@vercel/flags-core 1.10.3 → 1.11.0-31e6462-20261026142820

package/CHANGELOG.md

@@ -1,19 +1,15 @@
 # @vercel/flags-core
 
-## 1.10.3
+## 1.11.0-31e6462-20261026142820
 
-### Patch Changes
-
-- [#578](https://github.com/vercel/flags/pull/578) [`63d13be`](https://github.com/vercel/flags/commit/63d13be0193102a4f0cbcbf48e7f67efad96a462) Thanks [@luismeyer](https://github.com/luismeyer)! - Fail fast on authentication errors. When the stream gets a 401 or no OIDC token is available, the client no longer falls back to polling, which would fail the same way, and goes straight to revalidating over HTTP on reads. When polling is the primary source, its first auth failure stops it, and a missing OIDC token is no longer retried. A failed OIDC token refresh is still retried. A client without credentials no longer keeps scripts and test files running.
+### Minor Changes
 
-## 1.10.2
+- [#539](https://github.com/vercel/flags/pull/539) [`fc7da82`](https://github.com/vercel/flags/commit/fc7da82d4cffb9d4662335e984e09fec22ba4a6b) Thanks [@vincent-derks](https://github.com/vincent-derks)! - Add a `projectId` option to read the flags of a connected project.
 
 ### Patch Changes
 
 - [#567](https://github.com/vercel/flags/pull/567) [`5f738f0`](https://github.com/vercel/flags/commit/5f738f08f182838d0efb13fd3efb89751d48cb0a) Thanks [@vincent-derks](https://github.com/vincent-derks)! - Improve guidance for authorization errors.
 
-- [#573](https://github.com/vercel/flags/pull/573) [`e2a1a39`](https://github.com/vercel/flags/commit/e2a1a394e3de4b271c8305bae6cbcf053814ab70) Thanks [@luismeyer](https://github.com/luismeyer)! - Read embedded flag definitions when the client is created, using the SDK key or `VERCEL_PROJECT_ID` in OIDC mode.
-
 ## 1.10.1
 
 ### Patch Changes

package/README.md

@@ -33,6 +33,18 @@ export default app;
 
 Outside Vercel, pass an SDK key explicitly: `createClient(process.env.FLAGS)`.
 
+### Read a connected project's flags
+
+Grant your project access from the source project's **Flags → Connections** page, then create a client with the source project's ID:
+
+```ts
+const sharedClient = createClient({ projectId: 'prj_source' });
+```
+
+The client uses your project's OIDC token. Both projects must belong to the same team. Connections apply across environments; the token selects the source environment, with custom environments mapped to preview. Run `vercel env pull` in your project for local development. The `projectId` option cannot be combined with an SDK key.
+
+See [Project Connections](https://vercel.com/docs/flags/vercel-flags/project-connections) for permissions and setup.
+
 ## Header-driven reads on Vercel
 
 When `VERCEL=1`, the client defaults to `vercel: true`. Initialization loads provided

package/dist/{chunk-EGGUENXP.cjs → chunk-J73HQYK2.cjs}

@@ -559,7 +559,7 @@ function bulkEvaluate(flags, shared) {
 }
 
 // package.json
-var version = "1.10.3";
+var version = "1.11.0-31e6462-20261026142820";
 
 // src/lib/report-value.ts
 function internalReportValue(key, value, data) {
@@ -1063,6 +1063,10 @@ var _oidc = require('@vercel/oidc');
 
 // src/utils/sdk-keys.ts
 var SDK_KEY_REGEX = /^vf_(?:server|client)_/;
+var PROJECT_ID_REGEX = /^[A-Za-z0-9_]{1,64}$/;
+function isValidProjectId(value) {
+  return PROJECT_ID_REGEX.test(value);
+}
 function parseSdkKeyFromFlagsConnectionString(text) {
   if (SDK_KEY_REGEX.test(text)) return text;
   try {
@@ -1089,26 +1093,17 @@ function unauthorizedMessage(sourceProjectId) {
   }
   return `unauthorized (401): this deployment is not allowed to read the flags of project "${sourceProjectId}". Check that the project is connected. See https://vercel.com/docs/flags/vercel-flags/project-connections`;
 }
-var oidcTokenMessage = [
-  "@vercel/flags-core: Failed to get OIDC token.",
-  "Are you running in a Vercel Environment where OIDC tokens are available?",
-  "Did you mean to use an SDK Key instead? Use the environment variable FLAGS or pass it directly to the client."
-].join(" ");
-var missingCredentials = /`vc link|vercel login|^The 'x-vercel-oidc-token' header is missing from the request\.$/;
-var OidcTokenError = class extends Error {
-  constructor(cause) {
-    super(oidcTokenMessage, { cause });
-    this.name = "OidcTokenError";
-  }
-};
 async function getOidcToken() {
   try {
     return await _oidc.getVercelOidcToken.call(void 0, );
-  } catch (error) {
-    if (error instanceof Error && missingCredentials.test(error.message)) {
-      throw new OidcTokenError(error);
-    }
-    throw new Error(oidcTokenMessage, { cause: error });
+  } catch (e7) {
+    throw new Error(
+      [
+        "@vercel/flags-core: Failed to get OIDC token.",
+        "Are you running in a Vercel Environment where OIDC tokens are available?",
+        "Did you mean to use an SDK Key instead? Use the environment variable FLAGS or pass it directly to the client."
+      ].join(" ")
+    );
   }
 }
 function getProjectIdFromOidcToken(oidcToken) {
@@ -1129,7 +1124,21 @@ function getProjectIdFromOidcToken(oidcToken) {
 var Authentication = class {
   
