flagmint-js-sdk 2.2.1 → 2.2.2

package/README.md

@@ -162,7 +162,7 @@ transportMode: 'long-polling'   // POST evaluate on an interval
 
 # Connection sharing
 
-Used when the same app is embedded twice on one origin (for example two WeSeeDo iframes in a host page).
+Used when the same app is embedded twice on one origin (for example two iframes in a host page).
 
 - **Leader** performs handshake and holds EventSource.
 - **Followers** receive flag snapshots over `BroadcastChannel` (`flagmint-share:<apiKey>`). Leadership is a `localStorage` lock (`flagmint_share_lock:<apiKey>`).

package/dist/flagmint.cjs.js

@@ -39093,7 +39093,7 @@ class SseTransport {
     this.connectPromise = new Promise((resolve, reject) => {
       this.connectResolve = resolve;
       this.connectReject = reject;
-      const sdkVersion = "2.2.1";
+      const sdkVersion = "2.2.2";
       const platform2 = typeof window !== "undefined" ? "browser" : "nodejs";
       const wrapperName = this.configOptions?.wrapper?.name || "native-js";
       const wrapperVersion = this.configOptions?.wrapper?.version || "none";
@@ -41779,7 +41779,7 @@ function expand2(hash3, prk, info, length = 32) {
 const hkdf = (hash3, ikm, salt, info, length) => expand2(hash3, extract(hash3, ikm, salt), info, length);
 const ASL_HKDF_INFO = "flagmint-asl-config-sync-mac-v1";
 const ASL_KEY_AGREEMENT = "x25519-hkdf-sha256";
-const textEncoder$1 = new TextEncoder();
+const textEncoder$2 = new TextEncoder();
 function generateAslClientKeyPair() {
   const privateKey = x25519.utils.randomSecretKey();
   const publicKey = x25519.getPublicKey(privateKey);
@@ -41810,7 +41810,7 @@ function deriveAslMacKey(input) {
     sha256,
     shared,
     salt,
-    textEncoder$1.encode(ASL_HKDF_INFO),
+    textEncoder$2.encode(ASL_HKDF_INFO),
     32
   );
   return { configMacKey };
@@ -41820,7 +41820,7 @@ function wipeKeyMaterial(key2) {
     return;
   key2.fill(0);
 }
-const textEncoder = new TextEncoder();
+const textEncoder$1 = new TextEncoder();
 function canonicalizeForSigning(value) {
   return JSON.stringify(sortValue(value));
 }
@@ -41837,12 +41837,12 @@ function sortValue(value) {
   return sorted;
 }
 function normalizeMacKey(secret2) {
-  return typeof secret2 === "string" ? textEncoder.encode(secret2) : secret2;
+  return typeof secret2 === "string" ? textEncoder$1.encode(secret2) : secret2;
 }
 function signConfigPayload(body, secret2) {
   const { signature: _ignored, ...unsigned } = body;
   const canonical = canonicalizeForSigning(unsigned);
-  const mac = hmac2(sha256, normalizeMacKey(secret2), textEncoder.encode(canonical));
+  const mac = hmac2(sha256, normalizeMacKey(secret2), textEncoder$1.encode(canonical));
   return bytesToHex$1(mac);
 }
 function timingSafeEqualBytes(a, b) {
@@ -41864,13 +41864,107 @@ function verifyConfigPayloadSignature(body, secret2) {
   } catch {
     return false;
   }
-  const a = textEncoder.encode(body.signature);
-  const b = textEncoder.encode(expected);
+  const a = textEncoder$1.encode(body.signature);
+  const b = textEncoder$1.encode(expected);
   return timingSafeEqualBytes(a, b);
 }
 function isConfigPayloadExpired(expiresAt, now = Date.now()) {
   return !Number.isFinite(expiresAt) || now >= expiresAt;
 }
+const PII_VALUE_ENCODING = "hmac-v1";
+const textEncoder = new TextEncoder();
+function normalizePiiString(value) {
+  return value.trim().toLowerCase();
+}
+function hashPiiValue(value, salt) {
+  const mac = hmac2(
+    sha256,
+    textEncoder.encode(salt),
+    textEncoder.encode(normalizePiiString(value))
+  );
+  return bytesToHex$1(mac);
+}
+function isPiiAttribute(attribute, piiAttributes) {
+  if (!attribute || piiAttributes.length === 0)
+    return false;
+  const attr = attribute.trim();
+  if (!attr)
+    return false;
+  for (const key2 of piiAttributes) {
+    if (!key2)
+      continue;
+    if (attr === key2)
+      return true;
+    if (attr.endsWith(`.${key2}`))
+      return true;
+  }
+  return false;
+}
+function payloadHasExplicitPiiFields(payload) {
+  if (!payload)
+    return false;
