@featureflip/mcp 0.1.6 → 0.1.8

package/dist/{org-BixGfyQ6.js → org-DZ1ge1Mx.js}

@@ -4,9 +4,21 @@ import * as t from "zod/v4";
 //#region src/version.ts
 var n = {
 	name: "@featureflip/mcp",
-	version: "0.1.6",
+	version: "0.1.8",
 	mcpName: "io.github.canopy-labs/featureflip",
 	description: "MCP server for managing Featureflip feature flags from AI agents and editors",
+	keywords: [
+		"feature-flags",
+		"feature-toggles",
+		"feature-management",
+		"featureflip",
+		"mcp",
+		"mcp-server",
+		"model-context-protocol",
+		"ai-agents",
+		"claude",
+		"cursor"
+	],
 	license: "Apache-2.0",
 	repository: {
 		type: "git",
@@ -32,16 +44,16 @@ var n = {
 	},
 	dependencies: {
 		"@modelcontextprotocol/server": "2.0.0",
-		zod: "^4.6.2"
+		zod: "^4.6.5"
 	},
 	devDependencies: {
 		"@modelcontextprotocol/client": "2.0.0",
 		"@typescript/typescript6": "^6.0.2",
-		"@types/node": "^26.5.1",
+		"@types/node": "^26.6.2",
 		typescript: "^7.0.2",
 		vite: "^8.3.0",
-		"vite-plugin-dts": "^5.1.0",
-		vitest: "^5.0.0"
+		"vite-plugin-dts": "^5.1.1",
+		vitest: "^5.0.1"
 	},
 	engines: { node: ">=20.19.0" }
 }.version, r = class extends Error {
@@ -54,51 +66,73 @@ var n = {
 function i(e) {
 	return encodeURIComponent(e);
 }
-var a = class {
+var a = /* @__PURE__ */ new Set([
+	502,
+	503,
+	504
+]), o = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"PUT",
+	"DELETE"
+]), s = [250, 1e3], c = class {
 	opts;
 	fetchImpl;
+	sleep;
 	constructor(e) {
-		this.opts = e, this.fetchImpl = e.fetchImpl ?? fetch;
+		this.opts = e, this.fetchImpl = e.fetchImpl ?? fetch, this.sleep = e.sleep ?? ((e) => new Promise((t) => setTimeout(t, e)));
 	}
 	async request(e, t, n = {}) {
 		let i = new URL(this.opts.baseUrl + t);
 		for (let [e, t] of Object.entries(n.query ?? {})) t !== void 0 && i.searchParams.set(e, String(t));
-		let a = {
+		let c = {
 			Authorization: `Bearer ${this.opts.token}`,
 			Accept: "application/json"
-		}, o;
-		n.body !== void 0 && (a["Content-Type"] = "application/json", o = JSON.stringify(n.body)), n.idempotencyKey && (a["Idempotency-Key"] = n.idempotencyKey);
-		let s = await this.fetchImpl(i.toString(), {
-			method: e,
-			headers: a,
-			body: o
-		});
-		if (s.status !== 204) {
-			if (!s.ok) {
+		}, l;
+		n.body !== void 0 && (c["Content-Type"] = "application/json", l = JSON.stringify(n.body)), n.idempotencyKey && (c["Idempotency-Key"] = n.idempotencyKey);
+		let u = o.has(e) || n.idempotencyKey !== void 0, d;
+		for (let t = 0;; t++) {
+			let n = t < s.length;
+			try {
+				d = await this.fetchImpl(i.toString(), {
+					method: e,
+					headers: c,
+					body: l
+				});
+			} catch (e) {
+				if (!u || !n) throw e;
+				await this.sleep(s[t]);
+				continue;
+			}
+			if (!(u ? a.has(d.status) : d.status === 503) || !n) break;
+			await d.body?.cancel(), await this.sleep(s[t]);
+		}
+		if (d.status !== 204) {
+			if (!d.ok) {
 				let e;
 				try {
-					if (e = await s.json(), typeof e?.error != "string") throw Error("not an envelope");
+					if (e = await d.json(), typeof e?.error != "string") throw Error("not an envelope");
 				} catch {
 					e = {
-						error: `http_${s.status}`,
-						message: `HTTP ${s.status} from ${i.pathname}`
+						error: `http_${d.status}`,
+						message: `HTTP ${d.status} from ${i.pathname}`
 					};
 				}
-				throw new r(s.status, e);
+				throw new r(d.status, e);
 			}
-			return await s.json();
+			return await d.json();
 		}
 	}
 };
 //#endregion
 //#region src/errors.ts
-function o(e) {
+function l(e) {
 	return { content: [{
 		type: "text",
 		text: JSON.stringify(e, null, 2)
 	}] };
 }
-function s(e) {
+function u(e) {
 	if (e instanceof r) {
 		let t = e.envelope, n = [`Featureflip API error ${e.status} (${t.error}): ${t.message}`];
 		return t.fields && n.push(`Field errors: ${JSON.stringify(t.fields)}`), t.did_you_mean?.length && n.push(`Did you mean: ${t.did_you_mean.join(", ")}`), t.next_actions?.length && n.push(`Next actions: ${t.next_actions.map((e) => `${e.method} ${e.path}`).join("; ")}`), t.retry_after != null && n.push(`Rate limited — retry after ${t.retry_after}s.`), e.status === 404 && n.push("Note: 404 can also mean the public Management API is not enabled for this organization yet, or a service token does not include this project."), t.docs_url && n.push(`Docs: ${t.docs_url}`), {
@@ -117,33 +151,33 @@ function s(e) {
 		isError: !0
 	};
 }
-async function c(e) {
+async function d(e) {
 	try {
 		return await e();
 	} catch (e) {
-		return s(e);
+		return u(e);
 	}
 }
 //#endregion
 //#region src/tools/projects.ts
-var l = {
+var f = {
 	limit: t.number().int().min(1).max(100).optional().describe("Page size (default 20)"),
 	cursor: t.string().optional().describe("next_cursor from a previous response")
 };
-function u(e, n) {
+function p(e, n) {
 	e.registerTool("list_projects", {
 		title: "List projects",
 		description: "List projects in the Featureflip organization. Paginated: pass cursor from next_cursor to continue.",
-		inputSchema: t.object({ ...l }),
+		inputSchema: t.object({ ...f }),
 		annotations: { readOnlyHint: !0 }
-	}, async ({ limit: e, cursor: t }) => c(async () => o(await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects`, { query: {
+	}, async ({ limit: e, cursor: t }) => d(async () => l(await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects`, { query: {
 		limit: e,
 		cursor: t
 	} }))));
 }
 //#endregion
