@lunora/flags 1.0.0-alpha.40 → 1.0.0-alpha.41

package/dist/providers/flagship.d.mts

@@ -27,8 +27,15 @@ interface FlagshipHttpOptions {
   accountId?: string;
   /** Flagship app id; the SDK builds the evaluation URL (mutually exclusive with `endpoint`). */
   appId?: string;
-  /** Bearer token added as an `Authorization: Bearer` header to every request. */
-  authToken?: string;
+  /**
+   * Bearer token added as an `Authorization: Bearer` header to every request.
+   * Either the literal token, or a thunk resolved against the Worker `env` at
+   * construction (`(env) => env.FLAGSHIP_TOKEN`) so the secret never has to be
+   * inlined in source. A thunk resolving to anything but a non-empty string
+   * throws: `Bearer undefined` would otherwise make every evaluation fall
+   * silently back to its default.
+   */
+  authToken?: ((env: Record<string, unknown>) => unknown) | string;
   /** Base URL override (only used with `appId`). */
   baseUrl?: string;
   cacheMaxSize?: number;
@@ -54,8 +61,9 @@ type FlagshipProviderOptions = FlagshipBindingOptions | FlagshipHttpOptions;
  * // Binding mode (recommended) — reads env.FLAGS at request time:
  * flagshipProvider({ binding: "FLAGS" })
  *
- * // HTTP mode:
+ * // HTTP mode — the token is a literal, or a thunk read off the Worker env:
  * flagshipProvider({ appId: "app-abc", accountId: "acct", authToken: "tok" })
+ * flagshipProvider({ appId: "app-abc", accountId: "acct", authToken: (env) => env.FLAGSHIP_TOKEN })
  * ```
  */
 declare const flagshipProvider: (options: FlagshipProviderOptions) => FlagsProviderFactory;

package/dist/providers/flagship.d.ts

@@ -27,8 +27,15 @@ interface FlagshipHttpOptions {
   accountId?: string;
   /** Flagship app id; the SDK builds the evaluation URL (mutually exclusive with `endpoint`). */
   appId?: string;
-  /** Bearer token added as an `Authorization: Bearer` header to every request. */
-  authToken?: string;
+  /**
+   * Bearer token added as an `Authorization: Bearer` header to every request.
+   * Either the literal token, or a thunk resolved against the Worker `env` at
+   * construction (`(env) => env.FLAGSHIP_TOKEN`) so the secret never has to be
+   * inlined in source. A thunk resolving to anything but a non-empty string
+   * throws: `Bearer undefined` would otherwise make every evaluation fall
+   * silently back to its default.
+   */
+  authToken?: ((env: Record<string, unknown>) => unknown) | string;
   /** Base URL override (only used with `appId`). */
   baseUrl?: string;
   cacheMaxSize?: number;
@@ -54,8 +61,9 @@ type FlagshipProviderOptions = FlagshipBindingOptions | FlagshipHttpOptions;
  * // Binding mode (recommended) — reads env.FLAGS at request time:
  * flagshipProvider({ binding: "FLAGS" })
  *
- * // HTTP mode:
+ * // HTTP mode — the token is a literal, or a thunk read off the Worker env:
  * flagshipProvider({ appId: "app-abc", accountId: "acct", authToken: "tok" })
+ * flagshipProvider({ appId: "app-abc", accountId: "acct", authToken: (env) => env.FLAGSHIP_TOKEN })
  * ```
  */
 declare const flagshipProvider: (options: FlagshipProviderOptions) => FlagsProviderFactory;

package/dist/providers/flagship.mjs

@@ -1 +1 @@
-import{FlagshipServerProvider as a}from"@cloudflare/flagship/server";import{LunoraError as r}from"@lunora/errors";const g=i=>"binding"in i&&typeof i.binding=="string",f=i=>{if(g(i)){const{binding:n,...t}=i;return p=>{const e=p[n];if(e==null)throw new r("INTERNAL",`flagshipProvider: no binding "${n}" found on env. Add a \`flagship\` binding to wrangler.jsonc, e.g. { "flagship": [{ "binding": "${n}", "app_id": "your-app-id" }] }.`);return new a({binding:e,...t})}}const{appId:d,endpoint:o}=i;if(d===void 0&&o===void 0)throw new r("INTERNAL",'flagshipProvider: HTTP mode requires either `appId` (the SDK builds the evaluation URL) or `endpoint` (a full evaluation URL). Pass exactly one, or use binding mode: `flagshipProvider({ binding: "FLAGS" })`.');if(d!==void 0&&o!==void 0)throw new r("INTERNAL","flagshipProvider: `appId` and `endpoint` are mutually exclusive in HTTP mode — pass exactly one.");return()=>new a(i)};export{f as flagshipProvider};
+import{FlagshipServerProvider as d}from"@cloudflare/flagship/server";import{LunoraError as o}from"@lunora/errors";const p=e=>"binding"in e&&typeof e.binding=="string",h=e=>{if(p(e)){const{binding:n,...i}=e;return u=>{const t=u[n];if(t==null)throw new o("INTERNAL",`flagshipProvider: no binding "${n}" found on env. Add a \`flagship\` binding to wrangler.jsonc, e.g. { "flagship": [{ "binding": "${n}", "app_id": "your-app-id" }] }.`);return new d({binding:t,...i})}}const{appId:a,endpoint:s}=e;if(a===void 0&&s===void 0)throw new o("INTERNAL",'flagshipProvider: HTTP mode requires either `appId` (the SDK builds the evaluation URL) or `endpoint` (a full evaluation URL). Pass exactly one, or use binding mode: `flagshipProvider({ binding: "FLAGS" })`.');if(a!==void 0&&s!==void 0)throw new o("INTERNAL","flagshipProvider: `appId` and `endpoint` are mutually exclusive in HTTP mode — pass exactly one.");const{authToken:r,...l}=e;return n=>{if(typeof r!="function")return new d({...l,...r===void 0?{}:{authToken:r}});const i=r(n);if(typeof i!="string"||i.length===0)throw new o("INTERNAL","flagshipProvider: `authToken` resolved to an empty or non-string value — check that the env var the thunk reads is set. An unset secret would send `Bearer undefined`, and every evaluation would silently fall back to its default.");return new d({...l,authToken:i})}};export{h as flagshipProvider};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/flags",
-  "version": "1.0.0-alpha.40",
+  "version": "1.0.0-alpha.41",
   "description": "OpenFeature-based feature flags for Lunora — ctx.flags, useFlag, and a first-class Cloudflare Flagship provider with any OpenFeature provider pluggable",
   "keywords": [
     "cloudflare",
@@ -60,7 +60,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.29",
+    "@lunora/errors": "1.0.0-alpha.30",
     "@openfeature/server-sdk": "^1.23.0"
   },
   "peerDependencies": {