@nebulr-group/bridge-auth-core 0.1.2 → 0.4.0-beta.0

package/dist/flags/flag.js

@@ -0,0 +1,337 @@
+// bridge.flag(key, default) — the canonical SDK call (TBP-160).
+//
+// One method, one signature. The TypeScript return type matches the default
+// value's type (boolean / string / number / structured), so callers don't
+// need a separate cast.
+//
+// Local-first evaluation:
+//   1. Look up the flag in the in-memory cache
+//   2. If absent → return the developer's `defaultValue` (and emit a
+//      "discovered" hook so the SDK can register the key with bridge-api)
+//   3. If present → evaluate locally against the dev-supplied context
+//   4. Always emit an `onEval` hook so the SDK can batch eval telemetry
+//
+// Hooks are pluggable so this module stays platform-agnostic. The actual
+// wiring (HTTP batcher, fetch client, etc.) is the SDK integration's job
+// — see TBP-157 / TBP-156 for the implementations.
+import { evaluateRule, } from './evaluator.js';
+import { AttributeProviderRegistry, } from './attribute-providers.js';
+export class BridgeFlags {
+    cache = new Map();
+    context = { attributes: {} };
+    hooks = {};
+    discoveredKeys = new Set();
+    /** Per-runtime dedup for attribute observations: `${key}::${canonicalValue}`. */
+    observedAttributeKeys = new Set();
+    attributeDeclarations = new Map();
+    mode = 'frontend';
+    serverInstanceIdValue;
+    missingIdentityWarned = new Set();
+    /** Billing 2.0 US-10 (TBP-262): self-report `bridge.flag_evaluations` per eval. */
+    usageReporter;
+    /**
+     * Phase 1 / US-13 (TBP-293, TBP-294) — AttributeProvider registry consulted
+     * on every flag eval. Bridge-managed providers (`bridge:auth`,
+     * `bridge:billing`) are auto-registered by framework SDKs; apps register
+     * their own providers via `registerAttributeProvider()`.
+     */
+    registry = new AttributeProviderRegistry();
+    constructor(options = {}) {
+        if (options.mode)
+            this.mode = options.mode;
+        if (options.usageReporter)
+            this.usageReporter = options.usageReporter;
+    }
+    /**
+     * Register an `AttributeProvider`. Idempotent on `provider.name` —
+     * re-registering with the same name replaces the previous instance.
+     * Provider attributes flow into every `flag()` eval automatically.
+     * Dev-supplied attrs (via `setContext` / per-call `context`) win on
+     * collision (locked decision #20).
+     */
+    registerAttributeProvider(provider) {
+        this.registry.register(provider);
+    }
+    /** Remove a previously-registered provider by name. No-op if not present. */
+    unregisterAttributeProvider(name) {
+        this.registry.unregister(name);
+    }
+    /**
+     * Expose the registry for advanced callers (e.g. async `applyTo()` refreshes
+     * driven by framework auth events). Most consumers should prefer
+     * `registerAttributeProvider` / `unregisterAttributeProvider`.
+     */
+    getAttributeProviderRegistry() {
+        return this.registry;
+    }
+    /**
+     * Wire a usage reporter post-construction. The flag-eval path will call
+     * `reporter.report('bridge.flag_evaluations', 1)` on every successful eval
+     * (i.e. when a cached flag is present and evaluated). Discovery-only paths
+     * — first-sight unknown flag → default — do NOT count.
+     */
+    setUsageReporter(reporter) {
+        this.usageReporter = reporter;
+    }
+    /** Read the active runtime mode. */
+    getMode() {
+        return this.mode;
+    }
+    /**
+     * Set a stable server-instance identity (TBP-172). When set, backend flags
+     * that explicitly opt into system-level targeting can bucket on this value
+     * (e.g. canary a feature to one specific instance). Most evals continue to
+     * use the per-call/per-context identity.
