@flaghoist/core 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and do
+          not modify the License. You may add Your own attribution notices
+          within Derivative Works that You distribute, alongside or as an
+          addendum to the NOTICE text from the Work, provided that such
+          additional attribution notices cannot be construed as modifying
+          the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Damilola Oluwafemi and the Flaghoist contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/index.cjs

@@ -0,0 +1,300 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  FLAG_KEY_RULE: () => FLAG_KEY_RULE,
+  FORBIDDEN_ATTRIBUTES: () => FORBIDDEN_ATTRIBUTES,
+  LIMITS: () => LIMITS,
+  clampPercentage: () => clampPercentage,
+  compareSemver: () => compareSemver,
+  createFlag: () => createFlag,
+  evaluate: () => evaluate,
+  evaluateAll: () => evaluateAll,
+  isInRollout: () => isInRollout,
+  isValidFlagKey: () => isValidFlagKey,
+  matchCondition: () => matchCondition,
+  matchesAllConditions: () => matchesAllConditions,
+  parseFlag: () => parseFlag,
+  stickyBucket: () => stickyBucket,
+  version: () => version
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/hash.ts
+function clampPercentage(percentage) {
+  if (Number.isNaN(percentage)) return 0;
+  return Math.max(0, Math.min(100, percentage));
+}
+async function stickyBucket(seed) {
+  const data = new TextEncoder().encode(seed);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+  return new DataView(digest).getUint32(0) % 100;
+}
+async function isInRollout(targetingKey, flagKey, percentage) {
+  const pct = clampPercentage(percentage);
+  if (pct >= 100) return true;
+  if (pct <= 0) return false;
+  const bucket = await stickyBucket(`${targetingKey}:${flagKey}`);
+  return bucket < pct;
+}
+
+// src/limits.ts
+var LIMITS = {
+  maxKeyLength: 256,
+  maxRules: 100,
+  maxConditionsPerRule: 50,
+  maxListItems: 1e3,
+  maxValueLength: 1024
+};
+var FLAG_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var FORBIDDEN_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function isValidFlagKey(key) {
+  return key.length >= 1 && key.length <= LIMITS.maxKeyLength && FLAG_KEY_PATTERN.test(key);
+}
+var FLAG_KEY_RULE = "must be 1-256 characters of [A-Za-z0-9._-] and start with an alphanumeric";
+
+// src/operators.ts
+function isScalar(v) {
+  return typeof v === "string" || typeof v === "number" || typeof v === "boolean";
+}
+function compareNumbers(a, v, test) {
+  const x = Number(a);
+  const y = Number(v);
+  if (Number.isNaN(x) || Number.isNaN(y)) return false;
+  return test(x, y);
+}
+function toInt(part) {
+  const n = parseInt(part ?? "", 10);
+  return Number.isNaN(n) ? 0 : n;
+}
+function parseSemver(v) {
+  const clean = v.trim().replace(/^v/, "");
+  const dash = clean.indexOf("-");
+  const core = dash === -1 ? clean : clean.slice(0, dash);
+  const pre = dash === -1 ? "" : clean.slice(dash + 1);
+  const [major, minor, patch] = core.split(".");
+  return { major: toInt(major), minor: toInt(minor), patch: toInt(patch), pre };
+}
+function compareSemver(a, b) {
+  const x = parseSemver(a);
+  const y = parseSemver(b);
+  if (x.major !== y.major) return x.major < y.major ? -1 : 1;
+  if (x.minor !== y.minor) return x.minor < y.minor ? -1 : 1;
+  if (x.patch !== y.patch) return x.patch < y.patch ? -1 : 1;
+  if (x.pre === y.pre) return 0;
+  if (x.pre === "") return 1;
+  if (y.pre === "") return -1;
+  return x.pre < y.pre ? -1 : 1;
+}
+function compareSemvers(a, v, test) {
+  if (typeof a !== "string" || typeof v !== "string") return false;
+  return test(compareSemver(a, v));
+}
+var operators = {
+  eq: (a, v) => isScalar(v) && a === v,
+  neq: (a, v) => isScalar(v) && a !== v,
+  in: (a, v) => Array.isArray(v) && v.some((item) => item === a),
+  notIn: (a, v) => Array.isArray(v) && !v.some((item) => item === a),
+  contains: (a, v) => typeof a === "string" && typeof v === "string" && a.includes(v),
+  startsWith: (a, v) => typeof a === "string" && typeof v === "string" && a.startsWith(v),
+  endsWith: (a, v) => typeof a === "string" && typeof v === "string" && a.endsWith(v),
+  gt: (a, v) => compareNumbers(a, v, (x, y) => x > y),
+  gte: (a, v) => compareNumbers(a, v, (x, y) => x >= y),
+  lt: (a, v) => compareNumbers(a, v, (x, y) => x < y),
+  lte: (a, v) => compareNumbers(a, v, (x, y) => x <= y),
+  semverGte: (a, v) => compareSemvers(a, v, (cmp) => cmp >= 0),
+  semverLt: (a, v) => compareSemvers(a, v, (cmp) => cmp < 0)
+};
+function matchCondition(condition, context) {
+  if (FORBIDDEN_ATTRIBUTES.has(condition.attribute)) return false;
