@yedoma-labs/kulyn-flags 0.0.0-stage → 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 yedoma-labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,182 @@
-# Temporary Holding Version
+# @yedoma-labs/kulyn-flags
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<picture>
+  <source media="(max-width: 640px)" srcset="https://raw.githubusercontent.com/yedoma-labs/assets/main/resized/banner-resized-mobile.png">
+  <img src="https://raw.githubusercontent.com/yedoma-labs/assets/main/resized/banner-resized.png" alt="Project Header">
+</picture>
+
+[![CI](https://github.com/yedoma-labs/kulyn-flags/actions/workflows/ci.yml/badge.svg)](https://github.com/yedoma-labs/kulyn-flags/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/@yedoma-labs/kulyn-flags.svg)](https://www.npmjs.com/package/@yedoma-labs/kulyn-flags)
+[![TypeScript](https://img.shields.io/badge/TypeScript-6-blue.svg)](https://www.typescriptlang.org/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+> **kulyn** (*kulyn*) — Yakutian (Sakha) for (noch zu bestätigen)
+
+A flag register with owners and expiry dates, plus hygiene checks you run in CI.
+It answers the question that runtime flag SDKs leave open: **who owns this flag, and is it safe to delete?**
+
+## The problem
+
+Teams add feature flags and never remove them. After a year nobody knows:
+
+- who owns a flag,
+- whether the code still reads it,
+- whether it can be deleted without changing behavior.
+
+Runtime SDKs evaluate flags well. They do not track the lifecycle of a flag. This library fills that gap with a small data format and checks that you run in tests or CI.
+
+## Installation
+
+```sh
+pnpm add -D @yedoma-labs/kulyn-flags
+```
+
+Requires Node.js 20 or newer. It has no runtime dependencies.
+
+## Quickstart
+
+### 1. Register your flags
+
+```ts
+// flags.register.ts
+import { defineFlags } from "@yedoma-labs/kulyn-flags";
+
+export const flags = defineFlags([
+	{
+		key: "checkout.new-ui",
+		owner: "team-checkout",
+		kind: "release",
+		createdAt: "2026-01-12",
+		expiresAt: "2026-03-31",
+		description: "Replaces the legacy checkout page",
+	},
+	{
+		key: "ops.maintenance-banner",
+		owner: "platform",
+		kind: "ops",
+		createdAt: "2026-02-01",
+		expiresAt: "2027-02-01",
+	},
+	{
+		key: "perm.beta-admin",
+		owner: "platform",
+		kind: "permission",
+		createdAt: "2025-11-03",
+	},
+]);
+```
+
+`defineFlags` throws a `FlagRegistryError` with a `code` for the first invalid entry, for example a duplicate key, a missing owner, an invalid date or a lifetime that is too long.
+
+### 2. Add a CI test
+
+```ts
+// tests/flag-hygiene.test.ts
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { describe, it } from "vitest";
+import { assertFlagHygiene, checkFlagHygiene, findFlagKeysInSource } from "@yedoma-labs/kulyn-flags";
+import { flags } from "../flags.register";
+
+function readSources(dir: string): string {
+	return readdirSync(dir, { recursive: true })
+		.map(String)
+		.filter((name) => name.endsWith(".ts") || name.endsWith(".tsx"))
+		.map((name) => readFileSync(join(dir, name), "utf8"))
+		.join("\n");
+}
+
+describe("feature flag hygiene", () => {
+	it("has no expired, overlong or unused flags, and no unregistered usage", () => {
+		const usedKeys = findFlagKeysInSource(readSources("src"));
+		const findings = checkFlagHygiene({ flags, usedKeys });
+		assertFlagHygiene(findings);
+	});
+});
+```
+
+`assertFlagHygiene` throws a `FlagHygieneError` that lists every finding. Pass `failOn` to fail only on some codes:
+
+```ts
+assertFlagHygiene(findings, { failOn: ["EXPIRED", "UNREGISTERED_USAGE"] });
+```
+
+## Lifecycle rules
+
+### Register
+
+| Field         | Rule                                                                                  |
+| ------------- | ------------------------------------------------------------------------------------- |
+| `key`         | Matches `/^[a-z][a-z0-9-.]{1,79}$/`. Keys are unique.                                  |
+| `owner`       | Must not be blank.                                                                    |
+| `kind`        | `release`, `experiment`, `ops` or `permission`.                                       |
+| `createdAt`   | ISO date (`2026-01-12`) or date-time with a timezone (`2026-01-12T10:00:00Z`).       |
+| `expiresAt`   | Same format. Must be after `createdAt`.                                               |
+| `description` | Optional string.                                                                      |
+
+Default maximum lifetimes:
+
+| Kind         | Max lifetime | `expiresAt` required |
+| ------------ | ------------ | -------------------- |
+| `release`    | 90 days      | yes                  |
+| `experiment` | 30 days      | yes                  |
+| `ops`        | 365 days     | yes                  |
+| `permission` | no limit     | no                   |
+
+A kind with a finite limit requires `expiresAt`. Otherwise a flag could avoid the limit by omitting the date.
