@featureflip/mcp 0.1.11 → 0.1.13

package/dist/org-D-y_4-WG.js

@@ -0,0 +1,1357 @@
+import { McpServer as e, fromJsonSchema as t } from "@modelcontextprotocol/server";
+import * as n from "zod/v4";
+//#endregion
+//#region src/version.ts
+var r = {
+	name: "@featureflip/mcp",
+	version: "0.1.13",
+	mcpName: "io.github.canopy-labs/featureflip",
+	description: "MCP server for managing Featureflip feature flags from AI agents and editors",
+	keywords: [
+		"feature-flags",
+		"feature-toggles",
+		"feature-management",
+		"featureflip",
+		"mcp",
+		"mcp-server",
+		"model-context-protocol",
+		"ai-agents",
+		"claude",
+		"cursor"
+	],
+	license: "Apache-2.0",
+	repository: {
+		type: "git",
+		url: "https://github.com/canopy-labs/featureflip-mcp.git"
+	},
+	homepage: "https://featureflip.io/docs/integrations/mcp/",
+	type: "module",
+	bin: { "featureflip-mcp": "bin/featureflip-mcp.mjs" },
+	exports: { ".": {
+		types: "./dist/index.d.ts",
+		import: "./dist/index.mjs"
+	} },
+	types: "./dist/index.d.ts",
+	files: ["dist", "bin"],
+	publishConfig: { access: "public" },
+	scripts: {
+		build: "vite build",
+		typecheck: "tsc --noEmit -p tsconfig.json",
+		"generate:api": "npx --yes openapi-typescript@7.13.0 ../../apps/management-api/public-v1-openapi.json -o src/generated/api-types.ts && node scripts/generate-output-schemas.mjs",
+		test: "vitest run",
+		"test:watch": "vitest",
+		"smoke:docker": "node scripts/docker-smoke.mjs",
+		"build:mcpb": "node scripts/build-mcpb.mjs"
+	},
+	dependencies: {
+		"@modelcontextprotocol/server": "2.3.1",
+		zod: "^4.6.5"
+	},
+	devDependencies: {
+		"@modelcontextprotocol/client": "2.3.1",
+		"@typescript/typescript6": "^6.0.2",
+		"@types/node": "^26.6.4",
+		typescript: "^7.0.2",
+		vite: "^8.3.4",
+		"vite-plugin-dts": "^5.1.2",
+		vitest: "^5.0.3"
+	},
+	engines: { node: ">=20.19.0" }
+}.version, i = class extends Error {
+	status;
+	envelope;
+	constructor(e, t) {
+		super(t.message), this.status = e, this.envelope = t, this.name = "ApiError";
+	}
+};
+function a(e) {
+	return encodeURIComponent(e);
+}
+var o = /* @__PURE__ */ new Set([
+	502,
+	503,
+	504
+]), s = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"PUT",
+	"DELETE"
+]), c = [250, 1e3], l = class {
+	opts;
+	fetchImpl;
+	sleep;
+	constructor(e) {
+		this.opts = e, this.fetchImpl = e.fetchImpl ?? fetch, this.sleep = e.sleep ?? ((e) => new Promise((t) => setTimeout(t, e)));
+	}
+	async request(e, t, n = {}) {
+		let r = new URL(this.opts.baseUrl + t);
+		for (let [e, t] of Object.entries(n.query ?? {})) t !== void 0 && r.searchParams.set(e, String(t));
+		let a = {
+			Authorization: `Bearer ${this.opts.token}`,
+			Accept: "application/json"
+		}, l;
+		n.body !== void 0 && (a["Content-Type"] = "application/json", l = JSON.stringify(n.body)), n.idempotencyKey && (a["Idempotency-Key"] = n.idempotencyKey);
+		let u = s.has(e) || n.idempotencyKey !== void 0, d;
+		for (let t = 0;; t++) {
+			let n = t < c.length;
+			try {
+				d = await this.fetchImpl(r.toString(), {
+					method: e,
+					headers: a,
+					body: l
+				});
+			} catch (e) {
+				if (!u || !n) throw e;
+				await this.sleep(c[t]);
+				continue;
+			}
+			if (!(u ? o.has(d.status) : d.status === 503) || !n) break;
+			await d.body?.cancel(), await this.sleep(c[t]);
+		}
+		if (d.status !== 204) {
+			if (!d.ok) {
+				let e;
+				try {
+					if (e = await d.json(), typeof e?.error != "string") throw Error("not an envelope");
+				} catch {
+					e = {
+						error: `http_${d.status}`,
+						message: `HTTP ${d.status} from ${r.pathname}`
+					};
+				}
+				throw new i(d.status, e);
+			}
+			return await d.json();
+		}
+	}
+};
+//#endregion
+//#region src/errors.ts
+function u(e) {
+	let t = [{
+		type: "text",
+		text: JSON.stringify(e, null, 2)
+	}];
+	return typeof e == "object" && e && !Array.isArray(e) ? {
+		content: t,
+		structuredContent: e
+	} : { content: t };
+}
+function d(e) {
+	if (e instanceof i) {
+		let t = e.envelope, n = [`Featureflip API error ${e.status} (${t.error}): ${t.message}`];
+		return t.fields && n.push(`Field errors: ${JSON.stringify(t.fields)}`), t.did_you_mean?.length && n.push(`Did you mean: ${t.did_you_mean.join(", ")}`), t.next_actions?.length && n.push(`Next actions: ${t.next_actions.map((e) => `${e.method} ${e.path}`).join("; ")}`), t.retry_after != null && n.push(`Rate limited — retry after ${t.retry_after}s.`), e.status === 404 && n.push("Note: 404 can also mean the public Management API is not enabled for this organization yet, or a service token does not include this project."), t.docs_url && n.push(`Docs: ${t.docs_url}`), {
+			content: [{
+				type: "text",
+				text: n.join("\n")
+			}],
+			isError: !0
+		};
+	}
+	return {
+		content: [{
+			type: "text",
+			text: `Error: ${e instanceof Error ? e.message : String(e)}`
+		}],
+		isError: !0
+	};
+}
+async function f(e) {
+	try {
+		return await e();
+	} catch (e) {
+		return d(e);
+	}
+}
+var p = {
+	endpoints: {
+		"POST /api/v1/orgs/{org}/projects/{project}/environments": "PublicEnvironmentResponse",
+		"GET /api/v1/orgs/{org}/projects/{project}/environments": "PublicEnvironmentResponsePagedResult",
+		"GET /api/v1/orgs/{org}/projects/{project}/environments/{env}": "PublicEnvironmentResponse",
+		"POST /api/v1/orgs/{org}/projects/{project}/flags": "PublicFlagResponse",
+		"GET /api/v1/orgs/{org}/projects/{project}/flags": "PublicFlagListItemPagedResult",
+		"GET /api/v1/orgs/{org}/projects/{project}/flags/removal-candidates": "PublicFlagRemovalCandidatePagedResult",
+		"GET /api/v1/orgs/{org}/projects/{project}/flags/{flag}": "PublicFlagResponse",
+		"GET /api/v1/orgs/{org}/projects/{project}/flags/{flag}/environments/{env}": "PublicFlagEnvConfigResponse",
+		"GET /api/v1/orgs/{org}/projects/{project}/flags/{flag}/environments/{env}/targeting": "PublicTargetingConfigResponse",
+		"POST /api/v1/orgs/{org}/projects/{project}/flags/{flag}/environments/{env}/rules": "PublicTargetingRuleResponse",
+		"GET /api/v1/orgs/{org}/projects/{project}/flags/{flag}/environments/{env}/rules/{ruleId}": "PublicTargetingRuleResponse",
+		"POST /api/v1/orgs/{org}/projects/{project}/flags/{flag}/variations": "PublicVariationResponse",
+		"GET /api/v1/me": "MeResponse",
+		"GET /api/v1/orgs": "OrganizationResponsePagedResult",
+		"GET /api/v1/orgs/{org}": "OrganizationResponse",
+		"POST /api/v1/orgs/{org}/projects": "ProjectResponse",
+		"GET /api/v1/orgs/{org}/projects": "ProjectResponsePagedResult",
+		"GET /api/v1/orgs/{org}/projects/{project}": "ProjectResponse",
+		"GET /api/v1/orgs/{org}/projects/{project}/default-flag-lifetime/impact": "PublicDefaultFlagLifetimeImpact",
+		"POST /api/v1/orgs/{org}/projects/{project}/environments/{env}/sdk-keys": "PublicCreateSdkKeyResponse",
+		"GET /api/v1/orgs/{org}/projects/{project}/environments/{env}/sdk-keys": "PublicSdkKeyResponsePagedResult",
+		"GET /api/v1/orgs/{org}/projects/{project}/environments/{env}/sdk-keys/{sdkKey}": "PublicSdkKeyResponse",
+		"POST /api/v1/orgs/{org}/projects/{project}/segments": "PublicSegmentResponse",
+		"GET /api/v1/orgs/{org}/projects/{project}/segments": "PublicSegmentResponsePagedResult",
+		"GET /api/v1/orgs/{org}/projects/{project}/segments/{segment}": "PublicSegmentResponse",
+		"GET /api/v1/orgs/{org}/webhooks": "PublicWebhookSubscriptionResponsePagedResult",
+		"POST /api/v1/orgs/{org}/webhooks": "PublicCreateWebhookSubscriptionResponse",
+		"GET /api/v1/orgs/{org}/webhooks/{id}": "PublicWebhookSubscriptionResponse",
+		"POST /api/v1/orgs/{org}/webhooks/{id}/secrets": "PublicRotateWebhookSecretResponse",
+		"POST /api/v1/orgs/{org}/webhooks/{id}/test": "PublicTestWebhookSubscriptionResponse",
+		"GET /api/v1/orgs/{org}/webhooks/{id}/deliveries": "PublicWebhookDeliveryResponsePagedResult"
+	},
+	$defs: /* @__PURE__ */ JSON.parse("{\"ActionCapability\":{\"type\":[\"object\",\"null\"],\"properties\":{\"allowed\":{\"type\":[\"boolean\",\"null\"]},\"reason\":{\"type\":[\"string\",\"null\"]}},\"description\":\"One entry in a resource's `_actions` block: may the caller perform it, and if not, why.\"},\"MeResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"type\":{\"type\":[\"string\",\"null\"]},\"id\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"email\":{\"type\":[\"string\",\"null\"]},\"emailVerified\":{\"type\":[\"boolean\",\"null\"]},\"organizationId\":{\"type\":[\"string\",\"null\"]},\"role\":{\"type\":[\"string\",\"null\"]},\"projectScope\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}}},\"description\":\"The authenticated caller's identity, returned by `GET /api/v1/me`. The public API\\nauthenticates two kinds of principal, so this is a `type`-discriminated shape.\\nA `\\\"user\\\"` caller (a session/JWT user or a personal access token, `ffp_...`) carries\\n`email` + `emailVerified`. A `\\\"service_token\\\"` caller (`ffs_...`) has no\\nbacking user row, so it carries `organizationId` + `role` + `projectScope` (the\\ntoken's org, its role in that org, and its project allowlist) instead. The type-inapplicable\\nfields are omitted from the response body. `projectScope` is omitted for an unrestricted\\nservice token (access to every project), never an empty list.\"},\"NextAction\":{\"type\":[\"object\",\"null\"],\"properties\":{\"method\":{\"type\":[\"string\",\"null\"]},\"path\":{\"type\":[\"string\",\"null\"]}}},\"OrganizationResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"slug\":{\"type\":[\"string\",\"null\"]},\"plan\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: Solo, Team, Pro, Business, Enterprise.\"},\"isActive\":{\"type\":[\"boolean\",\"null\"]},\"createdAt\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Public representation of an organization, returned by both `GET /api/v1/orgs` (list) and\\n`GET /api/v1/orgs/{org}` (detail). Drops dashboard-only fields (`BillingEmail` is\\nbilling-contact PII, `UpdatedAt` is dashboard audit trivia) from the dashboard's\\nOrganizationDto/OrganizationListItemDto.\"},\"OrganizationResponsePagedResult\":{\"type\":[\"object\",\"null\"],\"properties\":{\"items\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/OrganizationResponse\"},{\"type\":\"null\"}]}},\"next_cursor\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A page of results plus an opaque cursor for the next page, or null when this is the last\\npage. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and\\n`next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).\"},\"ProjectResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"createdAt\":{\"type\":[\"string\",\"null\"]},\"updatedAt\":{\"type\":[\"string\",\"null\"]},\"defaultFlagLifetimeDays\":{\"type\":[\"integer\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"Public representation of a project, returned by `GET /api/v1/orgs/{org}/projects` (list),\\n`GET .../projects/{project}` (detail), and the body of a successful create/update. Drops\\nthe dashboard-only nested `Environments` collection from ProjectDto — the\\npublic API surfaces environments via their own endpoint (Task 6), not embedded here.\\nUpdatedAt is only populated from ProjectDto (the detail/create\\nshape); ProjectListItemDto doesn't carry it, so list rows leave it `null`.\\nDefaultFlagLifetimeDays is the project's default flag lifetime in days, or null (#3194).\"},\"ProjectResponsePagedResult\":{\"type\":[\"object\",\"null\"],\"properties\":{\"items\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/ProjectResponse\"},{\"type\":\"null\"}]}},\"next_cursor\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A page of results plus an opaque cursor for the next page, or null when this is the last\\npage. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and\\n`next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).\"},\"PublicAddVariationRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"value\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Request body for\\n`POST /api/v1/orgs/{org}/projects/{project}/flags/{flag}/variations`. Named distinctly\\nfrom the dashboard's own `AddVariationRequest` —\\nsee PublicCreateEnvironmentRequest for the schemaId-collision rationale (both\\ncontrollers share one Swagger document).\"},\"PublicApiErrorEnvelope\":{\"type\":[\"object\",\"null\"],\"properties\":{\"error\":{\"type\":[\"string\",\"null\"]},\"message\":{\"type\":[\"string\",\"null\"]},\"docs_url\":{\"type\":[\"string\",\"null\"]},\"fields\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}}},\"retry_after\":{\"type\":[\"integer\",\"null\"]},\"did_you_mean\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"next_actions\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/NextAction\"},{\"type\":\"null\"}]}},\"connection_id\":{\"type\":[\"string\",\"null\"]}},\"description\":\"The frozen public-API error contract. `error` codes are stable snake_case strings. Wire keys\\nare frozen snake_case too (`error`, `message`, `docs_url`, `fields`,\\n`retry_after`) — the global camelCase naming policy would otherwise emit\\n`docsUrl`/`retryAfter`, breaking the published spec. !:JsonPropertyName\\nalways wins over the policy, so these are pinned explicitly rather than relying on the\\nproperty names already being lowercase for the single-word ones.