 //#region src/tools/environments.ts
-function d(e, n) {
+function m(e, n) {
 	e.registerTool("list_environments", {
 		title: "List environments",
 		description: "List the environments of a project (e.g. development, staging, production).",
@@ -153,14 +187,14 @@ function d(e, n) {
 			cursor: t.string().optional()
 		}),
 		annotations: { readOnlyHint: !0 }
-	}, async ({ project: e, limit: t, cursor: r }) => c(async () => o(await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/environments`, { query: {
+	}, async ({ project: e, limit: t, cursor: r }) => d(async () => l(await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/environments`, { query: {
 		limit: t,
 		cursor: r
 	} }))));
 }
 //#endregion
 //#region src/tools/segments.ts
-function f(e, n) {
+function h(e, n) {
 	e.registerTool("list_segments", {
 		title: "List user segments",
 		description: "List reusable user segments in a project. Segments are referenced from targeting rules via userSegmentId.",
@@ -170,7 +204,7 @@ function f(e, n) {
 			cursor: t.string().optional()
 		}),
 		annotations: { readOnlyHint: !0 }
-	}, async ({ project: e, limit: t, cursor: r }) => c(async () => o(await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/segments`, { query: {
+	}, async ({ project: e, limit: t, cursor: r }) => d(async () => l(await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/segments`, { query: {
 		limit: t,
 		cursor: r
 	} })))), e.registerTool("get_segment", {
@@ -181,17 +215,17 @@ function f(e, n) {
 			segment: t.string().describe("Segment key or id")
 		}),
 		annotations: { readOnlyHint: !0 }
-	}, async ({ project: e, segment: t }) => c(async () => o(await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/segments/${i(t)}`))));
+	}, async ({ project: e, segment: t }) => d(async () => l(await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/segments/${i(t)}`))));
 }
 //#endregion
 //#region src/tools/flags.ts
-var p = t.enum([
+var g = t.enum([
 	"Boolean",
 	"String",
 	"Number",
 	"Json"
 ]);
-function m(e, n) {
+function _(e, n) {
 	let r = (e) => `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/flags`;
 	e.registerTool("list_flags", {
 		title: "List feature flags",
@@ -200,13 +234,13 @@ function m(e, n) {
 			project: t.string().describe("Project key"),
 			search: t.string().optional(),
 			tag: t.string().optional(),
-			type: p.optional(),
+			type: g.optional(),
 			archived: t.boolean().optional().describe("true = only archived, false = only active"),
 			limit: t.number().int().min(1).max(100).optional(),
 			cursor: t.string().optional()
 		}),
 		annotations: { readOnlyHint: !0 }
-	}, async ({ project: e, ...t }) => c(async () => o(await n.api.request("GET", r(e), { query: t })))), e.registerTool("get_flag", {
+	}, async ({ project: e, ...t }) => d(async () => l(await n.api.request("GET", r(e), { query: t })))), e.registerTool("get_flag", {
 		title: "Get feature flag",
 		description: "Get one feature flag with its variations and metadata. Address by flag key or id.",
 		inputSchema: t.object({
@@ -214,14 +248,14 @@ function m(e, n) {
 			flag: t.string().describe("Flag key or id")
 		}),
 		annotations: { readOnlyHint: !0 }
-	}, async ({ project: e, flag: t }) => c(async () => o(await n.api.request("GET", `${r(e)}/${i(t)}`)))), e.registerTool("create_flag", {
+	}, async ({ project: e, flag: t }) => d(async () => l(await n.api.request("GET", `${r(e)}/${i(t)}`)))), e.registerTool("create_flag", {
 		title: "Create feature flag",
 		description: "Create a feature flag. type is one of Boolean|String|Number|Json. Boolean flags get true/false variations automatically; for other types pass initialVariations. The flag is created in every environment of the project (disabled).",
 		inputSchema: t.object({
 			project: t.string().describe("Project key"),
 			key: t.string().describe("Unique flag key, e.g. checkout-v2"),
 			name: t.string(),
-			type: p,
+			type: g,
 			description: t.string().optional(),
 			tags: t.array(t.string()).optional(),
 			clientSideVisible: t.boolean().optional().describe("Expose to client-side SDKs (browser/mobile)"),
@@ -231,10 +265,11 @@ function m(e, n) {
 				value: t.string().describe("Variation value serialized as a string"),
 				description: t.string().optional()
 			})).optional(),
+			expiresAtUtc: t.string().optional().describe("Optional ISO-8601 UTC instant the flag is expected to be removed by (see set_flag_expiry)"),
 			idempotency_key: t.string().optional().describe("Idempotency-Key header for safe retries")
 		}),
 		annotations: { destructiveHint: !1 }
-	}, async ({ project: e, idempotency_key: t, ...i }) => c(async () => o(await n.api.request("POST", r(e), {
+	}, async ({ project: e, idempotency_key: t, ...i }) => d(async () => l(await n.api.request("POST", r(e), {
 		body: i,
 		idempotencyKey: t
 	})))), e.registerTool("update_flag", {
@@ -249,11 +284,30 @@ function m(e, n) {
 			clientSideVisible: t.boolean().optional()
 		}),
 		annotations: { destructiveHint: !0 }
-	}, async ({ project: e, flag: t, ...a }) => c(async () => (await n.api.request("PUT", `${r(e)}/${i(t)}`, { body: a }), o({
+	}, async ({ project: e, flag: t, ...a }) => d(async () => (await n.api.request("PUT", `${r(e)}/${i(t)}`, { body: a }), l({
 		project: e,
 		flag: t,
 		updated: !0
-	})))), e.registerTool("delete_flag", {
+	})))), e.registerTool("set_flag_expiry", {
+		title: "Set or clear flag expiry",