+Lifetimes are measured from `createdAt` to `expiresAt`. A lifetime equal to the maximum is allowed.
+
+Override the limits per kind. Use `null` to remove a limit:
+
+```ts
+defineFlags(flags, {
+	maxLifetimeDays: { release: 120, experiment: null },
+});
+```
+
+### Hygiene findings
+
+| Code                    | Meaning                                                                                  |
+| ----------------------- | ---------------------------------------------------------------------------------------- |
+| `EXPIRED`               | `now` is at or after `expiresAt`. The expiry instant itself counts as expired.           |
+| `EXCEEDS_MAX_LIFETIME`  | The lifetime is longer than the current limit for its kind. Catches flags registered before a limit was lowered. |
+| `UNUSED`                | The flag is registered but its key was not found in the code. Only with `usedKeys`.      |
+| `UNREGISTERED_USAGE`    | A key is used in the code but not registered. Only with `usedKeys`.                      |
+
+`UNUSED` and `UNREGISTERED_USAGE` are only produced when you pass `usedKeys`. Findings are sorted by key, then by code, so the output is stable and diff-friendly.
+
+## API
+
+- `defineFlags(flags, options?)` validates a register and returns a frozen copy.
+- `checkFlagHygiene({ flags, now?, usedKeys?, maxLifetimeDays? })` returns an array of findings.
+- `assertFlagHygiene(findings, { failOn? })` throws `FlagHygieneError` when a finding matches `failOn`. The default is all codes.
+- `findFlagKeysInSource(sourceText, { functions? })` returns a `Set` of keys. The default function names are `isEnabled`, `getFlag`, `flag` and `evaluate`. The library does not read files. Pass in the text.
+- Errors: `FlagRegistryError` (with `code` and `key`) and `FlagHygieneError` (with `code` and `findings`).
+
+## How the source scan works
+
+`findFlagKeysInSource` recognizes:
+
+- calls with a string literal as the first argument: `isEnabled("key")`, `getFlag('key')`, `client.isEnabled("key", { fallback: false })`
+- property access: `flags.beta`, `flags["new-ui"]`
+
+It ignores text in comments, in template literals (`` `isEnabled("x")` `` is not a call) and in quoted strings (`"flags.old"` is text, not a use). It does scan calls inside `${...}` placeholders. Template literals used as call arguments, such as ``getFlag(`key`)``, are not matched. Keys must be written as literals to be found.
+
+The scan runs in linear time and does not use nested quantifiers. Long inputs stay fast.
+
+## Limitations
+
+- The scan is static. Keys computed at runtime, such as `isEnabled(prefix + name)`, are not found. Flags that are only reached through such calls appear as `UNUSED`. Pass the relevant keys in `usedKeys` or narrow `failOn`.