\\n`did_you_mean`, `next_actions` and `connection_id` are ADDITIVE optional keys\\n(null → omitted via the global `DefaultIgnoreCondition = WhenWritingNull`), so\\npre-existing error bodies are byte-for-byte unchanged when they're absent.\\n\\n`connection_id` is present only on the `sso_required` error: the organization\\nrequires single sign-on, and this credential didn't come through its identity provider.\\n`connection_id` identifies which SSO connection to sign in with.\"},\"PublicConditionGroupRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"operator\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: And, Or.\"},\"conditions\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicConditionRequest\"},{\"type\":\"null\"}]}}},\"description\":\"Request-side condition group, symmetric with PublicConditionGroupResponse.\"},\"PublicConditionGroupResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"operator\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: And, Or.\"},\"conditions\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicConditionResponse\"},{\"type\":\"null\"}]}}},\"description\":\"A condition group within a PublicTargetingRuleResponse. Maps 1:1 onto\\nConditionGroupDto. Operator is a bare wire string naming one of\\nthe `ConditionGroupOperator` members (`\\\"And\\\"`/`\\\"Or\\\"`) —\\ngroups are ANDed together at the rule level; within a group, its conditions combine using\\nthis operator.\"},\"PublicConditionRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"attribute\":{\"type\":[\"string\",\"null\"]},\"operator\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: Equals, NotEquals, Contains, NotContains, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, In, NotIn, MatchesRegex, StartsWith, EndsWith, Before, After, SemverEquals, SemverGreaterThan, SemverGreaterThanOrEqual, SemverLessThan, SemverLessThanOrEqual.\"},\"values\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"negate\":{\"type\":[\"boolean\",\"null\"]}},\"description\":\"Request-side condition, symmetric with PublicConditionResponse.\"},\"PublicConditionResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"attribute\":{\"type\":[\"string\",\"null\"]},\"operator\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: Equals, NotEquals, Contains, NotContains, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, In, NotIn, MatchesRegex, StartsWith, EndsWith, Before, After, SemverEquals, SemverGreaterThan, SemverGreaterThanOrEqual, SemverLessThan, SemverLessThanOrEqual.\"},\"values\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"negate\":{\"type\":[\"boolean\",\"null\"]}},\"description\":\"A single condition within a PublicConditionGroupResponse. Maps 1:1 onto\\nConditionDto. Operator is a bare wire string naming one of the\\n`OperatorType` members (e.g. `\\\"Equals\\\"`, `\\\"In\\\"`).\"},\"PublicCreateEnvironmentRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"color\":{\"type\":[\"string\",\"null\"]},\"sortOrder\":{\"type\":[\"integer\",\"null\"]}},\"description\":\"Request body for `POST /api/v1/orgs/{org}/projects/{project}/environments`. Named\\ndistinctly from the dashboard's own `CreateEnvironmentRequest`\\n— both controllers share one Swagger document (see `Program.cs`'s `AddSwaggerGen``DocInclusionPredicate` override), and Swashbuckle's default schemaId is the bare type\\nname, so an identical name in either namespace throws a schemaId collision at\\n`--export-openapi` time.\"},\"PublicCreateFeatureFlagRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"type\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: Boolean, String, Number, Json.\"},\"description\":{\"type\":[\"string\",\"null\"]},\"tags\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"initialVariations\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicCreateVariationDto\"},{\"type\":\"null\"}]}},\"clientSideVisible\":{\"type\":[\"boolean\",\"null\"]},\"expiresAtUtc\":{\"type\":[\"string\",\"null\"]},\"ownerEmail\":{\"type\":[\"string\",\"null\"]},\"isPermanent\":{\"type\":[\"boolean\",\"null\"]}},\"description\":\"Request body for `POST /api/v1/orgs/{org}/projects/{project}/flags`. Named distinctly\\nfrom the dashboard's own `CreateFeatureFlagRequest`\\n— see PublicCreateEnvironmentRequest for the\\nschemaId-collision rationale (both controllers share one Swagger document). Type\\nis passed through verbatim to Type, which itself takes a\\nbare string (Boolean/String/Number/Json) rather than the domain enum — invalid values surface\\nas the handler's own validation failure, not a controller-level 400. ExpiresAtUtc is\\noptional and advisory; a bare date (`2026-12-01`) means the end of that day in UTC, and a full\\ntimestamp is stored exactly. It must be in the future and requires the flag-expiration feature\\n(400 `EXPIRY_IN_PAST` / `FEATURE_NOT_ENABLED`). OwnerEmail optionally names\\nthe owner (an active member, matched case-insensitively; requires the flag-ownership feature —\\n400 `OWNER_NOT_MEMBER` / `FEATURE_NOT_ENABLED`). Omitted, the owner is the caller when\\nthe caller is a member, so a service token creates an unowned flag. IsPermanent marks\\nthe flag permanent (a kill switch, ops toggle or entitlement that is meant to stay; never reported for\\ncleanup). It requires the flag-permanence feature and can't be combined with ExpiresAtUtc\\n(400 `FEATURE_NOT_ENABLED` / `PERMANENT_FLAG_HAS_EXPIRY`).\"},\"PublicCreateProjectRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Request body for `POST /api/v1/orgs/{org}/projects`. Named distinctly from the\\ndashboard's own `CreateProjectRequest` — both\\ncontrollers share one Swagger document (see `Program.cs`'s `AddSwaggerGen``DocInclusionPredicate` override), and Swashbuckle's default schemaId is the bare type\\nname, so an identical name in either namespace throws a schemaId collision at\\n`--export-openapi` time.\"},\"PublicCreateSdkKeyRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"type\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: ClientSide, ServerSide.\"}},\"description\":\"Request body for `POST /api/v1/orgs/{org}/projects/{project}/environments/{env}/sdk-keys`.\\nType is a bare string (\\\"ClientSide\\\" or \\\"ServerSide\\\") — the controller parses it\\nagainst a NAME allowlist (not a bare TryParse``1(ReadOnlySpan{Char},Boolean,``0@), which would\\nsilently accept a numeric string like `\\\"0\\\"`) before dispatching. Named distinctly from\\nthe dashboard's own `CreateSdkKeyRequest` — both\\ncontrollers share one Swagger document, and an identical type name in either namespace throws\\na schemaId collision at `--export-openapi` time.\"},\"PublicCreateSdkKeyResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"key\":{\"type\":[\"string\",\"null\"]},\"lastFourCharacters\":{\"type\":[\"string\",\"null\"]},\"type\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: ClientSide, ServerSide.\"},\"name\":{\"type\":[\"string\",\"null\"]},\"createdAt\":{\"type\":[\"string\",\"null\"]},\"warning\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Response body for a successful `POST .../sdk-keys`. The ONLY place the plaintext\\nKey is ever returned — PublicSdkKeyResponse (list/get) carries just\\n`LastFourCharacters`. Built directly from CreateSdkKeyResult rather than a\\nre-fetch (unlike `FeatureFlagsController.Create`'s re-fetch pattern) because the\\nplaintext key only ever exists on the create result — a subsequent\\nGetSdkKeyQuery can't recover it.\"},\"PublicCreateSegmentRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"conditions\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicSegmentConditionDto\"},{\"type\":\"null\"}]}}},\"description\":\"Request body for `POST /api/v1/orgs/{org}/projects/{project}/segments`. Named distinctly\\nfrom the dashboard's own `CreateUserSegmentRequest` — see\\nPublicCreateEnvironmentRequest for the schemaId-collision rationale (both\\ncontrollers share one Swagger document).\"},\"PublicCreateTargetingRuleRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"description\":{\"type\":[\"string\",\"null\"]},\"variationId\":{\"type\":[\"string\",\"null\"]},\"rolloutPercentage\":{\"type\":[\"integer\",\"null\"]},\"userSegmentId\":{\"type\":[\"string\",\"null\"]},\"conditionGroups\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicConditionGroupRequest\"},{\"type\":\"null\"}]}}},\"description\":\"Request body for `POST .../rules`. The Application-side\\n`CreateTargetingRuleDto`/`CreateConditionGroupDto`/`CreateConditionDto` all take\\ntheir `Operator` as a bare string, re-parsed CASE-SENSITIVELY inside\\n`CreateTargetingRuleCommandHandler` — `FlagTargetingController`'s mapping helpers\\nvalidate every operator against the enum's member-name allowlist AND canonicalize the casing\\n(e.g. `\\\"in\\\"` → `\\\"In\\\"`) before building the command DTO, so a valid\\ncase-insensitive match never trips the handler's strict re-parse.\"},\"PublicCreateVariationDto\":{\"type\":[\"object\",\"null\"],\"properties\":{\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"value\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]}},\"description\":\"A variation supplied at flag-creation time. Maps 1:1 onto\\nCreateVariationDto.\"},\"PublicCreateWebhookSubscriptionRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"name\":{\"type\":[\"string\",\"null\"]},\"url\":{\"type\":[\"string\",\"null\"]},\"provider\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: GenericHttp.\"},\"eventTypes\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"projectIds\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"environmentIds\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}}},\"description\":\"Creates a webhook subscription. `provider` is `GenericHttp`. Omit `eventTypes`,\\n`projectIds` or `environmentIds` (or send an empty list) to receive every event,\\nproject or environment. A token restricted to specific projects must list at least one project,\\nall of them within its allowlist.\"},\"PublicCreateWebhookSubscriptionResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"secret\":{\"type\":[\"string\",\"null\"]},\"warning\":{\"type\":[\"string\",\"null\"]}},\"description\":\"The created subscription's id and its signing secret. The secret is shown only here.\"},\"PublicDefaultFlagLifetimeImpact\":{\"type\":[\"object\",\"null\"],\"properties\":{\"newlyPastExpiry\":{\"type\":[\"integer\",\"null\"]},\"noLongerPastExpiry\":{\"type\":[\"integer\",\"null\"]}},\"description\":\"Response of `GET .../default-flag-lifetime/impact`: how many temporary flags with no expiry\\ndate of their own would newly be past expiry, and how many would stop being past it.\"},\"PublicEnvironmentResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"color\":{\"type\":[\"string\",\"null\"]},\"sortOrder\":{\"type\":[\"integer\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"Public representation of an environment, returned by\\n`GET /api/v1/orgs/{org}/projects/{project}/environments` (list),\\n`GET .../environments/{env}` (detail), and the body of a successful create/update. Drops\\ninternal fields (e.g. `ProjectId` is implicit in the route) — mirrors\\n`ProjectResponse`'s minimal shape. Named `PublicEnvironmentResponse` rather than\\n`EnvironmentResponse` (unlike the sibling `ProjectResponse`, which didn't collide)\\nbecause the dashboard already has its own\\n`EnvironmentResponse` — see\\nPublicCreateEnvironmentRequest for the schemaId-collision rationale.\"},\"PublicEnvironmentResponsePagedResult\":{\"type\":[\"object\",\"null\"],\"properties\":{\"items\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicEnvironmentResponse\"},{\"type\":\"null\"}]}},\"next_cursor\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A page of results plus an opaque cursor for the next page, or null when this is the last\\npage. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and\\n`next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).\"},\"PublicFlagEnvConfigResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"environmentId\":{\"type\":[\"string\",\"null\"]},\"environmentKey\":{\"type\":[\"string\",\"null\"]},\"isEnabled\":{\"type\":[\"boolean\",\"null\"]},\"defaultVariationId\":{\"type\":[\"string\",\"null\"]},\"strategy\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: SingleVariation, PercentageRollout, TargetedRollout.\"},\"prerequisites\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicPrerequisiteDto\"},{\"type\":\"null\"}]}},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"Public representation of a flag's config within a single environment, returned by\\n`GET .../flags/{flag}/environments` and `GET .../flags/{flag}/environments/{env}`.\\nDrops internal/dashboard-only fields present on FlagEnvironmentConfigurationDto\\n— Id (an internal row id, not part of the public\\ncontract; EnvironmentId is the addressable key), `FeatureFlagId` (implicit\\nin the route), the environment's name/color/sort-order (dashboard display fields — the public\\ncontract only needs the addressable EnvironmentKey), and `Staleness` (an\\ninternal analytics signal).