@voltro/plugin-flags 0.86.0 → 0.88.0

package/dist/index.js

@@ -1,91 +1,219 @@
-import { BASE_NAME as e, evaluateDescriptor as t, evaluateVariantsDescriptor as n, flagsRpcClientImports as r } from "./rpc.js";
-import { evaluateAll as i, evaluateAllVariants as a, evaluateFlag as o, evaluateSchedule as s, evaluateVariant as c, resolveVariant as l, toDefinition as u } from "./evaluate.js";
-import { dataStoreFlagAuditStore as ee, dataStoreFlagStore as d, describeFlags as f, featureFlagsTable as p, flagAuditTable as m, flipFlagEnabled as h, mergeOverrides as g, persistFlagToggle as te, registry as _, setFlagEnabled as v } from "./store.js";
-import { defineFlag as y, gateOverride as b, isTypedFlag as x, typedValueOf as S } from "./define.js";
-import { assertFlagExperimentLinks as C, checkFlagExperimentLinks as w } from "./experimentLink.js";
-import { FLAG_LIFECYCLE_LIMITS as T, classifyShape as E, flagLifecycleReport as D } from "./lifecycle.js";
-import { DEFAULT_FLAG_USAGE_FLUSH_MS as O, FLAG_USAGE_TABLE as k, dataStoreFlagUsageStore as A, flagUsageBuffer as j, flagUsageRowId as M, flagUsageTable as N, recordFlagEvaluation as P, registerFlagUsageRetention as F, startFlagUsageFlush as I, utcDay as L } from "./usage.js";
-import { FlagDisabled as R } from "./errors.js";
-import { Effect as z, Result as B } from "effect";
-import { definePlugin as ne, pluginInstanceName as re } from "@voltro/protocol";
-//#region src/index.ts
-var V = (e) => "request" in e && e.request?.subject || "subject" in e && e.subject || {}, H = (e, t) => {
-	let n = _.get(t);
-	return P(t, "targeted"), n !== void 0 && o(t, n, V(e));
-}, U = (e, t) => H(e, t) ? z.void : z.fail(new R({ flag: t })), W = (e, t) => {
-	let n = _.get(t.key);
-	return P(t.key, "targeted"), n === void 0 ? t.defaultValue : S(t, c(t.key, n, V(e)));
-}, G = (e, t) => {
-	let n = _.get(t.key);
-	return P(t.key, "targeted"), n === void 0 ? null : c(t.key, n, V(e)).name;
-}, ie = (e, t) => e === t || e.startsWith("/") && e.endsWith("/") && new RegExp(e.slice(1, -1)).test(t), K = e, q = (e = {}) => {
-	let o = e.gatedBy ?? {}, s = re({
-		base: K,
-		alias: e.alias,
-		instance: e.name
-	}), c = e.typedFlags ?? [], l = /* @__PURE__ */ new Map();
-	for (let t of c) {
-		if (l.has(t.key)) throw Error(`${K}: two typedFlags declare the key ${JSON.stringify(t.key)}`);
-		if (e.flags?.[t.key] !== void 0) throw Error(`${K}: ${JSON.stringify(t.key)} is declared BOTH in \`flags\` and in \`typedFlags\`. One key, one declaration — the typed one would otherwise be silently overwritten by the untyped baseline.`);
-		l.set(t.key, t);
+import { ConfigError as e, FlagDisabled as t, FlagToggleRefused as n } from "./errors.js";
+import { BASE_NAME as r, configMineDescriptor as i, configRpcClientImports as a, evaluateDescriptor as o, evaluateVariantsDescriptor as s, flagsRpcClientImports as ee } from "./rpc.js";
+import { evaluateAll as te, evaluateAllVariants as ne, evaluateFlag as c, evaluateSchedule as l, evaluateVariant as u, resolveVariant as d, toDefinition as re } from "./evaluate.js";
+import { dataStoreFlagAuditStore as ie, dataStoreFlagStore as ae, describeFlags as f, featureFlagsTable as p, flagAuditTable as m, flipFlagEnabled as oe, mergeOverrides as se, persistConfigValue as ce, persistFlagToggle as le, registry as h, setFlagEnabled as ue } from "./store.js";
+import { defineFlag as g, gateOverride as de, isTypedFlag as _, typedValueOf as v } from "./define.js";
