@nebulr-group/bridge-auth-core 0.1.2 → 0.4.0-beta.0

package/dist/flags/attribute-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribute-providers.d.ts","sourceRoot":"","sources":["../../src/flags/attribute-providers.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yGAAyG;IACzG,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACzC;;;OAGG;IACH,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvE;AAED;;;GAGG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,SAAS,CAA2B;IAE5C,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAQ3C,iCAAiC;IACjC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI9B,gDAAgD;IAChD,IAAI,IAAI,MAAM;IAId,2BAA2B;IAC3B,KAAK,IAAI,MAAM,EAAE;IAIjB;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAajD;;;;;;;;OAQG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAkBtC;;;;;;;;OAQG;IACG,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAYlD;AAYD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;oFACgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC/B,wDAAwD;IACxD,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,aAAa,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,iBAAiB;IAC7D,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,SAAS,EAAG,QAAQ,CAAU;IAEvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;gBAEhC,MAAM,CAAC,EAAE,kBAAkB;IAIvC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAgCnC;AAgCD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,kBAAkB,EAAE,MAChB,eAAe,GACf,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACpC,SAAS,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,wDAAwD;IACxD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,iEAAiE;IACjE,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAID,qBAAa,wBAAyB,YAAW,iBAAiB;IAChE,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,SAAS,EAAG,QAAQ,CAAU;IAEvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,UAAU,CAAS;IAE3B;;;;OAIG;gBACS,MAAM,CAAC,EAAE,qBAAqB;IAI1C;;;;;;;;;;OAUG;IACH,UAAU,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI;IAI/C;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,IACH,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAkCpC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,aAAa;IA+DrB,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,QAAQ;CAajB"}

package/dist/flags/attribute-providers.js

@@ -0,0 +1,375 @@
+// AttributeProvider plugin model for Bridge Feature Flags (TBP-173).
+//
+// AttributeProvider is THE canonical mechanism for feeding attributes into
+// flag evaluation. Every framework SDK wires the bridge-managed providers
+// (`AuthAttributeProvider`, `BillingAttributeProvider`) automatically on
+// bootstrap so `user.role`, `tenant.plan`, billing entitlements etc. flow in
+// without app code. Apps push their own state into eval by implementing
+// `AttributeProvider` and `register()`ing the instance on the registry — that
+// is the canonical pattern for any attribute backed by app state (cohort,
+// route segment, current workspace, anything reactive).
+//
+// Per-call attributes (via `setContext` or the `<FeatureFlag context>` /
+// `useFlag(key, default, context)` prop) are the *override* path — for
+// transient, one-off, or per-instance values, and to override a provider
+// value at a specific call site. Collision rule (locked decision #20):
+// dev-supplied attributes WIN over provider-supplied attributes on key
+// overlap. The admin UI surfaces the collision so it's debuggable (TBP-178).
+/**
+ * Registry attached to a BridgeFlags instance. Framework SDKs (bridge-svelte's
+ * Bridge.init) wire this up during bootstrap.
+ */
+export class AttributeProviderRegistry {
+    providers = [];
+    /** Register a provider. Idempotent on `name` — re-registering with the same name replaces. */
+    register(provider) {
+        if (!provider.name) {
+            throw new Error('AttributeProvider must have a non-empty name');
+        }
+        this.providers = this.providers.filter((p) => p.name !== provider.name);
+        this.providers.push(provider);
+    }
+    /** Remove a provider by name. */
+    unregister(name) {
+        this.providers = this.providers.filter((p) => p.name !== name);
+    }
+    /** Number of providers currently registered. */
+    size() {
+        return this.providers.length;
+    }
+    /** List provider names. */
+    names() {
+        return this.providers.map((p) => p.name);
+    }
+    /**
+     * Collect attributes from every registered provider, merged in registration
+     * order. Later providers' keys overwrite earlier ones; this is INTERNAL
+     * merge order — dev-supplied attributes always win at the call boundary
+     * (handled in `applyTo`).