+  return payload.piiSalt !== void 0 || payload.piiAttributes !== void 0 || payload.piiValueEncoding !== void 0;
+}
+function piiWireOptionsFromPayload(payload) {
+  if (!payload)
+    return null;
+  const salt = typeof payload.piiSalt === "string" ? payload.piiSalt : "";
+  if (!salt)
+    return null;
+  const encoding = typeof payload.piiValueEncoding === "string" ? payload.piiValueEncoding : PII_VALUE_ENCODING;
+  if (encoding !== PII_VALUE_ENCODING)
+    return null;
+  const attrs = Array.isArray(payload.piiAttributes) ? payload.piiAttributes.filter((k) => typeof k === "string") : [];
+  return {
+    piiAttributes: attrs,
+    piiSalt: salt,
+    piiValueEncoding: PII_VALUE_ENCODING
+  };
+}
+function resolvePiiWireForDelta(previous, action) {
+  if (!payloadHasExplicitPiiFields(action)) {
+    return previous;
+  }
+  const merged = {
+    piiSalt: action.piiSalt !== void 0 ? action.piiSalt : previous?.piiSalt,
+    piiAttributes: action.piiAttributes !== void 0 ? action.piiAttributes : previous?.piiAttributes,
+    piiValueEncoding: action.piiValueEncoding !== void 0 ? action.piiValueEncoding : previous?.piiValueEncoding
+  };
+  return piiWireOptionsFromPayload(merged);
+}
+function applyPiiHashToFlatContext(context, options, mode) {
+  if (!options || !options.piiSalt || !options.piiAttributes.length || options.piiValueEncoding !== PII_VALUE_ENCODING) {
+    return context;
+  }
+  if (mode?.alreadyHashed) {
+    return context;
+  }
+  let changed = false;
+  const out = { ...context };
+  for (const [key2, value] of Object.entries(context)) {
+    if (!isPiiAttribute(key2, options.piiAttributes))
+      continue;
+    if (typeof value === "string") {
+      out[key2] = hashPiiValue(value, options.piiSalt);
+      changed = true;
+      continue;
+    }
+    if (Array.isArray(value)) {
+      let arrayChanged = false;
+      const next = value.map((entry) => {
+        if (typeof entry !== "string")
+          return entry;
+        arrayChanged = true;
+        return hashPiiValue(entry, options.piiSalt);
+      });
+      if (arrayChanged) {
+        out[key2] = next;
+        changed = true;
+      }
+    }
+  }
+  return changed ? out : context;
+}
 function createEmptyRulesState() {
   return {
     version: 0,
@@ -41878,7 +41972,8 @@ function createEmptyRulesState() {
     flags: /* @__PURE__ */ new Map(),
     segments: /* @__PURE__ */ new Map(),
     ready: false,
-    needsFullConfig: true
+    needsFullConfig: true,
+    piiWire: null
   };
 }
 function cloneState(state) {
@@ -41888,7 +41983,12 @@ function cloneState(state) {
     flags: new Map(state.flags),
     segments: new Map(state.segments),
     ready: state.ready,
-    needsFullConfig: state.needsFullConfig
+    needsFullConfig: state.needsFullConfig,
+    piiWire: state.piiWire ? {
+      piiAttributes: [...state.piiWire.piiAttributes],
+      piiSalt: state.piiWire.piiSalt,
+      piiValueEncoding: state.piiWire.piiValueEncoding
+    } : null
   };
 }
 function segmentsFromRecord(record) {
@@ -41921,7 +42021,8 @@ function hydrateFromFull(action) {
     flags,
     segments: segmentsFromRecord(action.segments),
     ready: true,
-    needsFullConfig: false
+    needsFullConfig: false,
+    piiWire: piiWireOptionsFromPayload(action)
   };
 }
 function applyPatch(state, action) {
@@ -41933,13 +42034,15 @@ function applyPatch(state, action) {
     if (flag?.key)
       flags.set(flag.key, flag);
   }
+  const nextPii = resolvePiiWireForDelta(state.piiWire, action);
   return {
     version: action.toVersion,
     expiresAt: typeof action.expiresAt === "number" ? action.expiresAt : state.expiresAt,
     flags,
     segments: applySegmentUpserts(state.segments, action.segments),
     ready: true,
-    needsFullConfig: false
+    needsFullConfig: false,
+    piiWire: nextPii
   };
 }
 function reduceRules(state, action, now = Date.now()) {
@@ -42116,11 +42219,17 @@ class RulesStore {
     this.state.segments.forEach((segment, id) => {
       segments[id] = segment;
     });
+    const pii = this.state.piiWire;
     return {