+import { assertFlagExperimentLinks as y, checkFlagExperimentLinks as b } from "./experimentLink.js";
+import { FLAG_LIFECYCLE_LIMITS as x, classifyShape as S, flagLifecycleReport as fe } from "./lifecycle.js";
+import { DEFAULT_FLAG_USAGE_FLUSH_MS as C, FLAG_USAGE_TABLE as w, dataStoreFlagUsageStore as pe, flagUsageBuffer as T, flagUsageRowId as E, flagUsageTable as me, recordFlagEvaluation as D, registerFlagUsageRetention as he, startFlagUsageFlush as ge, utcDay as O } from "./usage.js";
+import { captureConfigFlag as _e, captureDefinedConfig as ve, configData as ye, configError as k, configKey as be, configSummary as xe, defineConfig as A } from "./config.js";
+import { ConfigPort as Se, captureConfigService as j, configValue as M, defaultConfigResolver as N, flagConfigService as Ce } from "./config-port.js";
+import { Effect as P, Layer as we, Result as Te } from "effect";
+import { definePlugin as Ee, pluginInstanceName as De } from "@voltro/protocol";
+// src/index.ts
+var F = (e) => "request" in e && e.request?.subject || "subject" in e && e.subject || {}, I = (e, t) => {
+	let n = h.get(t);
+	return D(t, "targeted"), n !== void 0 && c(t, n, F(e));
+}, L = (e, n) => I(e, n) ? P.void : P.fail(new t({ flag: n })), R = (e, t) => {
+	let n = h.get(t.key);
+	return D(t.key, "targeted"), n === void 0 ? t.defaultValue : v(t, u(t.key, n, F(e)));
+}, z = (e, t) => {
+	let n = h.get(t.key);
+	return D(t.key, "targeted"), n === void 0 ? null : u(t.key, n, F(e)).name;
+}, Oe = (e, t) => e === t || e.startsWith("/") && e.endsWith("/") && new RegExp(e.slice(1, -1)).test(t), B = r, V = (r = {}) => {
+	let c = [
+		"config",
+		"configVersion",
+		"configResolver",
+		"configService",
+		"configQuerySources"
+	], l = Object.create(null);
+	for (let e of c) {
+		let t = Object.getOwnPropertyDescriptor(r, e);
+		if (t) {
+			if (!("value" in t)) throw k("invalid_input");
+			l[e] = t.value;
+		}
 	}
-	c.some((e) => e.experiment !== void 0) && C(c, e.experiments ?? []);
-	let u = { ...e.flags ?? {} };
-	for (let e of c) u[e.key] = e.definition;
-	let v = e.store === "postgres", y, x, S, w, T, E, O, k = [], M = e.usage ?? {}, L = M.track ?? v;
-	if (L && !v) throw Error(`${K}: usage.track requires store: 'postgres' — there is nowhere to record an evaluation on the memory tier, and a dead-flag report that silently observed nothing is exactly the defect it exists to find.`);
-	let V = M.staleAfterDays ?? 30, U = M.retentionDays ?? 90;
-	if (V > U) throw Error(`${K}: usage.staleAfterDays (${V}) exceeds usage.retentionDays (${U}), so the observation window can never be long enough to prove a flag stale and every verdict would be withheld.`);
-	let W = (e) => {
-		let t = g(u, e), n = [];
-		for (let [e, r] of l) {
-			let i = t[e];
-			if (i === void 0) continue;
-			let a = b(r, typeof i == "boolean" ? { enabled: i } : i);
-			a.ok || (n.push(a.refusal), t[e] = r.definition);
+	let u = Object.freeze(l), d = r.gatedBy ?? {}, ue = De({
+		base: B,
+		alias: r.alias,
+		instance: r.name
+	}), g = u.config === void 0 ? void 0 : ve(u.config);
+	if (g) {
+		if (ye(g, [
+			"entries",
+			"keys",
+			"typedFlags"
+		]), !Object.isFrozen(g) || !Object.isFrozen(g.entries) || !Array.isArray(g.keys) || g.keys.length < 1 || g.keys.length > 128) throw k("invalid_input");
+	} else if (u.configVersion !== void 0 || u.configResolver !== void 0 || u.configService !== void 0 || u.configQuerySources !== void 0) throw k("invalid_input");
