@nanoflags/sdk 0.0.0-stage → 0.3.0

package/dist/src-DUF_NkBY.js

@@ -0,0 +1,1471 @@
+// ../engine/src/index.ts
+const encoder$1 = new TextEncoder();
+/** MurmurHash3 x86 32-bit over UTF-8 bytes. Used for distribution only — never for security. */
+function murmur3(input, seed = 0) {
+	const data = encoder$1.encode(input.normalize("NFC"));
+	const c1 = 3432918353;
+	const c2 = 461845907;
+	let h = seed >>> 0;
+	const blocks = data.length >> 2;
+	for (let i = 0; i < blocks; i++) {
+		const o = i * 4;
+		let k = data[o] | data[o + 1] << 8 | data[o + 2] << 16 | data[o + 3] << 24;
+		k = Math.imul(k, c1);
+		k = k << 15 | k >>> 17;
+		k = Math.imul(k, c2);
+		h ^= k;
+		h = h << 13 | h >>> 19;
+		h = Math.imul(h, 5) + 3864292196 | 0;
+	}
+	let k = 0;
+	const tail = blocks * 4;
+	switch (data.length & 3) {
+		case 3: k ^= data[tail + 2] << 16;
+		case 2: k ^= data[tail + 1] << 8;
+		case 1:
+			k ^= data[tail];
+			k = Math.imul(k, c1);
+			k = k << 15 | k >>> 17;
+			k = Math.imul(k, c2);
+			h ^= k;
+	}
+	h ^= data.length;
+	h ^= h >>> 16;
+	h = Math.imul(h, 2246822507);
+	h ^= h >>> 13;
+	h = Math.imul(h, 3266489909);
+	h ^= h >>> 16;
+	return h >>> 0;
+}
+/** Bucket in [0, 100) with two decimals of resolution. Stable for a given seed + identity. */
+function bucketOf(seed, identity) {
+	return murmur3(`${seed}:${identity}`) % 1e4 / 100;
+}
+/** Own-property lookup, so keys such as "constructor" or "__proto__" never resolve to Object.prototype members. */
+function own(obj, key) {
+	return obj != null && Object.prototype.hasOwnProperty.call(obj, key) ? obj[key] : void 0;
+}
+function looseEq(a, b) {
+	if (a === void 0 || b === void 0) return false;
+	if (typeof a === "object" || typeof b === "object") return JSON.stringify(a) === JSON.stringify(b);
+	return a === b;
+}
+function num(v) {
+	if (typeof v === "number" && Number.isFinite(v)) return v;
+	if (typeof v === "string" && v.trim() !== "" && Number.isFinite(Number(v))) return Number(v);
+	return null;
+}
+function matchCondition(c, ctx, segments, depth = 0) {
+	if (c.op === "segment" || c.op === "not_segment") {
+		const seg = typeof c.value === "string" ? own(segments, c.value) : void 0;
+		const inSeg = seg !== void 0 && depth < 4 && matchAll(seg.match, seg.conditions, ctx, segments, depth + 1);
+		return c.op === "segment" ? inSeg : seg !== void 0 && !inSeg;
+	}
+	const actual = own(ctx, c.attribute);
+	switch (c.op) {
+		case "exists": return actual !== void 0 && actual !== null;
+		case "not_exists": return actual === void 0 || actual === null;
+		case "eq": return looseEq(actual, c.value);
+		case "neq": return actual !== void 0 && !looseEq(actual, c.value);
+		case "in": return Array.isArray(c.value) && c.value.some((v) => looseEq(actual, v));
+		case "not_in": return actual !== void 0 && Array.isArray(c.value) && !c.value.some((v) => looseEq(actual, v));
+		case "contains": return typeof actual === "string" && typeof c.value === "string" && actual.includes(c.value);
+		case "starts_with": return typeof actual === "string" && typeof c.value === "string" && actual.startsWith(c.value);
+		case "ends_with": return typeof actual === "string" && typeof c.value === "string" && actual.endsWith(c.value);
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte": {
+			const a = num(actual);
+			const b = num(c.value);
+			if (a === null || b === null) return false;
+			return c.op === "gt" ? a > b : c.op === "gte" ? a >= b : c.op === "lt" ? a < b : a <= b;
+		}
+		default: return false;
+	}
+}
+function matchAll(mode, conditions, ctx, segments, depth = 0) {
+	if (conditions.length === 0) return true;
+	return mode === "any" ? conditions.some((c) => matchCondition(c, ctx, segments, depth)) : conditions.every((c) => matchCondition(c, ctx, segments, depth));
+}
+function describeCondition(c) {
+	const v = Array.isArray(c.value) ? c.value.join(", ") : c.value === void 0 ? "" : String(c.value);
+	const words = {
+		eq: "=",
+		neq: "≠",
+		in: "in",
+		not_in: "not in",
+		contains: "contains",
+		starts_with: "starts with",
+		ends_with: "ends with",
+		gt: ">",
+		gte: "≥",
+		lt: "<",
+		lte: "≤",
+		exists: "exists",
+		not_exists: "does not exist",
+		segment: "in segment",
+		not_segment: "not in segment"
+	};
+	if (c.op === "segment" || c.op === "not_segment") return `${words[c.op]} ${v}`;
+	if (c.op === "exists" || c.op === "not_exists") return `${c.attribute} ${words[c.op]}`;
+	return `${c.attribute} ${words[c.op]} ${v}`;
+}
+/**
+* Evaluate one flag. Never throws: on any problem it returns `fallback` with reason
+* "flag_not_found" or "error", so callers always have an explicit default.
+*/
+function evaluate(bundle, flagKey, ctx, fallback) {
+	const revision = bundle?.revision ?? 0;
+	const trace = [];
+	try {
+		const flag = own(bundle?.flags, flagKey);
+		if (!bundle || !flag) {
+			trace.push({
+				kind: "result",
+				title: `Returned ${fmt(fallback)}`,
+				detail: bundle ? "Flag is not in this configuration. The application fallback applies." : "No configuration is loaded. The application fallback applies."
+			});
+			return {
+				flagKey,
+				value: fallback,
+				reason: "flag_not_found",
+				revision,
+				trace
+			};
+		}
+		trace.push({
+			kind: "config",
+			title: "Configuration loaded",
+			detail: revision > 0 ? `r${revision}` : "draft"
+		});
+		if (!flag.enabled) {
+			trace.push({
+				kind: "result",
+				title: `Returned ${fmt(flag.off)}`,
+				detail: "Flag is disabled in this environment."