+  if (!Object.hasOwn(context, condition.attribute)) return false;
+  const attr = context[condition.attribute];
+  if (attr === void 0) return false;
+  const op = operators[condition.operator];
+  if (!op) return false;
+  return op(attr, condition.value);
+}
+function matchesAllConditions(conditions, context) {
+  return conditions.every((condition) => matchCondition(condition, context));
+}
+
+// src/evaluate.ts
+function isSplit(percentage) {
+  return percentage > 0 && percentage < 100;
+}
+async function resolveRule(result, targetingKey, flagKey, ruleIndex) {
+  if (!result.enabled) return { value: false, reason: "TARGETING_MATCH", ruleIndex };
+  const percentage = result.rollout?.percentage ?? 100;
+  const value = await isInRollout(targetingKey, flagKey, percentage);
+  return { value, reason: isSplit(percentage) ? "SPLIT" : "TARGETING_MATCH", ruleIndex };
+}
+async function evaluate(flag, context = {}) {
+  if (!flag.enabled) return { value: false, reason: "DISABLED" };
+  const targetingKey = context.targetingKey ?? "";
+  let ruleIndex = 0;
+  for (const rule of flag.rules ?? []) {
+    if (matchesAllConditions(rule.conditions, context)) {
+      return resolveRule(rule.result, targetingKey, flag.key, ruleIndex);
+    }
+    ruleIndex++;
+  }
+  const percentage = flag.rollout.percentage;
+  const value = await isInRollout(targetingKey, flag.key, percentage);
+  return { value, reason: isSplit(percentage) ? "SPLIT" : "DEFAULT" };
+}
+async function evaluateAll(flags, context = {}) {
+  const entries = await Promise.all(
+    flags.map(async (flag) => [flag.key, await evaluate(flag, context)])
+  );
+  return Object.fromEntries(entries);
+}
+
+// src/validate.ts
+var OPERATORS = [
+  "eq",
+  "neq",
+  "in",
+  "notIn",
+  "contains",
+  "startsWith",
+  "endsWith",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "semverGte",
+  "semverLt"
+];
+function asRecord(input) {
+  return typeof input === "object" && input !== null ? input : null;
+}
+function isConditionValue(v) {
+  if (typeof v === "string") return v.length <= LIMITS.maxValueLength;
+  if (typeof v === "number" || typeof v === "boolean") return true;
+  if (Array.isArray(v)) {
+    if (v.length > LIMITS.maxListItems) return false;
+    return v.every(
+      (x) => typeof x === "string" ? x.length <= LIMITS.maxValueLength : typeof x === "number"
+    );
+  }
+  return false;
+}
+function parseCondition(input) {
+  const o = asRecord(input);
+  if (!o) return null;
+  if (typeof o.attribute !== "string") return null;
+  if (o.attribute.length === 0 || o.attribute.length > LIMITS.maxKeyLength) return null;
+  if (FORBIDDEN_ATTRIBUTES.has(o.attribute)) return null;
+  if (typeof o.operator !== "string" || !OPERATORS.includes(o.operator)) return null;
+  if (!isConditionValue(o.value)) return null;
+  return { attribute: o.attribute, operator: o.operator, value: o.value };
+}
+function parseRuleResult(input) {
+  const o = asRecord(input);
+  if (!o || typeof o.enabled !== "boolean") return null;
+  const result = { enabled: o.enabled };
+  const rollout = asRecord(o.rollout);
+  if (rollout && typeof rollout.percentage === "number") {
+    result.rollout = { percentage: clampPercentage(rollout.percentage) };
+  }
+  return result;
+}
+function parseRule(input) {
+  const o = asRecord(input);
+  if (!o || !Array.isArray(o.conditions)) return null;
+  if (o.conditions.length > LIMITS.maxConditionsPerRule) return null;
+  const conditions = o.conditions.map(parseCondition);
+  if (conditions.some((c) => c === null)) return null;
+  const result = parseRuleResult(o.result);
+  if (!result) return null;
+  const rule = { conditions, result };
+  if (typeof o.description === "string") rule.description = o.description;
+  return rule;
+}
+function parseMetadata(input) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const o = asRecord(input) ?? {};
+  return {
+    createdBy: typeof o.createdBy === "string" ? o.createdBy : "unknown",
+    createdAt: typeof o.createdAt === "string" ? o.createdAt : now,
+    updatedBy: typeof o.updatedBy === "string" ? o.updatedBy : "unknown",
+    updatedAt: typeof o.updatedAt === "string" ? o.updatedAt : now
+  };
+}
+function parseFlag(input) {
+  const o = asRecord(input);
+  if (!o) return null;
+  if (typeof o.key !== "string" || !isValidFlagKey(o.key)) return null;
+  if (typeof o.enabled !== "boolean") return null;
+  const rollout = asRecord(o.rollout);
+  const percentage = rollout && typeof rollout.percentage === "number" ? clampPercentage(rollout.percentage) : 0;
+  const rawRules = Array.isArray(o.rules) ? o.rules : [];
