Fast.Utils runtime contract

Runtime and package contract

• Runtime platforms: ES2022 modern browsers, WebViews, Vue 3 applications, and uni-app.
• Package format: one public named-export ESM entry for package managers and one separately minified IIFE entry for CDN use; CommonJS and UMD are not shipped.
• CryptoJS-backed compatibility hashes and AES are bundled into both JavaScript artifacts; consumers do not resolve crypto-js CommonJS subpaths, and the independent crypto module remains tree-shakeable.
• Framework boundary: Vue remains external to the package-manager build and is a required peer in ^3.5.11.
• Vue browser composables: event and observer helpers use native platform APIs, return manual stop handles where exposed, and clean up automatically with the current Vue scope. Window size and breakpoints use 0/false outside browsers; useNow returns a non-updating initial Date during SSR.
• uni-app boundary: platform APIs resolve the runtime-injected uni and App-Plus plus identifiers at call time, with globalThis property fallbacks. The first Storage operation, or an earlier configureStorage({ prefix }) call, uses the detected synchronous Storage API.
• Browser storage: applications import Local and Session directly; configureStorage() is needed only to override defaults before the first operation.
• Storage operation overrides: set/get({ crypto }) select JSON or Base64 for one operation without mutating global configuration. The v3 envelope does not identify its codec, so callers must use matching options for the same entry.
• Storage read typing: get<Value = string>() defaults to string | undefined when no generic is supplied; codecs still restore the original runtime JSON value.
• Stateful browser defaults: Storage, Identity, and default Logger configuration are page-global by design. Storage and Identity reject conflicting reconfiguration; configureLogger replaces the default Logger configuration while preserving the exported facade reference.
• Randomness: every random generation entry prefers Web Crypto and falls back to Math.random() when unavailable.
• Publishing: the repository root is the only package, dist/ is the only build output, and package.json#exports is the complete public path whitelist.

Importing a module does not itself read window, browser Storage, or uni, so unsupported platform capabilities fail only when the corresponding API is called.

Public API policy

• Stateless Array, Date, String, Number, Object, Base64, Color, DOM, Env, Async, and Crypto capabilities use named exports.
• The public API uses named functions instead of mutable aggregate utility objects.
• Base64 and Crypto text decoders return primitive strings typed as DecodedText. They can be used directly as strings; an explicit .parseJson<T = any>() call attempts JSON parsing and falls back to the original string for invalid JSON. The first text decode lazily installs a non-enumerable String.prototype.parseJson and rejects a foreign same-name property instead of overwriting it. Storage codecs continue to parse JSON automatically and strictly.
• Stateful browser capabilities use cohesive package-owned objects: Local, Session, installationIdentity, and Logger instances. Logger exposes the matching debug, log, warn, and error levels, defaults to the debug minimum, and receives scope on each method rather than storing it in child instances. createLogger returns isolated instances, while configureLogger only changes the default logger facade.
• Internal adapters and client factories are implementation details and are not public export paths.