+			});
+			return {
+				flagKey,
+				value: flag.off,
+				reason: "off",
+				revision,
+				trace
+			};
+		}
+		for (let i = 0; i < flag.rules.length; i++) {
+			const rule = flag.rules[i];
+			const matched = matchAll(rule.match, rule.conditions, ctx, bundle.segments);
+			const label = `Rule ${String(i + 1).padStart(2, "0")}`;
+			const summary = rule.conditions.length ? rule.conditions.map(describeCondition).join(rule.match === "any" ? " OR " : " AND ") : "all contexts";
+			trace.push({
+				kind: "rule",
+				title: matched ? `${label} matched` : `${label} did not match`,
+				detail: summary,
+				matched
+			});
+			if (!matched) continue;
+			if (rule.serve.type === "fixed") {
+				trace.push({
+					kind: "result",
+					title: `Returned ${fmt(rule.serve.value)}`,
+					detail: `${label} serves a fixed value.`
+				});
+				return {
+					flagKey,
+					value: rule.serve.value,
+					reason: "rule_match",
+					ruleIndex: i,
+					ruleId: rule.id,
+					revision,
+					trace
+				};
+			}
+			const attr = rule.serve.bucketBy ?? "key";
+			const identity = own(ctx, attr);
+			if (identity === void 0 || identity === null || identity === "") {
+				trace.push({
+					kind: "allocation",
+					title: "Allocation skipped",
+					detail: `Context has no "${attr}" to bucket by; treated as outside the allocation.`,
+					matched: false
+				});
+				trace.push({
+					kind: "result",
+					title: `Returned ${fmt(rule.serve.otherwise)}`,
+					detail: "Remaining eligible users."
+				});
+				return {
+					flagKey,
+					value: rule.serve.otherwise,
+					reason: "rule_match",
+					ruleIndex: i,
+					ruleId: rule.id,
+					inRollout: false,
+					revision,
+					trace
+				};
+			}
+			const bucket = bucketOf(rule.serve.seed ?? flagKey, String(identity));
+			const inRollout = bucket < rule.serve.percentage;
+			trace.push({
+				kind: "allocation",
+				title: "Allocation evaluated",
+				detail: `${rule.serve.percentage}% rollout · ${attr} ${inRollout ? "inside" : "outside"} allocation (bucket ${bucket.toFixed(2)})`,
+				matched: inRollout
+			});
+			const value = inRollout ? rule.serve.value : rule.serve.otherwise;
+			trace.push({
+				kind: "result",
+				title: `Returned ${fmt(value)}`,
+				detail: inRollout ? `Inside the ${rule.serve.percentage}% allocation.` : "Remaining eligible users."
+			});
+			return {
+				flagKey,
+				value,
+				reason: "rule_match",
+				ruleIndex: i,
+				ruleId: rule.id,
+				inRollout,
+				bucket,
+				revision,
+				trace
+			};
+		}
+		trace.push({
+			kind: "result",
+			title: `Returned ${fmt(flag.default)}`,
+			detail: "No rule matched. The flag default applies."
+		});
+		return {
+			flagKey,
+			value: flag.default,
+			reason: "default",
+			revision,
+			trace
+		};
+	} catch (e) {
+		const error = e instanceof Error ? e.message : String(e);
+		trace.push({
+			kind: "result",
+			title: `Returned ${fmt(fallback)}`,
+			detail: `Evaluation error: ${error}. The application fallback applies.`
+		});
+		return {
+			flagKey,
+			value: fallback,
+			reason: "error",
+			revision,
+			trace,
+			error
+		};
+	}
+}
+function fmt(v) {
+	return typeof v === "string" ? v : JSON.stringify(v);
+}
+// src/store.ts
+const DB = "nanoflags";
+const OBJECT_STORE = "bundles";
+/**
+* Browser default: IndexedDB when available. Everywhere else (Node, edge runtimes, serverless):
+* no persistence — there is no safe default location and cold starts should not touch disk.
+*/
+function defaultStore(id) {
+	if (typeof window === "undefined" || typeof indexedDB === "undefined" || indexedDB === null) return null;
+	return indexedDbStore(id);
+}
+function indexedDbStore(id) {
+	const open = () => new Promise((resolve, reject) => {
+		const req = indexedDB.open(DB, 1);
+		req.onupgradeneeded = () => {
+			if (!req.result.objectStoreNames.contains(OBJECT_STORE)) req.result.createObjectStore(OBJECT_STORE);
+		};
+		req.onsuccess = () => resolve(req.result);
+		req.onerror = () => reject(req.error ?? /* @__PURE__ */ new Error("indexedDB open failed"));
+		req.onblocked = () => reject(/* @__PURE__ */ new Error("indexedDB blocked"));
+	});
+	const run = async (mode, op) => {
+		const db = await open();
+		try {
+			return await new Promise((resolve, reject) => {
+				const tx = db.transaction(OBJECT_STORE, mode);
+				const req = op(tx.objectStore(OBJECT_STORE));
+				tx.oncomplete = () => resolve(req.result);
+				tx.onerror = () => reject(tx.error ?? /* @__PURE__ */ new Error("indexedDB transaction failed"));
+				tx.onabort = () => reject(tx.error ?? /* @__PURE__ */ new Error("indexedDB transaction aborted"));
+			});
+		} finally {
+			db.close();
+		}
+	};
+	return {
+		async get() {
+			try {
+				const v = await run("readonly", (s) => s.get(id));
+				return typeof v === "string" ? v : null;
+			} catch {
+				return null;
+			}
+		},
+		async set(value) {
+			try {
+				await run("readwrite", (s) => s.put(value, id));
+			} catch {}
+		}
+	};
+}
+// src/sse.ts
+/** Minimal server-sent-events reader for fetch streams (Node, workers, browsers without EventSource auth). */
+async function readSse(body, onEvent) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	const dispatch = (block) => {
+		let event = "message";
+		const data = [];
+		for (const line of block.split("\n")) {
+			if (line === "" || line.startsWith(":")) continue;
+			const i = line.indexOf(":");
+			const field = i === -1 ? line : line.slice(0, i);
+			const value = i === -1 ? "" : line.slice(i + 1).replace(/^ /, "");
+			if (field === "event") event = value;
+			else if (field === "data") data.push(value);
+		}
+		if (data.length > 0) onEvent(event, data.join("\n"));
+	};
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			buffer = (buffer + decoder.decode(value, { stream: true })).replace(/\r\n?/g, "\n");
+			let i;
+			while ((i = buffer.indexOf("\n\n")) !== -1) {
+				dispatch(buffer.slice(0, i));
+				buffer = buffer.slice(i + 2);
+			}
+			if (buffer.length > 65536) buffer = "";
+		}
+	} finally {
+		reader.cancel().catch(() => void 0);
+	}
+}
+// src/verify.ts
+const encoder = new TextEncoder();
+function canonicalString(environmentId, revision, checksum, bundleSha256Hex) {
+	return `nanoflags-bundle-v1\n${environmentId}\n${revision}\n${checksum}\n${bundleSha256Hex}`;
+}
+function subtle() {
+	const s = globalThis.crypto?.subtle;
+	if (!s) throw new Error("WebCrypto is not available in this runtime.");
+	return s;
+}
+async function sha256Hex(text) {
+	const digest = new Uint8Array(await subtle().digest("SHA-256", encoder.encode(text)));
+	let out = "";
+	for (const b of digest) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+function base64UrlDecode(input) {
+	const s = input.replace(/-/g, "+").replace(/_/g, "/").replace(/=+$/, "");
+	if (!/^[A-Za-z0-9+/]*$/.test(s) || s.length % 4 === 1) throw new Error("Malformed base64url value.");
+	const bin = atob(s + "=".repeat((4 - s.length % 4) % 4));
+	const out = new Uint8Array(new ArrayBuffer(bin.length));
+	for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+	return out;
+}
+function isPublicEd25519Jwk(v) {
+	if (typeof v !== "object" || v === null) return false;
+	const k = v;
+	return k.kty === "OKP" && k.crv === "Ed25519" && typeof k.x === "string" && k.d === void 0;
+}
+async function importPublicKeys(jwks) {
+	const out = [];
+	for (const jwk of jwks) {
+		if (!isPublicEd25519Jwk(jwk)) continue;
+		const key = await subtle().importKey("jwk", {
+			kty: "OKP",
+			crv: "Ed25519",
+			x: jwk.x
+		}, { name: "Ed25519" }, false, ["verify"]);
+		out.push({
+			kid: typeof jwk.kid === "string" ? jwk.kid : null,
+			key
+		});
+	}
+	return out;
+}
+/** True when `info.signature` is a valid signature by one of `keys` over the canonical string for `bundleText`. */
+async function verifyBundleText(keys, info, bundleText) {
+	let signature;
+	try {
+		signature = base64UrlDecode(info.signature);
+	} catch {
+		return false;
+	}
+	if (signature.length !== 64) return false;
+	const data = encoder.encode(canonicalString(info.environmentId, info.revision, info.checksum, await sha256Hex(bundleText)));
+	const candidates = info.kid === null ? keys : keys.filter((k) => k.kid === info.kid || k.kid === null);
+	for (const k of candidates) try {
+		if (await subtle().verify({ name: "Ed25519" }, k.key, signature, data)) return true;
+	} catch {}
+	return false;
+}
+/**
+* Returns the exact source text of the top-level `"bundle"` member of a JSON object, or null.