+     */
+    setServerInstanceId(id) {
+        if (typeof id !== 'string' || id.length === 0)
+            return;
+        this.serverInstanceIdValue = id;
+    }
+    /** Read the configured server-instance id, or undefined when not set. */
+    getServerInstanceId() {
+        return this.serverInstanceIdValue;
+    }
+    /** Replace or merge the eval context. */
+    setContext(ctx, merge = false) {
+        if (merge) {
+            this.context = {
+                identity: ctx.identity ?? this.context.identity,
+                attributes: { ...this.context.attributes, ...ctx.attributes },
+            };
+        }
+        else {
+            this.context = ctx;
+        }
+    }
+    /** Return a defensive shallow copy of the current eval context. */
+    getContext() {
+        return { identity: this.context.identity, attributes: { ...this.context.attributes } };
+    }
+    /** Replace the cache from a bulk hydrate (e.g. response from bridge-api). */
+    hydrate(flags) {
+        this.cache.clear();
+        for (const f of flags) {
+            this.cache.set(f.key, f);
+        }
+    }
+    /** Replace or insert a single flag (used by live updates). */
+    upsert(flag) {
+        this.cache.set(flag.key, flag);
+    }
+    /** Remove a flag from the cache. */
+    remove(key) {
+        this.cache.delete(key);
+    }
+    /** Register telemetry hooks. Replaces any previous hooks. */
+    setHooks(hooks) {
+        this.hooks = hooks;
+    }
+    /**
+     * Read a flag value. Returns `defaultValue` when the flag isn't known yet.
+     * TypeScript infers `T` from `defaultValue`, so callers don't write casts.
+     *
+     * An optional per-call `context` overrides the SDK's global context for
+     * just this eval. Attributes deep-merge — per-call wins on overlap, global
+     * keys not in the override are preserved.
+     */
+    flag(key, defaultValue, context) {
+        const cached = this.cache.get(key);
+        const now = Date.now();
+        const observedType = inferType(defaultValue);
+        // Phase 1 / US-13 — merge AttributeProvider-supplied attrs into the eval
+        // context on every call. Precedence (locked decision #20):
+        //   providers (lowest)  <  setContext globals  <  per-call context (highest)
+        // Sync-only here: `collectSync()` skips any async provider for this eval
+        // (those refresh via `applyTo()` on auth/billing change events).
+        const providerAttrs = this.registry.size() > 0 ? this.registry.collectSync() : undefined;
+        let effectiveCtx;
+        if (!context && !providerAttrs) {
+            effectiveCtx = this.context;
+        }
+        else {
+            effectiveCtx = {
+                identity: context?.identity ?? this.context.identity,
+                attributes: {
+                    ...(providerAttrs ?? {}),
+                    ...this.context.attributes,
+                    ...(context?.attributes ?? {}),
+                },
+            };
+        }
+        // Observe per-call attribute keys so the admin UI's attribute catalog
+        // surfaces what dev code actually supplies (powers TBP-178 collision
+        // detection + custom attribute autocomplete). Dedup per (key, value) in
+        // this runtime to keep the batcher quiet.
+        if (context?.attributes) {
+            for (const [attrKey, attrVal] of Object.entries(context.attributes)) {
+                if (!attrKey)
+                    continue;
+                const dedupKey = `${attrKey}::${canonicalSampleKey(attrVal)}`;
+                if (this.observedAttributeKeys.has(dedupKey))
+                    continue;
+                this.observedAttributeKeys.add(dedupKey);
+                this.safeHook(() => this.hooks.onAttributeObserved?.({
+                    key: attrKey,
+                    sampleValue: attrVal,
+                    observedType: inferType(attrVal),
+                    timestamp: now,
+                }));
+            }
+        }
+        // Backend mode (TBP-170): refuse to evaluate user-level rules without an
+        // identity. Returns the developer's `defaultValue` rather than guessing
+        // with anonymous bucketing. Warn once per flag per runtime.
+        if (this.mode === 'backend' && !effectiveCtx.identity && cached?.state === 'on-with-rule') {
+            if (!this.missingIdentityWarned.has(key)) {
+                this.missingIdentityWarned.add(key);
+                try {
+                    // eslint-disable-next-line no-console
+                    globalThis.console?.warn?.(`[bridge.flag] '${key}': backend eval requires an explicit identity; returning default. ` +
+                        `Pass context.identity per call, or use a server-instance id for system-level flags.`);
+                }
+                catch {
+                    // ignore console errors
+                }
+            }
+            return { passed: false, value: defaultValue };
+        }
+        if (!cached) {
+            // First sight — emit a discovery event so the server creates the
+            // record. Dedupe per (key) in this runtime; server is the authority.