\"},\"PublicFlagListItem\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"type\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: Boolean, String, Number, Json.\"},\"isArchived\":{\"type\":[\"boolean\",\"null\"]},\"clientSideVisible\":{\"type\":[\"boolean\",\"null\"]},\"tags\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"createdAt\":{\"type\":[\"string\",\"null\"]},\"updatedAt\":{\"type\":[\"string\",\"null\"]},\"expiresAtUtc\":{\"type\":[\"string\",\"null\"]},\"owner\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicFlagOwner\"},{\"type\":\"null\"}]},\"removalPrUrl\":{\"type\":[\"string\",\"null\"]},\"isPermanent\":{\"type\":[\"boolean\",\"null\"]},\"effectiveExpiresAtUtc\":{\"type\":[\"string\",\"null\"]},\"expirySource\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Public list-item representation of a feature flag, returned by\\n`GET .../flags`. Narrower than PublicFlagResponse — drops\\nVariations (a summary-only shape upstream) and\\nStaleness, matching the \\\"list is narrower than detail\\\"\\nsplit already present on the Application-layer DTOs.\\nEffectiveExpiresAtUtc is when the flag counts as past expiry, from its own ExpiresAtUtc\\nor its project's default lifetime; ExpirySource says which (`explicit` / `project-default`),\\nboth null when neither applies.\"},\"PublicFlagListItemPagedResult\":{\"type\":[\"object\",\"null\"],\"properties\":{\"items\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicFlagListItem\"},{\"type\":\"null\"}]}},\"next_cursor\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A page of results plus an opaque cursor for the next page, or null when this is the last\\npage. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and\\n`next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).\"},\"PublicFlagOwner\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"email\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]}},\"description\":\"A flag's owner as returned on flag reads. Null means the flag is unowned.\"},\"PublicFlagRemovalCandidate\":{\"type\":[\"object\",\"null\"],\"properties\":{\"key\":{\"type\":[\"string\",\"null\"]},\"reason\":{\"type\":[\"string\",\"null\"]},\"treatment\":{\"type\":[\"boolean\",\"null\"]},\"status\":{\"type\":[\"string\",\"null\"]},\"blockedBy\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}}},\"description\":\"One dead flag the Featureflip Flag Cleanup Action should remove, returned by\\n`GET .../flags/removal-candidates`. `Treatment` is the kill decision: true → keep the\\nflag's on-branch, false → keep the off-branch. `Status` is the flag's staleness tier\\n(`\\\"Stale\\\"` or `\\\"Dead\\\"`, never `\\\"Active\\\"`) — lets a caller distinguish the two when\\n`?staleness=stale` widens the response to include both tiers. This is the ONLY public\\nprojection of staleness — PublicFlagResponse and PublicFlagListItem\\nstill omit it by design. `BlockedBy` names the live flags that still list this one as a\\nprerequisite, sorted by key; while it is non-empty the flag cannot be archived\\n(`FLAG_HAS_DEPENDENTS`), so a caller should remove those dependents first.\"},\"PublicFlagRemovalCandidatePagedResult\":{\"type\":[\"object\",\"null\"],\"properties\":{\"items\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicFlagRemovalCandidate\"},{\"type\":\"null\"}]}},\"next_cursor\":{\"type\":[\"string\",\"null\"]}},\"description\":\"A page of results plus an opaque cursor for the next page, or null when this is the last\\npage. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and\\n`next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).\"},\"PublicFlagResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"type\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: Boolean, String, Number, Json.\"},\"isArchived\":{\"type\":[\"boolean\",\"null\"]},\"clientSideVisible\":{\"type\":[\"boolean\",\"null\"]},\"tags\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"variations\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicVariationResponse\"},{\"type\":\"null\"}]}},\"createdAt\":{\"type\":[\"string\",\"null\"]},\"updatedAt\":{\"type\":[\"string\",\"null\"]},\"expiresAtUtc\":{\"type\":[\"string\",\"null\"]},\"owner\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicFlagOwner\"},{\"type\":\"null\"}]},\"removalPrUrl\":{\"type\":[\"string\",\"null\"]},\"isPermanent\":{\"type\":[\"boolean\",\"null\"]},\"effectiveExpiresAtUtc\":{\"type\":[\"string\",\"null\"]},\"expirySource\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"Public detail representation of a feature flag, returned by\\n`GET .../flags/{flag}` and the body of a successful create. Drops internal/dashboard-only\\nfields present on FeatureFlagDto — notably `ProjectId` (implicit in the\\nroute) and `Staleness` (an internal analytics signal, not part of the public contract).\\nEffectiveExpiresAtUtc is when the flag counts as past expiry, from its own ExpiresAtUtc\\nor its project's default lifetime; ExpirySource says which (`explicit` / `project-default`),\\nboth null when neither applies.\"},\"PublicPrerequisiteDto\":{\"type\":[\"object\",\"null\"],\"properties\":{\"prerequisiteFlagKey\":{\"type\":[\"string\",\"null\"]},\"expectedVariationKey\":{\"type\":[\"string\",\"null\"]}},\"description\":\"A single prerequisite entry on a flag's per-environment config. Maps 1:1 onto\\nPrerequisiteDto (read side) and PrerequisiteInput (write side).\"},\"PublicPutTargetingRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"rules\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicCreateTargetingRuleRequest\"},{\"type\":\"null\"}]}}},\"description\":\"Request body for `PUT .../targeting` — a declarative full replace of the environment's\\nordered targeting rule set. Rules are applied in array order (index = priority, so the array\\norder IS the evaluation order). Rules is nullable so that an OMITTED `rules`\\nfield (a body of `{}`) binds successfully instead of failing ASP.NET Core's implicit\\nrequired-property check on non-nullable reference types — both an omitted `rules` field\\nand an explicit empty list (`{ \\\"rules\\\": [] }`) clear all targeting rules for the\\nenvironment. Each element is a PublicCreateTargetingRuleRequest (identical to the\\n`POST .../rules` body), so `UserSegmentId` is supported — segment-scoped rules can be\\nsubmitted through this endpoint. The replace is atomic (all-or-nothing): the whole rule set is\\nswapped in one transaction, or nothing changes.\"},\"PublicReorderRulesRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"ruleIds\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}}},\"description\":\"Request body for `PUT .../rules/reorder`. Must include every existing rule id exactly\\nonce — `ReorderTargetingRulesCommandHandler` rejects duplicate, omitted, or unknown rule\\nids with `BadRequestException`, surfaced as an HTTP 400 `bad_request` envelope\\ncarrying the handler's message.\"},\"PublicRotateWebhookSecretResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"secretId\":{\"type\":[\"string\",\"null\"]},\"secret\":{\"type\":[\"string\",\"null\"]},\"warning\":{\"type\":[\"string\",\"null\"]}},\"description\":\"A newly added signing secret. The secret is shown only here.\"},\"PublicSdkKeyResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"type\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: ClientSide, ServerSide.\"},\"lastFourCharacters\":{\"type\":[\"string\",\"null\"]},\"isActive\":{\"type\":[\"boolean\",\"null\"]},\"createdAt\":{\"type\":[\"string\",\"null\"]},\"lastUsedAt\":{\"type\":[\"string\",\"null\"]},\"revokedAt\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"Public representation of an SDK key, returned by\\n`GET /api/v1/orgs/{org}/projects/{project}/environments/{env}/sdk-keys` (list) and\\n`GET .../sdk-keys/{sdkKey}` (detail). Deliberately narrower than\\nSdkKeyDto — drops `RevokedBy` (an internal user id) and\\n`EnvironmentId` (implicit in the route), and carries no plaintext key field: only\\nLastFourCharacters is ever exposed once the key has been created. The plaintext\\nkey is a one-time value that appears solely in PublicCreateSdkKeyResponse.\"},\"PublicSdkKeyResponsePagedResult\":{\"type\":[\"object\",\"null\"],\"properties\":{\"items\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicSdkKeyResponse\"},{\"type\":\"null\"}]}},\"next_cursor\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A page of results plus an opaque cursor for the next page, or null when this is the last\\npage. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and\\n`next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).\"},\"PublicSegmentConditionDto\":{\"type\":[\"object\",\"null\"],\"properties\":{\"attribute\":{\"type\":[\"string\",\"null\"]},\"operator\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: Equals, NotEquals, Contains, NotContains, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, In, NotIn, MatchesRegex, StartsWith, EndsWith, Before, After, SemverEquals, SemverGreaterThan, SemverGreaterThanOrEqual, SemverLessThan, SemverLessThanOrEqual.\"},\"values\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"negate\":{\"type\":[\"boolean\",\"null\"]}},\"description\":\"A single targeting condition on a segment, used both as input (create/update) and output\\n(Conditions). Operator is a bare string on\\nboth sides of the wire — on write it's parsed to\\nOperatorType by `SegmentsController` (an unknown\\nvalue fails closed with a 400, never silently dropped or defaulted); on read it's mapped\\nstraight through from Operator, which is already a string.\"},\"PublicSegmentResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"conditions\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicSegmentConditionDto\"},{\"type\":\"null\"}]}},\"createdAt\":{\"type\":[\"string\",\"null\"]},\"updatedAt\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"Public representation of a user segment, returned by `GET .../segments`,\\n`GET .../segments/{segment}`, and the body of a successful create.\"},\"PublicSegmentResponsePagedResult\":{\"type\":[\"object\",\"null\"],\"properties\":{\"items\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicSegmentResponse\"},{\"type\":\"null\"}]}},\"next_cursor\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A page of results plus an opaque cursor for the next page, or null when this is the last\\npage. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and\\n`next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).\"},\"PublicSetDefaultFlagLifetimeRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"days\":{\"type\":[\"integer\",\"null\"]}},\"description\":\"Request body for `PUT /api/v1/orgs/{org}/projects/{project}/default-flag-lifetime`. `days`\\nis 1–3650; null (or an empty body) removes the default.\"},\"PublicSetFlagExpiryRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"expiresAtUtc\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Request body for `PUT /api/v1/orgs/{org}/projects/{project}/flags/{flag}/expiry`. Expiry is a\\ndedicated sub-resource, deliberately NOT a field on PublicUpdateFeatureFlagRequest: that\\nPUT is a full replace, so a new nullable field there would let any client that doesn't know about\\nexpiry (the Terraform provider included) wipe it on every update. A bare date means the end of that\\nUTC day; a full timestamp is stored exactly.\"},\"PublicSetFlagOwnerRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"email\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Request body for `PUT /api/v1/orgs/{org}/projects/{project}/flags/{flag}/owner`. A dedicated\\nsub-resource for the same reason as expiry: the main flag PUT is a full replace, so an owner field\\nthere would let every client that doesn't know about owners wipe one. `email` must belong\\nto an active member of the organization (case-insensitive).\"},\"PublicSetFlagRemovalPrRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"url\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Request body for `PUT /api/v1/orgs/{org}/projects/{project}/flags/{flag}/removal-pr`: the\\npull request that removes this flag from code, as opened by the Featureflip Flag Cleanup Action.\\nA dedicated sub-resource for the same reason as expiry and owner. `url` must be an https\\npull request URL (`https://{host}/{owner}/{repo}/pull/{number}`).\"},\"PublicTargetingConfigResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"isEnabled\":{\"type\":[\"boolean\",\"null\"]},\"rules\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicTargetingRuleResponse\"},{\"type\":\"null\"}]}},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"The full targeting configuration for a flag in a single environment, returned by\\n`GET .../targeting`. Maps 1:1 onto TargetingConfigurationDto — including\\nits IsEnabled field, which reflects the parent\\n`FlagEnvironmentConfiguration.IsEnabled` (whether the flag is on in this environment at\\nall), not anything specific to targeting itself.