OAAe,EACf,YAA8B,EAC9B,YAAe,EACf,OAA0B;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CACxC,OAAO,EACP,YAAY,EACZ,YAAoC,EACpC,OAAuB,CACxB,CAAC;QACF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/runtime.d.ts

@@ -0,0 +1,62 @@
+import type { ContextInput, ContextLimits } from './context.js';
+import type { RegisterTargetOptions, RegisterTargetResult, WebBackendAdapter } from './adapter.js';
+import type { Decision, Exposure, JsonValue, LifecycleState, ReleaseContext, Signal } from './types.js';
+export type ExpectedFlagType = 'boolean' | 'string' | 'number' | 'object';
+/** Ceiling on the initial prefetch so a hung backend cannot block boot. */
+export declare const DEFAULT_FLAGS_READY_TIMEOUT_MS = 5000;
+export interface FireweaveWebRuntimeConfig {
+    /** Context applied to every evaluation unless overridden per call. */
+    readonly globalContext?: ContextInput;
+    readonly limits?: Partial<ContextLimits>;
+    readonly flagsReadyTimeoutMs?: number;
+    /** Restrict prefetch to a known set of control points. */
+    readonly flagKeys?: readonly string[];
+    /** Emit a Fireweave exposure on each successful evaluation. Default false. */
+    readonly sendExposure?: boolean;
+}
+export declare class FireweaveWebRuntime {
+    readonly adapter: WebBackendAdapter;
+    readonly config: FireweaveWebRuntimeConfig;
+    private state;
+    private cache;
+    private globalContext;
+    private readonly limits;
+    private releaseContext;
+    private readonly listeners;
+    constructor(adapter: WebBackendAdapter, config?: FireweaveWebRuntimeConfig);
+    getState(): LifecycleState;
+    onStateChange(listener: (state: LifecycleState) => void): () => void;
+    private setState;
+    setReleaseContext(ctx: ReleaseContext): void;
+    getReleaseContext(): ReleaseContext;
+    /** Initialize the adapter and populate the cache. Never throws. */
+    initialize(context?: ContextInput): Promise<void>;
+    /**
+     * Replace the global context and re-prefetch — the identity-change path.
+     *
+     * Call this after sign-in with the user's stable id, so percentage ramps
+     * bucket on that id rather than on an anonymous one. Returns the keys whose
+     * decisions changed, so a provider can emit a targeted ConfigurationChanged.
+     */
+    setContext(context: ContextInput): Promise<readonly string[]>;
+    /** Re-run the prefetch against the current global context. */
+    refresh(): Promise<void>;
+    /**
+     * Synchronous evaluation against the prefetched cache. Never throws —
+     * failures surface as ERROR decisions, exactly like the OpenFeature contract.
+     */
+    evaluateSync(flagKey: string, expectedType: ExpectedFlagType, defaultValue: JsonValue, invocationContext?: ContextInput): Decision;
+    private reasonFor;
+    private metadataFor;
+    private recordExposureFor;
+    recordExposure(exposure: Exposure): void;
+    recordSignal(signal: Signal): void;
+    registerTarget(targetingKey: string, options?: RegisterTargetOptions): Promise<RegisterTargetResult>;
+    flush(options?: {
+        beacon?: boolean;
+    }): Promise<void>;
+    shutdown(): Promise<void>;
+    private changedKeys;
+    private errorDecision;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,KAAK,EAGV,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAEV,QAAQ,EAER,QAAQ,EACR,SAAS,EACT,cAAc,EACd,cAAc,EACd,MAAM,EACP,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1E,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AAEpD,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAeD,qBAAa,mBAAmB;IAC9B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAE3C,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,aAAa,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,cAAc,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8C;gBAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,GAAE,yBAA8B;IAO9E,QAAQ,IAAI,cAAc;IAI1B,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI;IAKpE,OAAO,CAAC,QAAQ;IAKhB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI;IAI5C,iBAAiB,IAAI,cAAc;IAInC,mEAAmE;IAC7D,UAAU,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAcvD;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAOnE,8DAA8D;IACxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA8C9B;;;OAGG;IACH,YAAY,CACV,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,gBAAgB,EAC9B,YAAY,EAAE,SAAS,EACvB,iBAAiB,CAAC,EAAE,YAAY,GAC/B,QAAQ;IAgDX,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,iBAAiB;IAkBzB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAIxC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5B,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC;IAiB1B,KAAK,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAW/B,OAAO,CAAC,WAAW;IAWnB,OAAO,CAAC,aAAa;CAetB"}