       version: this.state.version,
       expiresAt: this.state.expiresAt,
       flags: Array.from(this.state.flags.values()),
-      segments
+      segments,
+      ...pii ? {
+        piiAttributes: [...pii.piiAttributes],
+        piiSalt: pii.piiSalt,
+        piiValueEncoding: pii.piiValueEncoding
+      } : {}
     };
   }
   hydrateFromSnapshot(snapshot, now = Date.now()) {
@@ -42136,7 +42245,8 @@ class RulesStore {
       flags,
       segments: segmentsFromRecord(snapshot.segments),
       ready: !expired && flags.size > 0,
-      needsFullConfig: expired || flags.size === 0
+      needsFullConfig: expired || flags.size === 0,
+      piiWire: piiWireOptionsFromPayload(snapshot)
     };
   }
 }
@@ -42338,7 +42448,7 @@ function flattenEvaluationContext(context) {
 function toComparableString(value) {
   if (value === null || value === void 0)
     return "";
-  return String(value);
+  return String(value).trim().toLowerCase();
 }
 function toComparableArray(value) {
   if (Array.isArray(value)) {
@@ -42900,8 +43010,13 @@ function prepareContextForEvaluator(context) {
   }
   return context;
 }
-function evaluateSdkFlag(flag, context, segments) {
-  const evalContext = prepareContextForEvaluator(context);
+function prepareContextForLocalEval(context, pii) {
+  const prepared = prepareContextForEvaluator(context);
+  const flat = flattenEvaluationContext(prepared);
+  return applyPiiHashToFlatContext(flat, pii);
+}
+function evaluateSdkFlag(flag, context, segments, pii) {
+  const evalContext = prepareContextForLocalEval(context, pii);
   const variationsById = {};
   for (const v of flag.variations || []) {
     if (v?.id)
@@ -42961,7 +43076,7 @@ function evaluateSdkFlag(flag, context, segments) {
 }
 function evaluateAllSdkFlags(flags, context, segments, options) {
   const list = flags instanceof Map ? Array.from(flags.values()) : flags;
-  const prepared = prepareContextForEvaluator(context);
+  const prepared = prepareContextForLocalEval(context, options?.pii);
   const out = {};
   for (const flag of list) {
     if (!flag?.key)
@@ -42970,7 +43085,7 @@ function evaluateAllSdkFlags(flags, context, segments, options) {
       out[flag.key] = coerceType(flag.default_value, flag.type);
       continue;
     }
-    out[flag.key] = evaluateSdkFlag(flag, prepared, segments);
+    out[flag.key] = evaluateSdkFlag(flag, prepared, segments, null);
   }
   return out;
 }
@@ -43415,7 +43530,8 @@ class FlagClient {
         value = evaluateSdkFlag(
           flag,
           this.context,
-          this.rulesStore.getState().segments
+          this.rulesStore.getState().segments,
+          this.rulesStore.getState().piiWire
         ) ?? fallback;
       }
     } else {
@@ -43895,7 +44011,7 @@ class FlagClient {
       state.flags,
       context ?? this.context,
       state.segments,
-      { failClosedDefaultsOnly: failClosed }
+      { failClosedDefaultsOnly: failClosed, pii: state.piiWire }
     );
   }
   analyticsMapFromRulesStore() {
@@ -44024,6 +44140,7 @@ exports.FlagClient = FlagClient;
 exports.LongPollingTransport = LongPollingTransport;
 exports.RulesStore = RulesStore;
 exports.SseTransport = SseTransport;
+exports.applyPiiHashToFlatContext = applyPiiHashToFlatContext;
 exports.applyRolloutStrategy = applyRolloutStrategy;
 exports.asyncCache = cacheHelper_async;
 exports.canonicalizeForSigning = canonicalizeForSigning;
@@ -44041,11 +44158,13 @@ exports.evaluateSdkFlag = evaluateSdkFlag;
 exports.flattenEvaluationContext = flattenEvaluationContext;
 exports.generateAslClientKeyPair = generateAslClientKeyPair;
 exports.hashPercent = hashPercent;
+exports.hashPiiValue = hashPiiValue;
 exports.hashToPercentage = hashToPercentage;
 exports.isConfigPayloadExpired = isConfigPayloadExpired;
 exports.isInSegment = isInSegment;
 exports.performAslHandshake = performAslHandshake;
 exports.pickVariant = pickVariant;
+exports.prepareContextForLocalEval = prepareContextForLocalEval;
 exports.reduceRules = reduceRules;
 exports.signConfigPayload = signConfigPayload;
 exports.stringHash = stringHash;