+- Regex literals that contain quote characters are not understood. A quote inside a regex can hide code on the same line.
+- Dates are checked against the calendar. Date-times need an explicit timezone.
+- The library checks the register. It does not know which flags are on or off in production.
+
+## Not a runtime SDK
+
+This library does not evaluate flags. It does not decide whether a user sees a feature, and it has no network access. For that, use [OpenFeature](https://openfeature.dev/) with its server SDK, [Unleash](https://www.getunleash.io/) or [Flagsmith](https://www.flagsmith.com/).
+
+Use `kulyn-flags` alongside them. Keep the register in your repository, run the hygiene check in CI, and delete flags once the findings say they are safe to remove.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

package/dist/index.cjs

@@ -0,0 +1,419 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+// src/errors.ts
+/**
+* Thrown when a flag register or its options are invalid.
+*/
+var FlagRegistryError = class extends Error {
+	code;
+	/** The offending flag key, when it is known. */
+	key;
+	constructor(code, message, key) {
+		super(message);
+		this.name = "FlagRegistryError";
+		this.code = code;
+		this.key = key;
+	}
+};
+/**
+* Thrown by `assertFlagHygiene` when findings match the `failOn` codes.
+*/
+var FlagHygieneError = class extends Error {
+	code;
+	findings;
+	constructor(findings) {
+		const lines = findings.map((finding) => `  - [${finding.code}] ${finding.message}`);
+		super(`Flag hygiene check failed with ${findings.length} finding(s):\n${lines.join("\n")}`);
+		this.name = "FlagHygieneError";
+		this.code = findings[0]?.code ?? "UNUSED";
+		this.findings = findings;
+	}
+};
+// src/dates.ts
+const DAY_MS = 864e5;
+/**
+* `YYYY-MM-DD`, optionally followed by `T HH:MM[:SS[.fraction]]` and a mandatory timezone.
+* Only fixed quantifiers and a single optional group, so matching is linear.
+*/
+const ISO_PATTERN = /^(\d{4})-(\d{2})-(\d{2})(?:T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(Z|[+-]\d{2}:\d{2}))?$/;
+function isLeapYear(year) {
+	return year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+}
+function daysInMonth(year, month) {
+	return [
+		31,
+		isLeapYear(year) ? 29 : 28,
+		31,
+		30,
+		31,
+		30,
+		31,
+		31,
+		30,
+		31,
+		30,
+		31
+	][month - 1] ?? 0;
+}
+/**
+* Parses a strict ISO 8601 date or date-time and returns epoch milliseconds.
+* Returns `undefined` for anything that is not a real calendar date and time.
+*/
+function parseIsoDate(value) {
+	if (typeof value !== "string") return;
+	const match = ISO_PATTERN.exec(value);
+	if (match === null) return;
+	const year = Number(match[1]);
+	const month = Number(match[2]);
+	const day = Number(match[3]);
+	if (month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month)) return;
+	if (match[4] !== void 0) {
+		const hours = Number(match[4]);
+		const minutes = Number(match[5]);
+		const seconds = match[6] === void 0 ? 0 : Number(match[6]);
+		if (hours > 23 || minutes > 59 || seconds > 59) return;
+		const offset = match[8];
+		if (offset !== void 0 && offset !== "Z") {
+			const offsetHours = Number(offset.slice(1, 3));
+			const offsetMinutes = Number(offset.slice(4, 6));
+			if (offsetHours > 23 || offsetMinutes > 59) return;
+		}
+	}
+	const time = Date.parse(value);
+	return Number.isNaN(time) ? void 0 : time;
+}
+// src/lifetimes.ts
+const FLAG_KINDS = [
+	"release",
+	"experiment",
+	"ops",
+	"permission"
+];
+/**
+* Default maximum lifetimes. `permission` flags may live without limit.
