@vercel/flags-core 1.11.0-31e6462-20261026142820 → 1.11.0

package/CHANGELOG.md

@@ -1,15 +1,25 @@
 # @vercel/flags-core
 
-## 1.11.0-31e6462-20261026142820
+## 1.11.0
 
 ### Minor Changes
 
-- [#539](https://github.com/vercel/flags/pull/539) [`fc7da82`](https://github.com/vercel/flags/commit/fc7da82d4cffb9d4662335e984e09fec22ba4a6b) Thanks [@vincent-derks](https://github.com/vincent-derks)! - Add a `projectId` option to read the flags of a connected project.
+- [#539](https://github.com/vercel/flags/pull/539) [`24983f9`](https://github.com/vercel/flags/commit/24983f90eec9789fbed1a7a556d41070218aecb6) Thanks [@vincent-derks](https://github.com/vincent-derks)! - Prepare for upcoming Vercel Flags Project Connections with a new `projectId` option.
+
+## 1.10.3
+
+### Patch Changes
+
+- [#578](https://github.com/vercel/flags/pull/578) [`63d13be`](https://github.com/vercel/flags/commit/63d13be0193102a4f0cbcbf48e7f67efad96a462) Thanks [@luismeyer](https://github.com/luismeyer)! - Fail fast on authentication errors. When the stream gets a 401 or no OIDC token is available, the client no longer falls back to polling, which would fail the same way, and goes straight to revalidating over HTTP on reads. When polling is the primary source, its first auth failure stops it, and a missing OIDC token is no longer retried. A failed OIDC token refresh is still retried. A client without credentials no longer keeps scripts and test files running.
+
+## 1.10.2
 
 ### Patch Changes
 
 - [#567](https://github.com/vercel/flags/pull/567) [`5f738f0`](https://github.com/vercel/flags/commit/5f738f08f182838d0efb13fd3efb89751d48cb0a) Thanks [@vincent-derks](https://github.com/vincent-derks)! - Improve guidance for authorization errors.
 
+- [#573](https://github.com/vercel/flags/pull/573) [`e2a1a39`](https://github.com/vercel/flags/commit/e2a1a394e3de4b271c8305bae6cbcf053814ab70) Thanks [@luismeyer](https://github.com/luismeyer)! - Read embedded flag definitions when the client is created, using the SDK key or `VERCEL_PROJECT_ID` in OIDC mode.
+
 ## 1.10.1
 
 ### Patch Changes

package/dist/{chunk-WMVRYZBA.js → chunk-755SFCGD.js}

@@ -576,7 +576,7 @@ function bulkEvaluate(flags, shared) {
 }
 
 // package.json
-var version = "1.11.0-31e6462-20261026142820";
+var version = "1.11.0";
 
