@vercel/flags-core 1.5.0-dde2adb-20260526050633 → 1.5.0

package/CHANGELOG.md

@@ -1,10 +1,10 @@
 # @vercel/flags-core
 
-## 1.5.0-dde2adb-20260526050633
+## 1.5.0
 
 ### Minor Changes
 
-- [#385](https://github.com/vercel/flags/pull/385) [`5b2dc37`](https://github.com/vercel/flags/commit/5b2dc37041e24811f735beede41fc8c29f508cb7) Thanks [@dferber90](https://github.com/dferber90)! - Add `bulkEvaluate` method to `FlagsClient` for resolving multiple flags against shared entities in a single call.
+- [#385](https://github.com/vercel/flags/pull/385) [`201f9d5`](https://github.com/vercel/flags/commit/201f9d5988d7fc307511e35638e66769d38cedb3) Thanks [@dferber90](https://github.com/dferber90)! - Add `bulkEvaluate` method to `FlagsClient` for resolving multiple flags against shared entities in a single call.
 
   ```ts
   const results = await client.bulkEvaluate(
@@ -29,6 +29,14 @@
   processes. When all retry attempts are exhausted the SDK now logs a structured
   warning so consumers can alert on dropped batches.
 
+- [#390](https://github.com/vercel/flags/pull/390) [`7b5ea9a`](https://github.com/vercel/flags/commit/7b5ea9a808dfd4155bd2bbf321c3b44ec730cda6) Thanks [@luismeyer](https://github.com/luismeyer)! - Add OIDC authentication support for Vercel Flags clients and generated flag definitions.
+
+  `@vercel/flags-core` can now create clients without an SDK key and authenticate with a Vercel OIDC token, while still supporting SDK keys and connection strings. Bundled definitions can be looked up by SDK key hash or OIDC project ID.
+
+  `@vercel/prepare-flags-definitions` now collects both SDK keys and `VERCEL_OIDC_TOKEN`, fetches definitions for each auth entry, deduplicates identical definitions across SDK keys and OIDC project IDs, and writes generated maps keyed by SDK key hash or project ID.
+
+  `@flags-sdk/vercel` now supports provider data lookup for Vercel flag origins that do not include an SDK key, allowing OIDC-backed clients to resolve project metadata.
+
 ### Patch Changes
 
 - [#382](https://github.com/vercel/flags/pull/382) [`4d90e91`](https://github.com/vercel/flags/commit/4d90e912a4d7c9d4ef986d5e8dc609c30b203242) Thanks [@dferber90](https://github.com/dferber90)! - Speed up flag evaluation on the hot path.

package/dist/{chunk-XINPOF5O.cjs → chunk-CSSU7O2G.cjs}

@@ -467,7 +467,7 @@ function findWeightedIndex(weights, value, maxValue) {
 }
 
 // package.json
-var version = "1.5.0-dde2adb-20260526050633";
+var version = "1.5.0";
 
 // src/lib/report-value.ts
 function internalReportValue(key, value, data) {
@@ -744,7 +744,7 @@ function hashSdkKey(sdkKey) {
   sdkKeyHashCache.set(sdkKey, promise);
   return promise;
 }
-async function readBundledDefinitions(sdkKey) {
+async function readBundledDefinitions(auth) {
   let get;
   try {
     const module = await Promise.resolve().then(() => _interopRequireWildcard(require(
@@ -761,10 +761,20 @@ async function readBundledDefinitions(sdkKey) {
   if (typeof get !== "function") {
     return { definitions: null, state: "missing-file" };
   }
-  const entry = get(sdkKey);
+  let lookup;
+  try {
+    lookup = await auth.resolveBundledDefinitionsLookup();
+  } catch (error) {
+    return { definitions: null, state: "unexpected-error", error };
+  }
+  if (lookup.type === "project-id") {
+    const entry2 = get(lookup.projectId);
+    return entry2 ? { definitions: entry2, state: "ok" } : { definitions: null, state: "missing-entry" };
+  }
+  const entry = get(lookup.sdkKey);
   if (entry) return { definitions: entry, state: "ok" };
   try {
-    const hashedKey = await hashSdkKey(sdkKey);
+    const hashedKey = await hashSdkKey(lookup.sdkKey);
     const hashedEntry = get(hashedKey);
     if (hashedEntry) return { definitions: hashedEntry, state: "ok" };
   } catch (error) {
@@ -935,13 +945,14 @@ var UsageTracker = (_class = class {
     const flushId = ++this.flushCounter;
     for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
       try {
+        const token = await this.options.auth.resolveToken();
         const response = await this.options.fetch(
           `${this.options.host}/v1/ingest`,
           {
             method: "POST",
             headers: {
               "Content-Type": "application/json",
-              Authorization: `Bearer ${this.options.sdkKey}`,
+              Authorization: `Bearer ${token}`,
               "User-Agent": `VercelFlagsCore/${version}`,
               ...process.env.VERCEL_ENV ? { "X-Vercel-Env": process.env.VERCEL_ENV } : null,
               ...isDebugMode ? { "x-vercel-debug-ingest": "1" } : null
@@ -993,11 +1004,10 @@ var FallbackEntryNotFoundError = class extends Error {
 
 // src/controller/bundled-source.ts
 var BundledSource = class {
-  
-  
   constructor(options) {
     this.options = options;
   }
+  
   /**
    * Load bundled definitions.