+	let _ = be(u.configVersion ?? "default.v1");
+	if ((u.configResolver !== void 0 || u.configService !== void 0) && _ === "default.v1" || u.configService && u.configResolver) throw k("invalid_input");
+	let v;
+	if (u.configService) {
+		let e = u.configQuerySources;
+		if (!Array.isArray(e) || e.length > 32 || Reflect.ownKeys(e).length !== e.length + 1) throw k("invalid_input");
+		let t = [];
+		for (let n = 0; n < e.length; n++) {
+			let r = Object.getOwnPropertyDescriptor(e, String(n));
+			if (!r || !("value" in r) || typeof r.value != "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,119}$/.test(r.value)) throw k("invalid_input");
+			t.push(r.value);
 		}
-		k = n, _.set(t);
-	}, G = 0, q = async () => {
-		if (!x) return;
-		let e = ++G, t = await x.loadOverrides();
-		e === G && W(t);
-	}, J = async () => {
-		if (E && x) {
-			if (await q(), L && w && !T) {
-				O = F(process.env, U), j.enable();
-				let e = E.logger;
-				T = I({
-					store: w,
-					intervalMs: M.flushIntervalMs ?? 3e5,
+		if (v = Object.freeze(t), new Set(v).size !== v.length) throw k("invalid_input");
+	} else if (u.configQuerySources !== void 0) throw k("invalid_input");
+	let b = new Set(g?.keys ?? []), x = [...r.typedFlags ?? [], ...u.configService ? [] : g?.typedFlags ?? []];
+	if (u.configService && (r.typedFlags?.some((e) => b.has(e.key)) || Object.keys(r.flags ?? {}).some((e) => b.has(e)))) throw k("invalid_input");
+	let S = /* @__PURE__ */ new Map();
+	for (let e of x) {
+		if (S.has(e.key)) throw Error(`${B}: two typedFlags declare the key ${JSON.stringify(e.key)}`);
+		if (r.flags?.[e.key] !== void 0) throw Error(`${B}: ${JSON.stringify(e.key)} is declared BOTH in \`flags\` and in \`typedFlags\`. One key, one declaration — the typed one would otherwise be silently overwritten by the untyped baseline.`);
+		S.set(e.key, e);
+	}
+	x.some((e) => e.experiment !== void 0) && y(x, r.experiments ?? []);
+	let C = { ...r.flags ?? {} };
+	for (let e of x) C[e.key] = e.definition;
+	let w = C, E = !1, O = 0, A = g ? Ce({
+		catalog: g,
+		flags: () => w,
+		active: () => E,
+		revision: () => O,
+		...u.configResolver === void 0 ? {} : { resolver: u.configResolver },
+		...u.configService === void 0 ? {} : { replacement: u.configService }
+	}) : void 0, j = () => g ? Object.fromEntries(Object.entries(h.all()).filter(([e]) => !b.has(e))) : h.all(), M = r.store === "postgres", F, L, R, z, V, H, ke, U = [], W = r.usage ?? {}, G = W.track ?? M;
+	if (G && !M) throw Error(`${B}: usage.track requires store: 'postgres' — there is nowhere to record an evaluation on the memory tier, and a dead-flag report that silently observed nothing is exactly the defect it exists to find.`);
+	let K = W.staleAfterDays ?? 30, q = W.retentionDays ?? 90;
+	if (K > q) throw Error(`${B}: usage.staleAfterDays (${K}) exceeds usage.retentionDays (${q}), so the observation window can never be long enough to prove a flag stale and every verdict would be withheld.`);
+	let Ae = (e) => {
+		let t = se(C, e), n = g ? new Map(e.map((e) => [e.key, e])) : void 0, r = [];
+		for (let [e, i] of S) {
+			let a = t[e];
+			if (a === void 0) continue;
+			if (g && b.has(e)) try {
+				let r = n?.get(e), i = r ? {
+					enabled: r.enabled,
+					...Object.fromEntries([
+						"rollout",
+						"rolloutBy",
+						"targeting",
+						"variants",
+						"offVariant",
+						"schedule",