 // src/lib/report-value.ts
 function internalReportValue(key, value, data) {
@@ -1110,17 +1110,26 @@ function unauthorizedMessage(sourceProjectId) {
   }
   return `unauthorized (401): this deployment is not allowed to read the flags of project "${sourceProjectId}". Check that the project is connected. See https://vercel.com/docs/flags/vercel-flags/project-connections`;
 }
+var oidcTokenMessage = [
+  "@vercel/flags-core: Failed to get OIDC token.",
+  "Are you running in a Vercel Environment where OIDC tokens are available?",
+  "Did you mean to use an SDK Key instead? Use the environment variable FLAGS or pass it directly to the client."
+].join(" ");
+var missingCredentials = /`vc link|vercel login|^The 'x-vercel-oidc-token' header is missing from the request\.$/;
+var OidcTokenError = class extends Error {
+  constructor(cause) {
+    super(oidcTokenMessage, { cause });
+    this.name = "OidcTokenError";
+  }
+};
 async function getOidcToken() {
   try {
     return await getVercelOidcToken();
-  } catch {
-    throw new Error(
-      [
-        "@vercel/flags-core: Failed to get OIDC token.",
-        "Are you running in a Vercel Environment where OIDC tokens are available?",
-        "Did you mean to use an SDK Key instead? Use the environment variable FLAGS or pass it directly to the client."
-      ].join(" ")
-    );
+  } catch (error) {
+    if (error instanceof Error && missingCredentials.test(error.message)) {
+      throw new OidcTokenError(error);
+    }
+    throw new Error(oidcTokenMessage, { cause: error });
   }
 }
 function getProjectIdFromOidcToken(oidcToken) {
@@ -1177,13 +1186,24 @@ var Authentication = class {
     }
     return await getOidcToken();
   }
-  async resolveBundledDefinitionsLookup() {
+  getStaticBundledDefinitionsLookup() {
     if (this.sdkKey) {
       return { type: "sdk-key", sdkKey: this.sdkKey };
     }
     if (this.sourceProjectId) {
       return { type: "project-id", projectId: this.sourceProjectId };
     }
+    const projectId = process.env.VERCEL_PROJECT_ID;
+    if (projectId) {
+      return { type: "project-id", projectId };
+    }
+    return void 0;
+  }
+  async resolveBundledDefinitionsLookup() {
+    const lookup = this.getStaticBundledDefinitionsLookup();
+    if (lookup) {
+      return lookup;
+    }
     const oidcToken = await this.resolveToken();
     return {
       type: "project-id",
@@ -1693,6 +1713,13 @@ var BundledSource = class {
     }
     return void 0;
   }
+  /**
+   * Starts reading bundled definitions without waiting for the result.
+   */
+  preload() {
+    this.getResult().catch(() => {
+    });
+  }
   getResult() {
     if (!this.promise) {
       this.promise = this.options.readBundledDefinitions(this.options.auth);
@@ -2160,7 +2187,8 @@ async function fetchDatafile(options) {
         return await Promise.race([fetchAttempt(attempt + 1), aborted]);
       } catch (error) {
         signal.throwIfAborted();
-        if (attempt === maxAttempts - 1 || error instanceof DatafileHttpError && !error.retryable) {
+        if (attempt === maxAttempts - 1 || error instanceof DatafileHttpError && !error.retryable || // Retrying will not produce a token that is not there.
+        error instanceof OidcTokenError) {
           throw error instanceof Error ? error : new Error("Unknown fetch error");
         }
         debug(options.clientName, "datafile.fetch.retry", () => ({
@@ -2578,7 +2606,7 @@ async function connectStream(config, callbacks) {
             rejectInit(error);
           }
           onDisconnect?.();
-          abortController.abort();
+          abortController.abort(error);
           break;
         }
         if (!response.ok) {
@@ -2680,7 +2708,7 @@ async function connectStream(config, callbacks) {
         }
         if (error instanceof TokenResolutionError && !initialDataReceived) {
           rejectInit(error.cause);
-          abortController.abort();
+          abortController.abort(error.cause);
           break;
         }
         if (connectionAbort.signal.reason !== PING_TIMEOUT) {
@@ -2754,7 +2782,7 @@ var StreamSource = class extends TypedEmitter {
         if (this.abortController === abortController) {
           this.promise = void 0;
           this.abortController = void 0;
-          this.emit("exhausted");
+          this.emit("exhausted", abortController.signal.reason);
         }
       },
       { once: true }
@@ -2815,7 +2843,7 @@ var UNKNOWN_FRESHNESS = {
   assess: () => ({ status: "unknown" })
 };
 function isUnauthorizedError(error) {
-  if (error instanceof UnauthorizedError) {
+  if (error instanceof UnauthorizedError || error instanceof OidcTokenError) {
     return true;
   }
   if (!(error instanceof Error)) {
@@ -2850,8 +2878,9 @@ var Controller = class {
   // Build-step deduplication
   buildDataPromise = null;
   buildReadTracked = false;
-  // Suppresses usage tracking while the credential is rejected. Set on a 401
-  // from any source, cleared as soon as a source delivers data again.
+  // Suppresses usage tracking while the credential is rejected or no OIDC
+  // token is available. Set on an auth failure from any source, cleared as
+  // soon as a source delivers data again.
   unauthorized = false;
   constructor(options) {
     this.options = normalizeOptions(options);
@@ -2888,6 +2917,9 @@ var Controller = class {
       auth: this.options.auth,
       readBundledDefinitions
     });
+    if (!this.options.datafile && this.options.auth.getStaticBundledDefinitionsLookup()) {
+      this.bundledSource.preload();
+    }
     this.wireSourceEvents();
     if (this.options.datafile) {
       this.cache.seed(tagData({ ...this.options.datafile }, "provided"));
@@ -2944,10 +2976,16 @@ var Controller = class {
       this.transition("degraded", "stream-disconnected");
     }
   };
-  onStreamExhausted = () => {
+  onStreamExhausted = (reason) => {
     if (this.state !== "streaming" && this.state !== "degraded") {
       return;
     }
+    if (isUnauthorizedError(reason)) {
+      if (this.state === "streaming") {
+        this.transition("degraded", "stream-auth-failed");
+      }
+      return;
+    }
     void this.activateFallbackSource().catch(() => {
     });
   };
@@ -2959,7 +2997,7 @@ var Controller = class {
     this.onSourceError(error);
     if (this.state === "polling" && isUnauthorizedError(error)) {
       this.pollingSource.stop();
-      this.transition("degraded", "polling-unauthorized");
+      this.transition("degraded", "polling-auth-failed");
     }
   };
   // ---------------------------------------------------------------------------
@@ -3369,6 +3407,10 @@ var Controller = class {
         this.transition("degraded", "stream-still-connecting");
         return;
       }
+      if (outcome === "auth-failed") {
+        this.transition("degraded", "stream-auth-failed");
+        return;
+      }
     }
     if (this.options.polling.enabled) {
       if (this.state !== "polling") {
@@ -3401,7 +3443,7 @@ var Controller = class {
         return "connected";
       } catch (error) {
         this.noteUnauthorized(error);
-        return "failed";
+        return isUnauthorizedError(error) ? "auth-failed" : "failed";
       }
     }
     let timeoutId;
@@ -3435,7 +3477,7 @@ var Controller = class {
     } catch (error) {
       clearTimeout(timeoutId);
       this.noteUnauthorized(error);
-      return "failed";
+      return isUnauthorizedError(error) ? "auth-failed" : "failed";
     }
   }
   // ---------------------------------------------------------------------------
@@ -3763,4 +3805,4 @@ export {
   resetDefaultFlagsClient,
   createClient
 };
-//# sourceMappingURL=chunk-WMVRYZBA.js.map
+//# sourceMappingURL=chunk-755SFCGD.js.map