+     *
+     * Provider failures are isolated — one provider throwing doesn't block the
+     * rest. The failing provider contributes an empty attribute set for that call.
+     */
+    async collect() {
+        const out = {};
+        for (const provider of this.providers) {
+            try {
+                const attrs = await provider.provide();
+                Object.assign(out, attrs ?? {});
+            }
+            catch {
+                // Silently skip a failing provider for this eval.
+            }
+        }
+        return out;
+    }
+    /**
+     * Sync variant of `collect()` — used by `BridgeFlags.flag()` on the hot eval
+     * path (FF 2.0 evaluates inline on every flag check, so the merge must be
+     * sync). Async providers are SKIPPED for this eval; they should self-cache
+     * their result and return sync values once warmed.
+     *
+     * Same isolation guarantee as `collect()`: one throwing provider doesn't
+     * block the rest.
+     */
+    collectSync() {
+        const out = {};
+        for (const provider of this.providers) {
+            try {
+                const attrs = provider.provide();
+                if (attrs instanceof Promise) {
+                    // Async providers can't participate in the sync hot path. They run
+                    // through `collect()`/`applyTo()` on demand instead.
+                    continue;
+                }
+                Object.assign(out, attrs ?? {});
+            }
+            catch {
+                // Silently skip a failing provider for this eval.
+            }
+        }
+        return out;
+    }
+    /**
+     * Apply provider attributes to a BridgeFlags instance's global context.
+     * Should be called on a sensible cadence by the framework SDK — typically:
+     *   - once at bootstrap
+     *   - when auth state changes (logout/login, role change)
+     *   - on a periodic refresh if attributes drift
+     *
+     * Dev-supplied attributes are preserved on collision (locked decision #20).
+     */
+    async applyTo(bridge) {
+        const providerAttrs = await this.collect();
+        const current = bridge.getContext().attributes;
+        // Provider attrs first, dev-supplied attrs second (dev wins on collision)
+        bridge.setContext({
+            identity: bridge.getContext().identity,
+            attributes: { ...providerAttrs, ...current },
+        }, false);
+    }
+}
+/**
+ * Canonical auth-derived attribute source. Reads decoded JWT claims through
+ * a sync callback the framework SDK provides, and flattens them into the
+ * eval namespace:
+ *   - `user.id`        ← `sub`
+ *   - `user.role`      ← `role`
+ *   - `user.email`     ← `email`
+ *   - `tenant.id`      ← `tid`
+ *   - `tenant.plan`    ← `plan`
+ *   - `privileges`     ← `privileges` (array or string)
+ *
+ * Construct with no config for the empty stub (every workspace gets the
+ * provider in its registry by default; unconfigured ones contribute nothing).
+ */
+export class AuthAttributeProvider {
+    name = 'bridge:auth';
+    namespace = 'bridge';
+    config;
+    constructor(config) {
+        this.config = config ?? { getClaims: () => undefined };
+    }
+    provide() {
+        let claims;
+        try {
+            claims = this.config.getClaims();
+        }
+        catch {
+            return {};
+        }
+        if (!claims || typeof claims !== 'object')
+            return {};
+        const out = {};
+        if (typeof claims.sub === 'string' && claims.sub.length > 0) {
+            out['user.id'] = claims.sub;
+        }
+        if (typeof claims.role === 'string') {
+            out['user.role'] = claims.role;
+        }
+        if (typeof claims.email === 'string') {
+            out['user.email'] = claims.email;
+        }
+        if (typeof claims.tid === 'string') {
+            out['tenant.id'] = claims.tid;
+        }
+        if (typeof claims.plan === 'string') {
+            out['tenant.plan'] = claims.plan;
+        }
+        if (Array.isArray(claims.privileges)) {
+            out['privileges'] = claims.privileges;
+        }
+        else if (typeof claims.privileges === 'string') {
+            out['privileges'] = claims.privileges;
+        }
+        return out;
+    }
+}
+const BILLING_NS_PREFIX = 'bridge:billing.';
+export class BillingAttributeProvider {
+    name = 'bridge:billing';
+    namespace = 'bridge';
+    config;
+    stores = {};
+    warnedOnce = false;
+    /**
+     * Construct with an explicit config that supplies the billing snapshot.