+						"description"
+					].flatMap((e) => {
+						let t = r[e];
+						return t === null ? [] : [[e, t]];
+					}))
+				} : a;
+				a = _e(g.entries[e], i), t[e] = a;
+			} catch {
+				r.push({
+					key: e,
+					reason: "Override does not satisfy the bounded Config contract"
+				}), t[e] = i.definition;
+				continue;
+			}
+			let o = de(i, typeof a == "boolean" ? { enabled: a } : a);
+			o.ok || (r.push(o.refusal), t[e] = i.definition);
+		}
+		U = r, g && (w = t), h.set(t);
+	}, J = 0, Y = async () => {
+		if (!L) return;
+		let e = ++J, t = await L.loadOverrides();
+		e === J && Ae(t);
+	}, je = (t) => P.suspend(() => {
+		let n = g && typeof t?.key == "string" && b.has(t.key) ? g.entries[t.key] : void 0;
+		if (!g || !n) return P.fail(new e({ code: "not_found" }));
+		let r;
+		try {
+			r = _e(n, {
+				enabled: !0,
+				rollout: 100,
+				variants: [{
+					name: "set",
+					value: t.value
+				}]
+			});
+		} catch {
+			return P.fail(new e({ code: "invalid_value" }));
+		}
+		let i = n.key, a = r.variants[0].value;
+		if (!M) return w = {
+			...w,
+			[i]: r
+		}, O++, h.set({
+			...h.all(),
+			[i]: r
+		}), P.succeed({
+			key: i,
+			value: a
+		});
+		let o = F, s = h.get(i);
+		return !o || s === void 0 ? P.fail(new e({ code: "unavailable" })) : P.tryPromise(async () => {
+			await ce(o, i, s, a, typeof t.actor == "string" ? t.actor : null), await Y();
+		}).pipe(P.as({
+			key: i,
+			value: a
+		}), P.catch(() => P.tryPromise(Y).pipe(P.ignore, P.andThen(P.fail(new e({ code: "unavailable" }))))));
+	}), X = (e) => P.suspend(() => {
+		let t = e.key, r = e.enabled, i = (e) => P.fail(new n({
+			key: t,
+			reason: e
+		}));
+		if (typeof t != "string" || !t || typeof r != "boolean") return i("unknown_flag");
+		if (b.has(t)) return i("config_value");
+		let a = h.get(t);
+		if (a === void 0) return i("unknown_flag");
+		let o = re(a).enabled !== !1;
+		if (!M) return oe(t, r), P.succeed({
+			key: t,
+			enabled: r,
+			previous: o
+		});
+		let s = F;
+		return s ? P.tryPromise(async () => {
+			await le(s, t, a, r, typeof e.actor == "string" ? e.actor : null), await Y();
+		}).pipe(P.as({
+			key: t,
+			enabled: r,
+			previous: o
+		}), P.catch(() => P.tryPromise(Y).pipe(P.ignore, P.andThen(i("unconfirmed"))))) : i("not_ready");
+	}), Me = async () => {
+		if (H && L) {
+			if (await Y(), G && z && !V) {
+				ke = he(process.env, q), T.enable();
+				let e = H.logger;
+				V = ge({
+					store: z,
+					intervalMs: W.flushIntervalMs ?? 3e5,
 					log: { warn: (t, n) => e.warn(t, n) }
 				});
 			}
-			for (let e of k) E.logger.warn("feature flag override REFUSED — code-declared definition stands", {
+			for (let e of U) H.logger.warn("feature flag override REFUSED — code-declared definition stands", {
 				flag: e.key,
 				reason: e.reason
 			});
 		}
-	}, ae = (e) => {
-		if (o[e] !== void 0) return o[e];
-		for (let [t, n] of Object.entries(o)) if (t !== e && ie(t, e)) return n;
-	}, Y = (e, t) => {
-		let n = ae(t.tag);
-		return n === void 0 || H({ subject: t.subject }, n) ? e : z.fail(new R({ flag: n }));
-	}, X = Object.keys(o).length > 0, Z = (e) => {
-		for (let t of e) P(t, "bulk");
-	}, oe = {
-		...t,
+	}, Ne = (e) => {
+		if (d[e] !== void 0) return d[e];
+		for (let [t, n] of Object.entries(d)) if (t !== e && Oe(t, e)) return n;
+	}, Z = (e, n) => {
+		let r = Ne(n.tag);
+		return r === void 0 || I({ subject: n.subject }, r) ? e : P.fail(new t({ flag: r }));