+  if (rawRules.length > LIMITS.maxRules) return null;
+  const rules = rawRules.map(parseRule).filter((r) => r !== null);
+  return {
+    key: o.key,
+    enabled: o.enabled,
+    rollout: { percentage },
+    rules,
+    description: typeof o.description === "string" ? o.description : "",
+    metadata: parseMetadata(o.metadata)
+  };
+}
+function createFlag(input) {
+  if (!isValidFlagKey(input.key)) {
+    throw new Error(`Invalid flag key ${JSON.stringify(input.key)}: ${FLAG_KEY_RULE}.`);
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const identity = input.identity ?? "system";
+  return {
+    key: input.key,
+    enabled: input.enabled ?? false,
+    rollout: { percentage: clampPercentage(input.rollout?.percentage ?? 0) },
+    rules: input.rules ?? [],
+    description: input.description ?? "",
+    metadata: { createdBy: identity, createdAt: now, updatedBy: identity, updatedAt: now }
+  };
+}
+
+// src/index.ts
+var version = "0.0.0";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FLAG_KEY_RULE,
+  FORBIDDEN_ATTRIBUTES,
+  LIMITS,
+  clampPercentage,
+  compareSemver,
+  createFlag,
+  evaluate,
+  evaluateAll,
+  isInRollout,
+  isValidFlagKey,
+  matchCondition,
+  matchesAllConditions,
+  parseFlag,
+  stickyBucket,
+  version
+});

package/dist/index.d.cts

@@ -0,0 +1,190 @@
+/**
+ * Comparison operators available to targeting conditions. The set is intentionally
+ * bounded for v1; regex (`matches`) is deliberately excluded as a ReDoS footgun.
+ */
+type Operator = 'eq' | 'neq' | 'in' | 'notIn' | 'contains' | 'startsWith' | 'endsWith' | 'gt' | 'gte' | 'lt' | 'lte' | 'semverGte' | 'semverLt';
+/** A scalar attribute drawn from the evaluation context. */
+type AttributeValue = string | number | boolean;
+/** A value a condition compares against — scalar, or a list for `in` / `notIn`. */
+type ConditionValue = string | number | boolean | Array<string | number>;
+/** A single `attribute operator value` predicate. */
+interface Condition {
+    attribute: string;
+    operator: Operator;
+    value: ConditionValue;
+}
+/** What a matched targeting rule serves. */
+interface RuleResult {
+    enabled: boolean;
+    /** Optional rollout within the matched cohort. Absent means 100% (fully on). */
+    rollout?: {
+        percentage: number;
+    };
+}
+/**
+ * An ordered targeting rule. All `conditions` must hold (logical AND); express OR
+ * with a second rule. Rules are evaluated top to bottom and the first match wins.
+ */
+interface TargetingRule {
+    description?: string;
+    conditions: Condition[];
+    result: RuleResult;
+}
+interface FlagMetadata {
+    createdBy: string;
+    createdAt: string;
+    updatedBy: string;
+    updatedAt: string;
+}
+/**
+ * A feature flag as stored. `rules` is optional and additive: a flag with no rules
+ * evaluates purely on `enabled` + `rollout`, identical to a plain boolean-with-percentage
+ * flag. The top-level `rollout` acts as the default rule when no targeting rule matches.
+ */
+interface FeatureFlag {
+    key: string;
+    enabled: boolean;
+    rollout: {
+        percentage: number;
+    };
+    rules?: TargetingRule[];
+    description: string;
+    metadata: FlagMetadata;
+}
+/**
+ * The OpenFeature-style evaluation context: an optional stable `targetingKey` used for
+ * sticky percentage bucketing, plus arbitrary attributes referenced by targeting rules.
+ */
+interface EvaluationContext {
+    targetingKey?: string;
+    [attribute: string]: AttributeValue | undefined;
+}
+/** Why a flag resolved the way it did. Maps onto OpenFeature/OFREP resolution reasons. */
+type EvaluationReason = 'DISABLED' | 'TARGETING_MATCH' | 'SPLIT' | 'DEFAULT';
+interface EvaluationResult {
+    value: boolean;
+    reason: EvaluationReason;
+    /** Index of the targeting rule that matched, when `reason` is TARGETING_MATCH or SPLIT via a rule. */
+    ruleIndex?: number;
+}
+/**
+ * Storage contract — the "bring your own DB" seam. Any key/value store fits: a key maps
+ * to one flag's JSON. Implement these four methods and the server never knows the difference.
+ */
+interface StorageAdapter {
+    get(key: string): Promise<FeatureFlag | null>;
+    put(key: string, flag: FeatureFlag): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(): Promise<FeatureFlag[]>;
+}
+/** The authenticated caller, extracted from a validated admin token. */
+interface AuthContext {
+    identity: string;
+    groups: string[];
+}
+/**
+ * Auth contract for the admin/write path. Returns the caller's identity on success, or
+ * null when the token is missing/invalid. Group checks are layered on top by the server.