+     * No config → treated as an empty provider (returns `{}` on every call)
+     * so accidentally instantiating without wiring doesn't crash.
+     */
+    constructor(config) {
+        this.config = config ?? { getBillingSnapshot: () => undefined };
+    }
+    /**
+     * Billing 2.0 US-13 — wire the three reactive stores from `useBridge()` so
+     * `provide()` can flatten live billing state synchronously on every flag
+     * eval. Idempotent: re-binding replaces the previous store references. Any
+     * subset of stores may be supplied — missing stores simply contribute no
+     * keys to the flattened map (eg. unattached subscription → no `plan` key).
+     *
+     * Framework wrappers (bridge-svelte's `Bridge.init`) call this once after
+     * `useBridge()` has been bootstrapped, then `register()` the provider on
+     * the FF 2.0 AttributeProviderRegistry.
+     */
+    bindStores(stores) {
+        this.stores = { ...stores };
+    }
+    /**
+     * Flatten the live billing state into the `bridge:billing.*` namespace.
+     *
+     * Two sources are merged:
+     *   1. US-13 store path: reads the three `useBridge()` stores synchronously
+     *      and emits canonical `plan`, `trial`, `subscription.status`,
+     *      `quota.<metric>.*`, and `entitlement.<name>` keys.
+     *   2. Legacy `getBillingSnapshot` callback path (pre-US-13): preserved so
+     *      standalone-FF apps that wired the provider before US-13 keep
+     *      working. Store-derived keys win on collision (newer = canonical).
+     *
+     * The store path is sync, no HTTP, no awaits — safe in the FF 2.0 hot eval
+     * path. The legacy path may be async; when it is, the merged result is a
+     * Promise (consumers awaiting `provide()` already handle this).
+     *
+     * Failures in any branch degrade silently to whatever was successfully
+     * collected — never throws, never breaks the eval.
+     */
+    provide() {
+        // US-13 — store-backed path. Synchronous, no HTTP. Reads the live state
+        // of the three Phase A/B stores (subscription, quotas, entitlements) and
+        // flattens into the `bridge:billing.*` namespace. Safe to call before any
+        // store is wired — missing stores simply contribute no keys.
+        const storeAttrs = this.flattenStores();
+        // Legacy path — the `getBillingSnapshot` callback config. Preserved so
+        // standalone-FF apps that wired the provider before US-13 keep working.
+        let result;
+        try {
+            result = this.config.getBillingSnapshot();
+        }
+        catch (err) {
+            this.warnOnce(err);
+            return storeAttrs;
+        }
+        if (result instanceof Promise) {
+            // Async legacy snapshot — merge async; store attrs are returned now and
+            // also re-emitted under the resolved promise. Provider attrs from the
+            // store path win on collision (newer = US-13 canonical).
+            return result.then((snap) => ({ ...this.flatten(snap), ...storeAttrs }), (err) => {
+                this.warnOnce(err);
+                return storeAttrs;
+            });
+        }
+        // Sync legacy snapshot (or undefined) — merge sync. Store attrs win.
+        const legacyAttrs = this.flatten(result);
+        return { ...legacyAttrs, ...storeAttrs };
+    }
+    /**
+     * US-13 — read the three stores and emit the canonical `bridge:billing.*`
+     * flat map. Sync, defensive: every store ref is optional and every read is
+     * wrapped so a single misbehaving store can't break the eval path.