+	}, Pe = Object.keys(d).length > 0, Fe = (e) => {
+		for (let t of e) D(t, "bulk");
+	}, Ie = {
+		...o,
 		description: "Resolve every feature flag for the calling subject.",
-		execute: (e, t) => z.sync(() => {
-			let e = _.all();
-			return Z(Object.keys(e)), i(e, t.request.subject ?? {});
+		execute: (e, t) => P.sync(() => {
+			let e = j();
+			return Fe(Object.keys(e)), te(e, t.request.subject ?? {});
 		})
-	}, se = {
-		...n,
+	}, Le = {
+		...s,
 		description: "Resolve every feature flag to its served variant for the calling subject.",
-		execute: (e, t) => z.sync(() => {
-			let e = _.all();
-			return Z(Object.keys(e)), a(e, t.request.subject ?? {});
+		execute: (e, t) => P.sync(() => {
+			let e = j();
+			return Fe(Object.keys(e)), ne(e, t.request.subject ?? {});
 		})
 	}, Q = (e) => ({
 		kind: "json",
@@ -94,43 +222,54 @@ var V = (e) => "request" in e && e.request?.subject || "subject" in e && e.subje
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), ce = async () => {
+	}), Re = async () => {
 		let e = [];
-		if (L && w) try {
-			e = await w.load();
+		if (G && z) try {
+			e = await z.load();
 		} catch {
 			e = [];
 		}
-		return D({
-			flags: _.all(),
+		return fe({
+			flags: j(),
 			usage: e,
-			tracking: L,
-			liveCounts: j.liveTargetedCounts(),
-			staleAfterDays: V,
-			retentionDays: U
+			tracking: G,
+			liveCounts: T.liveTargetedCounts(),
+			staleAfterDays: K,
+			retentionDays: q
 		});
-	}, le = () => {
+	}, ze = () => {
 		let e = {};
-		for (let [t, n] of l) e[t] = {
+		for (let [t, n] of S) b.has(t) || (e[t] = {
 			valueType: n.valueType,
 			variants: n.variants.map((e) => e.name),
 			experiment: n.experiment ?? null
-		};
+		});
 		return e;
-	}, ue = [
+	}, Be = [
 		{
 			method: "GET",
 			path: "/list",
 			scope: "process",
 			description: "Every resolved flag (key, enabled, rollout, description) plus the dead-flag lifecycle report: per-flag shape + usage verdict, the observation coverage window, and the limits of what the report can prove.",
-			handler: () => z.promise(async () => {
-				let e = await ce();
+			handler: () => P.promise(async () => {
+				let e = await Re();
 				return Q({
-					flags: f(_.all()),
-					writeScope: v ? "shared-store" : "process",
+					flags: f(j()),
+					writeScope: M ? "shared-store" : "process",
 					lifecycle: e,
-					typed: le(),
-					overrideRefusals: k
+					typed: ze(),
+					overrideRefusals: U,
+					...g ? { config: {
+						bound: E,
+						backend: u.configService ? "custom" : "flags",
+						version: _,
+						resolver: u.configService ? "app-owned" : (u.configResolver ?? N) === N ? "default" : "custom",
+						keys: xe(g),
+						publicKeys: g.keys.filter((e) => g.entries[e].public),
+						maxValueBytes: 16384,
+						roomBindingInstalled: !1,
+						gmEditInstalled: !1
+					} } : {}
 				});
 			})
 		},
@@ -138,7 +277,7 @@ var V = (e) => "request" in e && e.request?.subject || "subject" in e && e.subje
 			method: "POST",
 			path: "/toggle",
 			description: "Flip a flag's kill-switch on/off (live registry; durable on the postgres tier). Logs an audit row.",
-			handler: (e) => z.gen(function* () {
+			handler: (e) => P.gen(function* () {
 				let t;
 				try {
 					t = JSON.parse(e.body || "{}");
@@ -146,33 +285,32 @@ var V = (e) => "request" in e && e.request?.subject || "subject" in e && e.subje
 					return $(400, "invalid JSON body");
 				}