+ */
+interface AuthVerifier {
+    verify(token: string | null): Promise<AuthContext | null>;
+}
+
+/** Clamp a percentage into [0, 100]; NaN becomes 0 (conservative — feature stays hidden). */
+declare function clampPercentage(percentage: number): number;
+/**
+ * Deterministically map a seed string into a bucket in [0, 100). Uses SHA-256 so the
+ * distribution is uniform and the result is stable across runtimes and languages — the
+ * same seed always lands in the same bucket. Cryptographic strength is incidental here;
+ * what matters is determinism and even spread.
+ */
+declare function stickyBucket(seed: string): Promise<number>;
+/**
+ * Decide whether a given target is inside a percentage rollout for a flag. Sticky: the
+ * same (targetingKey, flagKey) pair always resolves the same way, so a partner does not
+ * flip in and out of a feature between page loads. No assignment state is stored.
+ */
+declare function isInRollout(targetingKey: string, flagKey: string, percentage: number): Promise<boolean>;
+
+/**
+ * Resource limits enforced when parsing untrusted flag input. These bound how much work a
+ * single flag can impose on evaluation, so a compromised or fat-fingered admin write cannot
+ * wedge the read path. Generous enough that legitimate flags never hit them.
+ */
+declare const LIMITS: {
+    readonly maxKeyLength: 256;
+    readonly maxRules: 100;
+    readonly maxConditionsPerRule: 50;
+    readonly maxListItems: 1000;
+    readonly maxValueLength: 1024;
+};
+/**
+ * Attribute names that resolve onto the prototype chain rather than to real data. They are
+ * never valid targeting attributes and must never be read from an evaluation context.
+ */
+declare const FORBIDDEN_ATTRIBUTES: ReadonlySet<string>;
+/**
+ * A flag key is URL- and storage-safe: it appears verbatim in request paths
+ * (`/flags/:key`, `/ofrep/v1/evaluate/flags/{key}`) and as a raw key in whatever storage
+ * backend is plugged in. Restrict to alphanumerics plus dot, underscore, and hyphen,
+ * starting with an alphanumeric, within a bounded length. This excludes path separators
+ * and control characters, closing off traversal and key-injection classes for any adapter.
+ */
+declare function isValidFlagKey(key: string): boolean;
+/** Human-readable description of the flag key rule, for error messages. */
+declare const FLAG_KEY_RULE = "must be 1-256 characters of [A-Za-z0-9._-] and start with an alphanumeric";
+
+/**
+ * Compare two semver strings. Returns -1, 0, or 1. A version with no prerelease outranks
+ * one with a prerelease (1.0.0 > 1.0.0-rc.1); prereleases are otherwise compared lexically.
+ */
+declare function compareSemver(a: string, b: string): number;
+/**
+ * Evaluate a single condition against the context. A referenced attribute that is absent
+ * from the context never matches — you cannot target on data you were not given. Prototype
+ * attribute names are rejected, and only own properties are read, so a crafted attribute
+ * name can never reach up the prototype chain.
+ */
+declare function matchCondition(condition: Condition, context: EvaluationContext): boolean;
+/** True when every condition matches (logical AND). An empty list matches everyone. */
+declare function matchesAllConditions(conditions: Condition[], context: EvaluationContext): boolean;
+
+/**
+ * Evaluate one flag against a context. The cascade:
+ *
+ *   1. If the flag is disabled, serve off.
+ *   2. Walk targeting rules in order; the first whose conditions all match decides the result
+ *      (optionally gated by a per-rule rollout).
+ *   3. If no rule matches, fall through to the flag's default rollout percentage.
+ */
+declare function evaluate(flag: FeatureFlag, context?: EvaluationContext): Promise<EvaluationResult>;
+/** Evaluate many flags against one context, returning a map keyed by flag key. */
+declare function evaluateAll(flags: FeatureFlag[], context?: EvaluationContext): Promise<Record<string, EvaluationResult>>;
+
+/**
+ * Parse arbitrary (untrusted) input — e.g. JSON read back from a storage adapter — into a
+ * FeatureFlag, or return null if it is not a valid flag. A rule with any malformed condition
+ * is rejected wholesale rather than silently weakened. Percentages are clamped to [0, 100].
+ */
+declare function parseFlag(input: unknown): FeatureFlag | null;
+interface CreateFlagInput {
+    key: string;
+    enabled?: boolean;
+    rollout?: {
+        percentage: number;
+    };
+    rules?: TargetingRule[];
+    description?: string;
+    /** Identity recorded in createdBy/updatedBy metadata. */
+    identity?: string;
+}
+/**
+ * Construct a well-formed FeatureFlag with sensible defaults and fresh metadata.
+ * Throws if the key is invalid — this is a programmer-facing constructor, so bad input
+ * fails fast rather than producing an unusable flag.