+* The edge embeds the stored bundle text byte-for-byte; hashing that span avoids depending on
+* re-serialisation. When the member occurs more than once the LAST one wins, like `JSON.parse`.
+*/
+function rawMember(text, member) {
+	let i = 0;
+	const n = text.length;
+	const ws = () => {
+		while (i < n && (text[i] === " " || text[i] === "\n" || text[i] === "\r" || text[i] === "	")) i++;
+	};
+	const str = () => {
+		if (text[i] !== "\"") return null;
+		const start = i++;
+		while (i < n) {
+			const c = text[i];
+			if (c === "\\") i += 2;
+			else if (c === "\"") return text.slice(start, ++i);
+			else i++;
+		}
+		return null;
+	};
+	const value = () => {
+		ws();
+		const c = text[i];
+		if (c === "\"") return str() !== null;
+		if (c === "{" || c === "[") {
+			let depth = 0;
+			while (i < n) {
+				const d = text[i];
+				if (d === "\"") {
+					if (str() === null) return false;
+					continue;
+				}
+				if (d === "{" || d === "[") depth++;
+				else if (d === "}" || d === "]") depth--;
+				i++;
+				if (depth === 0) return true;
+			}
+			return false;
+		}
+		const start = i;
+		while (i < n && !",}] \n\r	".includes(text[i])) i++;
+		return i > start;
+	};
+	ws();
+	if (text[i] !== "{") return null;
+	i++;
+	let found = null;
+	for (;;) {
+		ws();
+		if (text[i] === "}") return found;
+		const key = str();
+		if (key === null) return null;
+		ws();
+		if (text[i] !== ":") return null;
+		i++;
+		ws();
+		const start = i;
+		if (!value()) return null;
+		let name;
+		try {
+			name = JSON.parse(key);
+		} catch {
+			return null;
+		}
+		if (name === member) found = text.slice(start, i);
+		ws();
+		if (text[i] === ",") i++;
+		else if (text[i] === "}") return found;
+		else return null;
+	}
+}
+// src/index.ts
+/**
+* @nanoflags/sdk — isomorphic core.
+*
+* Flags are evaluated locally and synchronously against an in-memory bundle. The network is only
+* used in the background: to load the bundle, to learn about new revisions, and to send sampled
+* telemetry. A flag accessor never performs I/O and never throws.
+*
+* New revisions arrive over one of three transports, best first: the live WebSocket (`/v1/live`,
+* the edge pushes the signed bundle itself — no request follows), the SSE stream (`/v1/stream`,
+* a notification followed by a conditional fetch), and polling (`/v1/bundle`).
+*/
+const SDK_VERSION = "0.3.0";
+/** Header that carries a test-session token between services. */
+const SESSION_HEADER = "x-nanoflags-session";
+/** WebSocket subprotocol of `/v1/live`. The key travels as a second protocol entry, never in the URL. */
+const LIVE_PROTOCOL = "nanoflags.v1";
+var NanoFlagsError = class extends Error {
+	code;
+	httpStatus;
+	constructor(message, code, httpStatus) {
+		super(message);
+		this.code = code;
+		this.httpStatus = httpStatus;
+		this.name = "NanoFlagsError";
+	}
+};
+const MAX_QUEUE = 500;
+const MAX_BATCH = 50;
+const MAX_EVENT_VALUE_CHARS = 1024;
+const REQUEST_TIMEOUT_MS = 1e4;
+const MAX_SESSIONS = 1e3;
+const SESSION_MISS_TTL_MS = 15e3;
+const SESSION_ERROR_TTL_MS = 3e3;
+const KEYS_REFETCH_MS = 6e4;
+const STORAGE_KEY = "nanoflags:session";
+const LIVE_CONNECT_TIMEOUT_MS = 1e4;
+const LIVE_PING_MS = 3e4;
+const LIVE_PONG_TIMEOUT_MS = 1e4;
+const LIVE_MAX_BACKOFF_MS = 3e5;
+/** A healthy socket is replaced after about this long, so the edge validates the key again (the edge drops sockets older than 2 h). */
+const LIVE_ROTATE_MS = 3e6;
+/** A session token is opaque; it only has to be safe to put in a header. */
+function isSessionToken(v) {
+	return typeof v === "string" && /^[\x21-\x7e]{1,512}$/.test(v);
+}
+function unref(t) {
+	t.unref?.();
+	return t;
+}
+function isBundle(v) {
+	if (typeof v !== "object" || v === null) return false;
+	const b = v;
+	return b.schema === 1 && typeof b.revision === "number" && typeof b.flags === "object" && b.flags !== null && !Array.isArray(b.flags) && typeof b.segments === "object" && b.segments !== null;
+}
+function typeOf(v) {
+	return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+}
+function createClient(options) {
+	const sdkKey = options.sdkKey;
+	const baseUrl = String(options.baseUrl ?? "").replace(/\/+$/, "");
+	const pollIntervalMs = options.pollIntervalMs ?? 3e4;
+	const doFetch = options.fetch ?? (typeof fetch === "function" ? (input, init) => fetch(input, init) : void 0);
+	const ev = options.events === false ? { enabled: false } : options.events ?? {};
+	const eventsEnabled = ev.enabled ?? true;
+	const sampleRate = Math.min(1, Math.max(0, ev.sampleRate ?? .1));
+	const flushIntervalMs = ev.flushIntervalMs ?? 1e4;
+	const reportIntervalMs = ev.reportIntervalMs ?? 6e4;
+	const livePollIntervalMs = options.livePollIntervalMs ?? 3e5;
+	const random = ev.random ?? Math.random;
+	const service = options.service ?? "unknown";
+	/** Non-secret fingerprint binding persisted bundles to this key + edge. */
+	const id = murmur3(`${baseUrl}|${sdkKey}`).toString(16).padStart(8, "0");
+	const store = options.store === false ? null : options.store ?? defaultStore(id);
+	const isBrowserKey = typeof sdkKey === "string" && sdkKey.startsWith("nf_pub_");
+	const doc = typeof document !== "undefined" ? document : void 0;
+	let bundle = null;
+	let etag = null;
+	let checksum = null;
+	let status = "not-ready";
+	let version = 0;
+	let closed = false;
+	let failures = 0;
+	let lastSyncAt = 0;
+	let pollTimer = null;
+	let flushTimer = null;
+	let inFlight = null;
+	let streamAbort = null;
+	let eventSource = null;
+	/** Bumped to stop the running SSE loop; `streamActive` is true while SSE (either flavour) is in use. */
+	let streamGen = 0;
+	let streamActive = false;
+	let streamTriggered = false;
+	const WS = options.webSocket ?? (typeof WebSocket === "function" ? WebSocket : void 0);
+	const liveUrl = /^https?:\/\//i.test(baseUrl) ? `${baseUrl.replace(/^http/i, "ws")}/v1/live` : null;
+	let socket = null;
+	let liveOpen = false;
+	let liveAttempt = 0;
+	let liveTimer = null;
+	/** Highest revision adopted from a push: a slower HTTP answer must never replace it with something older. */
+	let liveRevision = 0;
+	let pushChain = Promise.resolve();
+	let lastReportAt = 0;
+	const usedAttrs = /* @__PURE__ */ new WeakMap();