 				if (!t || typeof t.key != "string" || !t.key || typeof t.enabled != "boolean") return $(400, "key (string) + enabled (boolean) required");
-				let n = t.key, r = t.enabled, i = _.get(n);
-				if (i === void 0) return $(404, `unknown flag "${n}"`);
-				if (v) {
-					let e = y;
-					if (!e) return $(503, "flag store is not ready");
-					let a = yield* z.tryPromise(async () => {
-						await te(e, n, i, r, typeof t.actor == "string" ? t.actor : null), await q();
-					}).pipe(z.result);
-					if (B.isFailure(a)) return yield* z.tryPromise(q).pipe(z.ignore), $(503, "flag update could not be confirmed; reload the flag state before retrying");
-				} else h(n, r);
+				let n = yield* P.result(X({
+					key: t.key,
+					enabled: t.enabled,
+					actor: typeof t.actor == "string" ? t.actor : null
+				}));
+				if (Te.isFailure(n)) {
+					let e = n.failure.reason;
+					return e === "config_value" ? $(400, "Config values require their typed writer; the flag toggle cannot change them") : e === "unknown_flag" ? $(404, `unknown flag "${t.key}"`) : e === "not_ready" ? $(503, "flag store is not ready") : $(503, "flag update could not be confirmed; reload the flag state before retrying");
+				}
 				return Q({
 					ok: !0,
-					flags: f(_.all())
+					flags: f(j())
 				});
 			})
 		},
 		{
 			method: "GET",
 			path: "/audit",
-			scope: v ? "shared-store" : "declaration",
+			scope: M ? "shared-store" : "declaration",
 			description: "The kill-switch flip audit trail, newest-first. `?flag=<key>` filters; `?limit=<n>` caps (postgres tier only).",
-			handler: (e) => z.gen(function* () {
-				if (!S) return Q({
+			handler: (e) => P.gen(function* () {
+				if (!R) return Q({
 					audit: [],
 					note: "audit trail requires store: \"postgres\""
 				});
-				let t = new URL(e.url, "http://local"), n = t.searchParams.get("flag"), r = t.searchParams.get("limit"), i = r != null && Number.isFinite(Number(r)) ? Number(r) : 100, a = yield* z.promise(() => S.list({
+				let t = new URL(e.url, "http://local"), n = t.searchParams.get("flag"), r = t.searchParams.get("limit"), i = r != null && Number.isFinite(Number(r)) ? Number(r) : 100, a = yield* P.promise(() => R.list({
 					...n == null ? {} : { flag: n },
 					limit: i
 				}));
@@ -185,60 +323,92 @@ var V = (e) => "request" in e && e.request?.subject || "subject" in e && e.subje
 				})) });
 			})
 		}
-	], de = [
-		...X ? [
+	], Ve = [
+		...Pe ? [
 			"rpc:intercept:mutation",
 			"rpc:intercept:query",
 			"rpc:intercept:action",
 			"rpc:intercept:workflow"
 		] : [],
-		...v ? ["store:write", "store:changes:read"] : [],
+		...M ? ["store:write", "store:changes:read"] : [],
 		"inspect:read",
 		"inspect:write"
 	];
-	return ne({
-		name: s,
-		baseName: K,
-		description: "Feature flags — targeting, % rollout, kill-switch, declarative gating + client evaluation.",
-		permissions: de,
-		routes: [oe, se],
-		rpcClientDescriptors: r,
-		inspectEndpoints: ue,
-		errorSchemas: [{
-			schema: R,
-			import: {
-				module: "@voltro/plugin-flags/errors",
-				name: "FlagDisabled"
-			}
-		}],
-		...X ? {
-			interceptMutation: Y,
-			interceptQuery: Y,
-			interceptAction: Y,
-			interceptWorkflow: Y
+	return {
+		toggle: X,
+		...A ? {
+			config: () => A,
+			setConfig: je
 		} : {},
-		...v ? { extendSchema: { tables: L ? [
-			p,
-			m,
-			N
-		] : [p, m] } } : {},
-		...v ? { bindDataStore: async (e) => {
