@vercel/flags-core 1.5.0-dde2adb-20260526050633 → 1.5.0

package/dist/{chunk-CX2U3ZTN.js → chunk-WTGXBSWR.js}

@@ -482,7 +482,7 @@ function findWeightedIndex(weights, value, maxValue) {
 }
 
 // package.json
-var version = "1.5.0-dde2adb-20260526050633";
+var version = "1.5.0";
 
 // src/lib/report-value.ts
 function internalReportValue(key, value, data) {
@@ -759,7 +759,7 @@ function hashSdkKey(sdkKey) {
   sdkKeyHashCache.set(sdkKey, promise);
   return promise;
 }
-async function readBundledDefinitions(sdkKey) {
+async function readBundledDefinitions(auth) {
   let get;
   try {
     const module = await import(
@@ -776,10 +776,20 @@ async function readBundledDefinitions(sdkKey) {
   if (typeof get !== "function") {
     return { definitions: null, state: "missing-file" };
   }
-  const entry = get(sdkKey);
+  let lookup;
+  try {
+    lookup = await auth.resolveBundledDefinitionsLookup();
+  } catch (error) {
+    return { definitions: null, state: "unexpected-error", error };
+  }
+  if (lookup.type === "project-id") {
+    const entry2 = get(lookup.projectId);
+    return entry2 ? { definitions: entry2, state: "ok" } : { definitions: null, state: "missing-entry" };
+  }
+  const entry = get(lookup.sdkKey);
   if (entry) return { definitions: entry, state: "ok" };
   try {
-    const hashedKey = await hashSdkKey(sdkKey);
+    const hashedKey = await hashSdkKey(lookup.sdkKey);
     const hashedEntry = get(hashedKey);
     if (hashedEntry) return { definitions: hashedEntry, state: "ok" };
   } catch (error) {
@@ -950,13 +960,14 @@ var UsageTracker = class {
     const flushId = ++this.flushCounter;
     for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
       try {
+        const token = await this.options.auth.resolveToken();
         const response = await this.options.fetch(
           `${this.options.host}/v1/ingest`,
           {
             method: "POST",
             headers: {
               "Content-Type": "application/json",
-              Authorization: `Bearer ${this.options.sdkKey}`,
+              Authorization: `Bearer ${token}`,
               "User-Agent": `VercelFlagsCore/${version}`,
               ...process.env.VERCEL_ENV ? { "X-Vercel-Env": process.env.VERCEL_ENV } : null,
               ...isDebugMode ? { "x-vercel-debug-ingest": "1" } : null
@@ -1008,11 +1019,10 @@ var FallbackEntryNotFoundError = class extends Error {
 