+*/
+const DEFAULT_MAX_LIFETIME_DAYS = Object.freeze({
+	release: 90,
+	experiment: 30,
+	ops: 365,
+	permission: null
+});
+function isFlagKind(value) {
+	return typeof value === "string" && FLAG_KINDS.includes(value);
+}
+/**
+* Merges user overrides into the defaults and validates them.
+*/
+function resolveMaxLifetimeDays(overrides) {
+	const resolved = { ...DEFAULT_MAX_LIFETIME_DAYS };
+	if (overrides === void 0) return resolved;
+	if (typeof overrides !== "object" || overrides === null) throw new FlagRegistryError("INVALID_OPTIONS", "maxLifetimeDays must be an object");
+	for (const kind of Object.keys(overrides)) {
+		if (!isFlagKind(kind)) throw new FlagRegistryError("INVALID_OPTIONS", `Unknown flag kind in maxLifetimeDays: "${kind}"`);
+		const value = overrides[kind];
+		if (value === void 0) continue;
+		if (value !== null && !(Number.isInteger(value) && value > 0)) throw new FlagRegistryError("INVALID_OPTIONS", `maxLifetimeDays.${kind} must be a positive integer or null, got ${String(value)}`);
+		resolved[kind] = value;
+	}
+	return resolved;
+}
+// src/hygiene.ts
+/** Order of codes in the result when two findings share a key. */
+const CODE_ORDER = [
+	"EXPIRED",
+	"EXCEEDS_MAX_LIFETIME",
+	"UNUSED",
+	"UNREGISTERED_USAGE"
+];
+/**
+* Checks a flag register for flags that should be cleaned up.
+*
+* - `EXPIRED`: `now` is at or after `expiresAt`.
+* - `EXCEEDS_MAX_LIFETIME`: the flag lives longer than the configured maximum for its kind.
+*   This catches flags registered before a limit was lowered.
+* - `UNUSED`: only when `usedKeys` is given. The key is registered but not used.
+* - `UNREGISTERED_USAGE`: only when `usedKeys` is given. The key is used but not registered.
+*
+* Findings are sorted by key, then by code.
+*/
+function checkFlagHygiene(options) {
+	const nowMs = resolveNow(options.now);
+	const lifetimes = resolveMaxLifetimeDays(options.maxLifetimeDays);
+	const registered = /* @__PURE__ */ new Set();
+	const findings = [];
+	for (const flag of options.flags) {
+		if (registered.has(flag.key)) throw new FlagRegistryError("DUPLICATE_KEY", `Duplicate flag key "${flag.key}"`, flag.key);
+		registered.add(flag.key);
+		collectLifecycleFindings(flag, nowMs, lifetimes[flag.kind], findings);
+	}
+	if (options.usedKeys !== void 0) {
+		const used = new Set(options.usedKeys);
+		for (const key of registered) if (!used.has(key)) findings.push({
+			key,
+			code: "UNUSED",
+			message: `Flag "${key}" is registered but not used`
+		});
+		for (const key of used) if (!registered.has(key)) findings.push({
+			key,
+			code: "UNREGISTERED_USAGE",
+			message: `Flag "${key}" is used but not registered`
+		});
+	}
+	return findings.sort((a, b) => compareStrings(a.key, b.key) || CODE_ORDER.indexOf(a.code) - CODE_ORDER.indexOf(b.code));
+}
+/**
+* Throws `FlagHygieneError` if any finding has a code listed in `failOn`.
+* Defaults to all codes. Use it in tests or CI.