+ */
+declare function createFlag(input: CreateFlagInput): FeatureFlag;
+
+declare const version = "0.0.0";
+
+export { type AttributeValue, type AuthContext, type AuthVerifier, type Condition, type ConditionValue, type CreateFlagInput, type EvaluationContext, type EvaluationReason, type EvaluationResult, FLAG_KEY_RULE, FORBIDDEN_ATTRIBUTES, type FeatureFlag, type FlagMetadata, LIMITS, type Operator, type RuleResult, type StorageAdapter, type TargetingRule, clampPercentage, compareSemver, createFlag, evaluate, evaluateAll, isInRollout, isValidFlagKey, matchCondition, matchesAllConditions, parseFlag, stickyBucket, version };

package/dist/index.d.ts

@@ -0,0 +1,190 @@
+/**
+ * Comparison operators available to targeting conditions. The set is intentionally
+ * bounded for v1; regex (`matches`) is deliberately excluded as a ReDoS footgun.
+ */
+type Operator = 'eq' | 'neq' | 'in' | 'notIn' | 'contains' | 'startsWith' | 'endsWith' | 'gt' | 'gte' | 'lt' | 'lte' | 'semverGte' | 'semverLt';
+/** A scalar attribute drawn from the evaluation context. */
+type AttributeValue = string | number | boolean;
+/** A value a condition compares against — scalar, or a list for `in` / `notIn`. */
+type ConditionValue = string | number | boolean | Array<string | number>;
+/** A single `attribute operator value` predicate. */
+interface Condition {
+    attribute: string;
+    operator: Operator;
+    value: ConditionValue;
+}
+/** What a matched targeting rule serves. */
+interface RuleResult {
+    enabled: boolean;
+    /** Optional rollout within the matched cohort. Absent means 100% (fully on). */
+    rollout?: {
+        percentage: number;
+    };
+}
+/**
+ * An ordered targeting rule. All `conditions` must hold (logical AND); express OR
+ * with a second rule. Rules are evaluated top to bottom and the first match wins.
+ */
+interface TargetingRule {
+    description?: string;
+    conditions: Condition[];
+    result: RuleResult;
+}
+interface FlagMetadata {
+    createdBy: string;
+    createdAt: string;
+    updatedBy: string;
+    updatedAt: string;
+}
+/**
+ * A feature flag as stored. `rules` is optional and additive: a flag with no rules
+ * evaluates purely on `enabled` + `rollout`, identical to a plain boolean-with-percentage
+ * flag. The top-level `rollout` acts as the default rule when no targeting rule matches.
+ */
+interface FeatureFlag {
+    key: string;
+    enabled: boolean;
+    rollout: {
+        percentage: number;
+    };
+    rules?: TargetingRule[];
+    description: string;
+    metadata: FlagMetadata;
+}
+/**
+ * The OpenFeature-style evaluation context: an optional stable `targetingKey` used for
+ * sticky percentage bucketing, plus arbitrary attributes referenced by targeting rules.
+ */
+interface EvaluationContext {
+    targetingKey?: string;
+    [attribute: string]: AttributeValue | undefined;
+}
+/** Why a flag resolved the way it did. Maps onto OpenFeature/OFREP resolution reasons. */
+type EvaluationReason = 'DISABLED' | 'TARGETING_MATCH' | 'SPLIT' | 'DEFAULT';
+interface EvaluationResult {
+    value: boolean;
+    reason: EvaluationReason;
+    /** Index of the targeting rule that matched, when `reason` is TARGETING_MATCH or SPLIT via a rule. */
+    ruleIndex?: number;
+}
+/**
+ * Storage contract — the "bring your own DB" seam. Any key/value store fits: a key maps
+ * to one flag's JSON. Implement these four methods and the server never knows the difference.
+ */
+interface StorageAdapter {
+    get(key: string): Promise<FeatureFlag | null>;
+    put(key: string, flag: FeatureFlag): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(): Promise<FeatureFlag[]>;
+}
+/** The authenticated caller, extracted from a validated admin token. */
+interface AuthContext {
+    identity: string;
+    groups: string[];
+}
+/**
+ * Auth contract for the admin/write path. Returns the caller's identity on success, or
+ * null when the token is missing/invalid. Group checks are layered on top by the server.
+ */
+interface AuthVerifier {
+    verify(token: string | null): Promise<AuthContext | null>;
+}
+
+/** Clamp a percentage into [0, 100]; NaN becomes 0 (conservative — feature stays hidden). */
+declare function clampPercentage(percentage: number): number;
+/**
+ * Deterministically map a seed string into a bucket in [0, 100). Uses SHA-256 so the
+ * distribution is uniform and the result is stable across runtimes and languages — the
+ * same seed always lands in the same bucket. Cryptographic strength is incidental here;
+ * what matters is determinism and even spread.
+ */
+declare function stickyBucket(seed: string): Promise<number>;
+/**
+ * Decide whether a given target is inside a percentage rollout for a flag. Sticky: the
+ * same (targetingKey, flagKey) pair always resolves the same way, so a partner does not
+ * flip in and out of a feature between page loads. No assignment state is stored.
+ */
+declare function isInRollout(targetingKey: string, flagKey: string, percentage: number): Promise<boolean>;
+
+/**
+ * Resource limits enforced when parsing untrusted flag input. These bound how much work a
+ * single flag can impose on evaluation, so a compromised or fat-fingered admin write cannot
+ * wedge the read path. Generous enough that legitimate flags never hit them.