+	const verifyOpt = options.verify;
+	const isBrowser = typeof window !== "undefined" && typeof document !== "undefined";
+	let keysPromise = null;
+	let keysLoadedAt = 0;
+	let pinnedEnvironment = null;
+	let sig = null;
+	let rawText = null;
+	const sessions = /* @__PURE__ */ new Map();
+	let pageToken = null;
+	let pageSession = null;
+	let pageResolved = false;
+	let pageTimer = null;
+	const queue = [];
+	const listeners = {
+		update: /* @__PURE__ */ new Set(),
+		error: /* @__PURE__ */ new Set()
+	};
+	const subscribers = /* @__PURE__ */ new Set();
+	let resolveReady;
+	const readyPromise = new Promise((r) => resolveReady = r);
+	const safely = (fn) => {
+		try {
+			fn();
+		} catch {}
+	};
+	const changed = () => {
+		version++;
+		for (const s of [...subscribers]) safely(s);
+	};
+	const setStatus = (next) => {
+		if (status === next) return;
+		status = next;
+		changed();
+	};
+	const emitError = (e) => {
+		for (const cb of [...listeners.error]) safely(() => cb(e));
+	};
+	function adopt(next, meta) {
+		const previousRevision = bundle ? bundle.revision : null;
+		const isNew = !bundle || previousRevision !== next.revision || checksum !== meta.checksum;
+		bundle = next;
+		etag = meta.etag;
+		checksum = meta.checksum;
+		status = meta.status;
+		changed();
+		resolveReady();
+		if (isNew) {
+			const e = {
+				revision: next.revision,
+				previousRevision,
+				checksum: meta.checksum,
+				source: meta.source,
+				latencyMs: meta.latencyMs ?? null,
+				transport: meta.transport ?? "poll"
+			};
+			for (const cb of [...listeners.update]) safely(() => cb(e));
+		}
+	}
+	function persist() {
+		if (!store || !bundle) return;
+		const payload = {
+			v: 1,
+			id,
+			etag,
+			checksum,
+			savedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			bundle,
+			...sig ? { sig } : {},
+			...sig && rawText !== null ? { raw: rawText } : {}
+		};
+		Promise.resolve().then(() => store.set(JSON.stringify(payload))).catch(() => emitError(new NanoFlagsError("Could not persist the bundle.", "store")));
+	}
+	async function restore() {
+		if (!store) return;
+		try {
+			const raw = await store.get();
+			if (!raw || closed) return;
+			const p = JSON.parse(raw);
+			if (p.v !== 1 || p.id !== id || !isBundle(p.bundle)) return;
+			if (bundle && bundle.revision >= p.bundle.revision) return;
+			let restored = p.bundle;
+			let restoredSig = null;
+			let restoredRaw = null;
+			if (verifyOpt) {
+				const s = p.sig;
+				if (s && typeof s.signature === "string" && typeof s.environmentId === "string" && typeof s.checksum === "string" && s.revision === p.bundle.revision) {
+					const text = typeof p.raw === "string" ? p.raw : JSON.stringify(p.bundle);
+					let ok = false;
+					try {
+						ok = await verifyBundleText(await loadKeys(s.kid ?? null), {
+							signature: s.signature,
+							kid: s.kid ?? null,
+							environmentId: s.environmentId,
+							revision: s.revision,
+							checksum: s.checksum
+						}, text);
+						if (ok && typeof p.raw === "string") {
+							const parsed = JSON.parse(p.raw);
+							if (isBundle(parsed)) restored = parsed;
+							else ok = false;
+						}
+					} catch {
+						ok = false;
+					}
+					if (!ok) return void emitError(new NanoFlagsError("The persisted bundle failed signature verification and was ignored.", "signature"));
+					restoredSig = {
+						signature: s.signature,
+						kid: s.kid ?? null,
+						environmentId: s.environmentId,
+						revision: s.revision,
+						checksum: s.checksum
+					};
+					restoredRaw = typeof p.raw === "string" ? p.raw : null;
+				} else if (verifyOpt.require) return;
+				if (closed || bundle && bundle.revision >= restored.revision) return;
+			}
+			sig = restoredSig;
+			rawText = restoredRaw;
+			if (restoredSig) pinnedEnvironment ??= restoredSig.environmentId;
+			adopt(restored, {
+				etag: p.etag ?? null,
+				checksum: p.checksum ?? null,
+				status: "stale",
+				source: "store"
+			});
+		} catch {
+			emitError(new NanoFlagsError("Could not read the persisted bundle.", "store"));
+		}
+	}
+	async function request(path, init) {
+		if (!doFetch) throw new NanoFlagsError("No fetch implementation available.", "config");
+		const ac = new AbortController();
+		const t = unref(setTimeout(() => ac.abort(), REQUEST_TIMEOUT_MS));
+		try {
+			return await doFetch(`${baseUrl}${path}`, {
+				...init,
+				signal: ac.signal,
+				headers: {
+					Authorization: `Bearer ${sdkKey}`,
+					...init.headers
+				}
+			});
+		} finally {
+			clearTimeout(t);
+		}
+	}
+	async function fetchKeys() {
+		if (!doFetch) throw new NanoFlagsError("No fetch implementation available.", "config");
+		const ac = new AbortController();
+		const t = unref(setTimeout(() => ac.abort(), REQUEST_TIMEOUT_MS));
+		try {
+			const res = await doFetch(`${baseUrl}/v1/keys`, {
+				method: "GET",
+				signal: ac.signal
+			});
+			if (!res.ok) throw new NanoFlagsError(`Signing keys request failed with HTTP ${res.status}.`, "signature", res.status);
+			const body = await res.json();
+			const keys = await importPublicKeys(Array.isArray(body?.keys) ? body.keys : []);
+			if (keys.length === 0) throw new NanoFlagsError("The edge returned no usable signing keys.", "signature");
+			return keys;
+		} finally {
+			clearTimeout(t);
+		}
+	}
+	function loadKeys(kid) {
+		if (!verifyOpt) return Promise.resolve([]);
+		const start = () => {
+			keysLoadedAt = Date.now();
+			const p = verifyOpt.publicKeys === "fetch" ? fetchKeys() : importPublicKeys(Array.isArray(verifyOpt.publicKeys) ? verifyOpt.publicKeys : []);
+			keysPromise = p;
+			p.catch(() => {
+				if (keysPromise === p) keysPromise = null;
+			});
+			return p;
+		};
+		if (!keysPromise) return start();
+		if (verifyOpt.publicKeys !== "fetch" || kid === null) return keysPromise;
+		return keysPromise.then((keys) => keys.some((k) => k.kid === kid) || Date.now() - keysLoadedAt < KEYS_REFETCH_MS ? keys : start());
+	}
+	/** Returns the bundle to adopt, or throws a NanoFlagsError with code "signature". */
+	async function checkSignature(res, text, body) {
+		if (!verifyOpt) return {
+			bundle: body.bundle,
+			sig: null,
+			raw: null
+		};
