The SDK key validation now uses a regex (/^vf_(?:server|client)_/) to require
the format vf_server_* or vf_client_* instead of accepting any string starting
with vf_. This prevents false positives with third-party service identifiers
that happen to start with vf_ (e.g., Stripe identity flow IDs like
vf_1PyHgVLpWuMxVFx...).
Adds isValidSdkKey() helper function and updates parseSdkKeyFromFlagsConnectionString()
to use the stricter validation. Updates all tests to use valid SDK key formats.
* use __no_flags__ to handle precompute with empty flags
* handle __no_flags__ in serialize
* add __no_flags__ handling to sveltekit
* avoid returning undefined when defaultValue is set
This could only happen on precomputed flags in case of bad usage.
* add error messages
* test console logs
* update changeset
* Return meaningful result from prepareFlagsDefinitions
- Add PrepareFlagsDefinitionsResult discriminated union type that indicates whether definitions were created
- Change prepareFlagsDefinitions return type from Promise<void> to Promise<PrepareFlagsDefinitionsResult>
- Return { created: false, reason: 'no-sdk-keys' } when no SDK keys are found
- Return { created: true, sdkKeysCount: N } when definitions are successfully created
- Add tests for both return paths to verify the function communicates its result properly
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* Add changeset for prepareFlagsDefinitions result type
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* Replace version param with userAgentSuffix in prepare-flags-definitions
Changed the API to use a cleaner approach:
- Removed `version?: string` option in favor of `userAgentSuffix?: string`
- Now imports package version directly from package.json
- Constructs user-agent as: `@vercel/prepare-flags-definitions/{pkgVersion} {suffix}`
- Allows consumers (e.g., vercel-cli, vercel-api) to add context to the header
Added tests verifying both default and suffixed user-agent headers.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* add changeset
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* Extract @vercel/prepare-flags-definitions package
Extract the core flag definitions preparation logic from the Vercel CLI into a standalone, reusable package. This includes:
- prepareFlagsDefinitions() function that collects SDK keys from env, fetches definitions, and writes to node_modules
- hashSdkKey() helper for SHA-256 hashing
- generateDefinitionsModule() for JS module generation with deduplication and lazy parsing
Follows repo conventions: pnpm workspaces, tsup, vitest, ES modules with CJS fallback.
* Add JSDoc comments from original CLI source
* Add inline comments from original CLI source
* Add optional output parameter with debug logging
* Add output.time for datafile fetching
* Add changeset for @vercel/prepare-flags-definitions
* Added new comparators: (not_)contains and case-insensitive versions
* Switched to "ci" option instead of creating new condition for every ci-case
* Cleanup
* More cleanup
* Some more cleanup & finetuning
Made-with: Cursor
* Changeset
* Switch options key to just "i" and also allow for passing "i" as string instead of options object
* Apply suggestions from code review
* Update packages/vercel-flags-core/src/evaluate.ts
Co-authored-by: Dominik Ferber <dominik.ferber@gmail.com>
* naming
* Renaming
---------
Co-authored-by: Dominik Ferber <dominik.ferber@gmail.com>
* Add CJS support for @vercel/flags-core
Update tsup config to build both ESM and CJS formats, and update package.json exports to use import/require conditions with separate entry points for CommonJS consumers.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* changeset
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* add primed stream message support
Implements client-side support for version-based caching. When the client
already has the current datafile (indicated by revision), the server can
send a lightweight primed message instead of the full datafile, reducing
bandwidth. Tracks revision from datafile and sends X-Revision header on
reconnections.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* use getRevision getter for single source of truth and fix type errors
Refactors StreamConfig.revision to a getRevision getter function so
connectStream always reads the latest revision from client state instead
of tracking a separate copy. Fixes CI type-check errors in tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
When shutdown() is called on a client using FlagNetworkDataSource, the stream abort error is expected and should not be logged. The break statement still exits the loop properly.
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* Add custom fetch option to flags client
Allow passing a custom fetch function to createClient() for testing purposes (e.g. resolving to a different IP). Threads fetch through FlagNetworkDataSource, fetchDatafile(), and connectStream().
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* changeset
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* prepare
* origin
* prepare script
* step
* redo peer deps
* wip
* continue
* every 5 secs
* connect flag network
* add shirt-shop-vercel
* upgrade
* push
* update endpoint
* add vercel getProviderData
* fix importts
* Add retries to flag network datasource (#237)
* Fix React Server Components CVE vulnerabilities (#235)
Updated dependencies to fix Next.js and React CVE vulnerabilities.