+     *
+     * Output key set per `BillingAttributeProvider`'s ticket contract:
+     *   - `bridge:billing.plan`                    string (plan slug)
+     *   - `bridge:billing.trial`                   boolean
+     *   - `bridge:billing.subscription.status`     string
+     *   - `bridge:billing.quota.<metric>.used`     number
+     *   - `bridge:billing.quota.<metric>.limit`    number
+     *   - `bridge:billing.quota.<metric>.remaining` number
+     *   - `bridge:billing.quota.<metric>.percent_used` number (0..1+)
+     *   - `bridge:billing.entitlement.<name>`      boolean (incl. `app_active`)
+     *
+     * Note: `bridge:billing.limit.<name>` (non-quota plan caps like seats) is
+     * reserved for a future story — no live source today, so it's left empty.
+     */
+    flattenStores() {
+        const out = {};
+        // Subscription — plan slug, trial flag, status string.
+        try {
+            const sub = this.stores.subscription;
+            if (sub) {
+                const snap = sub.snapshot();
+                const state = snap.state;
+                if (state) {
+                    if (state.plan && typeof state.plan.slug === 'string') {
+                        out[`${BILLING_NS_PREFIX}plan`] = state.plan.slug;
+                    }
+                    if (typeof state.status === 'string') {
+                        out[`${BILLING_NS_PREFIX}subscription.status`] = state.status;
+                        out[`${BILLING_NS_PREFIX}trial`] = state.status === 'trial';
+                    }
+                }
+            }
+        }
+        catch (err) {
+            this.warnOnce(err);
+        }
+        // Quotas — per-metric used / limit / remaining / percent_used.
+        try {
+            const quotas = this.stores.quotas;
+            if (quotas) {
+                const all = quotas.getAll();
+                for (const [metric, snap] of all.entries()) {
+                    if (!snap)
+                        continue;
+                    const base = `${BILLING_NS_PREFIX}quota.${metric}`;
+                    if (typeof snap.used === 'number')
+                        out[`${base}.used`] = snap.used;
+                    if (typeof snap.limit === 'number')
+                        out[`${base}.limit`] = snap.limit;
+                    if (typeof snap.remaining === 'number') {
+                        out[`${base}.remaining`] = snap.remaining;
+                    }
+                    if (typeof snap.percent_used === 'number') {
+                        out[`${base}.percent_used`] = snap.percent_used;
+                    }
+                }
+            }
+        }
+        catch (err) {
+            this.warnOnce(err);
+        }
+        // Entitlements — boolean per name (incl. `app_active`).
+        try {
+            const ent = this.stores.entitlements;
+            if (ent && ent.isHydrated()) {
+                const all = ent.all();
+                for (const [name, value] of Object.entries(all)) {
+                    if (typeof value === 'boolean') {
+                        out[`${BILLING_NS_PREFIX}entitlement.${name}`] = value;
+                    }
+                }
+            }
+        }
+        catch (err) {
+            this.warnOnce(err);
+        }
+        return out;
+    }
+    flatten(snapshot) {
+        if (!snapshot || typeof snapshot !== 'object')
+            return {};
+        const out = {};
+        if (typeof snapshot.plan === 'string') {
+            out[`${BILLING_NS_PREFIX}plan`] = snapshot.plan;
+        }
+        if (typeof snapshot.trial === 'boolean') {
+            out[`${BILLING_NS_PREFIX}trial`] = snapshot.trial;
+        }
+        if (snapshot.quota && typeof snapshot.quota === 'object') {
+            for (const [resource, q] of Object.entries(snapshot.quota)) {
+                if (!q || typeof q !== 'object')
+                    continue;
+                const base = `${BILLING_NS_PREFIX}quota.${resource}`;
+                const used = typeof q.used === 'number' ? q.used : undefined;
+                const limit = typeof q.limit === 'number' ? q.limit : undefined;
+                if (used !== undefined)
+                    out[`${base}.used`] = used;
+                if (limit !== undefined)
+                    out[`${base}.limit`] = limit;
+                if (used !== undefined && limit !== undefined && limit > 0) {
+                    out[`${base}.percent_used`] = Math.floor((used / limit) * 100);
+                }
+            }
+        }
+        if (snapshot.limit && typeof snapshot.limit === 'object') {
+            for (const [name, value] of Object.entries(snapshot.limit)) {
+                if (typeof value === 'number' || typeof value === 'string') {
+                    out[`${BILLING_NS_PREFIX}limit.${name}`] = value;
+                }
+            }
+        }
+        return out;
+    }
+    warnOnce(err) {
+        if (this.warnedOnce)
+            return;
+        this.warnedOnce = true;
+        try {
+            // eslint-disable-next-line no-console
+            globalThis.console?.warn?.(`[BillingAttributeProvider] getBillingSnapshot threw; ` +
+                `returning empty attributes. Error: ${err?.message ?? String(err)}`);
+        }
+        catch {
+            // ignore console errors
+        }
+    }
+}
+//# sourceMappingURL=attribute-providers.js.map

