[QIU-Guanzong]

/claim #68

Adds @tryabby/vue under packages/vue, using @tryabby/core for evaluation, targeting, defaults and variant selection.

• useAbby returns a typed variant ref and onAct; useFeatureFlag and useRemoteConfig return read-only computed refs with configured key/value types.
• Includes initial data, subscriptions, cookie settings, collection helpers and optional devtools. Regression coverage handles saved consent, late-mounted consumers, cleanup and stale requests from replaced providers.
• Supports SSR and hydration with a factory per request. The README now includes a Nuxt 4 universal-plugin recipe, initial-data transfer and typed descendant usage, verified in a standalone Nuxt production build. It does not add a Nuxt module or global Abby auto-imports.

Packing also exposed a core declaration dependency: its public types import zod, which was only a devDependency. This moves the existing dependency to dependencies, without changing core algorithms or the locked version. The changeset requests a Vue minor release and core patch.

Validation

• At runtime revision 8566ea7, 31 Vue runtime tests and TypeScript inference/error assertions passed. The 29 existing core tests passed at 8b96af9; core source has not changed since that check.
• Vue CJS/ESM/DTS build, scoped Biome and diff checks passed at 8566ea7. Core and Vue were rebuilt successfully from this revision for the Nuxt consumer. The follow-up Nuxt recipe changes only documentation.
• The initial package at 8b96af9 passed a clean packed-consumer check with Vue 3.3.0 and TypeScript 5.5.4 (strict: true, skipLibCheck: false); ESM and CJS imports rendered real Vue SSR output.
• A separate Nuxt 4.5.2 / Vue 3.5.43 consumer installs packed current core/Vue artifacts. On Node 22.23.3, its typecheck (including positive and negative assertions on Nuxt's inferred plugin type), production build, 16 concurrent SSR requests, two isolated browser contexts at 1280px/390px, keyboard updates and two subsequent SSR requests passed. There were no hydration warnings, page errors or external browser requests. Reproducible Nuxt consumer, locked dependencies, logs and screenshots.
• The initial Vue browser example independently read back exposure/conversion requests from a localhost fixture. The new Nuxt check uses synthetic local data and does not assert tracking delivery, hosted Abby service access or production deployment. Nuxt 3 and user-specific cookie/targeting alignment are not covered by that check.

Codex assisted with implementation, tests, documentation and review. No competing implementation was copied.

30-second Vue browser demo (MP4) · Validation notes, logs and checksums

The child-before-parent mounted-hook regression is fixed in 1061648: targeting changes made by a child during mount now reach the rendered flag. Before/after evidence.

The missing-consent remount regression is fixed in 8566ea7: factories originally requiring opt-in stop writing cookies if saved consent has been removed before remounting. Default-allow behavior and explicit runtime disabling are preserved. Before/after evidence. This does not remove existing variant cookies or monitor external cookie changes while mounted.

Summary by CodeRabbit

• New Features
  • Added Vue 3 support for A/B tests, feature flags, and remote configuration, with typed lookups, server-rendered data, and devtools integration.
  • Added an interactive Vue example demonstrating flags, configuration, test variants, and conversion tracking.
• Documentation
  • Added Nuxt setup guidance, including server rendering and hydration examples.
  • Documented cookie consent and persistence behavior.

[vercel]

@Gavin-Yau is attempting to deploy a commit to the cstrnt's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 839129fd-07e2-4284-8bce-0e3792e3dc66

📥 Commits

Reviewing files that changed from the base of the PR and between 1061648 and 54372c5.

📒 Files selected for processing (3)

• packages/vue/README.md
• packages/vue/src/index.ts
• packages/vue/tests/composables.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

Walkthrough

The pull request adds @tryabby/vue, a Vue 3 integration with a provider, composables, cookie-backed storage, SSR support, and devtools integration. It also adds tests, usage documentation, and a local example application.

Changes

Vue integration

Layer / File(s)	Summary
Package setup and factory packages/vue/package.json, packages/core/package.json, packages/vue/tsconfig.json, packages/vue/tsup.config.ts, packages/vue/vite.config.ts, packages/vue/.gitignore, packages/vue/src/storage.ts, packages/vue/src/index.ts, packages/vue/tests/inference.types.ts, .changeset/vue-integration.md	Adds package and build configuration, cookie-backed storage, the createAbby factory, and type checks. The core manifest moves vitest to dependencies. The changeset declares releases for the core and Vue packages.
Provider, composables, and SSR packages/vue/src/index.ts, packages/vue/tests/ssr.test.ts, packages/vue/tests/composables.test.ts, packages/vue/tests/devtools.test.ts	Adds provider initialization from supplied data, window-provided data, or an HTTP request. The provider subscribes to updates and cleans up on unmount. Composables expose test, feature-flag, and remote-config values with tracking callbacks. Tests cover SSR, concurrent rendering, consent, remounts, targeting updates, and devtools lifecycle behavior.
Example application and usage documentation packages/vue/README.md, packages/vue/example/*	Adds a Vue example that displays flags, remote configuration, and a test variant. Its controls update fixture data, record conversions, and display events. The README documents Nuxt setup, SSR, and cookie-consent behavior.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant VueApp
  participant AbbyProvider
  participant HttpService
  participant Abby
  VueApp->>AbbyProvider: Mount without initialData
  AbbyProvider->>Abby: Subscribe to updates
  AbbyProvider->>HttpService: Load project data
  HttpService-->>AbbyProvider: Return project data
  AbbyProvider->>Abby: Initialize if provider remains mounted
  VueApp->>AbbyProvider: Unmount
  AbbyProvider->>Abby: Unsubscribe

Loading

Merge Risk: ⚪ Minimal · up to 54372

No actionable merge-blocking issue remains from the reviewed changes; the Vue integration is ready for normal merge checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 54372

The integration limits cookie writes when consent is absent, but mounted consumers can still report experiment exposures. Whether that is acceptable depends on the adopting application's tracking-consent policy. No broader privilege or deployment change was established.

Retained concerns

• Low · security · inferred: In a Vue application that treats cookie opt-in as tracking opt-in, mounting an experiment consumer can transmit its project, test, and selected variant before that grant. The implemented and documented cookie setting controls persistence, not exposure reporting; whether the wider consent rule applies is deployment-specific.

Security review details

Security Blast Radius

• inferred — The identified exposure is confined to applications that adopt the new Vue consumer path and their configured event endpoint. The observed event payload contains project, test, and variant identifiers; no new tenant-level authority or infrastructure permission is shown.

Security Findings and Attack Paths

• inferred — A visitor need not grant cookie persistence for a mounted consumer to send an exposure. This is a privacy-boundary concern only where the adopting application requires consent for event transmission too; the package documentation describes the implemented control as cookie-specific.

Trust Boundaries and Controls

• observed — Factory-local injection rejects a composable used under another factory's provider. Saved consent is applied before provider initialization, while cookie persistence is gated in core rather than by the Vue storage adapter alone.

Resilience and Maintainability Implications

• inferred — Per-request factory creation is important to SSR state isolation because the factory owns mutable core state. The documented pattern supports that boundary, but a concurrent Nuxt application run was not established by the available evidence.

Hardening Proposals

• proposed — If an adopting application's consent policy covers telemetry, gate exposure and conversion reporting separately from cookie persistence, and verify the behavior before and after a grant.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 5.56% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 10 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding a typed Vue 3 integration. It matches the pull request objectives and changed files.

Full details: Docstring Coverage

Explanation

Docstring coverage is 5.56% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 10 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}