\"},\"PublicTargetingRuleResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"priority\":{\"type\":[\"integer\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"variationId\":{\"type\":[\"string\",\"null\"]},\"rolloutPercentage\":{\"type\":[\"integer\",\"null\"]},\"userSegmentId\":{\"type\":[\"string\",\"null\"]},\"conditionGroups\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicConditionGroupResponse\"},{\"type\":\"null\"}]}},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A single targeting rule, returned by `GET .../rules/{ruleId}`,\\n`POST .../rules` (201 body), and nested within PublicTargetingConfigResponse.\\nMaps 1:1 onto TargetingRuleDto, dropping nothing — every field on the\\nApplication DTO is part of the public contract.\"},\"PublicTestWebhookSubscriptionResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"webhookEventId\":{\"type\":[\"string\",\"null\"]},\"webhookDeliveryId\":{\"type\":[\"string\",\"null\"]}},\"description\":\"The queued test event and its delivery. Poll the delivery log for the outcome.\"},\"PublicToggleFlagRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"enabled\":{\"type\":[\"boolean\",\"null\"]}},\"description\":\"Request body for `POST .../flags/{flag}/environments/{env}/toggle`. Named distinctly from\\nthe dashboard's own `ToggleFlagInEnvironmentRequest`\\n(which uses `IsEnabled`) — the public field is named Enabled per the phase-3c\\ncontract. Enabled is a NULLABLE `bool?` deliberately: a non-nullable value\\ntype would bind an omitted/empty body to `false` with no validation error (ASP.NET's\\nimplicit-required only covers non-nullable reference types, not value types), silently disabling\\nthe flag. The controller rejects a null Enabled with a `validation_failed` 400\\nso the intent is never ambiguous (#1806).\"},\"PublicUpdateEnvironmentRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"name\":{\"type\":[\"string\",\"null\"]},\"color\":{\"type\":[\"string\",\"null\"]},\"sortOrder\":{\"type\":[\"integer\",\"null\"]}},\"description\":\"Request body for `PUT /api/v1/orgs/{org}/projects/{project}/environments/{env}`. See\\nPublicCreateEnvironmentRequest for why this is named distinctly from the\\ndashboard's `UpdateEnvironmentRequest`.\"},\"PublicUpdateFeatureFlagRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"tags\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"clientSideVisible\":{\"type\":[\"boolean\",\"null\"]}},\"description\":\"Request body for `PUT /api/v1/orgs/{org}/projects/{project}/flags/{flag}`. See\\nPublicCreateFeatureFlagRequest for why this is named distinctly from the\\ndashboard's `UpdateFeatureFlagRequest`. The flag's key and type are immutable via this\\nendpoint (mirrors `UpdateFeatureFlagCommand`, which has no `Key`/`Type`).\"},\"PublicUpdateFlagEnvConfigRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"defaultVariationId\":{\"type\":[\"string\",\"null\"]},\"strategy\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: SingleVariation, PercentageRollout, TargetedRollout.\"},\"prerequisites\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicPrerequisiteDto\"},{\"type\":\"null\"}]}}},\"description\":\"Request body for `PUT .../flags/{flag}/environments/{env}`. Named distinctly from the\\ndashboard's own `UpdateFlagEnvironmentConfigurationRequest`\\n— see PublicCreateEnvironmentRequest for the schemaId-collision rationale (both\\ncontrollers share one Swagger document). Strategy is passed through verbatim to\\nStrategy\\n— the existing command validator name-allowlists it (SingleVariation/PercentageRollout/\\nTargetedRollout or null), so an invalid value surfaces as the handler's own 400, not a\\ncontroller-level guard. A null Prerequisites leaves prerequisites untouched; a\\nnon-null list replaces them wholesale (mirrors UpdateFlagPrerequisitesCommand's\\nreplace-all semantics).\"},\"PublicUpdateProjectRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Request body for `PUT /api/v1/orgs/{org}/projects/{project}`. See\\nPublicCreateProjectRequest for why this is named distinctly from the\\ndashboard's `UpdateProjectRequest`.\"},\"PublicUpdateSdkKeyRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Request body for `PUT /api/v1/orgs/{org}/projects/{project}/environments/{env}/sdk-keys/{sdkKey}`.\\nType and key material are immutable via this endpoint (mirrors\\nUpdateSdkKeyCommand, which\\ncarries no `Type`).\"},\"PublicUpdateSegmentRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"name\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"conditions\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicSegmentConditionDto\"},{\"type\":\"null\"}]}}},\"description\":\"Request body for `PUT /api/v1/orgs/{org}/projects/{project}/segments/{segment}`. The\\nsegment's key is immutable via this endpoint (mirrors `UpdateUserSegmentCommand`, which\\ncarries no `Key`).\"},\"PublicUpdateTargetingRuleRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"description\":{\"type\":[\"string\",\"null\"]},\"variationId\":{\"type\":[\"string\",\"null\"]},\"rolloutPercentage\":{\"type\":[\"integer\",\"null\"]},\"userSegmentId\":{\"type\":[\"string\",\"null\"]},\"conditionGroups\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicConditionGroupRequest\"},{\"type\":\"null\"}]}}},\"description\":\"Request body for `PUT .../rules/{ruleId}`. Same shape as\\nPublicCreateTargetingRuleRequest — see its remarks on operator\\nvalidation/canonicalization, which applies identically here.\"},\"PublicUpdateVariationRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"name\":{\"type\":[\"string\",\"null\"]},\"value\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]}},\"description\":\"Request body for\\n`PUT /api/v1/orgs/{org}/projects/{project}/flags/{flag}/variations/{variationId}`. The\\nvariation's key is immutable via this endpoint (mirrors\\n`UpdateVariationCommand`, which\\ncarries no `Key`).\"},\"PublicUpdateWebhookSubscriptionRequest\":{\"type\":[\"object\",\"null\"],\"properties\":{\"name\":{\"type\":[\"string\",\"null\"]},\"url\":{\"type\":[\"string\",\"null\"]},\"eventTypes\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"projectIds\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"environmentIds\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"isEnabled\":{\"type\":[\"boolean\",\"null\"]}},\"description\":\"Replaces a subscription's configuration (full replace — omitted lists become empty, meaning\\n\\\"all\\\"). `isEnabled` is required. The provider cannot be changed.\"},\"PublicVariationResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"key\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"value\":{\"type\":[\"string\",\"null\"]},\"description\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A single variation on a flag, as returned in Variations.\"},\"PublicWebhookDeliveryResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"webhookEventId\":{\"type\":[\"string\",\"null\"]},\"status\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: Pending, Succeeded, DeadLettered.\"},\"attemptCount\":{\"type\":[\"integer\",\"null\"]},\"nextAttemptAt\":{\"type\":[\"string\",\"null\"]},\"lastResponseStatusCode\":{\"type\":[\"integer\",\"null\"]},\"lastError\":{\"type\":[\"string\",\"null\"]},\"completedAt\":{\"type\":[\"string\",\"null\"]},\"createdAt\":{\"type\":[\"string\",\"null\"]}},\"description\":\"One delivery attempt record. `status` is `Pending` (awaiting its first attempt,\\nbacking off, or in flight), `Succeeded` or `DeadLettered`.\"},\"PublicWebhookDeliveryResponsePagedResult\":{\"type\":[\"object\",\"null\"],\"properties\":{\"items\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicWebhookDeliveryResponse\"},{\"type\":\"null\"}]}},\"next_cursor\":{\"type\":[\"string\",\"null\"]}},\"description\":\"A page of results plus an opaque cursor for the next page, or null when this is the last\\npage. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and\\n`next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).\"},\"PublicWebhookSecretResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"createdAt\":{\"type\":[\"string\",\"null\"]},\"retiredAt\":{\"type\":[\"string\",\"null\"]}},\"description\":\"A signing secret's id and lifecycle. A secret with no `retiredAt` is active and signs every delivery.\"},\"PublicWebhookSubscriptionResponse\":{\"type\":[\"object\",\"null\"],\"properties\":{\"id\":{\"type\":[\"string\",\"null\"]},\"name\":{\"type\":[\"string\",\"null\"]},\"url\":{\"type\":[\"string\",\"null\"]},\"provider\":{\"type\":[\"string\",\"null\"],\"description\":\"Allowed values: GenericHttp.\"},\"isEnabled\":{\"type\":[\"boolean\",\"null\"]},\"eventTypes\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"projectIds\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"environmentIds\":{\"type\":[\"array\",\"null\"],\"items\":{\"type\":[\"string\",\"null\"]}},\"consecutiveFailureCount\":{\"type\":[\"integer\",\"null\"]},\"autoDisabledAt\":{\"type\":[\"string\",\"null\"]},\"createdAt\":{\"type\":[\"string\",\"null\"]},\"updatedAt\":{\"type\":[\"string\",\"null\"]},\"secrets\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicWebhookSecretResponse\"},{\"type\":\"null\"}]}},\"overPlanLimit\":{\"type\":[\"boolean\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A webhook subscription. Never carries secret material: signing secrets are listed by id and\\nlifecycle only — the value itself is returned once, when it is created or rotated.\\n`overPlanLimit` is true when the organization has more subscriptions than its plan\\nallows, which happens after a downgrade. The oldest subscriptions up to the limit keep\\ndelivering. The rest receive nothing and cannot be re-enabled, tested or redelivered to until\\nthe plan is upgraded or older subscriptions are deleted.\"},\"PublicWebhookSubscriptionResponsePagedResult\":{\"type\":[\"object\",\"null\"],\"properties\":{\"items\":{\"type\":[\"array\",\"null\"],\"items\":{\"anyOf\":[{\"$ref\":\"#/$defs/PublicWebhookSubscriptionResponse\"},{\"type\":\"null\"}]}},\"next_cursor\":{\"type\":[\"string\",\"null\"]},\"_actions\":{\"type\":[\"object\",\"null\"],\"additionalProperties\":{\"anyOf\":[{\"$ref\":\"#/$defs/ActionCapability\"},{\"type\":\"null\"}]},\"description\":\"Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.\"}},\"description\":\"A page of results plus an opaque cursor for the next page, or null when this is the last\\npage. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and\\n`next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).\"}}")
+}, m = p.$defs, h = p.endpoints, g = (e) => ({ type: [e, "null"] });
+function _(e) {
+	if (!m[e]) throw Error(`no API schema named ${e}`);
+	return { $ref: `#/$defs/${e}` };
+}
+function v(e) {
+	let t = h[e];
+	if (!t) throw Error(`the public API spec has no JSON response for ${e}`);
+	return _(t);
+}
+function y(e, t = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(e)) for (let n of e) y(n, t);
+	else if (e && typeof e == "object") for (let [n, r] of Object.entries(e)) if (n === "$ref" && typeof r == "string" && r.startsWith("#/$defs/")) {
+		let e = r.slice(8);
+		t.has(e) || (t.add(e), y(m[e], t));
+	} else y(r, t);
+	return t;
+}
+function b(e) {
+	let n = [...y(e)].sort(), r = {
+		...e,
+		type: "object"
+	};
+	return n.length && (r.$defs = Object.fromEntries(n.map((e) => [e, m[e]]))), t(r);
+}
+function x(e) {
+	let t = h[e];
+	if (!t) throw Error(`the public API spec has no JSON response for ${e}`);
+	return b({
+		...m[t],
+		type: "object"
+	});
+}
+function ee(e, t) {
+	let n = h[e];
+	if (!n) throw Error(`the public API spec has no JSON response for ${e}`);
+	let r = m[n];
+	return b({
+		...r,
+		properties: {
+			...r.properties,
+			...t
+		}
+	});
+}
+function S(e, t = [], n) {
+	return b({
+		properties: e,
+		...t.length ? { required: t } : {},
+		...n ? { description: n } : {}
+	});
+}
+function C(...e) {
+	return b({ anyOf: e });
+}
+function w(e, t = []) {
+	return {
+		type: "object",
+		properties: e,
+		...t.length ? { required: t } : {}
+	};
+}
+//#endregion
+//#region src/tools/params.ts
+var T = n.string().describe("Project key"), E = n.string().describe("Flag key or id"), D = n.string().describe("Environment key, e.g. production"), O = {
+	limit: n.number().int().min(1).max(100).optional().describe("Page size (default 20)"),
+	cursor: n.string().optional().describe("next_cursor from a previous response")
+};
+//#endregion
+//#region src/tools/projects.ts
+function k(e, t) {
+	e.registerTool("list_projects", {
+		title: "List projects",
+		description: "List projects in the Featureflip organization. Paginated: pass cursor from next_cursor to continue.",
+		inputSchema: n.object({ ...O }),
+		outputSchema: x("GET /api/v1/orgs/{org}/projects"),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ limit: e, cursor: n }) => f(async () => u(await t.api.request("GET", `/api/v1/orgs/${a(t.org)}/projects`, { query: {
+		limit: e,
+		cursor: n
+	} }))));
+}
+//#endregion
+//#region src/tools/environments.ts
+function A(e, t) {
+	e.registerTool("list_environments", {
+		title: "List environments",
+		description: "List the environments of a project (e.g. development, staging, production).",