+		const reject = (why) => new NanoFlagsError(`Bundle r${body.bundle.revision} was rejected: ${why} The configuration in use is unchanged.`, "signature");
+		if (res.headers.get("X-NanoFlags-Signed") !== "true") {
+			if (verifyOpt.require) throw reject("it is not signed and `verify.require` is set.");
+			return {
+				bundle: body.bundle,
+				sig: null,
+				raw: null
+			};
+		}
+		const signature = res.headers.get("X-NanoFlags-Signature");
+		const environmentId = res.headers.get("X-NanoFlags-Environment-Id");
+		const kid = res.headers.get("X-NanoFlags-Key-Id");
+		if (!signature || !environmentId || typeof body.checksum !== "string") throw reject("the signature headers are incomplete.");
+		const revision = typeof body.revision === "number" ? body.revision : body.bundle.revision;
+		if (revision !== body.bundle.revision) throw reject("the signed revision does not match the bundle.");
+		if (pinnedEnvironment !== null && pinnedEnvironment !== environmentId) throw reject("it was signed for a different environment.");
+		const info = {
+			signature,
+			kid,
+			environmentId,
+			revision,
+			checksum: body.checksum
+		};
+		let keys;
+		try {
+			keys = await loadKeys(kid);
+		} catch (e) {
+			throw reject(`the signing keys could not be loaded (${e instanceof Error ? e.message : String(e)}).`);
+		}
+		try {
+			const raw = rawMember(text, "bundle");
+			const again = JSON.stringify(body.bundle);
+			if (raw !== null && raw !== again && await verifyBundleText(keys, info, raw)) {
+				const parsed = JSON.parse(raw);
+				if (isBundle(parsed) && parsed.revision === revision) {
+					pinnedEnvironment = environmentId;
+					return {
+						bundle: parsed,
+						sig: info,
+						raw
+					};
+				}
+			} else if (await verifyBundleText(keys, info, again)) {
+				pinnedEnvironment = environmentId;
+				return {
+					bundle: body.bundle,
+					sig: info,
+					raw: null
+				};
+			}
+		} catch (e) {
+			throw reject(`the signature could not be checked (${e instanceof Error ? e.message : String(e)}).`);
+		}
+		throw reject("its signature does not verify.");
+	}
+	async function syncOnce() {
+		lastSyncAt = Date.now();
+		const transport = streamTriggered ? "stream" : "poll";
+		streamTriggered = false;
+		try {
+			const res = await request("/v1/bundle", {
+				method: "GET",
+				headers: etag ? { "If-None-Match": etag } : {}
+			});
+			if (closed) return;
+			const servedStale = res.headers.get("X-NanoFlags-Stale") === "true";
+			if (res.status === 304) {
+				failures = 0;
+				if (bundle) setStatus(servedStale ? "stale" : "ready");
+				return;
+			}
+			if (res.status === 401 || res.status === 403) throw new NanoFlagsError("The SDK key was rejected (unknown or revoked).", "unauthorized", res.status);
+			if (!res.ok) throw new NanoFlagsError(`Bundle request failed with HTTP ${res.status}.`, "http", res.status);
+			const text = await res.text();
+			if (closed) return;
+			const body = (() => {
+				try {
+					return JSON.parse(text);
+				} catch {
+					return null;
+				}
+			})();
+			if (!body || !isBundle(body.bundle)) throw new NanoFlagsError("The edge returned an invalid bundle.", "invalid_bundle");
+			const verified = await checkSignature(res, text, body);
+			if (closed) return;
+			const next = verified.bundle;
+			failures = 0;
+			if (servedStale && bundle && bundle.revision >= next.revision) {
+				setStatus("stale");
+				return;
+			}
+			if (bundle && next.revision < liveRevision && bundle.revision >= liveRevision) return;
+			sig = verified.sig;
+			rawText = verified.raw;
+			adopt(next, {
+				etag: res.headers.get("ETag"),
+				checksum: body.checksum ?? null,
+				status: servedStale ? "stale" : "ready",
+				source: "network",
+				transport
+			});
+			persist();
+		} catch (e) {
+			if (closed) return;
+			failures++;
+			if (e instanceof NanoFlagsError && e.code === "signature") return void emitError(e);
+			if (e instanceof NanoFlagsError && e.code === "unauthorized") dropLive();
+			if (bundle) setStatus("stale");
+			emitError(e instanceof NanoFlagsError ? e : new NanoFlagsError(`Could not reach the NanoFlags edge: ${e instanceof Error ? e.message : String(e)}`, "network"));
+		}
+	}
+	/** Single-flight: concurrent triggers (poll, stream, visibility) share one request. */
+	function sync() {
+		if (closed) return Promise.resolve();
+		if (!inFlight) inFlight = syncOnce().finally(() => {
+			inFlight = null;
+		});
+		return inFlight;
+	}
+	function nextDelay() {
+		const jitter = .8 + .4 * Math.random();
+		const base = failures > 0 ? Math.min(pollIntervalMs, 1e3 * 2 ** Math.min(failures - 1, 10)) : liveOpen ? Math.max(pollIntervalMs, livePollIntervalMs) : pollIntervalMs;
+		return Math.max(250, Math.round(base * jitter));
+	}
+	function schedulePoll() {
+		if (closed || pollIntervalMs <= 0) return;
+		if (pollTimer) clearTimeout(pollTimer);
+		pollTimer = unref(setTimeout(() => {
+			pollTimer = null;
+			if (doc && doc.visibilityState === "hidden") return schedulePoll();
+			sync().then(schedulePoll);
+		}, nextDelay()));
+	}
+	const onVisible = () => {
+		if (closed || !doc || doc.visibilityState !== "visible") return void flush();
+		if (Date.now() - lastSyncAt >= Math.min(pollIntervalMs > 0 ? pollIntervalMs : 3e4, 3e4) || failures > 0) sync().then(schedulePoll);
+	};
+	const onOnline = () => {
+		if (!closed) sync().then(schedulePoll);
+	};
+	function onRevision(data) {
+		try {
+			const m = JSON.parse(data);
+			if (!bundle || m.revision !== bundle.revision || (m.checksum ?? null) !== checksum || status !== "ready") {
+				streamTriggered = true;
+				sync();
+			}
+		} catch {}
+	}
+	function startStream() {
+		if (closed || options.streaming === false || !doFetch || streamActive) return;
+		streamActive = true;
+		const ES = typeof EventSource === "function" ? EventSource : void 0;
+		if (ES && isBrowserKey) {
+			const es = new ES(`${baseUrl}/v1/stream?key=${encodeURIComponent(sdkKey)}`);
+			eventSource = es;
+			es.addEventListener("revision", (e) => onRevision(String(e.data)));
+			es.addEventListener("revoked", () => {
+				es.close();
+				sync();
+			});
+			return;
+		}
+		streamLoop(++streamGen);
+	}
+	function stopStream() {
+		streamGen++;
+		streamActive = false;
+		streamAbort?.abort();