+            if (!this.discoveredKeys.has(key)) {
+                this.discoveredKeys.add(key);
+                this.safeHook(() => this.hooks.onDiscover?.({
+                    flag: key,
+                    defaultValue,
+                    observedType,
+                    timestamp: now,
+                }));
+            }
+            return { passed: false, value: defaultValue };
+        }
+        const result = this.evaluateCached(cached, effectiveCtx);
+        const value = result.value === undefined ? defaultValue : result.value;
+        this.safeHook(() => this.hooks.onEval?.({
+            flag: key,
+            value,
+            variantIndex: result.variantIndex,
+            identity: effectiveCtx.identity,
+            timestamp: now,
+        }));
+        // Billing 2.0 US-10 (TBP-262): SDK-side flag_evaluations self-report.
+        // Fire-and-forget; the reporter handles batching + errors. One call per
+        // eval — there's no batched flag API, so no multiplier needed.
+        if (this.usageReporter) {
+            this.safeHook(() => this.usageReporter?.report('bridge.flag_evaluations', 1));
+        }
+        // Fail-safe type check: if the cached value doesn't match the dev's
+        // declared default type, fall back to the default. Protects the app
+        // from admin-side type mistakes (TBP-159 validation should catch most
+        // of these at save time; this is the last-mile safety net).
+        if (!typeMatches(value, observedType)) {
+            return { passed: false, value: defaultValue };
+        }
+        return { passed: result.matched, value };
+    }
+    /**
+     * Internal — evaluate the cached flag against an eval context.
+     */
+    evaluateCached(cached, ctx) {
+        switch (cached.state) {
+            case 'off':
+                return { value: cached.offValue, variantIndex: -1, matched: false, excludedByRollout: false };
+            case 'on':
+                return { value: cached.onValue, variantIndex: 0, matched: true, excludedByRollout: false };
+            case 'on-with-rule': {
+                if (!cached.rule) {
+                    // Defensive: state says on-with-rule but no rule. Fall back to on.
+                    return { value: cached.onValue, variantIndex: -1, matched: false, excludedByRollout: false };
+                }
+                return evaluateRule(cached.rule, cached.key, ctx);
+            }
+            default:
+                return { value: cached.offValue, variantIndex: -1, matched: false, excludedByRollout: false };
+        }
+    }
+    /** Number of cached flags. Useful for debugging + tests. */
+    cacheSize() {
+        return this.cache.size;
+    }
+    /** Get a snapshot of cached flag keys. */
+    cachedKeys() {
+        return Array.from(this.cache.keys());
+    }
+    /**
+     * @deprecated Per-call observations now power the admin attribute catalog
+     * automatically — just pass attributes when you evaluate a flag:
+     *   `bridge.flag('feat', false, { attributes: { plan: 'pro' } })`.
+     * The SDK reports each `(key, sampleValue)` once via `onAttributeObserved`,
+     * which the batcher relays to `/v1/flags/discover` with `kind: 'attribute'`.
+     * `declareAttributes()` will be removed in a future minor release.
+     */
+    declareAttributes(declarations) {
+        const now = Date.now();
+        for (const [name, type] of Object.entries(declarations)) {
+            if (typeof name !== 'string' || name.length === 0)
+                continue;
+            if (this.attributeDeclarations.get(name) === type)
+                continue; // same as before; no-op
+            this.attributeDeclarations.set(name, type);
+            this.safeHook(() => this.hooks.onAttributeDeclaration?.({ name, type, timestamp: now }));
+        }
+    }
+    /** Read the current attribute type declarations. Useful for tests + framework wrappers. */
+    getAttributeDeclarations() {
+        return Object.fromEntries(this.attributeDeclarations.entries());
+    }
+    safeHook(fn) {
+        try {
+            fn();
+        }
+        catch {
+            // Telemetry must never break eval. Silently swallow.