+		inputSchema: n.object({
+			project: T,
+			...O
+		}),
+		outputSchema: x("GET /api/v1/orgs/{org}/projects/{project}/environments"),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ project: e, limit: n, cursor: r }) => f(async () => u(await t.api.request("GET", `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/environments`, { query: {
+		limit: n,
+		cursor: r
+	} }))));
+}
+//#endregion
+//#region src/tools/segments.ts
+function j(e, t) {
+	e.registerTool("list_segments", {
+		title: "List user segments",
+		description: "List reusable user segments in a project. Segments are referenced from targeting rules via userSegmentId.",
+		inputSchema: n.object({
+			project: n.string().describe("Project key"),
+			...O
+		}),
+		outputSchema: x("GET /api/v1/orgs/{org}/projects/{project}/segments"),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ project: e, limit: n, cursor: r }) => f(async () => u(await t.api.request("GET", `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/segments`, { query: {
+		limit: n,
+		cursor: r
+	} })))), e.registerTool("get_segment", {
+		title: "Get user segment",
+		description: "Get one user segment (its conditions, id, and metadata) by key or id.",
+		inputSchema: n.object({
+			project: n.string().describe("Project key"),
+			segment: n.string().describe("Segment key or id")
+		}),
+		outputSchema: x("GET /api/v1/orgs/{org}/projects/{project}/segments/{segment}"),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ project: e, segment: n }) => f(async () => u(await t.api.request("GET", `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/segments/${a(n)}`))));
+}
+//#endregion
+//#region src/tools/owner.ts
+var M = n.string().optional().describe("Only flags with this owner: an email, \"me\" for the token's own user, or \"none\" for unowned flags");
+async function N(e, t) {
+	let n = t?.trim();
+	if (!n) return;
+	if (n.toLowerCase() !== "me") return n;
+	let r = await e.api.request("GET", "/api/v1/me");
+	if (r.type !== "user" || !r.email) throw Error("owner \"me\" needs a personal access token (ffp_...). A service token has no user, so it owns no flags; pass an owner email instead.");
+	return r.email;
+}
+//#endregion
+//#region src/tools/flags.ts
+var P = n.enum([
+	"Boolean",
+	"String",
+	"Number",
+	"Json"
+]);
+function F(e, t) {
+	let r = (e) => `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/flags`;
+	e.registerTool("list_flags", {
+		title: "List feature flags",
+		description: "List feature flags in a project. Filter with search (key/name substring), tag, type, archived, owner. Each flag carries its owner ({id, email, name}, or null when unowned). Paginated via cursor.",
+		inputSchema: n.object({
+			project: T,
+			search: n.string().optional().describe("Substring of the flag key or name"),
+			tag: n.string().optional().describe("Only flags carrying this tag"),
+			type: P.optional().describe("Only flags of this type"),
+			archived: n.boolean().optional().describe("true = only archived, false = only active"),
+			owner: M,
+			...O
+		}),
+		outputSchema: x("GET /api/v1/orgs/{org}/projects/{project}/flags"),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ project: e, owner: n, ...i }) => f(async () => u(await t.api.request("GET", r(e), { query: {
+		...i,
+		owner: await N(t, n)
+	} })))), e.registerTool("get_flag", {
+		title: "Get feature flag",
+		description: "Get one feature flag with its variations and metadata, including its owner (null when unowned). Address by flag key or id.",
+		inputSchema: n.object({
+			project: T,
+			flag: E
+		}),
+		outputSchema: x("GET /api/v1/orgs/{org}/projects/{project}/flags/{flag}"),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ project: e, flag: n }) => f(async () => u(await t.api.request("GET", `${r(e)}/${a(n)}`)))), e.registerTool("create_flag", {
+		title: "Create feature flag",
+		description: "Create a feature flag. type is one of Boolean|String|Number|Json. Boolean flags get true/false variations automatically; for other types pass initialVariations. The flag is created in every environment of the project (disabled).",
+		inputSchema: n.object({
+			project: T,
+			key: n.string().describe("Unique flag key, e.g. checkout-v2"),
+			name: n.string().describe("Display name"),
+			type: P.describe("Value type; Boolean gets true/false variations automatically"),
+			description: n.string().optional().describe("What the flag controls"),
+			tags: n.array(n.string()).optional().describe("Tags for filtering, e.g. team or area"),
+			clientSideVisible: n.boolean().optional().describe("Expose to client-side SDKs (browser/mobile)"),
+			initialVariations: n.array(n.object({
+				key: n.string(),
+				name: n.string().optional(),
+				value: n.string().describe("Variation value serialized as a string"),
+				description: n.string().optional()
+			})).optional().describe("Variations for a String, Number or Json flag (Boolean flags get true/false automatically)"),
+			expiresAtUtc: n.string().optional().describe("Optional date (YYYY-MM-DD, end of that UTC day) or ISO-8601 timestamp the flag is expected to be removed by (see set_flag_expiry)"),
+			ownerEmail: n.string().optional().describe("Optional owner: the email of an active member (Pro plan and above, see set_flag_owner). Omitted, a personal access token makes its own user the owner and a service token leaves the flag unowned"),
+			isPermanent: n.boolean().optional().describe("Mark the flag permanent: a kill switch, ops toggle or entitlement gate that is meant to stay. Permanent flags are never listed as removal candidates or by find_stale_flags. Cannot be combined with expiresAtUtc"),
+			idempotency_key: n.string().optional().describe("Idempotency-Key header for safe retries")
+		}),
+		outputSchema: x("POST /api/v1/orgs/{org}/projects/{project}/flags"),
+		annotations: { destructiveHint: !1 }
+	}, async ({ project: e, idempotency_key: n, ...i }) => f(async () => u(await t.api.request("POST", r(e), {
+		body: i,
+		idempotencyKey: n
+	})))), e.registerTool("update_flag", {
+		title: "Update feature flag metadata",
+		description: "Update flag name/description/tags/clientSideVisible. Changes only the fields you pass and keeps the rest; pass description: \"\" to clear it. Key and type are immutable. Use toggle_flag / update_targeting for behavior changes.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			name: n.string().optional().describe("New display name"),
+			description: n.string().optional().describe("New description; \"\" clears it"),
+			tags: n.array(n.string()).optional().describe("Replaces the whole tag list"),
+			clientSideVisible: n.boolean().optional().describe("Expose to client-side SDKs (browser/mobile); false hides the flag from them entirely")
+		}),
+		outputSchema: S({
+			project: { type: "string" },
+			flag: { type: "string" },
+			updated: { type: "boolean" }
+		}, [
+			"project",
+			"flag",
+			"updated"
+		]),
+		annotations: { destructiveHint: !0 }
+	}, async ({ project: e, flag: n, name: i, description: o, tags: s, clientSideVisible: c }) => f(async () => {
+		let l = `${r(e)}/${a(n)}`, d = i === void 0 || o === void 0 ? await t.api.request("GET", l) : void 0, f = {
+			name: i ?? d?.name,
+			description: o ?? d?.description,
+			tags: s,
+			clientSideVisible: c
+		};
+		return await t.api.request("PUT", l, { body: f }), u({
+			project: e,
+			flag: n,
+			updated: !0
+		});
+	})), e.registerTool("set_flag_expiry", {
+		title: "Set or clear flag expiry",
+		description: "Set the date a flag is expected to be removed by, or pass expiresAtUtc: null to clear it. Expiry is advisory: evaluation never changes. Once the date passes, find_stale_flags reports the flag as expired. expiresAtUtc takes a date (2026-12-31), which means the end of that day in UTC, the same as picking it in the dashboard, or a full ISO-8601 timestamp, which is stored exactly. Refused with EXPIRY_IN_PAST for a time that has already passed (today's date is allowed), with FEATURE_NOT_ENABLED while flag expiration is not enabled for the organization, and with PERMANENT_FLAG_HAS_EXPIRY on a permanent flag (make it temporary first with set_flag_permanent). Clearing is always allowed.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			expiresAtUtc: n.string().nullable().describe("Date (YYYY-MM-DD, end of that UTC day) or ISO-8601 timestamp, or null to clear the expiry")
+		}),
+		outputSchema: S({
+			project: { type: "string" },
+			flag: { type: "string" },
+			expiresAtUtc: g("string")
+		}, [
+			"project",
+			"flag",
+			"expiresAtUtc"
+		]),
+		annotations: {
+			destructiveHint: !1,
+			idempotentHint: !0
+		}
+	}, async ({ project: e, flag: n, expiresAtUtc: i }) => f(async () => {
+		let o = `${r(e)}/${a(n)}/expiry`;
+		return i === null ? await t.api.request("DELETE", o) : await t.api.request("PUT", o, { body: { expiresAtUtc: i } }), u({
+			project: e,
+			flag: n,
+			expiresAtUtc: i
+		});
+	})), e.registerTool("set_flag_permanent", {
+		title: "Mark a flag permanent or temporary",
+		description: "Mark a flag permanent (a kill switch, ops toggle or entitlement gate that is meant to stay), or pass permanent: false to make it temporary again. Permanent flags are never listed as removal candidates or by find_stale_flags; evaluation never changes. Marking is refused with PERMANENT_FLAG_HAS_EXPIRY while the flag has an expiry date (clear it first with set_flag_expiry and expiresAtUtc: null), with FEATURE_NOT_ENABLED while permanent flags are not enabled for the organization, and on an archived flag. Making a flag temporary is always allowed.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			permanent: n.boolean().describe("true to mark the flag permanent, false to make it temporary")
+		}),
+		outputSchema: S({
+			project: { type: "string" },
+			flag: { type: "string" },
+			permanent: { type: "boolean" }
+		}, [
+			"project",
+			"flag",
+			"permanent"
+		]),
+		annotations: {
+			destructiveHint: !1,
+			idempotentHint: !0
+		}
+	}, async ({ project: e, flag: n, permanent: i }) => f(async () => {
+		let o = `${r(e)}/${a(n)}/permanent`;
+		return await t.api.request(i ? "PUT" : "DELETE", o), u({
+			project: e,
+			flag: n,
+			permanent: i
+		});
+	})), e.registerTool("set_flag_owner", {
+		title: "Set or clear flag owner",
+		description: "Name the person responsible for a flag, or pass owner: null to leave it unowned. owner is the email of an active member of the organization, or \"me\" for the token's own user (needs a personal access token). The owner gets the flag's cleanup notices; evaluation never changes. Refused with OWNER_NOT_MEMBER for an email that is not an active member, and with PLAN_FEATURE_UNAVAILABLE below the Pro plan. Clearing is always allowed.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			owner: n.string().nullable().describe("Owner email, \"me\" for the token's own user, or null (or \"none\") to clear the owner")
+		}),
+		outputSchema: S({
+			project: { type: "string" },
+			flag: { type: "string" },
+			owner: {
+				...g("string"),
+				description: "Owner email now set, or null when unowned"
+			}
+		}, [
+			"project",
+			"flag",
+			"owner"
+		]),
+		annotations: {
+			destructiveHint: !1,
+			idempotentHint: !0
+		}
+	}, async ({ project: e, flag: n, owner: i }) => f(async () => {
+		let o = `${r(e)}/${a(n)}/owner`, s = i?.trim().toLowerCase() === "none" ? void 0 : await N(t, i ?? void 0);
+		return s === void 0 ? await t.api.request("DELETE", o) : await t.api.request("PUT", o, { body: { email: s } }), u({
+			project: e,
+			flag: n,
+			owner: s ?? null
+		});
+	})), e.registerTool("delete_flag", {
+		title: "Delete feature flag",
+		description: "PERMANENTLY delete a flag across all environments. Fails with FLAG_HAS_DEPENDENTS if other flags use it as a prerequisite. Prefer archive_flag unless the flag must be fully removed.",
+		inputSchema: n.object({
+			project: T,
+			flag: E
+		}),
+		outputSchema: S({ deleted: { type: "string" } }, ["deleted"]),
+		annotations: { destructiveHint: !0 }
+	}, async ({ project: e, flag: n }) => f(async () => (await t.api.request("DELETE", `${r(e)}/${a(n)}`), u({ deleted: n })))), e.registerTool("archive_flag", {
+		title: "Archive feature flag",
+		description: "Archive a flag (soft-hide, evaluation stops serving it). Reversible with restore_flag. Archive dependents first: refused with FLAG_HAS_DEPENDENTS while another live flag lists this one as a prerequisite, so archive those flags (blockedBy in find_stale_flags / list_removal_candidates) first. Refused with FLAG_RECENTLY_EVALUATED while live traffic is still evaluating the flag, because archiving makes every caller fall back to its own hardcoded default — normally that means the code removal has merged but not deployed yet, and the refusal clears itself once it has.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			force: n.boolean().optional().describe("Archive even though traffic is still evaluating the flag. Only for clients that can never be updated (old mobile app versions), where traffic will never drain on its own.")