+		streamAbort = null;
+		eventSource?.close();
+		eventSource = null;
+	}
+	async function streamLoop(gen) {
+		let attempt = 0;
+		const current = () => !closed && gen === streamGen;
+		while (current()) {
+			const ac = new AbortController();
+			streamAbort = ac;
+			const startedAt = Date.now();
+			let stop = false;
+			try {
+				const res = await doFetch(`${baseUrl}/v1/stream`, {
+					headers: {
+						Authorization: `Bearer ${sdkKey}`,
+						Accept: "text/event-stream"
+					},
+					signal: ac.signal
+				});
+				if (res.status === 401 || res.status === 403) stop = true;
+				else if (res.ok && res.body) await readSse(res.body, (event, data) => {
+					if (event === "revision") onRevision(data);
+					else if (event === "revoked") {
+						stop = true;
+						ac.abort();
+						sync();
+					}
+				});
+			} catch {}
+			if (!current()) return;
+			if (stop) {
+				streamActive = false;
+				return;
+			}
+			attempt = Date.now() - startedAt > 3e4 ? 0 : attempt + 1;
+			const wait = Math.min(3e4, 1e3 * 2 ** Math.min(attempt, 5)) * (.5 + Math.random());
+			await new Promise((r) => unref(setTimeout(r, wait)));
+		}
+	}
+	const liveWanted = options.streaming !== false && options.live !== false && WS !== void 0 && liveUrl !== null;
+	/** Applies one `rev` / `hello` message. Never throws; a message that cannot be trusted changes nothing. */
+	async function applyPush(m) {
+		if (closed || m.t !== "rev" && m.t !== "hello") return;
+		const revision = m.revision;
+		if (typeof revision !== "number" || !Number.isInteger(revision) || revision < 1 || typeof m.bundle !== "string") return;
+		if (bundle && revision < bundle.revision) return;
+		const text = m.bundle;
+		const pushedChecksum = typeof m.checksum === "string" ? m.checksum : null;
+		let info = null;
+		if (verifyOpt) {
+			const reject = (why) => {
+				emitError(new NanoFlagsError(`Pushed bundle r${revision} was rejected: ${why} The configuration in use is unchanged.`, "signature"));
+				sync();
+			};
+			if (typeof m.signature !== "string" || typeof m.environmentId !== "string" || pushedChecksum === null) return reject("it carries no complete signature.");
+			if (pinnedEnvironment !== null && pinnedEnvironment !== m.environmentId) return reject("it was signed for a different environment.");
+			info = {
+				signature: m.signature,
+				kid: typeof m.kid === "string" ? m.kid : null,
+				environmentId: m.environmentId,
+				revision,
+				checksum: pushedChecksum
+			};
+			let ok = false;
+			try {
+				ok = await verifyBundleText(await loadKeys(info.kid), info, text);
+			} catch {
+				ok = false;
+			}
+			if (closed) return;
+			if (!ok) return reject("its signature does not verify.");
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			parsed = null;
+		}
+		if (!isBundle(parsed) || parsed.revision !== revision) return void emitError(new NanoFlagsError("The edge pushed an invalid bundle; it was ignored.", "invalid_bundle"));
+		if (bundle && revision < bundle.revision) return;
+		failures = 0;
+		if (bundle && revision === bundle.revision) {
+			if (checksum === null || checksum === pushedChecksum) setStatus("ready");
+			return;
+		}
+		if (info) pinnedEnvironment = info.environmentId;
+		sig = info;
+		rawText = info && JSON.stringify(parsed) !== text ? text : null;
+		liveRevision = revision;
+		const committedAt = m.committedAt;
+		adopt(parsed, {
+			etag: pushedChecksum !== null ? `"${pushedChecksum}-${isBrowserKey ? "client" : "server"}"` : null,
+			checksum: pushedChecksum,
+			status: "ready",
+			source: "network",
+			transport: "live",
+			latencyMs: typeof committedAt === "number" && Number.isFinite(committedAt) ? Date.now() - committedAt : null
+		});
+		persist();
+	}
+	/** Closes the current socket; its close handler schedules the reconnect. */
+	function dropLive() {
+		try {
+			socket?.close(1e3, "bye");
+		} catch {}
+	}
+	function connectLive() {
+		if (closed || !liveWanted || socket) return;
+		let ws;
+		try {
+			ws = new WS(liveUrl, [LIVE_PROTOCOL, `key.${sdkKey}`]);
+		} catch {
+			return liveEnded(false, 0, false);
+		}
+		socket = ws;
+		let opened = false;
+		let done = false;
+		let rotating = false;
+		let openedAt = 0;
+		let pingTimer = null;
+		let pongTimer = null;
+		let rotateTimer = null;
+		const end = () => {
+			if (done) return;
+			done = true;
+			clearTimeout(connectTimer);
+			if (pingTimer) clearTimeout(pingTimer);
+			if (pongTimer) clearTimeout(pongTimer);
+			if (rotateTimer) clearTimeout(rotateTimer);
+			ws.onopen = ws.onmessage = ws.onclose = ws.onerror = null;
+			try {
+				ws.close();
+			} catch {}
+			if (socket === ws) socket = null;
+			liveOpen = false;
+			liveEnded(opened, opened ? Date.now() - openedAt : 0, rotating);
+		};
+		const connectTimer = unref(setTimeout(end, LIVE_CONNECT_TIMEOUT_MS));
+		const ping = () => {
+			pingTimer = unref(setTimeout(() => {
+				try {
+					ws.send("ping");
+				} catch {
+					return end();
+				}
+				pongTimer ??= unref(setTimeout(end, LIVE_PONG_TIMEOUT_MS));
+				ping();
+			}, LIVE_PING_MS * (.9 + .2 * Math.random())));
+		};
+		ws.onopen = () => {
+			if (done) return;
+			opened = true;
+			openedAt = Date.now();
+			liveOpen = true;
+			clearTimeout(connectTimer);
+			stopStream();
+			schedulePoll();
+			ping();
+			rotateTimer = unref(setTimeout(() => {
+				rotating = true;
+				end();
+			}, LIVE_ROTATE_MS * (.9 + .2 * Math.random())));
+		};
+		ws.onmessage = (event) => {
+			if (done || typeof event?.data !== "string") return;
+			if (pongTimer) clearTimeout(pongTimer);
+			pongTimer = null;
+			if (event.data === "pong") return;
+			let m;
+			try {
+				m = JSON.parse(event.data);
+			} catch {
+				return;
+			}
+			if (typeof m !== "object" || m === null || Array.isArray(m)) return;
+			pushChain = pushChain.then(() => applyPush(m)).catch(() => void 0);
+		};
+		ws.onclose = end;
+		ws.onerror = end;
+	}
+	function liveEnded(opened, openMs, rotating) {
+		if (closed) return;
+		if (rotating) return connectLive();
+		liveAttempt = opened && openMs > 3e4 ? 1 : liveAttempt + 1;
+		if (!opened) startStream();
+		else schedulePoll();
+		const wait = Math.min(LIVE_MAX_BACKOFF_MS, 1e3 * 2 ** Math.min(liveAttempt - 1, 10)) * (.5 + Math.random());