   
-  constructor(sdkKeyOrConnectionString) {
+  constructor(sdkKeyOrConnectionString, options = {}) {
+    if (options.projectId !== void 0) {
+      if (typeof options.projectId !== "string" || !isValidProjectId(options.projectId)) {
+        throw new Error(
+          `@vercel/flags-core: Invalid projectId "${options.projectId}". Expected a project id like "prj_\u2026" (letters, digits and underscores, up to 64 characters)`
+        );
+      }
+      if (sdkKeyOrConnectionString !== void 0) {
+        throw new Error(
+          "@vercel/flags-core: projectId cannot be combined with an SDK key. Connected projects are read with the OIDC token of this deployment."
+        );
+      }
+      this.sourceProjectId = options.projectId;
+      return;
+    }
     if (sdkKeyOrConnectionString !== void 0) {
       if (typeof sdkKeyOrConnectionString !== "string") {
         throw new Error(
@@ -1151,24 +1160,13 @@ var Authentication = class {
     }
     return await getOidcToken();
   }
-  getStaticBundledDefinitionsLookup() {
+  async resolveBundledDefinitionsLookup() {
     if (this.sdkKey) {
       return { type: "sdk-key", sdkKey: this.sdkKey };
     }
     if (this.sourceProjectId) {
       return { type: "project-id", projectId: this.sourceProjectId };
     }
-    const projectId = process.env.VERCEL_PROJECT_ID;
-    if (projectId) {
-      return { type: "project-id", projectId };
-    }
-    return void 0;
-  }
-  async resolveBundledDefinitionsLookup() {
-    const lookup = this.getStaticBundledDefinitionsLookup();
-    if (lookup) {
-      return lookup;
-    }
     const oidcToken = await this.resolveToken();
     return {
       type: "project-id",
@@ -1238,7 +1236,7 @@ function getRuntimeIngest() {
   try {
     const context = globalThis[FLAGS_CONTEXT_SYMBOL];
     return typeof _optionalChain([context, 'optionalAccess', _34 => _34.ingest]) === "function" ? context.ingest : void 0;
-  } catch (e7) {
+  } catch (e8) {
     return void 0;
   }
 }
@@ -1256,7 +1254,7 @@ async function getEvaluatingOidcToken(auth) {
   if (!auth.sdkKey) return void 0;
   try {
     return await _oidc.getVercelOidcToken.call(void 0, );
-  } catch (e8) {
+  } catch (e9) {
     return void 0;
   }
 }
@@ -1368,7 +1366,7 @@ var Scheduler = (_class = class {
       })();
       try {
         this.scheduleTask(this.pending);
-      } catch (e9) {
+      } catch (e10) {
       }
       this.maxTimeout = setTimeout(
         () => this.resolveScheduledFlush("max_timeout"),
@@ -1595,7 +1593,7 @@ var UsageTracker = (_class4 = class {
       void flush.finally(() => this.inflightFlushes.delete(flush));
       try {
         _optionalChain([this, 'access', _37 => _37.waitUntil, 'optionalCall', _38 => _38(flush)]);
-      } catch (e10) {
+      } catch (e11) {
       }
     } else {
       this.scheduler.scheduleFlush();
@@ -1678,13 +1676,6 @@ var BundledSource = class {
     }
     return void 0;
   }
-  /**
-   * Starts reading bundled definitions without waiting for the result.
-   */
-  preload() {
-    this.getResult().catch(() => {
-    });
-  }
   getResult() {
     if (!this.promise) {
       this.promise = this.options.readBundledDefinitions(this.options.auth);
@@ -1700,7 +1691,7 @@ function debug(clientName, event, details) {
   }
   try {
     console.debug("@vercel/flags-core", { event, clientName, ..._optionalChain([details, 'optionalCall', _40 => _40()]) });
-  } catch (e11) {
+  } catch (e12) {
   }
 }
 