+		description: "Set the date a flag is expected to be removed by, or pass expiresAtUtc: null to clear it. Expiry is advisory: evaluation never changes. Once the date passes, find_stale_flags reports the flag as expired. expiresAtUtc is an exact ISO-8601 UTC instant; a bare date means 00:00 UTC that day, so pass e.g. 2026-12-31T23:59:59Z for the end of a day. Refused with EXPIRY_IN_PAST for a time that has already passed, and with FEATURE_NOT_ENABLED while flag expiration is not enabled for the organization. Clearing is always allowed.",
+		inputSchema: t.object({
+			project: t.string(),
+			flag: t.string().describe("Flag key or id"),
+			expiresAtUtc: t.string().nullable().describe("ISO-8601 UTC instant, or null to clear the expiry")
+		}),
+		annotations: {
+			destructiveHint: !1,
+			idempotentHint: !0
+		}
+	}, async ({ project: e, flag: t, expiresAtUtc: a }) => d(async () => {
+		let o = `${r(e)}/${i(t)}/expiry`;
+		return a === null ? await n.api.request("DELETE", o) : await n.api.request("PUT", o, { body: { expiresAtUtc: a } }), l({
+			project: e,
+			flag: t,
+			expiresAtUtc: a
+		});
+	})), e.registerTool("delete_flag", {
 		title: "Delete feature flag",
 		description: "PERMANENTLY delete a flag across all environments. Fails with FLAG_HAS_DEPENDENTS if other flags use it as a prerequisite. Prefer archive_flag unless the flag must be fully removed.",
 		inputSchema: t.object({
@@ -261,15 +315,16 @@ function m(e, n) {
 			flag: t.string().describe("Flag key or id")
 		}),
 		annotations: { destructiveHint: !0 }
-	}, async ({ project: e, flag: t }) => c(async () => (await n.api.request("DELETE", `${r(e)}/${i(t)}`), o({ deleted: t })))), e.registerTool("archive_flag", {
+	}, async ({ project: e, flag: t }) => d(async () => (await n.api.request("DELETE", `${r(e)}/${i(t)}`), l({ deleted: t })))), e.registerTool("archive_flag", {
 		title: "Archive feature flag",
-		description: "Archive a flag (soft-hide, evaluation stops serving it). Reversible with restore_flag.",
+		description: "Archive a flag (soft-hide, evaluation stops serving it). Reversible with restore_flag. Refused with FLAG_RECENTLY_EVALUATED while live traffic is still evaluating the flag, because archiving makes every caller fall back to its own hardcoded default — normally that means the code removal has merged but not deployed yet, and the refusal clears itself once it has.",
 		inputSchema: t.object({
 			project: t.string(),
-			flag: t.string()
+			flag: t.string(),
+			force: t.boolean().optional().describe("Archive even though traffic is still evaluating the flag. Only for clients that can never be updated (old mobile app versions), where traffic will never drain on its own.")
 		}),
 		annotations: { destructiveHint: !0 }
-	}, async ({ project: e, flag: t }) => c(async () => (await n.api.request("POST", `${r(e)}/${i(t)}/archive`), o({
+	}, async ({ project: e, flag: t, force: a }) => d(async () => (await n.api.request("POST", `${r(e)}/${i(t)}/archive`, { query: a ? { force: !0 } : {} }), l({
 		flag: t,
 		archived: !0
 	})))), e.registerTool("restore_flag", {
@@ -280,19 +335,19 @@ function m(e, n) {
 			flag: t.string()
 		}),
 		annotations: { destructiveHint: !1 }
-	}, async ({ project: e, flag: t }) => c(async () => (await n.api.request("POST", `${r(e)}/${i(t)}/restore`), o({
+	}, async ({ project: e, flag: t }) => d(async () => (await n.api.request("POST", `${r(e)}/${i(t)}/restore`), l({
 		flag: t,
 		archived: !1
 	}))));
 }
 //#endregion
 //#region src/tools/flag-environments.ts
-var h = t.enum([
+var v = t.enum([
 	"SingleVariation",
 	"PercentageRollout",
 	"TargetedRollout"
 ]);
-function g(e, n) {
+function y(e, n) {
 	let r = (e, t) => `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/flags/${i(t)}`;
 	e.registerTool("toggle_flag", {
 		title: "Toggle flag in environment",
@@ -304,11 +359,11 @@ function g(e, n) {
 			enabled: t.boolean()
 		}),
 		annotations: { destructiveHint: !0 }
-	}, async ({ project: e, flag: t, environment: a, enabled: s }) => c(async () => (await n.api.request("POST", `${r(e, t)}/environments/${i(a)}/toggle`, { body: { enabled: s } }), o({
+	}, async ({ project: e, flag: t, environment: a, enabled: o }) => d(async () => (await n.api.request("POST", `${r(e, t)}/environments/${i(a)}/toggle`, { body: { enabled: o } }), l({
 		project: e,
 		flag: t,
 		environment: a,
-		enabled: s
+		enabled: o
 	})))), e.registerTool("update_flag_environment_config", {
 		title: "Update flag environment config",
 		description: "Update a flag's per-environment serving config: defaultVariationId (served on fallthrough, required), strategy (SingleVariation | PercentageRollout | TargetedRollout — only SingleVariation is currently supported at the environment level), and prerequisites. Percentage rollouts are configured on targeting rules via update_targeting.",
@@ -317,18 +372,18 @@ function g(e, n) {
 			flag: t.string(),
 			environment: t.string(),
 			defaultVariationId: t.string().describe("Variation id to serve on fallthrough — required by the API"),
-			strategy: h.optional(),
+			strategy: v.optional(),
 			prerequisites: t.array(t.object({
 				prerequisiteFlagKey: t.string(),
 				expectedVariationKey: t.string()
 			})).optional().describe("Flags that must evaluate to the expected variation before this flag serves. Omit to leave existing prerequisites untouched; pass a list (possibly empty) to replace them wholesale.")