package/dist/flags/attribute-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribute-providers.js","sourceRoot":"","sources":["../../src/flags/attribute-providers.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,0EAA0E;AAC1E,wDAAwD;AACxD,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,6EAA6E;AAyB7E;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IAC5B,SAAS,GAAwB,EAAE,CAAC;IAE5C,8FAA8F;IAC9F,QAAQ,CAAC,QAA2B;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,iCAAiC;IACjC,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,gDAAgD;IAChD,IAAI;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,2BAA2B;IAC3B,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACvC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW;QACT,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACjC,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;oBAC7B,mEAAmE;oBACnE,qDAAqD;oBACrD,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,MAAmB;QAC/B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC;QAC/C,0EAA0E;QAC1E,MAAM,CAAC,UAAU,CACf;YACE,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ;YACtC,UAAU,EAAE,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,EAAE;SAC7C,EACD,KAAK,CACN,CAAC;IACJ,CAAC;CACF;AA0CD;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,aAAa,CAAC;IACrB,SAAS,GAAG,QAAiB,CAAC;IAEtB,MAAM,CAAqB;IAE5C,YAAY,MAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAErD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,GAAG,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,GAAG,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC;QAChC,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,GAAG,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QACxC,CAAC;aAAM,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QACxC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAmFD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAE5C,MAAM,OAAO,wBAAwB;IAC1B,IAAI,GAAG,gBAAgB,CAAC;IACxB,SAAS,GAAG,QAAiB,CAAC;IAEtB,MAAM,CAAwB;IACvC,MAAM,GAA0B,EAAE,CAAC;IACnC,UAAU,GAAG,KAAK,CAAC;IAE3B;;;;OAIG;IACH,YAAY,MAA8B;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;;;OAUG;IACH,UAAU,CAAC,MAA6B;QACtC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO;QAGL,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,MAA+D,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;YAC9B,wEAAwE;YACxE,sEAAsE;YACtE,yDAAyD;YACzD,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,EACpD,CAAC,GAAG,EAAE,EAAE;gBACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO,UAAU,CAAC;YACpB,CAAC,CACF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,aAAa;QACnB,MAAM,GAAG,GAA4B,EAAE,CAAC;QAExC,uDAAuD;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACrC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACzB,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACtD,GAAG,CAAC,GAAG,iBAAiB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBACpD,CAAC;oBACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACrC,GAAG,CAAC,GAAG,iBAAiB,qBAAqB,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;wBAC9D,GAAG,CAAC,GAAG,iBAAiB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC3C,IAAI,CAAC,IAAI;wBAAE,SAAS;oBACpB,MAAM,IAAI,GAAG,GAAG,iBAAiB,SAAS,MAAM,EAAE,CAAC;oBACnD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;wBAAE,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;oBACnE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;wBAAE,GAAG,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;oBACtE,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;wBACvC,GAAG,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;oBAC5C,CAAC;oBACD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;wBAC1C,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;oBAClD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAED,wDAAwD;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACrC,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;wBAC/B,GAAG,CAAC,GAAG,iBAAiB,eAAe,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;oBACzD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,OAAO,CAAC,QAAqC;QACnD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzD,MAAM,GAAG,GAA4B,EAAE,CAAC;QAExC,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,GAAG,CAAC,GAAG,iBAAiB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACxC,GAAG,CAAC,GAAG,iBAAiB,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;QACpD,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACzD,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,SAAS;gBAC1C,MAAM,IAAI,GAAG,GAAG,iBAAiB,SAAS,QAAQ,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChE,IAAI,IAAI,KAAK,SAAS;oBAAE,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC;gBACnD,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,CAAC;gBACtD,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC3D,GAAG,CAAC,GAAG,iBAAiB,SAAS,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,QAAQ,CAAC,GAAY;QAC3B,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,sCAAsC;YACrC,UAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,CACjC,uDAAuD;gBACrD,sCAAuC,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACjF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;CACF"}

package/dist/flags/dev-attribute-provider.d.ts

@@ -0,0 +1,67 @@
+export type AttributeGetter = () => unknown;
+export type AttributeBulkGetter = () => Record<string, unknown> | undefined | null;
+export interface SetOptions {
+    /**
+     * When false, this attribute's reads do NOT participate in
+     * `onAttributeObserved` telemetry. Default true.