+ */
+declare const LIMITS: {
+    readonly maxKeyLength: 256;
+    readonly maxRules: 100;
+    readonly maxConditionsPerRule: 50;
+    readonly maxListItems: 1000;
+    readonly maxValueLength: 1024;
+};
+/**
+ * Attribute names that resolve onto the prototype chain rather than to real data. They are
+ * never valid targeting attributes and must never be read from an evaluation context.
+ */
+declare const FORBIDDEN_ATTRIBUTES: ReadonlySet<string>;
+/**
+ * A flag key is URL- and storage-safe: it appears verbatim in request paths
+ * (`/flags/:key`, `/ofrep/v1/evaluate/flags/{key}`) and as a raw key in whatever storage
+ * backend is plugged in. Restrict to alphanumerics plus dot, underscore, and hyphen,
+ * starting with an alphanumeric, within a bounded length. This excludes path separators
+ * and control characters, closing off traversal and key-injection classes for any adapter.
+ */
+declare function isValidFlagKey(key: string): boolean;
+/** Human-readable description of the flag key rule, for error messages. */
+declare const FLAG_KEY_RULE = "must be 1-256 characters of [A-Za-z0-9._-] and start with an alphanumeric";
+
+/**
+ * Compare two semver strings. Returns -1, 0, or 1. A version with no prerelease outranks
+ * one with a prerelease (1.0.0 > 1.0.0-rc.1); prereleases are otherwise compared lexically.
+ */
+declare function compareSemver(a: string, b: string): number;
+/**
+ * Evaluate a single condition against the context. A referenced attribute that is absent
+ * from the context never matches — you cannot target on data you were not given. Prototype
+ * attribute names are rejected, and only own properties are read, so a crafted attribute
+ * name can never reach up the prototype chain.
+ */
+declare function matchCondition(condition: Condition, context: EvaluationContext): boolean;
+/** True when every condition matches (logical AND). An empty list matches everyone. */
+declare function matchesAllConditions(conditions: Condition[], context: EvaluationContext): boolean;
+
+/**
+ * Evaluate one flag against a context. The cascade:
+ *
+ *   1. If the flag is disabled, serve off.
+ *   2. Walk targeting rules in order; the first whose conditions all match decides the result
+ *      (optionally gated by a per-rule rollout).
+ *   3. If no rule matches, fall through to the flag's default rollout percentage.
+ */
+declare function evaluate(flag: FeatureFlag, context?: EvaluationContext): Promise<EvaluationResult>;
+/** Evaluate many flags against one context, returning a map keyed by flag key. */
+declare function evaluateAll(flags: FeatureFlag[], context?: EvaluationContext): Promise<Record<string, EvaluationResult>>;
+
+/**
+ * Parse arbitrary (untrusted) input — e.g. JSON read back from a storage adapter — into a
+ * FeatureFlag, or return null if it is not a valid flag. A rule with any malformed condition
+ * is rejected wholesale rather than silently weakened. Percentages are clamped to [0, 100].
+ */
+declare function parseFlag(input: unknown): FeatureFlag | null;
+interface CreateFlagInput {
+    key: string;
+    enabled?: boolean;
+    rollout?: {
+        percentage: number;
+    };
+    rules?: TargetingRule[];
+    description?: string;
+    /** Identity recorded in createdBy/updatedBy metadata. */
+    identity?: string;
+}
+/**
+ * Construct a well-formed FeatureFlag with sensible defaults and fresh metadata.
+ * Throws if the key is invalid — this is a programmer-facing constructor, so bad input
+ * fails fast rather than producing an unusable flag.