 		}),
 		annotations: { destructiveHint: !0 }
-	}, async ({ project: e, flag: t, environment: a, ...s }) => c(async () => (await n.api.request("PUT", `${r(e, t)}/environments/${i(a)}`, { body: s }), o({
+	}, async ({ project: e, flag: t, environment: a, ...o }) => d(async () => (await n.api.request("PUT", `${r(e, t)}/environments/${i(a)}`, { body: o }), l({
 		project: e,
 		flag: t,
 		environment: a,
-		...s
+		...o
 	})))), e.registerTool("flag_status", {
 		title: "Flag status across environments",
 		description: "Compact cross-environment view of one flag: enabled state, strategy, default variation, and prerequisites per environment.",
@@ -337,9 +392,9 @@ function g(e, n) {
 			flag: t.string()
 		}),
 		annotations: { readOnlyHint: !0 }
-	}, async ({ project: e, flag: t }) => c(async () => {
-		let [i, a] = await Promise.all([n.api.request("GET", r(e, t)), n.api.request("GET", `${r(e, t)}/environments`)]), s = (e) => (i.variations ?? []).find((t) => t.id === e)?.key ?? e ?? null;
-		return o({
+	}, async ({ project: e, flag: t }) => d(async () => {
+		let [i, a] = await Promise.all([n.api.request("GET", r(e, t)), n.api.request("GET", `${r(e, t)}/environments`)]), o = (e) => (i.variations ?? []).find((t) => t.id === e)?.key ?? e ?? null;
+		return l({
 			key: i.key ?? null,
 			name: i.name ?? null,
 			type: i.type ?? null,
@@ -349,7 +404,7 @@ function g(e, n) {
 				environment: e.environmentKey ?? null,
 				enabled: e.isEnabled ?? !1,
 				strategy: e.strategy ?? null,
-				defaultVariation: s(e.defaultVariationId),
+				defaultVariation: o(e.defaultVariationId),
 				prerequisites: e.prerequisites ?? []
 			}))
 		});
@@ -357,22 +412,22 @@ function g(e, n) {
 }
 //#endregion
 //#region src/tools/targeting.ts
-var _ = t.object({
+var b = t.object({
 	attribute: t.string().describe("Context attribute name, e.g. plan, country, user_id"),
 	operator: t.string().describe("OperatorType member name, case-sensitive — e.g. Equals, NotEquals, Contains, In, GreaterThan"),
 	values: t.array(t.string()),
 	negate: t.boolean().optional().default(!1)
-}), v = t.object({
+}), x = t.object({
 	description: t.string().optional(),
 	variationId: t.string().optional().describe("Variation served when the rule matches"),
 	rolloutPercentage: t.number().int().min(0).max(100).optional().describe("Percentage rollout for this rule"),
 	userSegmentId: t.string().optional().describe("Match users in this segment (see list_segments)"),
 	conditionGroups: t.array(t.object({
 		operator: t.enum(["And", "Or"]).describe("How conditions inside this group combine"),
-		conditions: t.array(_)
+		conditions: t.array(b)
 	})).optional().describe("Groups are ANDed together; conditions inside a group use the group operator")
 });
-function y(e, n) {
+function S(e, n) {
 	let r = (e, t, r) => `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/flags/${i(t)}/environments/${i(r)}/targeting`;
 	e.registerTool("get_targeting", {
 		title: "Get targeting rules",
@@ -383,17 +438,17 @@ function y(e, n) {
 			environment: t.string()
 		}),
 		annotations: { readOnlyHint: !0 }
-	}, async ({ project: e, flag: t, environment: i }) => c(async () => o(await n.api.request("GET", r(e, t, i))))), e.registerTool("update_targeting", {
+	}, async ({ project: e, flag: t, environment: i }) => d(async () => l(await n.api.request("GET", r(e, t, i))))), e.registerTool("update_targeting", {
 		title: "Replace targeting rules",
 		description: "REPLACE all targeting rules of a flag in one environment (full PUT — rules not included are removed). Rules are evaluated in order. Get the current rules first with get_targeting.",
 		inputSchema: t.object({
 			project: t.string(),
 			flag: t.string(),
 			environment: t.string(),
-			rules: t.array(v)
+			rules: t.array(x)
 		}),
 		annotations: { destructiveHint: !0 }
-	}, async ({ project: e, flag: t, environment: i, rules: a }) => c(async () => (await n.api.request("PUT", r(e, t, i), { body: { rules: a } }), o({
+	}, async ({ project: e, flag: t, environment: i, rules: a }) => d(async () => (await n.api.request("PUT", r(e, t, i), { body: { rules: a } }), l({
 		project: e,
 		flag: t,
 		environment: i,
@@ -402,7 +457,7 @@ function y(e, n) {
 }
 //#endregion
 //#region src/tools/variations.ts
-function b(e, n) {
+function C(e, n) {
 	e.registerTool("manage_variation", {
 		title: "Add, update, or remove a variation",
 		description: "Manage a flag's variations. action=add requires key + value; action=update/remove require variationId (get ids via get_flag). Removing a variation fails with VARIATION_HAS_DEPENDENTS if other flags depend on it.",
@@ -421,68 +476,213 @@ function b(e, n) {
 			description: t.string().optional()
 		}),
 		annotations: { destructiveHint: !0 }
-	}, async ({ project: e, flag: t, action: r, variationId: a, key: l, name: u, value: d, description: f }) => c(async () => {
-		let c = `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/flags/${i(t)}/variations`;