@@ -2039,7 +2030,7 @@ var DatafileCache = (_class5 = class {
     });
     try {
       this.waitUntil(background);
-    } catch (e12) {
+    } catch (e13) {
     }
   }
   /** Resets storage, age, and the failure deadline so a restarted client begins clean. */
@@ -2152,8 +2143,7 @@ async function fetchDatafile(options) {
         return await Promise.race([fetchAttempt(attempt + 1), aborted]);
       } catch (error) {
         signal.throwIfAborted();
-        if (attempt === maxAttempts - 1 || error instanceof DatafileHttpError && !error.retryable || // Retrying will not produce a token that is not there.
-        error instanceof OidcTokenError) {
+        if (attempt === maxAttempts - 1 || error instanceof DatafileHttpError && !error.retryable) {
           throw error instanceof Error ? error : new Error("Unknown fetch error");
         }
         debug(options.clientName, "datafile.fetch.retry", () => ({
@@ -2571,7 +2561,7 @@ async function connectStream(config, callbacks) {
             rejectInit(error);
           }
           _optionalChain([onDisconnect, 'optionalCall', _97 => _97()]);
-          abortController.abort(error);
+          abortController.abort();
           break;
         }
         if (!response.ok) {
@@ -2607,7 +2597,7 @@ async function connectStream(config, callbacks) {
               let message;
               try {
                 message = JSON.parse(line);
-              } catch (e13) {
+              } catch (e14) {
                 console.warn(
                   "@vercel/flags-core: Failed to parse stream message, skipping"
                 );
@@ -2673,7 +2663,7 @@ async function connectStream(config, callbacks) {
         }
         if (error instanceof TokenResolutionError && !initialDataReceived) {
           rejectInit(error.cause);
-          abortController.abort(error.cause);
+          abortController.abort();
           break;
         }
         if (connectionAbort.signal.reason !== PING_TIMEOUT) {
@@ -2747,7 +2737,7 @@ var StreamSource = (_class9 = class extends TypedEmitter {
         if (this.abortController === abortController) {
           this.promise = void 0;
           this.abortController = void 0;
-          this.emit("exhausted", abortController.signal.reason);
+          this.emit("exhausted");
         }
       },
       { once: true }
@@ -2808,7 +2798,7 @@ var UNKNOWN_FRESHNESS = {
   assess: () => ({ status: "unknown" })
 };
 function isUnauthorizedError(error) {
-  if (error instanceof UnauthorizedError || error instanceof OidcTokenError) {
+  if (error instanceof UnauthorizedError) {
     return true;
   }
   if (!(error instanceof Error)) {
@@ -2843,9 +2833,8 @@ var Controller = (_class10 = class {
   // Build-step deduplication
   __init23() {this.buildDataPromise = null}
   __init24() {this.buildReadTracked = false}
-  // Suppresses usage tracking while the credential is rejected or no OIDC
-  // token is available. Set on an auth failure from any source, cleared as
-  // soon as a source delivers data again.
+  // Suppresses usage tracking while the credential is rejected. Set on a 401
+  // from any source, cleared as soon as a source delivers data again.
   __init25() {this.unauthorized = false}
   constructor(options) {;_class10.prototype.__init18.call(this);_class10.prototype.__init19.call(this);_class10.prototype.__init20.call(this);_class10.prototype.__init21.call(this);_class10.prototype.__init22.call(this);_class10.prototype.__init23.call(this);_class10.prototype.__init24.call(this);_class10.prototype.__init25.call(this);_class10.prototype.__init26.call(this);_class10.prototype.__init27.call(this);_class10.prototype.__init28.call(this);_class10.prototype.__init29.call(this);_class10.prototype.__init30.call(this);_class10.prototype.__init31.call(this);_class10.prototype.__init32.call(this);_class10.prototype.__init33.call(this);_class10.prototype.__init34.call(this);
     this.options = normalizeOptions(options);
@@ -2882,9 +2871,6 @@ var Controller = (_class10 = class {
       auth: this.options.auth,
       readBundledDefinitions
     });
-    if (!this.options.datafile && this.options.auth.getStaticBundledDefinitionsLookup()) {
-      this.bundledSource.preload();
-    }
     this.wireSourceEvents();
     if (this.options.datafile) {
       this.cache.seed(tagData({ ...this.options.datafile }, "provided"));
@@ -2941,16 +2927,10 @@ var Controller = (_class10 = class {
       this.transition("degraded", "stream-disconnected");
     }
   }}
-  __init31() {this.onStreamExhausted = (reason) => {
+  __init31() {this.onStreamExhausted = () => {
