[@vercel/flags-core] Support flags:projectId= connection strings

[vincent-derks]

Why

A deployment can read another Vercel project's flags with its own OIDC token instead of a copied SDK key. The connection string flags:projectId=<id> names that project. This is the client half; nothing changes for SDK keys or for createVercelAdapter() without arguments.

• flags:projectId=<id> → OIDC bearer plus X-Vercel-Flags-Project-Id on datafile, stream, and ingest. Bundled definitions are looked up by that id.
• Strings with both sdkKey and projectId, or a malformed projectId, throw.
• 401s name the project; usage tracking pauses on a 401 and resumes on the next successful read.
• Ingest for these clients goes over HTTP, batched, so both identities reach the service: the token (caller) and the header (project whose flags were evaluated). The runtime transport carries only the caller. Which project usage counts against is decided server-side, not here.
• origin.projectId is set so getProviderData reports the right project.
• prepare-flags-definitions embeds definitions for flags:projectId= env values, fetched with VERCEL_OIDC_TOKEN and the header.

Validation

Tests cover the header sets per request type, the parser rules, the 401 messages on every read path, tracking pause/resume, one batched ingest call with the runtime hook installed, and the prepare cases (fetch, no-token skip, own-project dedupe, both-keys skip).

Checked against the live service with a real OIDC token: flags:projectId=<own project> → 200 through the new path; <another project> → 401 naming it. The cross-project success path needs the backend to grant access and cannot be observed live yet; it was exercised against a local stand-in.

Try it

In any Vercel project with OIDC enabled, install the snapshot build and add:

createVercelAdapter(`flags:projectId=${process.env.VERCEL_PROJECT_ID}`); // 200, own flags via the new path
createVercelAdapter('flags:projectId=prj_someOtherProject');            // 401 naming that project

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
flags-playground	Ready	Preview, v0	Sep 28, 2026 11:47am UTC
flags-sdk-dev	Ready	Preview, v0	Sep 28, 2026 11:47am UTC
flags-sdk-snippets	Ready	Preview, v0	Sep 28, 2026 11:47am UTC
flags-sdk-sveltekit-snippets	Ready	Preview, v0	Sep 28, 2026 11:47am UTC
shirt-shop	Ready	Preview, v0	Sep 28, 2026 11:47am UTC
shirt-shop-api	Ready	Preview, v0	Sep 28, 2026 11:47am UTC