+		}),
+		outputSchema: S({
+			flag: { type: "string" },
+			archived: { type: "boolean" }
+		}, ["flag", "archived"]),
+		annotations: { destructiveHint: !0 }
+	}, async ({ project: e, flag: n, force: i }) => f(async () => (await t.api.request("POST", `${r(e)}/${a(n)}/archive`, { query: i ? { force: !0 } : {} }), u({
+		flag: n,
+		archived: !0
+	})))), e.registerTool("restore_flag", {
+		title: "Restore archived flag",
+		description: "Restore a previously archived flag.",
+		inputSchema: n.object({
+			project: T,
+			flag: E
+		}),
+		outputSchema: S({
+			flag: { type: "string" },
+			archived: { type: "boolean" }
+		}, ["flag", "archived"]),
+		annotations: { destructiveHint: !1 }
+	}, async ({ project: e, flag: n }) => f(async () => (await t.api.request("POST", `${r(e)}/${a(n)}/restore`), u({
+		flag: n,
+		archived: !1
+	}))));
+}
+//#endregion
+//#region src/tools/flag-environments.ts
+var I = n.enum([
+	"SingleVariation",
+	"PercentageRollout",
+	"TargetedRollout"
+]);
+function te(e, t) {
+	let r = (e, n) => `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/flags/${a(n)}`;
+	e.registerTool("toggle_flag", {
+		title: "Toggle flag in environment",
+		description: "Enable or disable a flag in ONE environment. Affects live evaluation immediately — double-check the environment.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			environment: D,
+			enabled: n.boolean().describe("true to turn the flag on in this environment, false to turn it off")
+		}),
+		outputSchema: S({
+			project: { type: "string" },
+			flag: { type: "string" },
+			environment: { type: "string" },
+			enabled: { type: "boolean" }
+		}, [
+			"project",
+			"flag",
+			"environment",
+			"enabled"
+		]),
+		annotations: { destructiveHint: !0 }
+	}, async ({ project: e, flag: n, environment: i, enabled: o }) => f(async () => (await t.api.request("POST", `${r(e, n)}/environments/${a(i)}/toggle`, { body: { enabled: o } }), u({
+		project: e,
+		flag: n,
+		environment: i,
+		enabled: o
+	})))), e.registerTool("update_flag_environment_config", {
+		title: "Update flag environment config",
+		description: "Update a flag's per-environment serving config: defaultVariationId (served on fallthrough, required), strategy (SingleVariation | PercentageRollout | TargetedRollout — only SingleVariation is currently supported at the environment level), and prerequisites. Percentage rollouts are configured on targeting rules via update_targeting.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			environment: D,
+			defaultVariationId: n.string().describe("Variation id to serve on fallthrough — required by the API"),
+			strategy: I.optional().describe("Serving strategy; only SingleVariation is currently supported here"),
+			prerequisites: n.array(n.object({
+				prerequisiteFlagKey: n.string(),
+				expectedVariationKey: n.string()
+			})).optional().describe("Flags that must evaluate to the expected variation before this flag serves. Omit to leave existing prerequisites untouched; pass a list (possibly empty) to replace them wholesale.")
+		}),
+		outputSchema: S({
+			project: { type: "string" },
+			flag: { type: "string" },
+			environment: { type: "string" },
+			defaultVariationId: { type: "string" },
+			strategy: { type: "string" },
+			prerequisites: {
+				type: "array",
+				items: w({
+					prerequisiteFlagKey: { type: "string" },
+					expectedVariationKey: { type: "string" }
+				})
+			}
+		}, [
+			"project",
+			"flag",
+			"environment",
+			"defaultVariationId"
+		]),
+		annotations: { destructiveHint: !0 }
+	}, async ({ project: e, flag: n, environment: i, ...o }) => f(async () => (await t.api.request("PUT", `${r(e, n)}/environments/${a(i)}`, { body: o }), u({
+		project: e,
+		flag: n,
+		environment: i,
+		...o
+	})))), e.registerTool("flag_status", {
+		title: "Flag status across environments",
+		description: "Compact cross-environment view of one flag: enabled state, strategy, default variation, and prerequisites per environment.",
+		inputSchema: n.object({
+			project: T,
+			flag: E
+		}),
+		outputSchema: S({
+			key: g("string"),
+			name: g("string"),
+			type: g("string"),
+			archived: { type: "boolean" },
+			updatedAt: g("string"),
+			environments: {
+				type: "array",
+				items: w({
+					environment: g("string"),
+					enabled: { type: "boolean" },
+					strategy: g("string"),
+					defaultVariation: {
+						...g("string"),
+						description: "Variation key served on fallthrough"
+					},
+					prerequisites: { type: "array" }
+				})
+			}
+		}, [
+			"key",
+			"name",
+			"type",
+			"archived",
+			"updatedAt",
+			"environments"
+		]),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ project: e, flag: n }) => f(async () => {
+		let [i, a] = await Promise.all([t.api.request("GET", r(e, n)), t.api.request("GET", `${r(e, n)}/environments`)]), o = (e) => (i.variations ?? []).find((t) => t.id === e)?.key ?? e ?? null;
+		return u({
+			key: i.key ?? null,
+			name: i.name ?? null,
+			type: i.type ?? null,
+			archived: i.isArchived ?? !1,
+			updatedAt: i.updatedAt ?? null,
+			environments: a.map((e) => ({
+				environment: e.environmentKey ?? null,
+				enabled: e.isEnabled ?? !1,
+				strategy: e.strategy ?? null,
+				defaultVariation: o(e.defaultVariationId),
+				prerequisites: e.prerequisites ?? []
+			}))
+		});
+	}));
+}
+//#endregion
+//#region src/tools/targeting.ts
+var ne = n.object({
+	attribute: n.string().describe("Context attribute name, e.g. plan, country, user_id"),
+	operator: n.string().describe("OperatorType member name, case-sensitive — e.g. Equals, NotEquals, Contains, In, GreaterThan"),
+	values: n.array(n.string()),
+	negate: n.boolean().optional().default(!1)
+}), L = n.object({
+	description: n.string().optional(),
+	variationId: n.string().optional().describe("Variation served when the rule matches"),
+	rolloutPercentage: n.number().int().min(0).max(100).optional().describe("Percentage rollout for this rule"),
+	userSegmentId: n.string().optional().describe("Match users in this segment (see list_segments)"),
+	conditionGroups: n.array(n.object({
+		operator: n.enum(["And", "Or"]).describe("How conditions inside this group combine"),
+		conditions: n.array(ne)
+	})).optional().describe("Groups are ANDed together; conditions inside a group use the group operator")
+});
+function R(e, t) {
+	let r = (e, n, r) => `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/flags/${a(n)}/environments/${a(r)}/targeting`;
+	e.registerTool("get_targeting", {
+		title: "Get targeting rules",
+		description: "Get a flag's current targeting configuration (enabled flag + ordered rules) in one environment.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			environment: D
+		}),
+		outputSchema: x("GET /api/v1/orgs/{org}/projects/{project}/flags/{flag}/environments/{env}/targeting"),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ project: e, flag: n, environment: i }) => f(async () => u(await t.api.request("GET", r(e, n, i))))), e.registerTool("update_targeting", {
+		title: "Replace targeting rules",
+		description: "REPLACE all targeting rules of a flag in one environment (full PUT — rules not included are removed). Rules are evaluated in order. Get the current rules first with get_targeting.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			environment: D,
+			rules: n.array(L).describe("The complete ordered rule list; rules left out are deleted")
+		}),
+		outputSchema: S({
+			project: { type: "string" },
+			flag: { type: "string" },
+			environment: { type: "string" },
+			rulesReplaced: { type: "integer" }
+		}, [
+			"project",
+			"flag",
+			"environment",
+			"rulesReplaced"
+		]),
+		annotations: { destructiveHint: !0 }
+	}, async ({ project: e, flag: n, environment: i, rules: a }) => f(async () => (await t.api.request("PUT", r(e, n, i), { body: { rules: a } }), u({
+		project: e,
+		flag: n,
+		environment: i,
+		rulesReplaced: a.length
+	}))));
+}
+//#endregion
+//#region src/tools/variations.ts
+function z(e, t) {
+	e.registerTool("manage_variation", {
+		title: "Add, update, or remove a variation",
+		description: "Manage a flag's variations. action=add requires key + value; action=update/remove require variationId (get ids via get_flag). Removing a variation fails with VARIATION_HAS_DEPENDENTS if other flags depend on it.",
+		inputSchema: n.object({
+			project: T,
+			flag: E,
+			action: n.enum([
+				"add",
+				"update",
+				"remove"
+			]).describe("add needs key + value; update and remove need variationId"),
+			variationId: n.string().optional().describe("Required for update/remove"),
+			key: n.string().optional().describe("Required for add; immutable afterwards"),
+			name: n.string().optional().describe("Display name"),
+			value: n.string().optional().describe("Variation value serialized as a string; required for add"),
+			description: n.string().optional().describe("What this variation means")
+		}),
+		outputSchema: C(v("POST /api/v1/orgs/{org}/projects/{project}/flags/{flag}/variations"), w({ updated: {
+			type: "string",
+			description: "Id of the updated variation"
+		} }, ["updated"]), w({ removed: {
+			type: "string",
+			description: "Id of the removed variation"
+		} }, ["removed"])),
+		annotations: { destructiveHint: !0 }
+	}, async ({ project: e, flag: n, action: r, variationId: i, key: o, name: s, value: c, description: l }) => f(async () => {
+		let f = `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/flags/${a(n)}/variations`;
+		return r === "add" ? !o || c === void 0 ? d(/* @__PURE__ */ Error("action=add requires key and value")) : u(await t.api.request("POST", f, { body: {
+			key: o,
+			name: s,
+			value: c,
+			description: l
+		} })) : i ? r === "update" ? (await t.api.request("PUT", `${f}/${a(i)}`, { body: {
+			name: s,
+			value: c,
+			description: l
+		} }), u({ updated: i })) : (await t.api.request("DELETE", `${f}/${a(i)}`), u({ removed: i })) : d(/* @__PURE__ */ Error(`action=${r} requires variationId (see get_flag for ids)`));
+	}));
+}
+//#endregion
+//#region src/tools/webhooks.ts
+var B = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, V = "Requires an Admin token. A 404 on every webhook call means webhooks are not enabled for the organization.";
+function H(e, t) {
+	let r = `/api/v1/orgs/${a(t.org)}/webhooks`, i = (e) => `${r}/${a(e)}`;
+	async function o(e) {
+		let n = [];
+		for (let r of e) {
+			if (B.test(r)) {
+				n.push(r);
+				continue;
+			}
+			let e = await t.api.request("GET", `/api/v1/orgs/${a(t.org)}/projects/${a(r)}`);
+			if (!e?.id) throw Error(`Project "${r}" resolved without an id`);
+			n.push(e.id);
+		}
+		return n;
+	}
+	async function s(e) {
+		let n = e.map((e) => {
+			if (B.test(e)) return { id: e };
+			let t = e.indexOf("/"), n = e.slice(0, t), r = e.slice(t + 1);
+			if (t < 0 || !n || !r) throw Error(`Environment "${e}" needs its project: pass "<project>/<environment>", e.g. "web/production", or the environment's id.`);
+			return {
+				project: n,
+				env: r
+			};
+		}), r = [];
+		for (let e of n) {
+			if ("id" in e) {
+				r.push(e.id);
+				continue;
+			}
+			let n = await t.api.request("GET", `/api/v1/orgs/${a(t.org)}/projects/${a(e.project)}/environments/${a(e.env)}`);
+			if (!n?.id) throw Error(`Environment "${e.project}/${e.env}" resolved without an id`);
+			r.push(n.id);
+		}
+		return r;
+	}
+	e.registerTool("list_webhooks", {
+		title: "List webhook subscriptions",