+        }
+    }
+}
+// ── Type inference helpers ──────────────────────────────────────────────────
+function inferType(v) {
+    if (typeof v === 'boolean')
+        return 'boolean';
+    if (typeof v === 'number')
+        return 'number';
+    if (typeof v === 'string')
+        return 'string';
+    return 'json';
+}
+/** Stable string key for an attribute sample value — used for in-process dedup
+ *  in `observedAttributeKeys`. Safe for primitives + JSON-serialisable values. */
+function canonicalSampleKey(v) {
+    if (v === undefined)
+        return '∅undef';
+    if (v === null)
+        return '∅null';
+    if (typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean')
+        return String(v);
+    try {
+        return JSON.stringify(v);
+    }
+    catch {
+        return '∅unserialisable';
+    }
+}
+function typeMatches(v, expected) {
+    if (v === undefined || v === null)
+        return false;
+    switch (expected) {
+        case 'boolean':
+            return typeof v === 'boolean';
+        case 'number':
+            return typeof v === 'number';
+        case 'string':
+            return typeof v === 'string';
+        case 'json':
+            return true;
+    }
+}
+//# sourceMappingURL=flag.js.map

package/dist/flags/flag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flag.js","sourceRoot":"","sources":["../../src/flags/flag.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,wBAAwB;AACxB,EAAE;AACF,0BAA0B;AAC1B,+CAA+C;AAC/C,qEAAqE;AACrE,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,mDAAmD;AAEnD,OAAO,EACL,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,GAE1B,MAAM,0BAA0B,CAAC;AAuHlC,MAAM,OAAO,WAAW;IACd,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,OAAO,GAAgB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC1C,KAAK,GAAqB,EAAE,CAAC;IAC7B,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,iFAAiF;IACzE,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,qBAAqB,GAAG,IAAI,GAAG,EAAiC,CAAC;IACjE,IAAI,GAAoB,UAAU,CAAC;IACnC,qBAAqB,CAAU;IAC/B,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAClD,mFAAmF;IAC3E,aAAa,CAAyB;IAC9C;;;;;OAKG;IACc,QAAQ,GAA8B,IAAI,yBAAyB,EAAE,CAAC;IAEvF,YAAY,UAA6E,EAAE;QACzF,IAAI,OAAO,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3C,IAAI,OAAO,CAAC,aAAa;YAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACH,yBAAyB,CAAC,QAA2B;QACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,6EAA6E;IAC7E,2BAA2B,CAAC,IAAY;QACtC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,4BAA4B;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,QAA2C;QAC1D,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;IAChC,CAAC;IAED,oCAAoC;IACpC,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,mBAAmB,CAAC,EAAU;QAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACtD,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC;IAClC,CAAC;IAED,yEAAyE;IACzE,mBAAmB;QACjB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED,yCAAyC;IACzC,UAAU,CAAC,GAAgB,EAAE,KAAK,GAAG,KAAK;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,OAAO,GAAG;gBACb,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/C,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE;aAC9D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;QACrB,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,UAAU;QACR,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;IACzF,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,KAAmB;QACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,CAAC,IAAgB;QACrB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,oCAAoC;IACpC,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,6DAA6D;IAC7D,QAAQ,CAAC,KAAuB;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,CAAI,GAAW,EAAE,YAAe,EAAE,OAA8B;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAE7C,yEAAyE;QACzE,2DAA2D;QAC3D,6EAA6E;QAC7E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,aAAa,GACjB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAErE,IAAI,YAAyB,CAAC;QAC9B,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/B,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,YAAY,GAAG;gBACb,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ;gBACpD,UAAU,EAAE;oBACV,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;oBACxB,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU;oBAC1B,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;iBAC/B;aACF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,0CAA0C;QAC1C,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9D,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACvD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACjB,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;oBAC/B,GAAG,EAAE,OAAO;oBACZ,WAAW,EAAE,OAAO;oBACpB,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC;oBAChC,SAAS,EAAE,GAAG;iBACf,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,MAAM,EAAE,KAAK,KAAK,cAAc,EAAE,CAAC;YAC1F,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,sCAAsC;oBACrC,UAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,CACjC,kBAAkB,GAAG,oEAAoE;wBACvF,qFAAqF,CACxF,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iEAAiE;YACjE,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACjB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;oBACtB,IAAI,EAAE,GAAG;oBACT,YAAY;oBACZ,YAAY;oBACZ,SAAS,EAAE,GAAG;iBACf,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAE,MAAM,CAAC,KAAW,CAAC;QAE9E,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACjB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,EAAE,GAAG;YACT,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,SAAS,EAAE,GAAG;SACf,CAAC,CACH,CAAC;QAEF,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,4DAA4D;QAC5D,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,MAAkB,EAAE,GAAgB;QACzD,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,KAAK;gBACR,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAChG,KAAK,IAAI;gBACP,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAC7F,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACjB,mEAAmE;oBACnE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;gBAC/F,CAAC;gBACD,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YACD;gBACE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;QAClG,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,0CAA0C;IAC1C,UAAU;QACR,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,YAAmD;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC5D,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS,CAAC,wBAAwB;YACrF,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACjB,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,wBAAwB;QACtB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAEO,QAAQ,CAAC,EAAc;QAC7B,IAAI,CAAC;YACH,EAAE,EAAE,CAAC;QACP,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAE/E,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;kFACkF;AAClF,SAAS,kBAAkB,CAAC,CAAU;IACpC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAU,EAAE,QAAuB;IACtD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC,KAAK,SAAS,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC/B,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC/B,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/flags/identity.d.ts

@@ -0,0 +1,77 @@
+import type { BridgeFlags } from './flag.js';
+/** How aggressively the anon ID is persisted. */
+export type AnonymousTrackingMode = 'persistent' | 'session' | 'none';
+/**
+ * Pluggable storage for the anonymous identity. Framework SDKs implement
+ * this against the right platform API.