     if (this.state !== "streaming" && this.state !== "degraded") {
       return;
     }
-    if (isUnauthorizedError(reason)) {
-      if (this.state === "streaming") {
-        this.transition("degraded", "stream-auth-failed");
-      }
-      return;
-    }
     void this.activateFallbackSource().catch(() => {
     });
   }}
@@ -2962,7 +2942,7 @@ var Controller = (_class10 = class {
     this.onSourceError(error);
     if (this.state === "polling" && isUnauthorizedError(error)) {
       this.pollingSource.stop();
-      this.transition("degraded", "polling-auth-failed");
+      this.transition("degraded", "polling-unauthorized");
     }
   }}
   // ---------------------------------------------------------------------------
@@ -3091,7 +3071,7 @@ var Controller = (_class10 = class {
       try {
         const bundled = await this.bundledSource.tryLoad();
         if (bundled) this.cache.seed(tagData({ ...bundled }, "bundled"));
-      } catch (e14) {
+      } catch (e15) {
       }
     }
     if (this.headerSource.isEnabled()) {
@@ -3276,7 +3256,7 @@ var Controller = (_class10 = class {
     }
     try {
       await this.cache.refresh();
-    } catch (e15) {
+    } catch (e16) {
       throw this.noDefinitionsError(
         ". Initialize the client or provide a datafile."
       );
@@ -3372,10 +3352,6 @@ var Controller = (_class10 = class {
         this.transition("degraded", "stream-still-connecting");
         return;
       }
-      if (outcome === "auth-failed") {
-        this.transition("degraded", "stream-auth-failed");
-        return;
-      }
     }
     if (this.options.polling.enabled) {
       if (this.state !== "polling") {
@@ -3408,7 +3384,7 @@ var Controller = (_class10 = class {
         return "connected";
       } catch (error) {
         this.noteUnauthorized(error);
-        return isUnauthorizedError(error) ? "auth-failed" : "failed";
+        return "failed";
       }
     }
     let timeoutId;
@@ -3442,7 +3418,7 @@ var Controller = (_class10 = class {
     } catch (error) {
       clearTimeout(timeoutId);
       this.noteUnauthorized(error);
-      return isUnauthorizedError(error) ? "auth-failed" : "failed";
+      return "failed";
     }
   }
   // ---------------------------------------------------------------------------
@@ -3593,7 +3569,7 @@ var Controller = (_class10 = class {
         this.acceptLastResortFetch(await this.fetchOnce());
         this.transition("degraded", "fetched-fallback");
         return;
-      } catch (e16) {
+      } catch (e17) {
       }
     }
     throw this.noDefinitionsError(". Bundled definitions not found.");
@@ -3638,7 +3614,7 @@ var Controller = (_class10 = class {
       let fetched;
       try {
         fetched = await this.fetchOnce();
-      } catch (e17) {
+      } catch (e18) {
       }
       if (fetched) {
         const remote = this.acceptLastResortFetch(fetched);
@@ -3704,8 +3680,8 @@ function make(createRawClient, defaults) {
     const optionsOnly = typeof sdkKeyOrConnectionStringOrOptions === "object" && sdkKeyOrConnectionStringOrOptions !== null;
     const sdkKeyOrConnectionString = optionsOnly ? void 0 : sdkKeyOrConnectionStringOrOptions;
     const createClientOptions = optionsOnly ? sdkKeyOrConnectionStringOrOptions : options;
-    const { experimental_reportExposures, ...controllerOptions } = _nullishCoalesce(createClientOptions, () => ( {}));
-    const auth = new Authentication(sdkKeyOrConnectionString);
+    const { experimental_reportExposures, projectId, ...controllerOptions } = _nullishCoalesce(createClientOptions, () => ( {}));
+    const auth = new Authentication(sdkKeyOrConnectionString, { projectId });
     const waitUntil2 = _nullishCoalesce(controllerOptions.waitUntil, () => ( defaults.waitUntil));
     const controller = new Controller({
       auth,
@@ -3746,7 +3722,7 @@ function setCacheLife() {
   try {
     _cache.cacheLife.call(void 0, { revalidate: 0, expire: 0 });
     _cache.cacheLife.call(void 0, { stale: 60 });
-  } catch (e18) {
+  } catch (e19) {
   }
 }
 var cachedFns = {
@@ -3796,4 +3772,4 @@ var { flagsClient, resetDefaultFlagsClient, createClient } = make(
 
 
 exports.ResolutionReason = ResolutionReason; exports.evaluate = evaluate; exports.FallbackNotFoundError = FallbackNotFoundError; exports.FallbackEntryNotFoundError = FallbackEntryNotFoundError; exports.Controller = Controller; exports.flagsClient = flagsClient; exports.resetDefaultFlagsClient = resetDefaultFlagsClient; exports.createClient = createClient;
-//# sourceMappingURL=chunk-EGGUENXP.cjs.map
+//# sourceMappingURL=chunk-J73HQYK2.cjs.map