+		if (liveTimer) clearTimeout(liveTimer);
+		liveTimer = unref(setTimeout(() => {
+			liveTimer = null;
+			connectLive();
+		}, wait));
+	}
+	function startRealtime() {
+		if (closed || options.streaming === false) return;
+		if (liveWanted) connectLive();
+		else startStream();
+	}
+	function attrsUsedBy(b, flagKey) {
+		let cache = b ? usedAttrs.get(b) : void 0;
+		if (b && !cache) usedAttrs.set(b, cache = /* @__PURE__ */ new Map());
+		const hit = cache?.get(flagKey);
+		if (hit) return hit;
+		const names = /* @__PURE__ */ new Set();
+		const flag = b && Object.prototype.hasOwnProperty.call(b.flags, flagKey) ? b.flags[flagKey] : void 0;
+		const visit = (conditions, depth) => {
+			for (const c of conditions) if (c.op === "segment" || c.op === "not_segment") {
+				const seg = b && typeof c.value === "string" && Object.prototype.hasOwnProperty.call(b.segments, c.value) ? b.segments[c.value] : void 0;
+				if (seg && depth < 4) visit(seg.conditions, depth + 1);
+			} else if (c.attribute) names.add(c.attribute);
+		};
+		try {
+			for (const r of flag?.rules ?? []) {
+				visit(r.conditions, 0);
+				if (r.serve.type === "rollout") names.add(r.serve.bucketBy ?? "key");
+			}
+		} catch {}
+		const list = [...names];
+		cache?.set(flagKey, list);
+		return list;
+	}
+	function defaultRedact(b, flagKey, ctx) {
+		const out = {};
+		for (const name of attrsUsedBy(b, flagKey)) if (Object.prototype.hasOwnProperty.call(ctx, name) && ctx[name] !== void 0) out[name] = typeOf(ctx[name]);
+		return out;
+	}
+	function record(e, ctx, b, sessionId) {
+		if (!eventsEnabled || closed || sampleRate <= 0 || random() >= sampleRate) return;
+		if (queue.length >= MAX_QUEUE) return;
+		try {
+			queue.push({
+				flagKey: e.flagKey,
+				value: e.value,
+				reason: e.reason,
+				...e.ruleIndex === void 0 ? {} : { ruleIndex: e.ruleIndex },
+				revision: e.revision,
+				context: ev.redact ? ev.redact({ ...ctx }) : defaultRedact(b, e.flagKey, ctx),
+				at: (/* @__PURE__ */ new Date()).toISOString(),
+				...sessionId === void 0 ? {} : { sessionId }
+			});
+		} catch {}
+	}
+	async function flush() {
+		if (!eventsEnabled || !doFetch) return;
+		const batch = queue.splice(0, MAX_BATCH).map((e) => {
+			let value = e.value;
+			try {
+				if (typeof value === "object" && value !== null && JSON.stringify(value).length > MAX_EVENT_VALUE_CHARS) value = null;
+				else if (typeof value === "string" && value.length > MAX_EVENT_VALUE_CHARS) value = value.slice(0, MAX_EVENT_VALUE_CHARS);
+			} catch {
+				value = null;
+			}
+			return {
+				...e,
+				flagKey: e.flagKey.slice(0, 63),
+				value
+			};
+		});
+		lastReportAt = Date.now();
+		try {
+			await request("/v1/events", {
+				method: "POST",
+				keepalive: true,
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					service,
+					sdk: `js/${SDK_VERSION}`,
+					revision: bundle?.revision ?? 0,
+					events: batch
+				})
+			});
+		} catch {}
+	}
+	function scheduleFlush() {
+		if (closed || !eventsEnabled || flushIntervalMs <= 0) return;
+		flushTimer = unref(setTimeout(() => {
+			flushTimer = null;
+			if (queue.length === 0 && Date.now() - lastReportAt < reportIntervalMs) return scheduleFlush();
+			flush().then(scheduleFlush);
+		}, flushIntervalMs));
+	}
+	const live = (s) => s !== null && Date.now() < s.expiresAtMs ? s : null;
+	/** `scope` undefined: the client's own accessors (which follow the browser page session, if any). */
+	function run(key, fallback, ctx, accepts, scope) {
+		const s = live(scope === void 0 ? pageSession : scope);
+		const b = s ? s.bundle : bundle;
+		const context = s ? {
+			...s.context,
+			...ctx
+		} : ctx ?? {};
+		let result = evaluate(b, key, context, fallback);
+		if (accepts && result.reason !== "flag_not_found" && result.reason !== "error" && !accepts(result.value)) {
+			const error = `Flag "${key}" has a ${typeOf(result.value)} value, which does not match the requested type.`;
+			result = {
+				flagKey: key,
+				value: fallback,
+				reason: "error",
+				revision: result.revision,
+				trace: [...result.trace, {
+					kind: "result",
+					title: "Returned the fallback",
+					detail: error
+				}],
+				error
+			};
+		}
+		record(result, context, b, s?.id);
+		return result;
+	}
+	function evaluatorFor(state) {
+		return {
+			get active() {
+				return live(state) !== null;
+			},
+			id: state ? state.id : null,
+			expiresAt: state ? state.expiresAt : null,
+			get revision() {
+				const s = live(state);
+				return s ? s.bundle.revision : bundle ? bundle.revision : null;
+			},
+			boolean: (key, fallback, ctx) => run(key, fallback, ctx, (v) => typeof v === "boolean", state).value,
+			string: (key, fallback, ctx) => run(key, fallback, ctx, (v) => typeof v === "string", state).value,
+			number: (key, fallback, ctx) => run(key, fallback, ctx, (v) => typeof v === "number" && Number.isFinite(v), state).value,
+			json: (key, fallback, ctx) => run(key, fallback, ctx, (v) => v !== void 0, state).value,
+			evaluate: (key, fallback, ctx) => run(key, fallback, ctx, null, state)
+		};
+	}
+	/** Resolves to null for "no such session" (unknown, expired, revoked, service not permitted) and on any failure. */
+	async function fetchSession(token, serviceName) {
+		try {
+			const res = await request("/v1/session", {
+				method: "GET",
+				cache: "no-store",
+				headers: {
+					"X-NanoFlags-Session": token,
+					...serviceName ? { "X-NanoFlags-Service": serviceName } : {}
+				}
+			});
+			if (res.status === 404) return {
+				state: null,
+				failed: false
+			};
+			if (!res.ok) throw new NanoFlagsError(`Session request failed with HTTP ${res.status}.`, res.status === 401 || res.status === 403 ? "unauthorized" : "session", res.status);
+			const body = await res.json();
+			const expiresAtMs = typeof body?.expires_at === "string" ? Date.parse(body.expires_at) : NaN;
+			if (!body || typeof body.id !== "string" || !isBundle(body.bundle) || !Number.isFinite(expiresAtMs)) throw new NanoFlagsError("The edge returned an invalid session.", "session");
+			if (expiresAtMs <= Date.now()) return {
+				state: null,
+				failed: false
+			};