+ */
+export interface IdentityStorage {
+    /** Persistence flavor — informational only; storage choice itself enforces it. */
+    readonly mode: AnonymousTrackingMode;
+    /** Read the stored anon ID, or undefined if not set. */
+    read(): string | undefined;
+    /** Write the anon ID. */
+    write(id: string): void;
+    /** Drop the anon ID (e.g. on logout). */
+    clear(): void;
+}
+/** In-memory storage. Used for SSR, tests, or when `tracking: 'none'`. */
+export declare class MemoryIdentityStorage implements IdentityStorage {
+    readonly mode: AnonymousTrackingMode;
+    private value;
+    constructor(mode?: AnonymousTrackingMode);
+    read(): string | undefined;
+    write(id: string): void;
+    clear(): void;
+}
+/** RFC4122-shaped UUID v4. Uses `crypto.randomUUID` when available, falls back to Math.random. */
+export declare function generateAnonymousId(): string;
+/**
+ * Identity manager bundled with a `BridgeFlags` instance. Created via the
+ * factory below — framework SDKs call `attachIdentity(bridge, storage)`
+ * during bootstrap so anonymous ID auto-populates the eval context.
+ */
+export declare class BridgeIdentity {
+    private readonly bridge;
+    private readonly storage;
+    /** Fires when the identity transitions from anonymous → known (TBP-169). */
+    private onIdentifyHook?;
+    /** True once `identify()` has been called (or a non-anonymous identity was loaded). */
+    private knownUserId?;
+    constructor(bridge: BridgeFlags, storage: IdentityStorage);
+    /** Read the current anonymous ID, generating + persisting on first call. */
+    ensureAnonymousId(): string;
+    /**
+     * Push the anonymous ID into the BridgeFlags global eval context. Idempotent.
+     * No-op if a known userId is already set.
+     */
+    hydrateAnonymous(): string;
+    /**
+     * Promote the SDK from anonymous to known. Updates the global identity in
+     * `BridgeFlags` and fires the `onIdentify` hook so the server can link
+     * anon-id telemetry to the known user's history.
+     */
+    identify(userId: string): void;
+    /**
+     * Drop the known identity and revert to anonymous. Used on logout. The
+     * anonymous ID itself is preserved unless `dropAnonymous` is also passed.
+     */
+    logout(options?: {
+        dropAnonymous?: boolean;
+    }): void;
+    /** Register a one-time hook fired on identify(). Used by the SDK telemetry batcher. */
+    setOnIdentify(hook: (args: {
+        anonymousId?: string;
+        userId: string;
+    }) => void): void;
+    /** True when `identify()` has set a known user. */
+    isKnown(): boolean;
+    /** Read the current effective identity (known userId or anonymous ID). */
+    current(): string | undefined;
+}
+/**
+ * Factory: attach an anonymous-aware identity manager to a `BridgeFlags`
+ * instance. Pass a storage implementation appropriate for the platform.