The fix-react2shell-next tool automatically updated the following packages to their secure versions:
- next
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
* Add retries to flag network datasource when stream closes
Implements automatic retry logic with exponential backoff when the flag network
stream unexpectedly closes. The stream will retry with delays increasing from
1s to a maximum of 30s, allowing the datasource to recover from temporary
network issues while falling back to bundled definitions if initial connection
fails.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* Revert package.json and pnpm-lock changes
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* use ndjson (#238)
* try
* try
* use debugLog
* replace testkey
* never retry on 4xx
* Track FLAG_CONFIG_READ events
* update @biomejs/biome
* send user-agent, rm terminate handling, fix tests
* extract usage-tracker and add tests
* rm EdgeConfigDataSource
* export EvaluationParams and EvaluationResult
* drop edge-config dep
* drop edge config from @flags-sdk/vercel
* adapt @flags-sdk/vercel
* fix integration tests
* wip
* assert ingest requests
* race initial connection, retry in background, abort on shutdown
* rm store
* make readBundledDefinitions async
* read from @vercel/flags-definitions/definitions.json
* add ensureFallback fn
* getDefaultFlagsClient() → flagsClient
* rm process.pid
* rm webpackIgnore: true
* require fallbacks at build time on vercel only
* test in layout
* vercel-flags prepare --verbose
* rm prebuild script
* ensure fallback from instrumentation.ts
* rm last process.pid
* print warning
* Track duration and cache status for config reads
* add tests
* await stream in initialize method
* consumeStream → runStreamLoop
* replace subscribe with doInitialize
* add webpackIgnore
* make @vercel/flags-core a peer dep
* fresh start
* debug
* step
* next-connection
* avoid opening stream during builds
* undo next specific exports
* handle abort
* fake
* poc
* clean up imports
* next-js exports
* upgrade next
* move "use cache" up
* move "use cache" handling to client
* split index.default.ts and index.next-js.ts
* separate
* jsdoc
* use scoped map instead of passing ref
* move jsdoc
* rename
* keep dataSource private, clean clientMap
* reset retryCount on connection; abort on 401
* break after 10 retries
* add backoff with jitter + limit
* add usage tracking and read fallback
* refactor
* extract stream-connection, update tests
* add tests
* reduce test amount
* add perf metadata
* add BaseEvaluationResult
* getData → read
* rm shirt-shop-vercel
* drop next-connection
* update pnpm-lock
* getMetadata → getInfo
* add getDatafile
* DataSourceData → Datafile
* merge metrics into datafile
* simplify metrics
* use embed for getDatafile
* add comment
* comment
* bring shirt-shop-vercel back
* try setCacheLife
* support cache components in OpenFeature import
* use new format
* rm cli
* fix origin
* use bundler
* simplify
* ensure warning is highlighted in build logs
* warn only once
* ensureFallback → getFallbackDatafile
* improve perf
* avoid creating new objects
* fix type issues
* stop exposing createRawClient
* fix: mark stream reconnection loop as intentional fire-and-forget
Add void operator before async IIFE to explicitly indicate the floating
promise is intentional, preventing linter warnings and making the code
intent clearer to future maintainers.
* fix: handle malformed JSON in stream messages gracefully
Wrap JSON.parse in try/catch to prevent crashes from malformed server
responses. Logs a warning and skips the invalid message instead of
crashing the stream connection handler.
* fix: add bounds checking for variant index access
Add getVariant() helper that throws a descriptive error if the variant
index is out of bounds. This prevents silent undefined returns when
variant indices are invalid, making issues easier to debug in production.
* fix: prevent concurrent initialization race condition
Add initializingPromise to coordinate concurrent initialize() calls.
The fast boolean check is preserved for the hot path, while concurrent
calls during initialization now await the same promise instead of
triggering multiple initializations.
* fix: add timeout and retry logic to fetchDatafile
- Add 10-second timeout using AbortController to prevent indefinite hangs
- Add exponential backoff retry (up to 3 attempts) for transient failures
- Skip retries for 4xx client errors (except 429 rate limiting)
- Improves resilience against network issues in production
* fix: prevent race condition in ensureStream
Use local variable for abortController and store streamPromise
immediately after creation. This prevents concurrent calls from
creating multiple streams or overwriting the abort controller
before the promise is stored.
* fix: prevent race condition in read() by capturing data reference
Capture this.data reference at the start of read() to ensure consistent
state throughout the method. The onMessage callback from the stream can
update this.data during async operations, which could cause inconsistent
behavior if the reference changes mid-operation.
* comments
* add streaming connectionState
* update usage
* fix init
* try to avoid hanging promise
* update attw, add types
* get rid of unnecessary async/await
* avoid printing the warning
* distinct warnings
* don't export cachedFns
* add CLAUDE.md
* jsdoc
* clear timeout
* export Datafile
* avoid exposing data sources
* simplify
* types
* avoid dangling timeout
* more options
* tests
* allow options in createClient
* DatafileInput
* better options
* Update event tracking to use streams
* Revert "Update event tracking to use streams"
This reverts commit cff740a18c.
* fix datafile input type
* type
* handle shutdown and re-init
* defensive
* retry stream for up to 15 minutes
* Update event reporting to use ndjson for more events
* Revert "Update event reporting to use ndjson for more events"
This reverts commit f70a7bfc59.
* Add debug logs to the usage tracker
* [adapter-vercel] fix getProviderData
* [adapter-vercel] only return vercel flags from getProviderData
* fix
* rm getInfo
* rm tgz
* rm example
* rm next/connection from gitignore
* rm unused deps
* use DatafileInput type
* fix tests
* ensure pollCount > 0
* fix type issues
* fix retry logic
* upgrade @sveltejs/kit
* resolve ci issues
---------
Co-authored-by: Luis Meyer <luis.meyer@vercel.com>
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Andy Bitz <artzbitz@gmail.com>
github-actions[bot]