    * Throws if bundled definitions are not available.
@@ -1042,7 +1052,7 @@ var BundledSource = class {
   }
   getResult() {
     if (!this.promise) {
-      this.promise = this.options.readBundledDefinitions(this.options.sdkKey);
+      this.promise = this.options.readBundledDefinitions(this.options.auth);
     }
     return this.promise;
   }
@@ -1051,6 +1061,7 @@ var BundledSource = class {
 // src/controller/fetch-datafile.ts
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function fetchDatafile(options) {
+  const token = await options.auth.resolveToken();
   const controller = new AbortController();
   const timeoutId = setTimeout(
     () => controller.abort(),
@@ -1067,7 +1078,7 @@ async function fetchDatafile(options) {
   try {
     const res = await options.fetch(`${options.host}/v1/datafile`, {
       headers: {
-        Authorization: `Bearer ${options.sdkKey}`,
+        Authorization: `Bearer ${token}`,
         "User-Agent": `VercelFlagsCore/${version}`,
         ...process.env.VERCEL_ENV ? { "X-Vercel-Env": process.env.VERCEL_ENV } : null
       },
@@ -1124,7 +1135,7 @@ function normalizeOptions(options) {
     };
   }
   return {
-    sdkKey: options.sdkKey,
+    auth: options.auth,
     datafile: options.datafile,
     stream,
     polling,
@@ -1234,13 +1245,14 @@ var UnauthorizedError = class extends Error {
     this.name = "UnauthorizedError";
   }
 };
+var TokenResolutionError = class extends Error {
+  constructor(error) {
+    super("stream: token resolution failed", { cause: error });
+    this.name = "TokenResolutionError";
+  }
+};
 async function connectStream(config, callbacks) {
-  const {
-    host,
-    sdkKey,
-    abortController,
-    fetch: fetchFn = globalThis.fetch
-  } = config;
+  const { host, abortController, fetch: fetchFn = globalThis.fetch } = config;
   const { onDatafile, onPrimed, onDisconnect } = callbacks;
   let retryCount = 0;
   let lastAttemptTime = 0;
@@ -1281,8 +1293,11 @@ async function connectStream(config, callbacks) {
       };
       try {
         lastAttemptTime = Date.now();
+        const token = await config.resolveToken().catch((error) => {
+          throw new TokenResolutionError(error);
+        });
         const headers = {
-          Authorization: `Bearer ${sdkKey}`,
+          Authorization: `Bearer ${token}`,
           "User-Agent": `VercelFlagsCore/${version}`,
           "X-Retry-Attempt": String(retryCount)
         };
@@ -1388,6 +1403,11 @@ async function connectStream(config, callbacks) {
         if (abortController.signal.aborted) {
           break;
         }
+        if (error instanceof TokenResolutionError && !initialDataReceived) {
+          rejectInit(error.cause);
+          abortController.abort();
+          break;
+        }
         if (!connectionAbort.signal.aborted) {
           console.error("@vercel/flags-core: Stream error", error);
         }
@@ -1439,7 +1459,7 @@ var StreamSource = class extends TypedEmitter {
       const promise = connectStream(
         {
           host: this.options.host,
-          sdkKey: this.options.sdkKey,
+          resolveToken: () => this.options.auth.resolveToken(),
           abortController,
           fetch: this.options.fetch,
           revision: this.revision
@@ -1526,11 +1546,6 @@ var Controller = (_class3 = class {
   // Suppresses usage tracking when the SDK key is unauthorized