+ */
+export declare function attachIdentity(bridge: BridgeFlags, storage: IdentityStorage): BridgeIdentity;
+//# sourceMappingURL=identity.d.ts.map

package/dist/flags/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/flags/identity.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,iDAAiD;AACjD,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;AAEtE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,wDAAwD;IACxD,IAAI,IAAI,MAAM,GAAG,SAAS,CAAC;IAC3B,yBAAyB;IACzB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,yCAAyC;IACzC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,0EAA0E;AAC1E,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,OAAO,CAAC,KAAK,CAAqB;gBAEtB,IAAI,GAAE,qBAA8B;IAIhD,IAAI,IAAI,MAAM,GAAG,SAAS;IAG1B,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAGvB,KAAK,IAAI,IAAI;CAGd;AAED,kGAAkG;AAClG,wBAAgB,mBAAmB,IAAI,MAAM,CAS5C;AAED;;;;GAIG;AACH,qBAAa,cAAc;IAOvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,4EAA4E;IAC5E,OAAO,CAAC,cAAc,CAAC,CAA2D;IAClF,uFAAuF;IACvF,OAAO,CAAC,WAAW,CAAC,CAAS;gBAGV,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,eAAe;IAG3C,4EAA4E;IAC5E,iBAAiB,IAAI,MAAM;IAQ3B;;;OAGG;IACH,gBAAgB,IAAI,MAAM;IAO1B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAc9B;;;OAGG;IACH,MAAM,CAAC,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,IAAI;IAMvD,uFAAuF;IACvF,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,IAAI;IAInF,mDAAmD;IACnD,OAAO,IAAI,OAAO;IAIlB,0EAA0E;IAC1E,OAAO,IAAI,MAAM,GAAG,SAAS;CAI9B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,GAAG,cAAc,CAK5F"}

package/dist/flags/identity.js

@@ -0,0 +1,134 @@
+// Anonymous identity + `identify` for Bridge Feature Flags (TBP-168, TBP-169).
+//
+// Frontends usually want a stable anonymous identifier for users who haven't
+// logged in, so flag evaluation has *something* to bucket on (especially for
+// percentage rollouts). This module:
+//
+//   1. Defines a pluggable IdentityStorage interface so framework SDKs can
+//      back it with localStorage / sessionStorage / cookies / memory.
+//   2. Generates a UUID v4 on first init and persists it.
+//   3. Provides `identify(userId)` to upgrade the anon → known state.
+//
+// auth-core itself is platform-agnostic; the framework SDKs (bridge-svelte,
+// bridge-react, bridge-nextjs) supply the browser-storage implementations.
+// auth-core ships `MemoryIdentityStorage` for tests / SSR.
+/** In-memory storage. Used for SSR, tests, or when `tracking: 'none'`. */
+export class MemoryIdentityStorage {
+    mode;
+    value;
+    constructor(mode = 'none') {
+        this.mode = mode;
+    }
+    read() {
+        return this.value;
+    }
+    write(id) {
+        this.value = id;
+    }
+    clear() {
+        this.value = undefined;
+    }
+}
+/** RFC4122-shaped UUID v4. Uses `crypto.randomUUID` when available, falls back to Math.random. */
+export function generateAnonymousId() {
+    // Prefer Web Crypto / Node 20+ crypto.randomUUID
+    const g = globalThis;
+    if (g.crypto && typeof g.crypto.randomUUID === 'function') {
+        return `anon_${g.crypto.randomUUID()}`;
+    }
+    // Fallback: Math.random-based v4 (acceptable for anon IDs — they're not security tokens)
+    const hex = (n) => Math.floor(Math.random() * (1 << (n * 4))).toString(16).padStart(n, '0');
+    return `anon_${hex(8)}-${hex(4)}-4${hex(3)}-${(8 + Math.floor(Math.random() * 4)).toString(16)}${hex(3)}-${hex(12)}`;
+}
+/**
+ * Identity manager bundled with a `BridgeFlags` instance. Created via the
+ * factory below — framework SDKs call `attachIdentity(bridge, storage)`
+ * during bootstrap so anonymous ID auto-populates the eval context.
+ */
+export class BridgeIdentity {
+    bridge;
+    storage;
+    /** Fires when the identity transitions from anonymous → known (TBP-169). */
+    onIdentifyHook;
+    /** True once `identify()` has been called (or a non-anonymous identity was loaded). */
+    knownUserId;
+    constructor(bridge, storage) {
+        this.bridge = bridge;
+        this.storage = storage;
+    }
+    /** Read the current anonymous ID, generating + persisting on first call. */
+    ensureAnonymousId() {
+        const existing = this.storage.read();
+        if (existing)
+            return existing;
+        const fresh = generateAnonymousId();
+        this.storage.write(fresh);
+        return fresh;
+    }
+    /**
+     * Push the anonymous ID into the BridgeFlags global eval context. Idempotent.
+     * No-op if a known userId is already set.
+     */
+    hydrateAnonymous() {
+        if (this.knownUserId)
+            return this.knownUserId;
+        const anonId = this.ensureAnonymousId();
+        this.bridge.setContext({ identity: anonId, attributes: {} }, true);
+        return anonId;
+    }
+    /**
+     * Promote the SDK from anonymous to known. Updates the global identity in
+     * `BridgeFlags` and fires the `onIdentify` hook so the server can link
+     * anon-id telemetry to the known user's history.