-			y = e, x = d(y), S = ee(e), L && (w = A(e)), await J();
-		} } : {},
-		...v ? { onChangeEvent: (e) => e.table === "_voltro_feature_flags" ? z.tryPromise(() => q()) : z.void } : {},
-		onActivate: (t) => z.gen(function* () {
-			_.set(u), E = t, x && (yield* z.promise(J)), t.logger.info("feature flags active", {
-				count: Object.keys(u).length,
-				typed: l.size,
-				gated: Object.keys(o).length,
-				store: e.store ?? "memory",
-				usage: L ? T ? `tracking (stale after ${V}d, observations kept ${Math.round((O ?? 0) / 864e5)}d)` : "waiting for store binding" : "off — no dead-flag evidence is collected"
-			});
-		}),
-		onDeactivate: () => z.promise(async () => {
-			E = void 0, await T?.stop(), T = void 0, j.disable(), _.set({});
+		...Ee({
+			name: ue,
+			baseName: B,
+			description: "Feature flags — targeting, % rollout, kill-switch, declarative gating + client evaluation.",
+			permissions: Ve,
+			routes: [
+				Ie,
+				Le,
+				...A ? [{
+					...i,
+					...v === void 0 ? {} : { source: v },
+					execute: (e, t) => A.mine(t.request.subject)
+				}] : []
+			],
+			rpcClientDescriptors: [...ee, ...A ? a : []],
+			inspectEndpoints: Be,
+			errorSchemas: [{
+				schema: t,
+				import: {
+					module: "@voltro/plugin-flags/errors",
+					name: "FlagDisabled"
+				}
+			}, ...A ? [{
+				schema: e,
+				import: {
+					module: "@voltro/plugin-flags/errors",
+					name: "ConfigError"
+				}
+			}] : []],
+			...A ? { services: we.succeed(Se, A) } : {},
+			...Pe ? {
+				interceptMutation: Z,
+				interceptQuery: Z,
+				interceptAction: Z,
+				interceptWorkflow: Z
+			} : {},
+			...M ? { extendSchema: { tables: G ? [
+				p,
+				m,
+				me
+			] : [p, m] } } : {},
+			...M ? { bindDataStore: async (e) => {
+				F = e, L = ae(F), R = ie(e), G && (z = pe(e)), await Me();
+			} } : {},
+			...M ? { onChangeEvent: (e) => e.table === "_voltro_feature_flags" ? P.tryPromise(() => Y()) : P.void } : {},
+			onActivate: (e) => P.gen(function* () {
+				g && (E = !1, O++, J++, w = C), h.set(C), H = e, L && (yield* P.promise(Me)), g && (E = !0), e.logger.info("feature flags active", {
+					count: Object.keys(C).length,
+					typed: S.size,
+					gated: Object.keys(d).length,
+					store: r.store ?? "memory",
+					usage: G ? V ? `tracking (stale after ${K}d, observations kept ${Math.round((ke ?? 0) / 864e5)}d)` : "waiting for store binding" : "off — no dead-flag evidence is collected"
+				});
+			}),
+			onDeactivate: () => P.promise(async () => {
+				g && (E = !1, O++, J++), H = void 0, await V?.stop(), V = void 0, T.disable(), h.set({});
+			})
 		})
-	});
-};
-//#endregion
-export { O as DEFAULT_FLAG_USAGE_FLUSH_MS, T as FLAG_LIFECYCLE_LIMITS, k as FLAG_USAGE_TABLE, R as FlagDisabled, C as assertFlagExperimentLinks, w as checkFlagExperimentLinks, E as classifyShape, A as dataStoreFlagUsageStore, y as defineFlag, f as describeFlags, i as evaluateAll, a as evaluateAllVariants, o as evaluateFlag, s as evaluateSchedule, c as evaluateVariant, p as featureFlagsTable, m as flagAuditTable, D as flagLifecycleReport, _ as flagRegistry, j as flagUsageBuffer, M as flagUsageRowId, N as flagUsageTable, W as flagValue, G as flagVariant, q as flagsPlugin, h as flipFlagEnabled, b as gateOverride, H as isFlagEnabled, x as isTypedFlag, g as mergeOverrides, P as recordFlagEvaluation, F as registerFlagUsageRetention, U as requireFlag, l as resolveVariant, v as setFlagEnabled, I as startFlagUsageFlush, u as toDefinition, S as typedValueOf, L as utcDay };