   __init11() {this.unauthorized = false}
   constructor(options) {;_class3.prototype.__init5.call(this);_class3.prototype.__init6.call(this);_class3.prototype.__init7.call(this);_class3.prototype.__init8.call(this);_class3.prototype.__init9.call(this);_class3.prototype.__init10.call(this);_class3.prototype.__init11.call(this);_class3.prototype.__init12.call(this);_class3.prototype.__init13.call(this);_class3.prototype.__init14.call(this);_class3.prototype.__init15.call(this);_class3.prototype.__init16.call(this);_class3.prototype.__init17.call(this);
-    if (!options.sdkKey || typeof options.sdkKey !== "string" || !options.sdkKey.startsWith("vf_")) {
-      throw new Error(
-        '@vercel/flags-core: SDK key must be a string starting with "vf_"'
-      );
-    }
     this.options = normalizeOptions(options);
     this.streamSource = new StreamSource(
       this.options,
@@ -1538,7 +1553,7 @@ var Controller = (_class3 = class {
     );
     this.pollingSource = new PollingSource(this.options);
     this.bundledSource = new BundledSource({
-      sdkKey: this.options.sdkKey,
+      auth: this.options.auth,
       readBundledDefinitions
     });
     this.wireSourceEvents();
@@ -1738,7 +1753,7 @@ var Controller = (_class3 = class {
         try {
           const fetched = await fetchDatafile({
             host: this.options.host,
-            sdkKey: this.options.sdkKey,
+            auth: this.options.auth,
             fetch: this.options.fetch
           });
           this.data = tagData(fetched, "fetched");
@@ -1934,7 +1949,7 @@ var Controller = (_class3 = class {
     try {
       const fetched = await fetchDatafile({
         host: this.options.host,
-        sdkKey: this.options.sdkKey,
+        auth: this.options.auth,
         fetch: this.options.fetch
       });
       return tagData(fetched, "fetched");
@@ -1966,7 +1981,7 @@ var Controller = (_class3 = class {
       try {
         const fetched = await fetchDatafile({
           host: this.options.host,
-          sdkKey: this.options.sdkKey,
+          auth: this.options.auth,
           fetch: this.options.fetch
         });
         this.data = tagData(fetched, "fetched");
@@ -2018,7 +2033,7 @@ var Controller = (_class3 = class {
       try {
         const fetched = await fetchDatafile({
           host: this.options.host,
-          sdkKey: this.options.sdkKey,
+          auth: this.options.auth,
           fetch: this.options.fetch
         });
         this.data = tagData(fetched, "fetched");
@@ -2091,6 +2106,9 @@ var Controller = (_class3 = class {
   }
 }, _class3);
 
+// src/controller/auth.ts
+var _oidc = require('@vercel/oidc');
+
 // src/utils/sdk-keys.ts
 var SDK_KEY_REGEX = /^vf_(?:server|client)_/;
 function parseSdkKeyFromFlagsConnectionString(text) {
@@ -2105,28 +2123,80 @@ function parseSdkKeyFromFlagsConnectionString(text) {
   return null;
 }
 
+// src/controller/auth.ts
+async function getOidcToken() {
+  try {
+    return await _oidc.getVercelOidcToken.call(void 0, );
+  } catch (e15) {
+    throw new Error(
+      [
+        "@vercel/flags-core: Failed to get OIDC token.",
+        "Are you running in a Vercel Environment where OIDC tokens are available?",
+        "Did you mean to use an SDK Key instead? Use the environment variable FLAGS or pass it directly to the client."