+     *
+     * Useful for high-frequency keys (e.g. cursor position, scroll offset)
+     * where the dev needs the value in flag evals but doesn't need the
+     * telemetry overhead.
+     */
+    observed?: boolean;
+}
+/**
+ * Dev-managed AttributeProvider — the single backend for the `bridge.attributes`
+ * surface. One instance is created per SDK init and registered with the
+ * AttributeProviderRegistry. The order of registration determines whose
+ * keys win on collision via `collectSync` merge order (per-call attrs >
+ * setContext > providers — locked decision #20). Dev's provider is registered
+ * LAST so its keys beat the framework providers.
+ */
+export declare class DevAttributeProvider {
+    readonly name = "dev";
+    readonly namespace: 'custom';
+    private readonly _entries;
+    private readonly _bulkEntries;
+    private readonly _subscribers;
+    /** Static one-shot value. `opts.observed` defaults to true. */
+    set(key: string, value: unknown, opts?: SetOptions): void;
+    /** Live-bound: getter re-invoked on every flag eval. */
+    bind(key: string, getter: AttributeGetter, opts?: SetOptions): void;
+    /**
+     * Bulk getter returning `Record<string, unknown>`. Reserved keys inside
+     * the returned map are silently dropped (a `console.warn` fires once per
+     * reserved key per session to surface the typo).
+     */
+    bindMany(getter: AttributeBulkGetter, opts?: SetOptions): void;
+    /** Remove a key (static or bound). Bulk getters are removed via `clearBulk()`. */
+    unset(key: string): void;
+    /** Remove every bulk getter. */
+    clearBulk(): void;
+    /** Remove every entry (test/teardown). */
+    clear(): void;
+    /**
+     * AttributeProvider contract — invoked synchronously on the FF 2.0 hot
+     * eval path. Returns the merged attribute map.
+     *
+     * Merge order within the dev provider: bulk getters first (so individual
+     * `set`/`bind` calls win over a bulk that happens to repeat a key).
+     * Getter exceptions are isolated — one throwing key doesn't break the rest.
+     */
+    provide(): Record<string, unknown>;
+    /** Read-side convenience used by the public `bridge.attributes.get()`. */
+    get(): Record<string, unknown>;
+    /**
+     * Whether the key opts out of `onAttributeObserved` telemetry. Looked up
+     * by the framework SDK at observation time; bulk-supplied keys default to
+     * the bulk entry's `observed` flag (or true).