+		description: "List the organization's outbound webhook subscriptions (url, event/project/environment filters, enabled state, failure count, signing secret ids — never secret values), plus availableEventTypes: the event types a subscription can filter on. Empty filter lists mean \"all\". Paginated via cursor. " + V,
+		inputSchema: n.object({ ...O }),
+		outputSchema: ee("GET /api/v1/orgs/{org}/webhooks", { availableEventTypes: {
+			type: "array",
+			items: { type: "string" },
+			description: "Event types a subscription can filter on"
+		} }),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ limit: e, cursor: n }) => f(async () => {
+		let [i, a] = await Promise.all([t.api.request("GET", r, { query: {
+			limit: e,
+			cursor: n
+		} }), t.api.request("GET", `${r}/event-types`)]);
+		return u({
+			...i,
+			availableEventTypes: a
+		});
+	})), e.registerTool("list_webhook_deliveries", {
+		title: "List webhook deliveries",
+		description: "List one subscription's delivery attempts, most recent first. status is Pending (awaiting an attempt, backing off, or in flight), Succeeded or DeadLettered; lastResponseStatusCode and lastError explain a failure. Paginated via cursor. " + V,
+		inputSchema: n.object({
+			id: n.string().describe("Subscription id (from list_webhooks)"),
+			...O
+		}),
+		outputSchema: x("GET /api/v1/orgs/{org}/webhooks/{id}/deliveries"),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ id: e, limit: n, cursor: r }) => f(async () => u(await t.api.request("GET", `${i(e)}/deliveries`, { query: {
+		limit: n,
+		cursor: r
+	} })))), e.registerTool("manage_webhook", {
+		title: "Create, update, or delete a webhook subscription, or rotate its secret",
+		description: "action=create requires name + url and returns the signing secret. action=update/delete/rotate_secret/retire_secret require id. update changes only the fields you pass and keeps the rest; pass an empty list to widen that filter back to \"all\". projects take project keys or ids; environments take \"<project>/<environment>\" keys (e.g. \"web/production\") or ids. eventTypes come from list_webhooks → availableEventTypes. create and rotate_secret return a secret that is NEVER shown again: relay it to the user verbatim so they can store it. rotate_secret adds a new active secret while the old one keeps signing; retire_secret (secretId from list_webhooks) removes one and is refused for the last active secret. A project-restricted service token must list at least one project, all in its scope. " + V,
+		inputSchema: n.object({
+			action: n.enum([
+				"create",
+				"update",
+				"delete",
+				"rotate_secret",
+				"retire_secret"
+			]).describe("What to do; every action except create needs id"),
+			id: n.string().optional().describe("Subscription id; required for everything except create"),
+			name: n.string().optional().describe("Required for create"),
+			url: n.string().optional().describe("Receiver URL; required for create"),
+			eventTypes: n.array(n.string()).optional().describe("Event types to send; empty or omitted = all"),
+			projects: n.array(n.string()).optional().describe("Project keys or ids to cover; empty or omitted on create = all"),
+			environments: n.array(n.string()).optional().describe("\"<project>/<environment>\" keys or environment ids; empty or omitted on create = all"),
+			enabled: n.boolean().optional().describe("update only; subscriptions are created enabled"),
+			secretId: n.string().optional().describe("Required for retire_secret"),
+			idempotency_key: n.string().optional().describe("Idempotency-Key header for create / rotate_secret")
+		}),
+		outputSchema: C(v("POST /api/v1/orgs/{org}/webhooks"), w({
+			id: { type: "string" },
+			updated: { type: "boolean" },
+			name: g("string"),
+			url: g("string"),
+			eventTypes: {
+				type: ["array", "null"],
+				items: { type: "string" }
+			},
+			projectIds: {
+				type: ["array", "null"],
+				items: { type: "string" }
+			},
+			environmentIds: {
+				type: ["array", "null"],
+				items: { type: "string" }
+			},
+			isEnabled: g("boolean")
+		}, ["id", "updated"]), w({ deleted: { type: "string" } }, ["deleted"]), v("POST /api/v1/orgs/{org}/webhooks/{id}/secrets"), w({
+			id: { type: "string" },
+			retiredSecretId: { type: "string" }
+		}, ["id", "retiredSecretId"])),
+		annotations: { destructiveHint: !0 }
+	}, async ({ action: e, id: n, name: c, url: l, eventTypes: p, projects: m, environments: h, enabled: g, secretId: _, idempotency_key: v }) => f(async () => {
+		if (e === "create") {
+			if (!c || !l) return d(/* @__PURE__ */ Error("action=create requires name and url"));
+			let e = h && await s(h), n = m && await o(m);
+			return u(await t.api.request("POST", r, {
+				body: {
+					name: c,
+					url: l,
+					provider: "GenericHttp",
+					eventTypes: p,
+					projectIds: n,
+					environmentIds: e
+				},
+				idempotencyKey: v
+			}));
+		}
+		if (!n) return d(/* @__PURE__ */ Error(`action=${e} requires id (see list_webhooks)`));
+		if (e === "update") {
+			let e = h && await s(h), r = m && await o(m), a = await t.api.request("GET", i(n)), d = {
+				name: c ?? a.name,
+				url: l ?? a.url,
+				eventTypes: p ?? a.eventTypes,
+				projectIds: r ?? a.projectIds,
+				environmentIds: e ?? a.environmentIds,
+				isEnabled: g ?? a.isEnabled
+			};
+			return await t.api.request("PUT", i(n), { body: d }), u({
+				id: n,
+				updated: !0,
+				...d
+			});
+		}
+		return e === "delete" ? (await t.api.request("DELETE", i(n)), u({ deleted: n })) : e === "rotate_secret" ? u(await t.api.request("POST", `${i(n)}/secrets`, { idempotencyKey: v })) : _ ? (await t.api.request("DELETE", `${i(n)}/secrets/${a(_)}`), u({
+			id: n,
+			retiredSecretId: _
+		})) : d(/* @__PURE__ */ Error("action=retire_secret requires secretId (see list_webhooks)"));
+	})), e.registerTool("deliver_webhook", {
+		title: "Send a test event or redeliver",
+		description: "action=test queues one synthetic flag.toggled event to this subscription alone; action=redeliver (deliveryId from list_webhook_deliveries) re-sends a finished delivery, restarting its retry schedule. Delivery is asynchronous: read list_webhook_deliveries for the outcome. Both are refused for a disabled subscription, and redeliver for a delivery that is still Pending. " + V,
+		inputSchema: n.object({
+			action: n.enum(["test", "redeliver"]).describe("test sends a synthetic event; redeliver re-sends deliveryId"),
+			id: n.string().describe("Subscription id (from list_webhooks)"),
+			deliveryId: n.string().optional().describe("Required for redeliver")
+		}),
+		outputSchema: C(v("POST /api/v1/orgs/{org}/webhooks/{id}/test"), w({
+			id: { type: "string" },
+			redelivered: { type: "string" }
+		}, ["id", "redelivered"])),
+		annotations: {
+			destructiveHint: !1,
+			openWorldHint: !0
+		}
+	}, async ({ action: e, id: n, deliveryId: r }) => f(async () => e === "test" ? u(await t.api.request("POST", `${i(n)}/test`)) : r ? (await t.api.request("POST", `${i(n)}/deliveries/${a(r)}/redeliver`), u({
+		id: n,
+		redelivered: r
+	})) : d(/* @__PURE__ */ Error("action=redeliver requires deliveryId (see list_webhook_deliveries)"))));
+}
+//#endregion
+//#region src/tools/workflows/stale-flags.ts
+var U = n.enum(["dead", "stale"]), W = 50;
+function G(e, t) {
+	e.registerTool("find_stale_flags", {
+		title: "Find stale flags",
+		description: `Find flags that look ready for code cleanup: not updated in N days AND either enabled in every environment (verify rollout is complete before removing — per-rule percentage ramps are not inspected) or disabled in every environment (dead — remove flag and code path). A flag whose expiry date (set_flag_expiry) has passed is always a candidate, however recently it was edited; if it is on in some environments and off in others its reason is past-expiry, meaning the owner has to decide which way to fold it. A project can give its temporary flags a default lifetime, so a flag with no date of its own can still be past expiry. Every result carries expiresAtUtc (the date set on the flag), effectiveExpiresAtUtc (the date in effect, from the flag or its project default), expirySource (explicit, project-default, or null), expired and owner (null when unowned). Flags marked permanent (kill switches, ops toggles) are never listed. Pass owner to see one person's stale flags ("me" for your own) or "none" for the unowned ones. Every result also carries blockedBy: the live flags that still list it as a prerequisite, which have to be removed and archived before it ([] when none). blockedBy is null when the server did not classify the flag as a removal candidate, which means unknown, not unblocked. A flag that other live flags list as a prerequisite has to be removed LAST, dependents first: archiving it while a dependent still names it makes that dependent fail its prerequisite check and serve its off variation, so archive_flag refuses it with FLAG_HAS_DEPENDENTS. Checks at most ${W} candidates per call, expired flags first.`,
+		inputSchema: n.object({
+			project: T,
+			days: n.number().int().min(1).optional().default(30).describe("Minimum age in days since last update"),
+			owner: M
+		}),
+		outputSchema: S({
+			project: { type: "string" },
+			olderThanDays: { type: "integer" },
+			owner: { type: "string" },
+			checked: { type: "integer" },
+			truncated: { type: "boolean" },
+			note: { type: "string" },
+			blockedByNote: { type: "string" },
+			stale: {
+				type: "array",
+				items: w({
+					key: { type: "string" },
+					name: { type: "string" },
+					updatedAt: { type: "string" },
+					expiresAtUtc: g("string"),
+					effectiveExpiresAtUtc: g("string"),
+					expirySource: {
+						...g("string"),
+						description: "explicit, project-default, or null"
+					},
+					expired: { type: "boolean" },
+					owner: { anyOf: [_("PublicFlagOwner"), { type: "null" }] },
+					reason: {
+						type: "string",
+						description: "enabled-everywhere, disabled-everywhere or past-expiry"
+					},
+					environments: { type: "integer" },
+					blockedBy: {
+						type: ["array", "null"],
+						items: { type: "string" },
+						description: "null means unknown, not unblocked"
+					}
+				})
+			}
+		}, [
+			"project",
+			"olderThanDays",
+			"checked",
+			"truncated",
+			"stale"
+		]),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ project: e, days: n, owner: r }) => f(async () => {
+		let o = await N(t, r), s = `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/flags`, c = Date.now(), l = c - n * 24 * 60 * 60 * 1e3, d = (e) => e.effectiveExpiresAtUtc ?? e.expiresAtUtc ?? null, f = (e) => e.expirySource ?? (e.expiresAtUtc ? "explicit" : null), p = (e) => {
+			let t = d(e);
+			return !!t && new Date(t).getTime() <= c;
+		}, m = [], h;
+		do {
+			let e = await t.api.request("GET", s, { query: {
+				archived: !1,
+				limit: 100,
+				cursor: h,
+				owner: o,
+				permanent: !1
+			} });
+			m.push(...(e.items ?? []).filter((e) => !!e.key && !!e.name && !!e.updatedAt && (new Date(e.updatedAt).getTime() < l || p(e)))), h = e.next_cursor ?? void 0;
+		} while (h);
+		m.sort((e, t) => Number(p(t)) - Number(p(e)));
+		let g = m.length > W, _ = m.slice(0, W), v = [];
+		for (let e of _) {
+			let n = await t.api.request("GET", `${s}/${a(e.key)}/environments`);
+			if (n.length === 0) continue;
+			let r = p(e), i = n.every((e) => e.isEnabled), o = n.every((e) => !e.isEnabled);