-		return r === "add" ? !l || d === void 0 ? s(/* @__PURE__ */ Error("action=add requires key and value")) : o(await n.api.request("POST", c, { body: {
-			key: l,
-			name: u,
-			value: d,
+	}, async ({ project: e, flag: t, action: r, variationId: a, key: o, name: s, value: c, description: f }) => d(async () => {
+		let d = `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/flags/${i(t)}/variations`;
+		return r === "add" ? !o || c === void 0 ? u(/* @__PURE__ */ Error("action=add requires key and value")) : l(await n.api.request("POST", d, { body: {
+			key: o,
+			name: s,
+			value: c,
 			description: f
-		} })) : a ? r === "update" ? (await n.api.request("PUT", `${c}/${i(a)}`, { body: {
-			name: u,
-			value: d,
+		} })) : a ? r === "update" ? (await n.api.request("PUT", `${d}/${i(a)}`, { body: {
+			name: s,
+			value: c,
 			description: f
-		} }), o({ updated: a })) : (await n.api.request("DELETE", `${c}/${i(a)}`), o({ removed: a })) : s(/* @__PURE__ */ Error(`action=${r} requires variationId (see get_flag for ids)`));
+		} }), l({ updated: a })) : (await n.api.request("DELETE", `${d}/${i(a)}`), l({ removed: a })) : u(/* @__PURE__ */ Error(`action=${r} requires variationId (see get_flag for ids)`));
 	}));
 }
 //#endregion
+//#region src/tools/webhooks.ts
+var w = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, T = "Requires an Admin token. A 404 on every webhook call means webhooks are not enabled for the organization.", E = {
+	limit: t.number().int().min(1).max(100).optional().describe("Page size (default 20)"),
+	cursor: t.string().optional().describe("next_cursor from a previous response")
+};
+function D(e, n) {
+	let r = `/api/v1/orgs/${i(n.org)}/webhooks`, a = (e) => `${r}/${i(e)}`;
+	async function o(e) {
+		let t = [];
+		for (let r of e) {
+			if (w.test(r)) {
+				t.push(r);
+				continue;
+			}
+			let e = await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects/${i(r)}`);
+			if (!e?.id) throw Error(`Project "${r}" resolved without an id`);
+			t.push(e.id);
+		}
+		return t;
+	}
+	async function s(e) {
+		let t = e.map((e) => {
+			if (w.test(e)) return { id: e };
+			let t = e.indexOf("/"), n = e.slice(0, t), r = e.slice(t + 1);
+			if (t < 0 || !n || !r) throw Error(`Environment "${e}" needs its project: pass "<project>/<environment>", e.g. "web/production", or the environment's id.`);
+			return {
+				project: n,
+				env: r
+			};
+		}), r = [];
+		for (let e of t) {
+			if ("id" in e) {
+				r.push(e.id);
+				continue;
+			}
+			let t = await n.api.request("GET", `/api/v1/orgs/${i(n.org)}/projects/${i(e.project)}/environments/${i(e.env)}`);
+			if (!t?.id) throw Error(`Environment "${e.project}/${e.env}" resolved without an id`);
+			r.push(t.id);
+		}
+		return r;
+	}
+	e.registerTool("list_webhooks", {
+		title: "List webhook subscriptions",
+		description: "List the organization's outbound webhook subscriptions (url, event/project/environment filters, enabled state, failure count, signing secret ids — never secret values), plus availableEventTypes: the event types a subscription can filter on. Empty filter lists mean \"all\". Paginated via cursor. " + T,
+		inputSchema: t.object({ ...E }),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ limit: e, cursor: t }) => d(async () => {
+		let [i, a] = await Promise.all([n.api.request("GET", r, { query: {
+			limit: e,
+			cursor: t
+		} }), n.api.request("GET", `${r}/event-types`)]);
+		return l({
+			...i,
+			availableEventTypes: a
+		});
+	})), e.registerTool("list_webhook_deliveries", {
+		title: "List webhook deliveries",
+		description: "List one subscription's delivery attempts, most recent first. status is Pending (awaiting an attempt, backing off, or in flight), Succeeded or DeadLettered; lastResponseStatusCode and lastError explain a failure. Paginated via cursor. " + T,
+		inputSchema: t.object({
+			id: t.string().describe("Subscription id (from list_webhooks)"),
+			...E
+		}),
+		annotations: { readOnlyHint: !0 }
+	}, async ({ id: e, limit: t, cursor: r }) => d(async () => l(await n.api.request("GET", `${a(e)}/deliveries`, { query: {
+		limit: t,
+		cursor: r
+	} })))), e.registerTool("manage_webhook", {
+		title: "Create, update, or delete a webhook subscription, or rotate its secret",
+		description: "action=create requires name + url and returns the signing secret. action=update/delete/rotate_secret/retire_secret require id. update changes only the fields you pass and keeps the rest; pass an empty list to widen that filter back to \"all\". projects take project keys or ids; environments take \"<project>/<environment>\" keys (e.g. \"web/production\") or ids. eventTypes come from list_webhooks → availableEventTypes. create and rotate_secret return a secret that is NEVER shown again: relay it to the user verbatim so they can store it. rotate_secret adds a new active secret while the old one keeps signing; retire_secret (secretId from list_webhooks) removes one and is refused for the last active secret. A project-restricted service token must list at least one project, all in its scope. " + T,