+     */
+    isObserved(key: string): boolean;
+    /** Svelte store contract — subscribe to attribute-map snapshots. */
+    subscribe(fn: (map: Record<string, unknown>) => void): () => void;
+    private _notify;
+}
+/** Exposed for tests in other packages that want to validate the reserved set. */
+export declare const __TEST_RESERVED_PREFIXES: readonly string[];
+//# sourceMappingURL=dev-attribute-provider.d.ts.map

package/dist/flags/dev-attribute-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-attribute-provider.d.ts","sourceRoot":"","sources":["../../src/flags/dev-attribute-provider.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC;AAC5C,MAAM,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC;AAEnF,MAAM,WAAW,UAAU;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA4BD;;;;;;;GAOG;AACH,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,IAAI,SAAS;IACtB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAY;IAIxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IAGjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqD;IAElF,+DAA+D;IAC/D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI;IAczD,wDAAwD;IACxD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI;IAcnE;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI;IAS9D,kFAAkF;IAClF,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxB,gCAAgC;IAChC,SAAS,IAAI,IAAI;IAMjB,0CAA0C;IAC1C,KAAK,IAAI,IAAI;IAMb;;;;;;;OAOG;IACH,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IA6BlC,0EAA0E;IAC1E,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI9B;;;;OAIG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAWhC,oEAAoE;IACpE,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI;IAYjE,OAAO,CAAC,OAAO;CAgBhB;AAED,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAsB,CAAC"}

package/dist/flags/dev-attribute-provider.js

@@ -0,0 +1,200 @@
+// Phase 5 (TBP-288/328/329/330) — dev-managed AttributeProvider.
+//
+// Backs the `bridge.attributes` surface in framework SDKs (bridge-svelte etc.).
+// Three contribution modes — all coexist in one provider instance:
+//
+//   set(key, value)        → static one-shot value
+//   bind(key, getter)      → live; getter is called on every flag eval
+//   bindMany(getter)       → bulk; getter returns Record<string, unknown>
+//
+// Reserved namespace: keys starting with `bridge:` (and the legacy aliases
+// `app:`, `tenant:`, `user:` reserved for bridge-managed attribute scopes)
+// are REJECTED at write time with a clear console.warn — they don't end up
+// in the provider map. Reads via get() return only the dev-contributed keys.
+const RESERVED_PREFIXES = ['bridge:'];
+function isReserved(key) {
+    for (const p of RESERVED_PREFIXES) {
+        if (key.startsWith(p))
+            return true;
+    }
+    return false;
+}
+function warnReserved(key, context) {
+    if (typeof console !== 'undefined' && typeof console.warn === 'function') {
+        // eslint-disable-next-line no-console
+        console.warn(`[bridge.attributes.${context}] key "${key}" is in the reserved \`bridge:\` namespace — write rejected. ` +
+            `Use a custom prefix (e.g. \`app.${key.split(':')[1] ?? key}\`) instead.`);
+    }
+}
+/**
+ * Dev-managed AttributeProvider — the single backend for the `bridge.attributes`
+ * surface. One instance is created per SDK init and registered with the
+ * AttributeProviderRegistry. The order of registration determines whose
+ * keys win on collision via `collectSync` merge order (per-call attrs >
+ * setContext > providers — locked decision #20). Dev's provider is registered
+ * LAST so its keys beat the framework providers.
+ */
+export class DevAttributeProvider {
+    name = 'dev';
+    namespace = 'custom';
+    // Single map keyed by attribute key for `static` + `bound` entries.
+    // Bulk entries are kept in a parallel list (no single key).
+    _entries = new Map();
+    _bulkEntries = [];
+    // Subscriptions for the Svelte store contract (TBP-328 AC: "subscribable").
+    _subscribers = new Set();
+    /** Static one-shot value. `opts.observed` defaults to true. */
+    set(key, value, opts) {
+        if (isReserved(key)) {
+            warnReserved(key, 'set');
+            return;
+        }
+        this._entries.set(key, {
+            kind: 'static',
+            key,
+            value,
+            observed: opts?.observed ?? true,
+        });
+        this._notify();
+    }
+    /** Live-bound: getter re-invoked on every flag eval. */
+    bind(key, getter, opts) {
+        if (isReserved(key)) {
+            warnReserved(key, 'bind');
+            return;
+        }
+        this._entries.set(key, {
+            kind: 'bound',
+            key,
+            getter,
+            observed: opts?.observed ?? true,
+        });
+        this._notify();
+    }
+    /**
+     * Bulk getter returning `Record<string, unknown>`. Reserved keys inside
+     * the returned map are silently dropped (a `console.warn` fires once per
+     * reserved key per session to surface the typo).