+ */
+declare function createFlag(input: CreateFlagInput): FeatureFlag;
+
+declare const version = "0.0.0";
+
+export { type AttributeValue, type AuthContext, type AuthVerifier, type Condition, type ConditionValue, type CreateFlagInput, type EvaluationContext, type EvaluationReason, type EvaluationResult, FLAG_KEY_RULE, FORBIDDEN_ATTRIBUTES, type FeatureFlag, type FlagMetadata, LIMITS, type Operator, type RuleResult, type StorageAdapter, type TargetingRule, clampPercentage, compareSemver, createFlag, evaluate, evaluateAll, isInRollout, isValidFlagKey, matchCondition, matchesAllConditions, parseFlag, stickyBucket, version };

package/dist/index.js

@@ -0,0 +1,259 @@
+// src/hash.ts
+function clampPercentage(percentage) {
+  if (Number.isNaN(percentage)) return 0;
+  return Math.max(0, Math.min(100, percentage));
+}
+async function stickyBucket(seed) {
+  const data = new TextEncoder().encode(seed);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+  return new DataView(digest).getUint32(0) % 100;
+}
+async function isInRollout(targetingKey, flagKey, percentage) {
+  const pct = clampPercentage(percentage);
+  if (pct >= 100) return true;
+  if (pct <= 0) return false;
+  const bucket = await stickyBucket(`${targetingKey}:${flagKey}`);
+  return bucket < pct;
+}
+
+// src/limits.ts
+var LIMITS = {
+  maxKeyLength: 256,
+  maxRules: 100,
+  maxConditionsPerRule: 50,
+  maxListItems: 1e3,
+  maxValueLength: 1024
+};
+var FLAG_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var FORBIDDEN_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function isValidFlagKey(key) {
+  return key.length >= 1 && key.length <= LIMITS.maxKeyLength && FLAG_KEY_PATTERN.test(key);
+}
+var FLAG_KEY_RULE = "must be 1-256 characters of [A-Za-z0-9._-] and start with an alphanumeric";
+
+// src/operators.ts
+function isScalar(v) {
+  return typeof v === "string" || typeof v === "number" || typeof v === "boolean";
+}
+function compareNumbers(a, v, test) {
+  const x = Number(a);
+  const y = Number(v);
+  if (Number.isNaN(x) || Number.isNaN(y)) return false;
+  return test(x, y);
+}
+function toInt(part) {
+  const n = parseInt(part ?? "", 10);
+  return Number.isNaN(n) ? 0 : n;
+}
+function parseSemver(v) {
+  const clean = v.trim().replace(/^v/, "");
+  const dash = clean.indexOf("-");
+  const core = dash === -1 ? clean : clean.slice(0, dash);
+  const pre = dash === -1 ? "" : clean.slice(dash + 1);
+  const [major, minor, patch] = core.split(".");
+  return { major: toInt(major), minor: toInt(minor), patch: toInt(patch), pre };
+}
+function compareSemver(a, b) {
+  const x = parseSemver(a);
+  const y = parseSemver(b);
+  if (x.major !== y.major) return x.major < y.major ? -1 : 1;
+  if (x.minor !== y.minor) return x.minor < y.minor ? -1 : 1;
+  if (x.patch !== y.patch) return x.patch < y.patch ? -1 : 1;
+  if (x.pre === y.pre) return 0;
+  if (x.pre === "") return 1;
+  if (y.pre === "") return -1;
+  return x.pre < y.pre ? -1 : 1;
+}
+function compareSemvers(a, v, test) {
+  if (typeof a !== "string" || typeof v !== "string") return false;
+  return test(compareSemver(a, v));
+}
+var operators = {
+  eq: (a, v) => isScalar(v) && a === v,
+  neq: (a, v) => isScalar(v) && a !== v,
+  in: (a, v) => Array.isArray(v) && v.some((item) => item === a),
+  notIn: (a, v) => Array.isArray(v) && !v.some((item) => item === a),
+  contains: (a, v) => typeof a === "string" && typeof v === "string" && a.includes(v),
+  startsWith: (a, v) => typeof a === "string" && typeof v === "string" && a.startsWith(v),
+  endsWith: (a, v) => typeof a === "string" && typeof v === "string" && a.endsWith(v),
+  gt: (a, v) => compareNumbers(a, v, (x, y) => x > y),
+  gte: (a, v) => compareNumbers(a, v, (x, y) => x >= y),
+  lt: (a, v) => compareNumbers(a, v, (x, y) => x < y),
+  lte: (a, v) => compareNumbers(a, v, (x, y) => x <= y),
+  semverGte: (a, v) => compareSemvers(a, v, (cmp) => cmp >= 0),
+  semverLt: (a, v) => compareSemvers(a, v, (cmp) => cmp < 0)
+};
+function matchCondition(condition, context) {
+  if (FORBIDDEN_ATTRIBUTES.has(condition.attribute)) return false;
+  if (!Object.hasOwn(context, condition.attribute)) return false;
+  const attr = context[condition.attribute];
+  if (attr === void 0) return false;
+  const op = operators[condition.operator];
+  if (!op) return false;
+  return op(attr, condition.value);
+}
+function matchesAllConditions(conditions, context) {
+  return conditions.every((condition) => matchCondition(condition, context));
+}
+
+// src/evaluate.ts
+function isSplit(percentage) {
+  return percentage > 0 && percentage < 100;
+}
+async function resolveRule(result, targetingKey, flagKey, ruleIndex) {
+  if (!result.enabled) return { value: false, reason: "TARGETING_MATCH", ruleIndex };
+  const percentage = result.rollout?.percentage ?? 100;
+  const value = await isInRollout(targetingKey, flagKey, percentage);
+  return { value, reason: isSplit(percentage) ? "SPLIT" : "TARGETING_MATCH", ruleIndex };
+}
+async function evaluate(flag, context = {}) {
+  if (!flag.enabled) return { value: false, reason: "DISABLED" };
+  const targetingKey = context.targetingKey ?? "";
+  let ruleIndex = 0;