+		inputSchema: t.object({
+			action: t.enum([
+				"create",
+				"update",
+				"delete",
+				"rotate_secret",
+				"retire_secret"
+			]),
+			id: t.string().optional().describe("Subscription id; required for everything except create"),
+			name: t.string().optional().describe("Required for create"),
+			url: t.string().optional().describe("Receiver URL; required for create"),
+			eventTypes: t.array(t.string()).optional().describe("Event types to send; empty or omitted = all"),
+			projects: t.array(t.string()).optional().describe("Project keys or ids to cover; empty or omitted on create = all"),
+			environments: t.array(t.string()).optional().describe("\"<project>/<environment>\" keys or environment ids; empty or omitted on create = all"),
+			enabled: t.boolean().optional().describe("update only; subscriptions are created enabled"),
+			secretId: t.string().optional().describe("Required for retire_secret"),
+			idempotency_key: t.string().optional().describe("Idempotency-Key header for create / rotate_secret")
+		}),
+		annotations: { destructiveHint: !0 }
+	}, async ({ action: e, id: t, name: c, url: f, eventTypes: p, projects: m, environments: h, enabled: g, secretId: _, idempotency_key: v }) => d(async () => {
+		if (e === "create") {
+			if (!c || !f) return u(/* @__PURE__ */ Error("action=create requires name and url"));
+			let e = h && await s(h), t = m && await o(m);
+			return l(await n.api.request("POST", r, {
+				body: {
+					name: c,
+					url: f,
+					provider: "GenericHttp",
+					eventTypes: p,
+					projectIds: t,
+					environmentIds: e
+				},
+				idempotencyKey: v
+			}));
+		}
+		if (!t) return u(/* @__PURE__ */ Error(`action=${e} requires id (see list_webhooks)`));
+		if (e === "update") {
+			let e = h && await s(h), r = m && await o(m), i = await n.api.request("GET", a(t)), u = {
+				name: c ?? i.name,
+				url: f ?? i.url,
+				eventTypes: p ?? i.eventTypes,
+				projectIds: r ?? i.projectIds,
+				environmentIds: e ?? i.environmentIds,
+				isEnabled: g ?? i.isEnabled
+			};
+			return await n.api.request("PUT", a(t), { body: u }), l({
+				id: t,
+				updated: !0,
+				...u
+			});
+		}
+		return e === "delete" ? (await n.api.request("DELETE", a(t)), l({ deleted: t })) : e === "rotate_secret" ? l(await n.api.request("POST", `${a(t)}/secrets`, { idempotencyKey: v })) : _ ? (await n.api.request("DELETE", `${a(t)}/secrets/${i(_)}`), l({
+			id: t,
+			retiredSecretId: _
+		})) : u(/* @__PURE__ */ Error("action=retire_secret requires secretId (see list_webhooks)"));
+	})), e.registerTool("deliver_webhook", {
+		title: "Send a test event or redeliver",
+		description: "action=test queues one synthetic flag.toggled event to this subscription alone; action=redeliver (deliveryId from list_webhook_deliveries) re-sends a finished delivery, restarting its retry schedule. Delivery is asynchronous: read list_webhook_deliveries for the outcome. Both are refused for a disabled subscription, and redeliver for a delivery that is still Pending. " + T,
+		inputSchema: t.object({
+			action: t.enum(["test", "redeliver"]),
+			id: t.string().describe("Subscription id (from list_webhooks)"),
+			deliveryId: t.string().optional().describe("Required for redeliver")
+		}),
+		annotations: {
+			destructiveHint: !1,
+			openWorldHint: !0
+		}
+	}, async ({ action: e, id: t, deliveryId: r }) => d(async () => e === "test" ? l(await n.api.request("POST", `${a(t)}/test`)) : r ? (await n.api.request("POST", `${a(t)}/deliveries/${i(r)}/redeliver`), l({
+		id: t,
+		redelivered: r
+	})) : u(/* @__PURE__ */ Error("action=redeliver requires deliveryId (see list_webhook_deliveries)"))));
+}
+//#endregion
 //#region src/tools/workflows/stale-flags.ts
-var x = 50;
-function S(e, n) {
+var O = 50;
+function k(e, n) {
 	e.registerTool("find_stale_flags", {
 		title: "Find stale flags",
-		description: `Find flags that look ready for code cleanup: not updated in N days AND either enabled in every environment (verify rollout is complete before removing — per-rule percentage ramps are not inspected) or disabled in every environment (dead — remove flag and code path). Checks at most ${x} candidates per call.`,
+		description: `Find flags that look ready for code cleanup: not updated in N days AND either enabled in every environment (verify rollout is complete before removing — per-rule percentage ramps are not inspected) or disabled in every environment (dead — remove flag and code path). A flag whose expiry date (set_flag_expiry) has passed is always a candidate, however recently it was edited; if it is on in some environments and off in others its reason is past-expiry, meaning the owner has to decide which way to fold it. Every result carries expiresAtUtc and expired. Checks at most ${O} candidates per call, expired flags first.`,
 		inputSchema: t.object({
 			project: t.string(),
 			days: t.number().int().min(1).optional().default(30).describe("Minimum age in days since last update")
 		}),