 // src/controller/bundled-source.ts
 var BundledSource = class {
-  promise;
-  options;
   constructor(options) {
     this.options = options;
   }
+  promise;
   /**
    * Load bundled definitions.
    * Throws if bundled definitions are not available.
@@ -1057,7 +1067,7 @@ var BundledSource = class {
   }
   getResult() {
     if (!this.promise) {
-      this.promise = this.options.readBundledDefinitions(this.options.sdkKey);
+      this.promise = this.options.readBundledDefinitions(this.options.auth);
     }
     return this.promise;
   }
@@ -1066,6 +1076,7 @@ var BundledSource = class {
 // src/controller/fetch-datafile.ts
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function fetchDatafile(options) {
+  const token = await options.auth.resolveToken();
   const controller = new AbortController();
   const timeoutId = setTimeout(
     () => controller.abort(),
@@ -1082,7 +1093,7 @@ async function fetchDatafile(options) {
   try {
     const res = await options.fetch(`${options.host}/v1/datafile`, {
       headers: {
-        Authorization: `Bearer ${options.sdkKey}`,
+        Authorization: `Bearer ${token}`,
         "User-Agent": `VercelFlagsCore/${version}`,
         ...process.env.VERCEL_ENV ? { "X-Vercel-Env": process.env.VERCEL_ENV } : null
       },
@@ -1139,7 +1150,7 @@ function normalizeOptions(options) {
     };
   }
   return {
-    sdkKey: options.sdkKey,
+    auth: options.auth,
     datafile: options.datafile,
     stream,
     polling,
@@ -1249,13 +1260,14 @@ var UnauthorizedError = class extends Error {
     this.name = "UnauthorizedError";
   }
 };
+var TokenResolutionError = class extends Error {
+  constructor(error) {
+    super("stream: token resolution failed", { cause: error });
+    this.name = "TokenResolutionError";
+  }
+};
 async function connectStream(config, callbacks) {
-  const {
-    host,
-    sdkKey,
-    abortController,
-    fetch: fetchFn = globalThis.fetch
-  } = config;
+  const { host, abortController, fetch: fetchFn = globalThis.fetch } = config;
   const { onDatafile, onPrimed, onDisconnect } = callbacks;
   let retryCount = 0;
   let lastAttemptTime = 0;
@@ -1296,8 +1308,11 @@ async function connectStream(config, callbacks) {
       };
       try {
         lastAttemptTime = Date.now();
+        const token = await config.resolveToken().catch((error) => {
+          throw new TokenResolutionError(error);
+        });
         const headers = {
-          Authorization: `Bearer ${sdkKey}`,
+          Authorization: `Bearer ${token}`,
           "User-Agent": `VercelFlagsCore/${version}`,
           "X-Retry-Attempt": String(retryCount)
         };
@@ -1403,6 +1418,11 @@ async function connectStream(config, callbacks) {
         if (abortController.signal.aborted) {
           break;
         }
+        if (error instanceof TokenResolutionError && !initialDataReceived) {
+          rejectInit(error.cause);
+          abortController.abort();
+          break;
+        }
         if (!connectionAbort.signal.aborted) {
           console.error("@vercel/flags-core: Stream error", error);
         }
@@ -1454,7 +1474,7 @@ var StreamSource = class extends TypedEmitter {
       const promise = connectStream(
         {
           host: this.options.host,
-          sdkKey: this.options.sdkKey,
+          resolveToken: () => this.options.auth.resolveToken(),
           abortController,
           fetch: this.options.fetch,
           revision: this.revision
@@ -1541,11 +1561,6 @@ var Controller = class {
   // Suppresses usage tracking when the SDK key is unauthorized
   unauthorized = false;
   constructor(options) {
-    if (!options.sdkKey || typeof options.sdkKey !== "string" || !options.sdkKey.startsWith("vf_")) {
-      throw new Error(
-        '@vercel/flags-core: SDK key must be a string starting with "vf_"'
-      );
-    }
     this.options = normalizeOptions(options);
     this.streamSource = new StreamSource(
       this.options,
@@ -1553,7 +1568,7 @@ var Controller = class {
     );
     this.pollingSource = new PollingSource(this.options);
     this.bundledSource = new BundledSource({
-      sdkKey: this.options.sdkKey,
+      auth: this.options.auth,
       readBundledDefinitions
     });
     this.wireSourceEvents();
@@ -1753,7 +1768,7 @@ var Controller = class {
         try {
           const fetched = await fetchDatafile({
             host: this.options.host,
-            sdkKey: this.options.sdkKey,
+            auth: this.options.auth,
             fetch: this.options.fetch
           });
           this.data = tagData(fetched, "fetched");
@@ -1949,7 +1964,7 @@ var Controller = class {
     try {
       const fetched = await fetchDatafile({
         host: this.options.host,
-        sdkKey: this.options.sdkKey,
+        auth: this.options.auth,
         fetch: this.options.fetch
       });
       return tagData(fetched, "fetched");
@@ -1981,7 +1996,7 @@ var Controller = class {
       try {
         const fetched = await fetchDatafile({
           host: this.options.host,
-          sdkKey: this.options.sdkKey,
+          auth: this.options.auth,
           fetch: this.options.fetch
         });
         this.data = tagData(fetched, "fetched");
@@ -2033,7 +2048,7 @@ var Controller = class {
       try {
         const fetched = await fetchDatafile({
           host: this.options.host,
-          sdkKey: this.options.sdkKey,
+          auth: this.options.auth,
           fetch: this.options.fetch
         });
         this.data = tagData(fetched, "fetched");
@@ -2106,6 +2121,9 @@ var Controller = class {
   }
 };
 
+// src/controller/auth.ts
+import { getVercelOidcToken } from "@vercel/oidc";
+
 // src/utils/sdk-keys.ts
 var SDK_KEY_REGEX = /^vf_(?:server|client)_/;
 function parseSdkKeyFromFlagsConnectionString(text) {
@@ -2120,28 +2138,80 @@ function parseSdkKeyFromFlagsConnectionString(text) {
   return null;
 }
 