+  for (const rule of flag.rules ?? []) {
+    if (matchesAllConditions(rule.conditions, context)) {
+      return resolveRule(rule.result, targetingKey, flag.key, ruleIndex);
+    }
+    ruleIndex++;
+  }
+  const percentage = flag.rollout.percentage;
+  const value = await isInRollout(targetingKey, flag.key, percentage);
+  return { value, reason: isSplit(percentage) ? "SPLIT" : "DEFAULT" };
+}
+async function evaluateAll(flags, context = {}) {
+  const entries = await Promise.all(
+    flags.map(async (flag) => [flag.key, await evaluate(flag, context)])
+  );
+  return Object.fromEntries(entries);
+}
+
+// src/validate.ts
+var OPERATORS = [
+  "eq",
+  "neq",
+  "in",
+  "notIn",
+  "contains",
+  "startsWith",
+  "endsWith",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "semverGte",
+  "semverLt"
+];
+function asRecord(input) {
+  return typeof input === "object" && input !== null ? input : null;
+}
+function isConditionValue(v) {
+  if (typeof v === "string") return v.length <= LIMITS.maxValueLength;
+  if (typeof v === "number" || typeof v === "boolean") return true;
+  if (Array.isArray(v)) {
+    if (v.length > LIMITS.maxListItems) return false;
+    return v.every(
+      (x) => typeof x === "string" ? x.length <= LIMITS.maxValueLength : typeof x === "number"
+    );
+  }
+  return false;
+}
+function parseCondition(input) {
+  const o = asRecord(input);
+  if (!o) return null;
+  if (typeof o.attribute !== "string") return null;
+  if (o.attribute.length === 0 || o.attribute.length > LIMITS.maxKeyLength) return null;
+  if (FORBIDDEN_ATTRIBUTES.has(o.attribute)) return null;
+  if (typeof o.operator !== "string" || !OPERATORS.includes(o.operator)) return null;
+  if (!isConditionValue(o.value)) return null;
+  return { attribute: o.attribute, operator: o.operator, value: o.value };
+}
+function parseRuleResult(input) {
+  const o = asRecord(input);
+  if (!o || typeof o.enabled !== "boolean") return null;
+  const result = { enabled: o.enabled };
+  const rollout = asRecord(o.rollout);
+  if (rollout && typeof rollout.percentage === "number") {
+    result.rollout = { percentage: clampPercentage(rollout.percentage) };
+  }
+  return result;
+}
+function parseRule(input) {
+  const o = asRecord(input);
+  if (!o || !Array.isArray(o.conditions)) return null;
+  if (o.conditions.length > LIMITS.maxConditionsPerRule) return null;
+  const conditions = o.conditions.map(parseCondition);
+  if (conditions.some((c) => c === null)) return null;
+  const result = parseRuleResult(o.result);
+  if (!result) return null;
+  const rule = { conditions, result };
+  if (typeof o.description === "string") rule.description = o.description;
+  return rule;
+}
+function parseMetadata(input) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const o = asRecord(input) ?? {};
+  return {
+    createdBy: typeof o.createdBy === "string" ? o.createdBy : "unknown",
+    createdAt: typeof o.createdAt === "string" ? o.createdAt : now,
+    updatedBy: typeof o.updatedBy === "string" ? o.updatedBy : "unknown",
+    updatedAt: typeof o.updatedAt === "string" ? o.updatedAt : now
+  };
+}
+function parseFlag(input) {
+  const o = asRecord(input);
+  if (!o) return null;
+  if (typeof o.key !== "string" || !isValidFlagKey(o.key)) return null;
+  if (typeof o.enabled !== "boolean") return null;
+  const rollout = asRecord(o.rollout);
+  const percentage = rollout && typeof rollout.percentage === "number" ? clampPercentage(rollout.percentage) : 0;
+  const rawRules = Array.isArray(o.rules) ? o.rules : [];
+  if (rawRules.length > LIMITS.maxRules) return null;
+  const rules = rawRules.map(parseRule).filter((r) => r !== null);
+  return {
+    key: o.key,
+    enabled: o.enabled,
+    rollout: { percentage },
+    rules,
+    description: typeof o.description === "string" ? o.description : "",
+    metadata: parseMetadata(o.metadata)
+  };
+}
+function createFlag(input) {
+  if (!isValidFlagKey(input.key)) {
+    throw new Error(`Invalid flag key ${JSON.stringify(input.key)}: ${FLAG_KEY_RULE}.`);
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const identity = input.identity ?? "system";
+  return {
+    key: input.key,
+    enabled: input.enabled ?? false,
+    rollout: { percentage: clampPercentage(input.rollout?.percentage ?? 0) },
+    rules: input.rules ?? [],
+    description: input.description ?? "",
+    metadata: { createdBy: identity, createdAt: now, updatedBy: identity, updatedAt: now }
+  };
+}
+
+// src/index.ts
+var version = "0.0.0";
+export {
+  FLAG_KEY_RULE,
+  FORBIDDEN_ATTRIBUTES,
+  LIMITS,
+  clampPercentage,
+  compareSemver,
+  createFlag,
+  evaluate,
+  evaluateAll,
+  isInRollout,
+  isValidFlagKey,
+  matchCondition,
+  matchesAllConditions,
+  parseFlag,
+  stickyBucket,
+  version
+};

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@flaghoist/core",
+  "version": "0.1.0",
+  "description": "Flag schema, evaluation engine, and storage/auth interfaces for Flaghoist. Zero dependencies.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
+    "test": "vitest run --passWithNoTests",
+    "typecheck": "tsc --noEmit",
+    "check:package": "publint --strict && attw --pack ."
+  }
+}