+	};
+}, H = Object.freeze({
+	slots: { resolver: {
+		defaultExport: "defaultConfigResolver",
+		fixtureExport: "configResolverSystemFixture"
+	} },
+	ports: { config: {
+		tagExport: "ConfigPort",
+		fakeLayerExport: "configFakeLayer",
+		fixtureExport: "configPortSystemFixture"
+	} },
+	events: []
+});
+export { e as ConfigError, Se as ConfigPort, C as DEFAULT_FLAG_USAGE_FLUSH_MS, x as FLAG_LIFECYCLE_LIMITS, w as FLAG_USAGE_TABLE, t as FlagDisabled, y as assertFlagExperimentLinks, j as captureConfigService, b as checkFlagExperimentLinks, S as classifyShape, xe as configSummary, H as configSystemContract, M as configValue, pe as dataStoreFlagUsageStore, N as defaultConfigResolver, A as defineConfig, g as defineFlag, f as describeFlags, te as evaluateAll, ne as evaluateAllVariants, c as evaluateFlag, l as evaluateSchedule, u as evaluateVariant, p as featureFlagsTable, m as flagAuditTable, Ce as flagConfigService, fe as flagLifecycleReport, h as flagRegistry, T as flagUsageBuffer, E as flagUsageRowId, me as flagUsageTable, R as flagValue, z as flagVariant, V as flagsPlugin, oe as flipFlagEnabled, de as gateOverride, I as isFlagEnabled, _ as isTypedFlag, se as mergeOverrides, D as recordFlagEvaluation, he as registerFlagUsageRetention, L as requireFlag, d as resolveVariant, ue as setFlagEnabled, ge as startFlagUsageFlush, re as toDefinition, v as typedValueOf, O as utcDay };

package/dist/lifecycle.js

@@ -1,5 +1,5 @@
 import { toDefinition as e } from "./evaluate.js";
-//#region src/lifecycle.ts
+// src/lifecycle.ts
 var t = 864e5, n = (e) => typeof e == "number" ? e : Date.parse(e), r = (t, r) => {
 	let i = e(t);
 	if (i.enabled === !1) return {
@@ -78,5 +78,4 @@ var t = 864e5, n = (e) => typeof e == "number" ? e : Date.parse(e), r = (t, r) =
 		limits: i
 	};
 };
-//#endregion
 export { i as FLAG_LIFECYCLE_LIMITS, r as classifyShape, a as flagLifecycleReport };

package/dist/rpc.d.ts

@@ -1,6 +1,7 @@
 import { PluginRpcClientDescriptor } from '@voltro/protocol';
 import { QueryProcedureDescriptor } from '@voltro/protocol';
 import { Schema } from 'effect';
+import { YieldableError } from 'effect/Cause';
 
 /**
  * The plugin's canonical package name — the key an app's `alias` is recorded
@@ -14,6 +15,19 @@ import { Schema } from 'effect';
  */
 export declare const BASE_NAME = "@voltro/plugin-flags";
 
+/** Typed Config failures contain no private value, subject or decode body. */
+declare class ConfigError extends ConfigError_base {
+}
+
+declare const ConfigError_base: Schema.Class<ConfigError, Schema.TaggedStruct<"ConfigError", {
+    readonly code: Schema.Literals<readonly ["invalid_input", "invalid_value", "not_found", "unavailable"]>;
+}>, YieldableError>;
+
+/** Only explicitly public Config keys, evaluated for the authenticated caller. */
+export declare const configMineDescriptor: QueryProcedureDescriptor<"config.mine", Schema.Struct<{}>, Schema.$Record<Schema.String, Schema.Unknown>, typeof ConfigError>;
+
+export declare const configRpcClientImports: readonly PluginRpcClientDescriptor[];
+
 export declare const evaluateDescriptor: QueryProcedureDescriptor<"flags.evaluate", Schema.Struct<{}>, Schema.$Record<Schema.String, Schema.Boolean>, Schema.Never>;
 
 export declare const evaluateVariantsDescriptor: QueryProcedureDescriptor<"flags.variants", Schema.Struct<{}>, Schema.$Record<Schema.String, Schema.Struct<{