+     */
+    identify(userId) {
+        if (!userId)
+            throw new Error('identify(userId): userId must be a non-empty string');
+        const previousAnon = this.knownUserId ? undefined : this.storage.read();
+        this.knownUserId = userId;
+        this.bridge.setContext({ identity: userId, attributes: {} }, true);
+        if (this.onIdentifyHook) {
+            try {
+                this.onIdentifyHook({ anonymousId: previousAnon, userId });
+            }
+            catch {
+                // Hook errors must not break identify().
+            }
+        }
+    }
+    /**
+     * Drop the known identity and revert to anonymous. Used on logout. The
+     * anonymous ID itself is preserved unless `dropAnonymous` is also passed.
+     */
+    logout(options = {}) {
+        this.knownUserId = undefined;
+        if (options.dropAnonymous)
+            this.storage.clear();
+        this.hydrateAnonymous();
+    }
+    /** Register a one-time hook fired on identify(). Used by the SDK telemetry batcher. */
+    setOnIdentify(hook) {
+        this.onIdentifyHook = hook;
+    }
+    /** True when `identify()` has set a known user. */
+    isKnown() {
+        return !!this.knownUserId;
+    }
+    /** Read the current effective identity (known userId or anonymous ID). */
+    current() {
+        if (this.knownUserId)
+            return this.knownUserId;
+        return this.storage.read();
+    }
+}
+/**
+ * Factory: attach an anonymous-aware identity manager to a `BridgeFlags`
+ * instance. Pass a storage implementation appropriate for the platform.
+ */
+export function attachIdentity(bridge, storage) {
+    const identity = new BridgeIdentity(bridge, storage);
+    // Eagerly populate context.identity so anonymous evals work from boot.
+    identity.hydrateAnonymous();
+    return identity;
+}
+//# sourceMappingURL=identity.js.map

package/dist/flags/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/flags/identity.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,qCAAqC;AACrC,EAAE;AACF,2EAA2E;AAC3E,sEAAsE;AACtE,0DAA0D;AAC1D,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2DAA2D;AAsB3D,0EAA0E;AAC1E,MAAM,OAAO,qBAAqB;IACvB,IAAI,CAAwB;IAC7B,KAAK,CAAqB;IAElC,YAAY,OAA8B,MAAM;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,KAAK,CAAC,EAAU;QACd,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,UAAU,mBAAmB;IACjC,iDAAiD;IACjD,MAAM,CAAC,GAAQ,UAAiB,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC1D,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,yFAAyF;IACzF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpG,OAAO,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AACvH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAON;IACA;IAPnB,4EAA4E;IACpE,cAAc,CAA4D;IAClF,uFAAuF;IAC/E,WAAW,CAAU;IAE7B,YACmB,MAAmB,EACnB,OAAwB;QADxB,WAAM,GAAN,MAAM,CAAa;QACnB,YAAO,GAAP,OAAO,CAAiB;IACxC,CAAC;IAEJ,4EAA4E;IAC5E,iBAAiB;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,gBAAgB;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,MAAc;QACrB,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACpF,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,yCAAyC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,UAAuC,EAAE;QAC9C,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,OAAO,CAAC,aAAa;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAChD,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,uFAAuF;IACvF,aAAa,CAAC,IAA8D;QAC1E,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,mDAAmD;IACnD,OAAO;QACL,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,0EAA0E;IAC1E,OAAO;QACL,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAmB,EAAE,OAAwB;IAC1E,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/flags/index.d.ts

@@ -0,0 +1,20 @@
+export { OPERATORS, OPERATOR_VERSION, CONDITIONS_PER_RULE_MAX, isOperator, isOperatorValidForType, validOperatorsForType, evaluateCondition, validateConditions, } from './operators.js';
+export type { Operator, AttributeType, Condition, ConditionValue, ValidationError, } from './operators.js';
+export { bucket, evaluateBranch, evaluateRule, resolveAttribute, validateRule, } from './evaluator.js';
+export type { Branch, Rule, FlagState, EvalContext, EvalResult, RuleValidationError, } from './evaluator.js';
+export { BridgeFlags } from './flag.js';
+export type { CachedFlag, FlagEvalResult, FlagValueType, EvalTelemetry, DiscoveryTelemetry, BridgeFlagsHooks, DeclaredAttributeType, AttributeDeclaration, BridgeFlagsMode, FlagUsageReporterLike, } from './flag.js';