+			const context = typeof body.context === "object" && body.context !== null && !Array.isArray(body.context) ? body.context : {};
+			return {
+				state: {
+					id: body.id,
+					bundle: body.bundle,
+					context,
+					expiresAt: new Date(expiresAtMs).toISOString(),
+					expiresAtMs
+				},
+				failed: false
+			};
+		} catch (e) {
+			if (!closed) emitError(e instanceof NanoFlagsError ? e : new NanoFlagsError(`Could not load the test session: ${e instanceof Error ? e.message : String(e)}`, "session"));
+			return {
+				state: null,
+				failed: true
+			};
+		}
+	}
+	function resolveSession(token, opts) {
+		if (!isSessionToken(token) || closed || baseUrl === "") return Promise.resolve(null);
+		const serviceName = opts?.service ?? options.service;
+		const cacheKey = `${serviceName ?? ""}\n${token}`;
+		const now = Date.now();
+		const hit = sessions.get(cacheKey);
+		if (hit && now < hit.until) return hit.promise;
+		sessions.delete(cacheKey);
+		if (sessions.size >= MAX_SESSIONS) {
+			for (const [k, v] of sessions) if (now >= v.until) sessions.delete(k);
+			for (const k of sessions.keys()) {
+				if (sessions.size < MAX_SESSIONS) break;
+				sessions.delete(k);
+			}
+		}
+		const entry = {
+			promise: Promise.resolve(null),
+			until: Number.POSITIVE_INFINITY
+		};
+		entry.promise = fetchSession(token, serviceName).then(({ state, failed }) => {
+			entry.until = state ? state.expiresAtMs : Date.now() + (failed ? SESSION_ERROR_TTL_MS : SESSION_MISS_TTL_MS);
+			return state;
+		});
+		sessions.set(cacheKey, entry);
+		return entry.promise;
+	}
+	function pageStorage() {
+		try {
+			return isBrowser && typeof sessionStorage !== "undefined" ? sessionStorage : null;
+		} catch {
+			return null;
+		}
+	}
+	function setPageSession(state, resolved) {
+		if (pageTimer) clearTimeout(pageTimer);
+		pageTimer = null;
+		pageSession = state;
+		pageResolved = resolved;
+		if (state) {
+			const wait = Math.min(Math.max(0, state.expiresAtMs - Date.now()) + 50, 2147e6);
+			pageTimer = unref(setTimeout(() => {
+				pageTimer = null;
+				if (pageSession === state) changed();
+			}, wait));
+		}
+		changed();
+	}
+	async function usePageSession(token) {
+		if (!isBrowser) {
+			if (token !== null) emitError(new NanoFlagsError("useSession() is for browsers. On servers use client.session(token) or @nanoflags/sdk/node.", "config"));
+			return evaluatorFor(null);
+		}
+		const storage = pageStorage();
+		if (!isSessionToken(token)) {
+			pageToken = null;
+			try {
+				storage?.removeItem(STORAGE_KEY);
+			} catch {}
+			setPageSession(null, false);
+			return evaluatorFor(null);
+		}
+		pageToken = token;
+		try {
+			storage?.setItem(STORAGE_KEY, token);
+		} catch {}
+		const state = await resolveSession(token, void 0);
+		if (pageToken === token) setPageSession(state, true);
+		return evaluatorFor(state);
+	}
+	const client = {
+		ready: () => readyPromise,
+		get status() {
+			return status;
+		},
+		get revision() {
+			return bundle ? bundle.revision : null;
+		},
+		get version() {
+			return version;
+		},
+		get transport() {
+			return liveOpen ? "live" : streamActive ? "stream" : "poll";
+		},
+		boolean: (key, fallback, ctx) => run(key, fallback, ctx, (v) => typeof v === "boolean").value,
+		string: (key, fallback, ctx) => run(key, fallback, ctx, (v) => typeof v === "string").value,
+		number: (key, fallback, ctx) => run(key, fallback, ctx, (v) => typeof v === "number" && Number.isFinite(v)).value,
+		json: (key, fallback, ctx) => run(key, fallback, ctx, (v) => v !== void 0).value,
+		evaluate: (key, fallback, ctx) => run(key, fallback, ctx, null),
+		session: (token, opts) => resolveSession(token, opts).then(evaluatorFor, () => evaluatorFor(null)),
+		useSession: (token) => usePageSession(token).catch(() => evaluatorFor(null)),
+		sessionHeaders() {
+			const headers = {};
+			if (pageToken !== null && !(pageResolved && live(pageSession) === null)) headers[SESSION_HEADER] = pageToken;
+			return headers;
+		},
+		on(event, cb) {
+			const set = listeners[event];
+			set.add(cb);
+			return () => void set.delete(cb);
+		},
+		subscribe(listener) {
+			subscribers.add(listener);
+			return () => void subscribers.delete(listener);
+		},
+		async refresh() {
+			if (inFlight) await inFlight;
+			return sync();
+		},
+		flush,
+		close() {
+			if (closed) return;
+			flush();
+			closed = true;
+			if (pollTimer) clearTimeout(pollTimer);
+			if (flushTimer) clearTimeout(flushTimer);
+			if (pageTimer) clearTimeout(pageTimer);
+			sessions.clear();
+			if (liveTimer) clearTimeout(liveTimer);
+			dropLive();
+			stopStream();
+			doc?.removeEventListener("visibilitychange", onVisible);
+			if (typeof removeEventListener === "function") removeEventListener("online", onOnline);
+			resolveReady();
+		}
+	};
+	if (options.bootstrap !== void 0) {
+		if (isBundle(options.bootstrap)) adopt(options.bootstrap, {
+			etag: null,
+			checksum: null,
+			status: "ready",
+			source: "bootstrap"
+		});
+		else queueMicrotask(() => emitError(new NanoFlagsError("The bootstrap bundle is invalid and was ignored.", "invalid_bundle")));
+	}
+	if (verifyOpt && Array.isArray(verifyOpt.publicKeys) && verifyOpt.publicKeys.some((k) => !isPublicEd25519Jwk(k))) queueMicrotask(() => emitError(new NanoFlagsError("`verify.publicKeys` must contain public Ed25519 JWKs only. Other entries (including private keys) were ignored.", "config")));
+	if (typeof sdkKey !== "string" || sdkKey === "" || baseUrl === "") {
+		queueMicrotask(() => emitError(new NanoFlagsError("`sdkKey` and `baseUrl` are required.", "config")));
+		resolveReady();
+		return client;
+	}
+	Promise.all([restore(), sync()]).then(() => {
+		resolveReady();
+		if (closed) return;
+		schedulePoll();
+		scheduleFlush();
+		startRealtime();
+	});
+	try {
+		const remembered = pageStorage()?.getItem(STORAGE_KEY);
+		if (isSessionToken(remembered)) usePageSession(remembered).catch(() => void 0);
+	} catch {}
+	doc?.addEventListener("visibilitychange", onVisible);
+	if (doc && typeof addEventListener === "function") addEventListener("online", onOnline);
+	return client;
+}
+export { createClient as a, SESSION_HEADER as i, NanoFlagsError as n, isSessionToken as o, SDK_VERSION as r, LIVE_PROTOCOL as t };