+// src/controller/auth.ts
+async function getOidcToken() {
+  try {
+    return await getVercelOidcToken();
+  } catch {
+    throw new Error(
+      [
+        "@vercel/flags-core: Failed to get OIDC token.",
+        "Are you running in a Vercel Environment where OIDC tokens are available?",
+        "Did you mean to use an SDK Key instead? Use the environment variable FLAGS or pass it directly to the client."
+      ].join(" ")
+    );
+  }
+}
+function getProjectIdFromOidcToken(oidcToken) {
+  const tokenParts = oidcToken.split(".");
+  if (tokenParts.length !== 3 || !tokenParts[1]) {
+    throw new Error("@vercel/flags-core: Invalid OIDC token");
+  }
+  const payload = JSON.parse(
+    Buffer.from(tokenParts[1], "base64url").toString("utf8")
+  );
+  if (typeof payload.project_id !== "string" || !payload.project_id) {
+    throw new Error(
+      "@vercel/flags-core: Missing project_id claim in OIDC token"
+    );
+  }
+  return payload.project_id;
+}
+var Authentication = class {
+  sdkKey;
+  constructor(sdkKeyOrConnectionString) {
+    if (sdkKeyOrConnectionString !== void 0) {
+      if (typeof sdkKeyOrConnectionString !== "string") {
+        throw new Error(
+          `@vercel/flags-core: Invalid sdkKey. Expected string, got ${typeof sdkKeyOrConnectionString}`
+        );
+      }
+      const parsed = parseSdkKeyFromFlagsConnectionString(
+        sdkKeyOrConnectionString
+      );
+      if (!parsed) {
+        throw new Error("@vercel/flags-core: Missing sdkKey");
+      }
+      this.sdkKey = parsed;
+    }
+  }
+  async resolveToken() {
+    if (this.sdkKey) {
+      return this.sdkKey;
+    }
+    return await getOidcToken();
+  }
+  async resolveBundledDefinitionsLookup() {
+    if (this.sdkKey) {
+      return { type: "sdk-key", sdkKey: this.sdkKey };
+    }
+    const oidcToken = await this.resolveToken();
+    return {
+      type: "project-id",
+      projectId: getProjectIdFromOidcToken(oidcToken)
+    };
+  }
+};
+
 // src/index.make.ts
 function make(createRawClient) {
   let _defaultFlagsClient = null;
   function createClient2(sdkKeyOrConnectionString, options) {
-    if (!sdkKeyOrConnectionString)
-      throw new Error("@vercel/flags-core: Missing sdkKey");
-    if (typeof sdkKeyOrConnectionString !== "string")
-      throw new Error(
-        `@vercel/flags-core: Invalid sdkKey. Expected string, got ${typeof sdkKeyOrConnectionString}`
-      );
-    const sdkKey = parseSdkKeyFromFlagsConnectionString(
-      sdkKeyOrConnectionString
-    );
-    if (!sdkKey) {
-      throw new Error(
-        "@vercel/flags-core: Missing sdkKey in connection string"
-      );
-    }
-    const controller = new Controller({ sdkKey, ...options });
+    const auth = new Authentication(sdkKeyOrConnectionString);
+    const controller = new Controller({ auth, ...options });
     return createRawClient({
       controller,
-      origin: { provider: "vercel", sdkKey }
+      origin: { provider: "vercel", sdkKey: auth.sdkKey }
     });
   }
   function resetDefaultFlagsClient2() {
@@ -2150,14 +2220,7 @@ function make(createRawClient) {
   const flagsClient2 = new Proxy({}, {
     get(_, prop) {
       if (!_defaultFlagsClient) {
-        if (!process.env.FLAGS) {
-          throw new Error("flags: Missing environment variable FLAGS");
-        }
-        const sdkKey = parseSdkKeyFromFlagsConnectionString(process.env.FLAGS);
-        if (!sdkKey) {
-          throw new Error("@vercel/flags-core: Missing sdkKey");
-        }
-        _defaultFlagsClient = createClient2(sdkKey);
+        _defaultFlagsClient = createClient2(process.env.FLAGS);
       }
       return _defaultFlagsClient[prop];
     }
@@ -2198,4 +2261,4 @@ export {
   resetDefaultFlagsClient,
   createClient
 };
-//# sourceMappingURL=chunk-CX2U3ZTN.js.map
+//# sourceMappingURL=chunk-WTGXBSWR.js.map