+export { BridgeIdentity, MemoryIdentityStorage, attachIdentity, generateAnonymousId, } from './identity.js';
+export type { AnonymousTrackingMode, IdentityStorage, } from './identity.js';
+export { AttributeProviderRegistry, AuthAttributeProvider, BillingAttributeProvider, } from './attribute-providers.js';
+export type { AttributeProvider, AuthJwtClaims, AuthProviderConfig, BillingSnapshot, BillingProviderConfig, BillingProviderStores, } from './attribute-providers.js';
+export { DevAttributeProvider } from './dev-attribute-provider.js';
+export type { AttributeGetter, AttributeBulkGetter, SetOptions as AttributesSetOptions, } from './dev-attribute-provider.js';
+export { BridgePullCache } from './runtime-mode.js';
+export type { BridgeRuntimeMode, PullCacheOptions } from './runtime-mode.js';
+export { TelemetryBatcher } from './telemetry.js';
+export type { TelemetryBatcherConfig } from './telemetry.js';
+export { RealtimeClient } from './realtime.js';
+export type { RealtimeClientConfig, RealtimeMessage, FlagUpdateMessage, FlagRemovedMessage, UserStateMessage, SubscriptionPlanChangedMessage, BillingLifecycleMessage, QuotaUpdatedMessage, EntitlementsChangedMessage, SessionSnapshotMessage, ConnectionState, WebSocketLike, } from './realtime.js';
+export { BRIDGE_CONTEXT_HEADER, serializeContext, deserializeContext, serverInstanceId, } from './propagation.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/flags/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/flags/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,QAAQ,EACR,aAAa,EACb,SAAS,EACT,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,MAAM,EACN,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,MAAM,EACN,IAAI,EACJ,SAAS,EACT,WAAW,EACX,UAAU,EACV,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,YAAY,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,qBAAqB,EACrB,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,UAAU,IAAI,oBAAoB,GACnC,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAG7D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,eAAe,EACf,aAAa,GACd,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/flags/index.js

@@ -0,0 +1,21 @@
+export { OPERATORS, OPERATOR_VERSION, CONDITIONS_PER_RULE_MAX, isOperator, isOperatorValidForType, validOperatorsForType, evaluateCondition, validateConditions, } from './operators.js';
+// Rule + branches + evaluator (TBP-160, TBP-158)
+export { bucket, evaluateBranch, evaluateRule, resolveAttribute, validateRule, } from './evaluator.js';
+// SDK API: bridge.flag(key, default) with type inference (TBP-160)
+export { BridgeFlags } from './flag.js';
+// Identity: anonymous ID + `identify` (TBP-168, TBP-169)
+export { BridgeIdentity, MemoryIdentityStorage, attachIdentity, generateAnonymousId, } from './identity.js';
+// AttributeProvider plugin model (TBP-173)
+export { AttributeProviderRegistry, AuthAttributeProvider, BillingAttributeProvider, } from './attribute-providers.js';
+// Phase 5 (TBP-328/329/330) — dev-managed AttributeProvider backing the
+// `bridge.attributes` write surface in framework SDKs.
+export { DevAttributeProvider } from './dev-attribute-provider.js';
+// Phase 6 (TBP-290/340) — runtime mode + pull-mode cache for backend SDKs.
+export { BridgePullCache } from './runtime-mode.js';
+// SDK telemetry batcher (TBP-157)
+export { TelemetryBatcher } from './telemetry.js';
+// SDK realtime client (TBP-150)
+export { RealtimeClient } from './realtime.js';
+// FE → BE context propagation (TBP-171) + server-instance ID (TBP-172)
+export { BRIDGE_CONTEXT_HEADER, serializeContext, deserializeContext, serverInstanceId, } from './propagation.js';
+//# sourceMappingURL=index.js.map

package/dist/flags/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/flags/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAUxB,iDAAiD;AACjD,OAAO,EACL,MAAM,EACN,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,gBAAgB,CAAC;AAWxB,mEAAmE;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAcxC,yDAAyD;AACzD,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAMvB,2CAA2C;AAC3C,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAUlC,wEAAwE;AACxE,uDAAuD;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAOnE,2EAA2E;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,gCAAgC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgB/C,uEAAuE;AACvE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}