Removes the SourceClear workflow that contains a dangerous curl|bash pattern,
which presents risks of script injection and untrusted remote code execution
in the CI/CD pipeline. This follows the same remediation approach used in the
PHP SDK (optimizely/php-sdk#294).

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

## Summary

Adds Feature Rollout support to the JavaScript SDK. Feature Rollouts are a new experiment rule type that combines Targeted Delivery simplicity with A/B test measurement capabilities. During project config parsing, the "everyone else" variation from the flag's rollout is injected into any experiment with type "feature_rollout", enabling correct evaluation without changes to decision logic.

## Changes

- Added optional `type` string field to the Experiment interface
- Added config parsing logic to inject the "everyone else" rollout variation into feature_rollout experiments
- Added traffic allocation entry (endOfRange=10000) for the injected variation
- Added `getEveryoneElseVariation` helper function to extract the last rollout rule's first variation
- Updated variation lookup maps (variationKeyMap, variationIdMap, variationVariableUsageMap) with injected variation
- Added 6 unit tests covering feature rollout injection, edge cases, and backward compatibility

---------

Co-authored-by: Raju Ahmed <raju.ahmed@optimizely.com>

Co-authored-by: Raju Ahmed <raju.ahmed@optimizely.com>

## Summary
simplify holdout handling to treat all holdouts as global.

## Changes
- Removed `includedHoldouts`, `excludedHoldouts`, and `globalHoldouts` from ProjectConfig
- Removed `getHoldoutsForFlag()` method from ProjectConfig
- Removed 3 test cases for deleted functionality
- Updated remaining tests to use new global holdout behavior

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Raju Ahmed <raju.ahmed@optimizely.com>

…#1151)

Co-authored-by: Raju Ahmed <raju.ahmed@optimizely.com>

…er (#1152)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Raju Ahmed <raju.ahmed@optimizely.com>

prevously, body.length was being used for content-length header, which is incorrect (The length data property of a String value contains the length of the string in UTF-16 code units, we need the byte length of utf-8 endcoded string). This PR fixes it.

…ompatibility (#1157)

---------

Co-authored-by: Raju Ahmed <raju.ahmed@optimizely.com>

* [FSSDK-12820] Upgrade to uuid v13

Upgrade uuid to v13 (ESM-only). Update rollup config to bundle uuid
into CJS outputs instead of keeping it as an external dependency,
since CJS consumers cannot require() an ESM-only package. Add a CJS
require hook shim so mocha/ts-node tests can still load uuid in
CommonJS mode.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…diction requests (#1160)

…ion_id, and entity_id (#1158)

Co-authored-by: Raju Ahmed <raju.ahmed@optimizely.com>

* Remove Karma testing infrastructure

Karma config files, scripts, and devDependencies are no longer used.
Remove them along with the README reference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* [FSSDK-12880] Refactor project config creation

- Simplify createProjectConfig to accept a datafile string directly
  instead of string | object, inlining datafile validation
- Remove the separate config_validator module and its tests
- Break monolithic config builder into focused parse functions:
  parseAudienceConfig, parseAttributeConfig, parseGroupConfig,
  parseRolloutConfig, parseIntegrationConfig, parseExperimentConfig,
  parseFeatureFlagConfig
- Eliminate mutation-safe datafile copy in favor of direct construction
- Refactor redundant iterations over experiments and feature flags
- Remove lodash dev dependency

Benchmarks show ~10% faster config parsing for 3-4 MB datafiles.
Removing createMutationSafeDatafileCopy also fixes a memory issue
where it allocated ~4x the datafile size in shallow copies per call,
causing OOM under repeated parsing of large datafiles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* [FSSDK-12933] Refactor message generator to use TS compiler API

Replace the dynamic-import-based message_generator.ts with a static
TS-parser approach (scripts/generate-messages.js) that preserves
declaration order and eliminates the jiti runtime dependency. Add a
test script and CI job for the generator.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* [FSSDK-12891] Switch npm publishing to OIDC trusted publishing

Replace long-lived NPM_PUBLISH_TOKEN with OIDC trusted publishing
for more secure, tokenless CI publishing to npm.

Workflow changes:
- Add id-token: write permission for OIDC token generation
- Move permissions to workflow level (add packages: write for GHR)
- Add GitHub environment gate (npm) for deployment protection
- Upgrade setup-node to v4 and Node to 22 (npm 11.5.1+ requirement)
- Add npm upgrade step to ensure OIDC support
- Remove NPM_PUBLISH_TOKEN from npm publish step (OIDC replaces it)

publish.sh changes:
- Make NODE_AUTH_TOKEN optional in curl lookup (public packages
  don't need auth for registry reads)
- Add --provenance flag for npm registry publishes (supply-chain
  attestations, not supported by GHR)

GHR publish step is unchanged — still uses GITHUB_TOKEN.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* test: temp version bump for OIDC test (revert before merge)

* fix: use string instead of array for optional curl auth header

* test: switch to rc.1 version for OIDC test

* revert: remove temp version bump

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>