 		annotations: { readOnlyHint: !0 }
-	}, async ({ project: e, days: t }) => c(async () => {
-		let r = `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/flags`, a = Date.now() - t * 24 * 60 * 60 * 1e3, s = [], c;
+	}, async ({ project: e, days: t }) => d(async () => {
+		let r = `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/flags`, a = Date.now(), o = a - t * 24 * 60 * 60 * 1e3, s = (e) => !!e.expiresAtUtc && new Date(e.expiresAtUtc).getTime() <= a, c = [], u;
 		do {
 			let e = await n.api.request("GET", r, { query: {
 				archived: !1,
 				limit: 100,
-				cursor: c
+				cursor: u
 			} });
-			s.push(...(e.items ?? []).filter((e) => !!e.key && !!e.name && !!e.updatedAt && new Date(e.updatedAt).getTime() < a)), c = e.next_cursor ?? void 0;
-		} while (c);
-		let l = s.length > x, u = s.slice(0, x), d = [];
-		for (let e of u) {
+			c.push(...(e.items ?? []).filter((e) => !!e.key && !!e.name && !!e.updatedAt && (new Date(e.updatedAt).getTime() < o || s(e)))), u = e.next_cursor ?? void 0;
+		} while (u);
+		c.sort((e, t) => Number(s(t)) - Number(s(e)));
+		let d = c.length > O, f = c.slice(0, O), p = [];
+		for (let e of f) {
 			let t = await n.api.request("GET", `${r}/${i(e.key)}/environments`);
 			if (t.length === 0) continue;
-			let a = t.every((e) => e.isEnabled), o = t.every((e) => !e.isEnabled);
-			(a || o) && d.push({
+			let a = s(e), o = t.every((e) => e.isEnabled), c = t.every((e) => !e.isEnabled);
+			(o || c || a) && p.push({
 				key: e.key,
 				name: e.name,
 				updatedAt: e.updatedAt,
-				reason: a ? "enabled-everywhere" : "disabled-everywhere",
+				expiresAtUtc: e.expiresAtUtc ?? null,
+				expired: a,
+				reason: o ? "enabled-everywhere" : c ? "disabled-everywhere" : "past-expiry",
 				environments: t.length
 			});
 		}
-		return o({
+		return l({
 			project: e,
 			olderThanDays: t,
-			checked: u.length,
-			truncated: l,
-			...l ? { note: `Only the first ${x} of ${s.length} candidates were checked.` } : {},
-			stale: d
+			checked: f.length,
+			truncated: d,
+			...d ? { note: `Only the first ${O} of ${c.length} candidates were checked.` } : {},
+			stale: p
 		});
 	}));
 }
 //#endregion
 //#region src/tools/workflows/snippets.ts
-var C = [
+var A = [
 	"js",
 	"node",
 	"browser",
@@ -494,16 +694,16 @@ var C = [
 	"php",
 	"ruby",
 	"swift"
-], w = [
+], j = [
 	"browser",
 	"react",
 	"swift"
 ];
-function T(e) {
-	return w.includes(e);
+function M(e) {
+	return j.includes(e);
 }
-var E = "Uses a SERVER-side SDK key (Featureflip dashboard → environment → SDK keys).", D = "Uses a CLIENT-side SDK key (safe to ship to browsers/apps).";
-function O(e, t) {
+var N = "Uses a SERVER-side SDK key (Featureflip dashboard → environment → SDK keys).", P = "Uses a CLIENT-side SDK key (safe to ship to browsers/apps).";
+function F(e, t) {
 	switch (e) {
 		case "js": return {
 			install: "npm install @featureflip/js",
@@ -518,7 +718,7 @@ const enabled = client.boolVariation('${t}', { user_id: userId }, false);
 if (enabled) {
   // new code path
 }`,
-			notes: E
+			notes: N
 		};
 		case "node": return {
 			install: "npm install @featureflip/node",
@@ -529,7 +729,7 @@ const enabled = client.boolVariation('${t}', { user_id: userId }, false);
 if (enabled) {
   // new code path
 }`,
-			notes: E
+			notes: N
 		};
 		case "browser": return {
 			install: "npm install @featureflip/browser",
@@ -541,7 +741,7 @@ const enabled = client.boolVariation('${t}', false);
 if (enabled) {
   // new code path
 }`,
-			notes: D
+			notes: P
 		};
 		case "react": return {
 			install: "npm install @featureflip/react @featureflip/browser",
@@ -554,7 +754,7 @@ function MyComponent() {
   const enabled = useFeatureFlag('${t}', false);
   return enabled ? <NewExperience /> : <CurrentExperience />;
 }`,
-			notes: D
+			notes: P
 		};
 		case "python": return {
 			install: "pip install featureflip",
@@ -565,7 +765,7 @@ enabled = client.variation("${t}", {"user_id": user_id}, default=False)
 if enabled:
     # new code path
     ...`,
-			notes: E
+			notes: N
 		};
 		case "csharp": return {
 			install: "dotnet add package Featureflip.Client",
@@ -578,7 +778,7 @@ if (enabled)
 {
     // new code path
 }`,
-			notes: E
+			notes: N
 		};
 		case "java": return {
 			install: "implementation 'io.featureflip:featureflip-java:2.0.0'",
@@ -592,7 +792,7 @@ boolean enabled = client.boolVariation("${t}",
 if (enabled) {
     // new code path
 }`,
-			notes: E
+			notes: N
 		};
 		case "go": return {
 			install: "go get github.com/canopy-labs/featureflip-go/v2",
@@ -608,7 +808,7 @@ ctx := featureflip.EvaluationContext{UserID: userID}
 if client.BoolVariation("${t}", ctx, false) {
     // new code path
 }`,
-			notes: E
+			notes: N
 		};
 		case "php": return {
 			install: "composer require featureflip/featureflip-php",
@@ -623,7 +823,7 @@ $enabled = $client->boolVariation('${t}', ['user_id' => $userId], false);
 if ($enabled) {
     // new code path
 }`,
-			notes: E + " Requires PSR-16 cache and PSR-18 HTTP implementations."
