feat: Add FDv2 streaming source factories and query-parameter authentication

[kinyoklion]

Stacked on #309 (FDv2 source-layer translation); that lands first.

What this adds

The streaming half of the FDv2 source factories, plus the authentication plumbing both source kinds share. Nothing constructs these factories in production yet (the orchestrator consumes them in a later PR), so behavior is unchanged.

Streaming factories

createSynchronizerFactoryFromEntry now builds FDv2StreamingSynchronizers instead of throwing UnsupportedError. The SSE client is constructed with a uriProvider that is re-invoked on every connection attempt, so the basis query parameter always reflects the current selector — a reconnect after payloads have been applied resumes with a delta request rather than refetching the full payload. The URI builder composes against the configured base URI the same way the polling requestor does (path joining without clobbering existing query parameters).

Query-parameter authentication

SourceFactoryContext gains additionalQueryParameters, applied to every data acquisition request by both FDv2 transports — streaming through the uriProvider, and polling through FDv2Requestor, which merges them into each poll URL. The transports are agnostic about what the parameters carry; authentication enters at the single population site, where SourceFactoryContext.fromClientConfig supplies the platform CredentialConfig.authQueryParameters: empty on io (every io transport authenticates with the authorization header in the base headers) and auth=<client-side-id> on web.

The web platform authenticates with the query parameter at all times rather than the authorization header: a browser only delivers that header when the target service's CORS pre-flight allows it, the browser's native EventSource cannot send custom headers at all, and the FDv2 endpoint paths do not embed the credential the way the FDv1 client-side paths do. (Requirement 3.1.3 of the client-side FDv2 spec, added in launchdarkly/sdk-specs#233, permits this.) Verified against the live service: the FDv2 polling endpoint returns 200 with ?auth=<credential> and 400 without.

Testing

Factory tests cover the streaming construction path and pin the URI contract: the streaming URI carries the auth query parameters and picks up the current selector's basis on each provider invocation, and the polling request URL carries the auth parameters through the factory wiring. Requestor tests assert the additional query parameters appear on every poll URL alongside basis, and that the requestor adds no authorization header (authentication comes from base headers or query parameters, never per-request). Full package suite passes.

SDK-2186

---

Note

Medium Risk
Touches authentication query parameters and streaming connection/error handling; production behavior is unchanged until the orchestrator wires these factories, but mistakes could break web auth or fallback when enabled.

Overview
Adds FDv2 streaming synchronizer factory wiring so StreamingSynchronizer entries build FDv2StreamingSynchronizer with an SSE client whose uriProvider is rebuilt on each connect, keeping basis aligned with the current selector for delta resumes after reconnect.

Introduces shared buildFDv2Uri for polling and streaming so paths, withReasons, basis, relay-style base query strings (including duplicate keys), and extra params merge the same way. SourceFactoryContext now carries credential and additionalQueryParameters (from CredentialConfig.authQueryParameters, e.g. web auth=), applied on every poll and stream URL via FDv2Requestor and the streaming URI builder.

FDv2StreamingBase gains optional defaultEnvironmentId when headers are unavailable, and treats UnrecoverableStatusError as a terminal failure (with optional x-ld-fd-fd-fallback). Factory and requestor tests cover auth query params, basis on reconnect, and repeated relay query keys.

^{Reviewed by Cursor Bugbot for commit 187332d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kinyoklion]

After some discussion and consideration I decided that the auth for the browser may as well always use the query parameter. This reduces the risk of a cors problem.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 651a7ad. Configure here.}