+      ].join(" ")
+    );
+  }
+}
+function getProjectIdFromOidcToken(oidcToken) {
+  const tokenParts = oidcToken.split(".");
+  if (tokenParts.length !== 3 || !tokenParts[1]) {
+    throw new Error("@vercel/flags-core: Invalid OIDC token");
+  }
+  const payload = JSON.parse(
+    Buffer.from(tokenParts[1], "base64url").toString("utf8")
+  );
+  if (typeof payload.project_id !== "string" || !payload.project_id) {
+    throw new Error(
+      "@vercel/flags-core: Missing project_id claim in OIDC token"
+    );
+  }
+  return payload.project_id;
+}
+var Authentication = class {
+  
+  constructor(sdkKeyOrConnectionString) {
+    if (sdkKeyOrConnectionString !== void 0) {
+      if (typeof sdkKeyOrConnectionString !== "string") {
+        throw new Error(
+          `@vercel/flags-core: Invalid sdkKey. Expected string, got ${typeof sdkKeyOrConnectionString}`
+        );
+      }
+      const parsed = parseSdkKeyFromFlagsConnectionString(
+        sdkKeyOrConnectionString
+      );
+      if (!parsed) {
+        throw new Error("@vercel/flags-core: Missing sdkKey");
+      }
+      this.sdkKey = parsed;
+    }
+  }
+  async resolveToken() {
+    if (this.sdkKey) {
+      return this.sdkKey;
+    }
+    return await getOidcToken();
+  }
+  async resolveBundledDefinitionsLookup() {
+    if (this.sdkKey) {
+      return { type: "sdk-key", sdkKey: this.sdkKey };
+    }
+    const oidcToken = await this.resolveToken();
+    return {
+      type: "project-id",
+      projectId: getProjectIdFromOidcToken(oidcToken)
+    };
+  }
+};
+
 // src/index.make.ts
 function make(createRawClient) {
   let _defaultFlagsClient = null;
   function createClient2(sdkKeyOrConnectionString, options) {
-    if (!sdkKeyOrConnectionString)
-      throw new Error("@vercel/flags-core: Missing sdkKey");
-    if (typeof sdkKeyOrConnectionString !== "string")
-      throw new Error(
-        `@vercel/flags-core: Invalid sdkKey. Expected string, got ${typeof sdkKeyOrConnectionString}`
-      );
-    const sdkKey = parseSdkKeyFromFlagsConnectionString(
-      sdkKeyOrConnectionString
-    );
-    if (!sdkKey) {
-      throw new Error(
-        "@vercel/flags-core: Missing sdkKey in connection string"
-      );
-    }
-    const controller = new Controller({ sdkKey, ...options });
+    const auth = new Authentication(sdkKeyOrConnectionString);
+    const controller = new Controller({ auth, ...options });
     return createRawClient({
       controller,
-      origin: { provider: "vercel", sdkKey }
+      origin: { provider: "vercel", sdkKey: auth.sdkKey }
     });
   }
   function resetDefaultFlagsClient2() {
@@ -2135,14 +2205,7 @@ function make(createRawClient) {
   const flagsClient2 = new Proxy({}, {
     get(_, prop) {
       if (!_defaultFlagsClient) {
-        if (!process.env.FLAGS) {
-          throw new Error("flags: Missing environment variable FLAGS");
-        }
-        const sdkKey = parseSdkKeyFromFlagsConnectionString(process.env.FLAGS);
-        if (!sdkKey) {
-          throw new Error("@vercel/flags-core: Missing sdkKey");
-        }
-        _defaultFlagsClient = createClient2(sdkKey);
+        _defaultFlagsClient = createClient2(process.env.FLAGS);
       }
       return _defaultFlagsClient[prop];
     }
@@ -2159,7 +2222,7 @@ function setCacheLife() {
   try {
     _cache.cacheLife.call(void 0, { revalidate: 0, expire: 0 });
     _cache.cacheLife.call(void 0, { stale: 60 });
-  } catch (e15) {
+  } catch (e16) {
   }
 }
 var cachedFns = {
@@ -2208,4 +2271,4 @@ var { flagsClient, resetDefaultFlagsClient, createClient } = make(
 
 
 exports.ResolutionReason = ResolutionReason; exports.evaluate = evaluate; exports.FallbackNotFoundError = FallbackNotFoundError; exports.FallbackEntryNotFoundError = FallbackEntryNotFoundError; exports.Controller = Controller; exports.flagsClient = flagsClient; exports.resetDefaultFlagsClient = resetDefaultFlagsClient; exports.createClient = createClient;
-//# sourceMappingURL=chunk-XINPOF5O.cjs.map
+//# sourceMappingURL=chunk-CSSU7O2G.cjs.map