+			notes: N + " Requires PSR-16 cache and PSR-18 HTTP implementations."
 		};
 		case "ruby": return {
 			install: "gem \"featureflip\"",
@@ -634,7 +834,7 @@ enabled = client.bool_variation("${t}", { "user_id" => user_id }, false)
 if enabled
   # new code path
 end`,
-			notes: E
+			notes: N
 		};
 		case "swift": return {
 			install: ".package(url: \"https://github.com/canopy-labs/featureflip-swift\", from: \"2.0.0\")",
@@ -647,13 +847,13 @@ let enabled = client.boolVariation("${t}", default: false)
 if enabled {
     // new code path
 }`,
-			notes: D
+			notes: P
 		};
 	}
 }
 //#endregion
 //#region src/tools/workflows/wrap-feature.ts
-function k(e, n) {
+function I(e, n) {
 	e.registerTool("wrap_feature", {
 		title: "Wrap a feature in a new flag",
 		description: "Create a Boolean feature flag and get back the SDK code snippet to guard the new code path with it. Returns the snippet only — apply the edit yourself. The flag starts DISABLED in every environment; enable it with toggle_flag when ready.",
@@ -663,26 +863,26 @@ function k(e, n) {
 			name: t.string().optional().describe("Display name; defaults to the key"),
 			description: t.string().optional().describe("What this flag guards"),
 			tags: t.array(t.string()).optional(),
-			language: t.enum(C).describe("SDK language of the codebase being edited"),
+			language: t.enum(A).describe("SDK language of the codebase being edited"),
 			idempotency_key: t.string().optional()
 		}),
 		annotations: { destructiveHint: !1 }
-	}, async ({ project: e, key: t, name: r, description: a, tags: s, language: l, idempotency_key: u }) => c(async () => {
-		let c = await n.api.request("POST", `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/flags`, {
+	}, async ({ project: e, key: t, name: r, description: a, tags: o, language: s, idempotency_key: c }) => d(async () => {
+		let u = await n.api.request("POST", `/api/v1/orgs/${i(n.org)}/projects/${i(e)}/flags`, {
 			body: {
 				key: t,
 				name: r ?? t,
 				type: "Boolean",
 				description: a,
-				tags: s,
-				...T(l) ? { clientSideVisible: !0 } : {}
+				tags: o,
+				...M(s) ? { clientSideVisible: !0 } : {}
 			},
-			idempotencyKey: u
-		}), d = O(l, t);
-		return o({
-			flag: c,
+			idempotencyKey: c
+		}), d = F(s, t);
+		return l({
+			flag: u,
 			integration: {
-				language: l,
+				language: s,
 				install: d.install,
 				code: d.code,
 				notes: d.notes
@@ -697,17 +897,17 @@ function k(e, n) {
 }
 //#endregion
 //#region src/server.ts
-function A(t) {
+function L(t) {
 	let r = new e({
 		name: "featureflip",
 		version: n
 	});
-	return u(r, t), d(r, t), f(r, t), m(r, t), g(r, t), y(r, t), b(r, t), S(r, t), k(r, t), r;
+	return p(r, t), m(r, t), h(r, t), _(r, t), y(r, t), S(r, t), C(r, t), D(r, t), k(r, t), I(r, t), r;
 }
 //#endregion
 //#region src/config.ts
-var j = "FEATUREFLIP_TOKEN is required. Create one in the Featureflip dashboard — Settings → API Tokens (personal token, ffp_...) or Organization Settings → Service Tokens (ffs_...) — and set it in your MCP client config.";
-function M(e = process.env) {
+var R = "FEATUREFLIP_TOKEN is required. Create one in the Featureflip dashboard — Settings → API Tokens (personal token, ffp_...) or Organization Settings → Service Tokens (ffs_...) — and set it in your MCP client config.";
+function z(e = process.env) {
 	let t = e.FEATUREFLIP_TOKEN?.trim();
 	return t ? {
 		token: t,
@@ -715,14 +915,14 @@ function M(e = process.env) {
 		org: e.FEATUREFLIP_ORG?.trim() || void 0
 	} : null;
 }
-function N(e = process.env) {
-	let t = M(e);
-	if (!t) throw Error(j);
+function B(e = process.env) {
+	let t = z(e);
+	if (!t) throw Error(R);
 	return t;
 }
 //#endregion
 //#region src/org.ts
-async function P(e, t) {
+async function V(e, t) {
 	if (t) return t;
 	let n = (await e.request("GET", "/api/v1/orgs", { query: { limit: 100 } })).items ?? [];
 	if (n.length === 1) {
@@ -733,4 +933,4 @@ async function P(e, t) {
 	throw n.length === 0 ? Error("The token can see no organizations. Check the token in the Featureflip dashboard.") : Error(`The token can see ${n.length} organizations — set FEATUREFLIP_ORG to one of: ` + n.map((e) => e.slug ?? "?").join(", "));
 }
 //#endregion
-export { A as a, n as c, M as i, j as n, r as o, N as r, a as s, P as t };
+export { L as a, n as c, z as i, R as n, r as o, B as r, c as s, V as t };