+			(i || o || r) && v.push({
+				key: e.key,
+				name: e.name,
+				updatedAt: e.updatedAt,
+				expiresAtUtc: e.expiresAtUtc ?? null,
+				effectiveExpiresAtUtc: d(e),
+				expirySource: f(e),
+				expired: r,
+				owner: e.owner ?? null,
+				reason: i ? "enabled-everywhere" : o ? "disabled-everywhere" : "past-expiry",
+				environments: n.length,
+				blockedBy: null
+			});
+		}
+		let y;
+		if (v.length > 0) try {
+			let e = /* @__PURE__ */ new Map(), n;
+			do {
+				let r = await t.api.request("GET", `${s}/removal-candidates`, { query: {
+					staleness: "stale",
+					limit: 100,
+					cursor: n
+				} });
+				for (let t of r.items ?? []) t.key && t.blockedBy && e.set(t.key, t.blockedBy);
+				n = r.next_cursor ?? void 0;
+			} while (n);
+			for (let t of v) t.blockedBy = e.get(t.key) ?? null;
+		} catch (e) {
+			if (!(e instanceof i)) throw e;
+			y = `Could not read removal-candidates (${e.status} ${e.envelope.error}), so blockedBy is unknown for every flag. archive_flag still refuses any flag that a live flag depends on (FLAG_HAS_DEPENDENTS).`;
+		}
+		return u({
+			project: e,
+			olderThanDays: n,
+			...o ? { owner: o } : {},
+			checked: _.length,
+			truncated: g,
+			...g ? { note: `Only the first ${W} of ${m.length} candidates were checked.` } : {},
+			...y ? { blockedByNote: y } : {},
+			stale: v
+		});
+	})), e.registerTool("list_removal_candidates", {
+		title: "List removal candidates",
+		description: "List the flags the server is confident can be removed from code, the same list the Featureflip flag cleanup GitHub Action works from. Each item has key, reason, status (Dead or Stale), treatment (true = keep the on-branch, false = keep the off-branch) and blockedBy: the live flags that still list it as a prerequisite. Only remove a flag whose blockedBy is empty. A flag that other live flags list as a prerequisite has to be removed LAST, dependents first: archiving it while a dependent still names it makes that dependent fail its prerequisite check and serve its off variation, so archive_flag refuses it with FLAG_HAS_DEPENDENTS. staleness \"dead\" (the default) returns only dead flags, \"stale\" adds stale ones. Paginated via cursor.",
+		inputSchema: n.object({
+			project: T,
+			staleness: U.optional().describe("Minimum staleness tier: dead (default) or stale"),
+			...O
+		}),
+		outputSchema: x("GET /api/v1/orgs/{org}/projects/{project}/flags/removal-candidates"),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ project: e, ...n }) => f(async () => u(await t.api.request("GET", `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/flags/removal-candidates`, { query: n }))));
+}
+//#endregion
+//#region src/tools/workflows/snippets.ts
+var K = [
+	"js",
+	"node",
+	"browser",
+	"react",
+	"python",
+	"csharp",
+	"java",
+	"go",
+	"php",
+	"ruby",
+	"swift"
+], q = [
+	"browser",
+	"react",
+	"swift"
+];
+function J(e) {
+	return q.includes(e);
+}
+var Y = "Uses a SERVER-side SDK key (Featureflip dashboard → environment → SDK keys).", X = "Uses a CLIENT-side SDK key (safe to ship to browsers/apps).";
+function re(e, t) {
+	switch (e) {
+		case "js": return {
+			install: "npm install @featureflip/js",
+			code: `import { FeatureflipClient, createNodePlatform } from '@featureflip/js';
+
+const client = FeatureflipClient.get(
+  { sdkKey: process.env.FEATUREFLIP_SDK_KEY!, baseUrl: 'https://eval.featureflip.io' },
+  createNodePlatform(),
+);
+await client.waitForInitialization();
+const enabled = client.boolVariation('${t}', { user_id: userId }, false);
+if (enabled) {
+  // new code path
+}`,
+			notes: Y
+		};
+		case "node": return {
+			install: "npm install @featureflip/node",
+			code: `import { FeatureflipClient } from '@featureflip/node';
+
+const client = await FeatureflipClient.create({ sdkKey: process.env.FEATUREFLIP_SDK_KEY! });
+const enabled = client.boolVariation('${t}', { user_id: userId }, false);
+if (enabled) {
+  // new code path
+}`,
+			notes: Y
+		};
+		case "browser": return {
+			install: "npm install @featureflip/browser",
+			code: `import { FeatureflipClient } from '@featureflip/browser';
+
+const client = FeatureflipClient.get({ clientKey: 'YOUR_CLIENT_SDK_KEY' });
+await client.initialize();
+const enabled = client.boolVariation('${t}', false);
+if (enabled) {
+  // new code path
+}`,
+			notes: X
+		};
+		case "react": return {
+			install: "npm install @featureflip/react @featureflip/browser",
+			code: `import { FeatureflipProvider, useFeatureFlag } from '@featureflip/react';
+
+// In your app root:
+// <FeatureflipProvider clientKey="YOUR_CLIENT_SDK_KEY">...</FeatureflipProvider>
+
+function MyComponent() {
+  const enabled = useFeatureFlag('${t}', false);
+  return enabled ? <NewExperience /> : <CurrentExperience />;
+}`,
+			notes: X
+		};
+		case "python": return {
+			install: "pip install featureflip",
+			code: `from featureflip import FeatureflipClient
+
+client = FeatureflipClient(sdk_key=os.environ["FEATUREFLIP_SDK_KEY"])
+enabled = client.variation("${t}", {"user_id": user_id}, default=False)
+if enabled:
+    # new code path
+    ...`,
+			notes: Y
+		};
+		case "csharp": return {
+			install: "dotnet add package Featureflip.Client",
+			code: `using Featureflip.Client;
+
+var client = FeatureflipClient.Get(Environment.GetEnvironmentVariable("FEATUREFLIP_SDK_KEY")!);
+var enabled = client.BoolVariation("${t}",
+    new EvaluationContext { UserId = userId }, false);
+if (enabled)
+{
+    // new code path
+}`,
+			notes: Y
+		};
+		case "java": return {
+			install: "implementation 'io.featureflip:featureflip-java:2.0.0'",
+			code: `import io.featureflip.client.FeatureflipClient;
+import io.featureflip.client.EvaluationContext;
+
+FeatureflipClient client = FeatureflipClient.get(System.getenv("FEATUREFLIP_SDK_KEY"));
+client.waitForInitialization();
+boolean enabled = client.boolVariation("${t}",
+    EvaluationContext.of(userId), false);
+if (enabled) {
+    // new code path
+}`,
+			notes: Y
+		};
+		case "go": return {
+			install: "go get github.com/canopy-labs/featureflip-go/v2",
+			code: `import featureflip "github.com/canopy-labs/featureflip-go/v2"
+
+client, err := featureflip.Get(os.Getenv("FEATUREFLIP_SDK_KEY"))
+if err != nil {
+    log.Fatal(err)
+}
+defer client.Close()
+
+ctx := featureflip.EvaluationContext{UserID: userID}
+if client.BoolVariation("${t}", ctx, false) {
+    // new code path
+}`,
+			notes: Y
+		};
+		case "php": return {
+			install: "composer require featureflip/featureflip-php",
+			code: `use Featureflip\\FeatureflipClient;
+use Featureflip\\Config;
+
+$client = FeatureflipClient::get(getenv('FEATUREFLIP_SDK_KEY'), new Config(
+    cache: $psrCache, httpClient: $psrHttpClient,
+    requestFactory: $psrRequestFactory, streamFactory: $psrStreamFactory,
+));
+$enabled = $client->boolVariation('${t}', ['user_id' => $userId], false);
+if ($enabled) {
+    // new code path
+}`,
+			notes: Y + " Requires PSR-16 cache and PSR-18 HTTP implementations."
+		};
+		case "ruby": return {
+			install: "gem \"featureflip\"",
+			code: `require "featureflip"
+
+client = Featureflip::Client.get(ENV.fetch("FEATUREFLIP_SDK_KEY"))
+enabled = client.bool_variation("${t}", { "user_id" => user_id }, false)
+if enabled
+  # new code path
+end`,
+			notes: Y
+		};
+		case "swift": return {
+			install: ".package(url: \"https://github.com/canopy-labs/featureflip-swift\", from: \"2.0.0\")",
+			code: `import Featureflip
+
+let config = FeatureflipConfig(clientKey: "YOUR_CLIENT_SDK_KEY")
+let client = FeatureflipClient(config: config)
+await client.initialize()
+let enabled = client.boolVariation("${t}", default: false)
+if enabled {
+    // new code path
+}`,
+			notes: X
+		};
+	}
+}
+//#endregion
+//#region src/tools/workflows/wrap-feature.ts
+function ie(e, t) {
+	e.registerTool("wrap_feature", {
+		title: "Wrap a feature in a new flag",
+		description: "Create a Boolean feature flag and get back the SDK code snippet to guard the new code path with it. Returns the snippet only — apply the edit yourself. The flag starts DISABLED in every environment; enable it with toggle_flag when ready.",
+		inputSchema: n.object({
+			project: n.string().describe("Project key"),
+			key: n.string().describe("Flag key, e.g. new-checkout"),
+			name: n.string().optional().describe("Display name; defaults to the key"),
+			description: n.string().optional().describe("What this flag guards"),
+			tags: n.array(n.string()).optional().describe("Tags for filtering, e.g. team or area"),
+			language: n.enum(K).describe("SDK language of the codebase being edited"),
+			idempotency_key: n.string().optional().describe("Idempotency-Key header for safe retries")
+		}),
+		outputSchema: S({
+			flag: v("POST /api/v1/orgs/{org}/projects/{project}/flags"),
+			integration: w({
+				language: { type: "string" },
+				install: { type: "string" },
+				code: { type: "string" },
+				notes: { type: "string" }
+			}),
+			next_steps: {
+				type: "array",
+				items: { type: "string" }
+			}
+		}, [
+			"flag",
+			"integration",
+			"next_steps"
+		]),
+		annotations: { destructiveHint: !1 }
+	}, async ({ project: e, key: n, name: r, description: i, tags: o, language: s, idempotency_key: c }) => f(async () => {
+		let l = await t.api.request("POST", `/api/v1/orgs/${a(t.org)}/projects/${a(e)}/flags`, {
+			body: {
+				key: n,
+				name: r ?? n,
+				type: "Boolean",
+				description: i,
+				tags: o,
+				...J(s) ? { clientSideVisible: !0 } : {}
+			},
+			idempotencyKey: c
+		}), d = re(s, n);
+		return u({
+			flag: l,
+			integration: {
+				language: s,
+				install: d.install,
+				code: d.code,
+				notes: d.notes
+			},
+			next_steps: [
+				"Apply the snippet around the new code path.",
+				`Enable in a non-production environment first: toggle_flag { project: "${e}", flag: "${n}", environment: "<env>", enabled: true }.`,
+				"Ramp with update_targeting (rolloutPercentage) when ready."
+			]
+		});
+	}));
+}
+//#endregion
+//#region src/server.ts
+function Z(t) {
+	let n = new e({
+		name: "featureflip",
+		version: r
+	});
+	return k(n, t), A(n, t), j(n, t), F(n, t), te(n, t), R(n, t), z(n, t), H(n, t), G(n, t), ie(n, t), n;
+}
+//#endregion
+//#region src/config.ts
+var Q = "FEATUREFLIP_TOKEN is required. Create one in the Featureflip dashboard — Settings → API Tokens (personal token, ffp_...) or Organization Settings → Service Tokens (ffs_...) — and set it in your MCP client config.";
+function $(e = process.env) {
+	let t = e.FEATUREFLIP_TOKEN?.trim();
+	return t ? {
+		token: t,
+		baseUrl: (e.FEATUREFLIP_API_URL?.trim() || "https://api.featureflip.io").replace(/\/+$/, ""),
+		org: e.FEATUREFLIP_ORG?.trim() || void 0
+	} : null;
+}
+function ae(e = process.env) {
+	let t = $(e);
+	if (!t) throw Error(Q);
+	return t;
+}
+//#endregion
+//#region src/org.ts
+async function oe(e, t) {
+	if (t) return t;
+	let n = (await e.request("GET", "/api/v1/orgs", { query: { limit: 100 } })).items ?? [];
+	if (n.length === 1) {
+		let e = n[0].slug;
+		if (!e) throw Error("The token can see one organization, but it has no slug set.");
+		return e;
+	}
+	throw n.length === 0 ? Error("The token can see no organizations. Check the token in the Featureflip dashboard.") : Error(`The token can see ${n.length} organizations — set FEATUREFLIP_ORG to one of: ` + n.map((e) => e.slug ?? "?").join(", "));
+}
+//#endregion
+export { Z as a, r as c, $ as i, Q as n, i as o, ae as r, l as s, oe as t };