+     */
+    bindMany(getter, opts) {
+        this._bulkEntries.push({
+            kind: 'bulk',
+            bulkGetter: getter,
+            observed: opts?.observed ?? true,
+        });
+        this._notify();
+    }
+    /** Remove a key (static or bound). Bulk getters are removed via `clearBulk()`. */
+    unset(key) {
+        if (this._entries.delete(key))
+            this._notify();
+    }
+    /** Remove every bulk getter. */
+    clearBulk() {
+        if (this._bulkEntries.length === 0)
+            return;
+        this._bulkEntries.length = 0;
+        this._notify();
+    }
+    /** Remove every entry (test/teardown). */
+    clear() {
+        this._entries.clear();
+        this._bulkEntries.length = 0;
+        this._notify();
+    }
+    /**
+     * AttributeProvider contract — invoked synchronously on the FF 2.0 hot
+     * eval path. Returns the merged attribute map.
+     *
+     * Merge order within the dev provider: bulk getters first (so individual
+     * `set`/`bind` calls win over a bulk that happens to repeat a key).
+     * Getter exceptions are isolated — one throwing key doesn't break the rest.
+     */
+    provide() {
+        const out = {};
+        for (const entry of this._bulkEntries) {
+            try {
+                const m = entry.bulkGetter();
+                if (m && typeof m === 'object') {
+                    for (const [k, v] of Object.entries(m)) {
+                        if (isReserved(k))
+                            continue;
+                        out[k] = v;
+                    }
+                }
+            }
+            catch {
+                // Skip a throwing bulk getter for this eval.
+            }
+        }
+        for (const entry of this._entries.values()) {
+            try {
+                if (entry.kind === 'static') {
+                    out[entry.key] = entry.value;
+                }
+                else if (entry.kind === 'bound') {
+                    out[entry.key] = entry.getter();
+                }
+            }
+            catch {
+                // Skip a throwing getter; other keys still flow through.
+            }
+        }
+        return out;
+    }
+    /** Read-side convenience used by the public `bridge.attributes.get()`. */
+    get() {
+        return this.provide();
+    }
+    /**
+     * Whether the key opts out of `onAttributeObserved` telemetry. Looked up
+     * by the framework SDK at observation time; bulk-supplied keys default to
+     * the bulk entry's `observed` flag (or true).
+     */
+    isObserved(key) {
+        const direct = this._entries.get(key);
+        if (direct)
+            return direct.observed;
+        // Bulk entries don't track per-key observation; use the most-recently
+        // added bulk entry's flag if any, else default true.
+        if (this._bulkEntries.length > 0) {
+            return this._bulkEntries[this._bulkEntries.length - 1].observed;
+        }
+        return true;
+    }
+    /** Svelte store contract — subscribe to attribute-map snapshots. */
+    subscribe(fn) {
+        this._subscribers.add(fn);
+        try {
+            fn(this.provide());
+        }
+        catch {
+            // ignore subscriber errors
+        }
+        return () => {
+            this._subscribers.delete(fn);
+        };
+    }
+    _notify() {
+        if (this._subscribers.size === 0)
+            return;
+        let snapshot;
+        try {
+            snapshot = this.provide();
+        }
+        catch {
+            return;
+        }
+        for (const fn of this._subscribers) {
+            try {
+                fn(snapshot);
+            }
+            catch {
+                // ignore subscriber errors
+            }
+        }
+    }
+}
+/** Exposed for tests in other packages that want to validate the reserved set. */
+export const __TEST_RESERVED_PREFIXES = RESERVED_PREFIXES;
+//# sourceMappingURL=dev-attribute-provider.js.map