+*/
+function assertFlagHygiene(findings, options) {
+	const failOn = new Set(options?.failOn ?? CODE_ORDER);
+	const failing = findings.filter((finding) => failOn.has(finding.code));
+	if (failing.length > 0) throw new FlagHygieneError(failing);
+}
+function collectLifecycleFindings(flag, nowMs, maxDays, findings) {
+	if (!isFlagKind(flag.kind)) throw new FlagRegistryError("INVALID_KIND", `Flag "${flag.key}" has invalid kind`, flag.key);
+	const createdMs = parseIsoDate(flag.createdAt);
+	if (createdMs === void 0) throw new FlagRegistryError("INVALID_DATE", `Flag "${flag.key}" has invalid createdAt`, flag.key);
+	if (flag.expiresAt === void 0) return;
+	const expiresMs = parseIsoDate(flag.expiresAt);
+	if (expiresMs === void 0) throw new FlagRegistryError("INVALID_DATE", `Flag "${flag.key}" has invalid expiresAt`, flag.key);
+	if (nowMs >= expiresMs) findings.push({
+		key: flag.key,
+		code: "EXPIRED",
+		message: `Flag "${flag.key}" expired at ${flag.expiresAt}`
+	});
+	if (maxDays !== null && maxDays !== void 0) {
+		const lifetimeMs = expiresMs - createdMs;
+		if (lifetimeMs > maxDays * 864e5) findings.push({
+			key: flag.key,
+			code: "EXCEEDS_MAX_LIFETIME",
+			message: `Flag "${flag.key}" (${flag.kind}) lives ${lifetimeMs / DAY_MS} days, the maximum is ${maxDays}`
+		});
+	}
+}
+function resolveNow(now) {
+	if (now === void 0) return Date.now();
+	const time = now.getTime();
+	if (Number.isNaN(time)) throw new FlagRegistryError("INVALID_OPTIONS", "now is an invalid Date");
+	return time;
+}
+function compareStrings(a, b) {
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+}
+// src/registry.ts
+const KEY_PATTERN = /^[a-z][a-z0-9-.]{1,79}$/;
+/**
+* Validates a flag register and returns a frozen, normalized copy.
+*
+* Throws `FlagRegistryError` with a `code` for the first invalid entry.
+* A flag kind with a finite maximum lifetime requires `expiresAt`, so that a flag
+* cannot escape the limit by omitting the date.
+*/
+function defineFlags(definitions, options) {
+	if (!Array.isArray(definitions)) throw new FlagRegistryError("INVALID_DEFINITION", "defineFlags expects an array of flags");
+	const maxLifetimeDays = resolveMaxLifetimeDays(options?.maxLifetimeDays);
+	const seen = /* @__PURE__ */ new Set();
+	const result = [];
+	for (const [index, raw] of definitions.entries()) {
+		const flag = validateDefinition(raw, index, maxLifetimeDays);
+		if (seen.has(flag.key)) throw new FlagRegistryError("DUPLICATE_KEY", `Duplicate flag key "${flag.key}"`, flag.key);
+		seen.add(flag.key);
+		result.push(flag);
+	}
+	return Object.freeze(result);
+}
+function validateDefinition(raw, index, maxLifetimeDays) {
+	if (typeof raw !== "object" || raw === null) throw new FlagRegistryError("INVALID_DEFINITION", `Flag at index ${index} is not an object`);
+	const record = raw;
+	const key = record.key;
+	if (typeof key !== "string" || !KEY_PATTERN.test(key)) throw new FlagRegistryError("INVALID_KEY", `Invalid flag key at index ${index}: ${JSON.stringify(key)} (must match ${KEY_PATTERN.source})`, typeof key === "string" ? key : void 0);
+	const owner = record.owner;
+	if (typeof owner !== "string" || owner.trim() === "") throw new FlagRegistryError("EMPTY_OWNER", `Flag "${key}" has no owner`, key);
+	const kind = record.kind;
+	if (!isFlagKind(kind)) throw new FlagRegistryError("INVALID_KIND", `Flag "${key}" has invalid kind ${JSON.stringify(kind)}`, key);
+	const createdAt = record.createdAt;
+	const createdMs = parseIsoDate(createdAt);
+	if (createdMs === void 0) throw new FlagRegistryError("INVALID_DATE", `Flag "${key}" has invalid createdAt ${JSON.stringify(createdAt)}`, key);
+	const expiresAt = record.expiresAt;
+	let expiresMs;
+	if (expiresAt !== void 0) {
+		expiresMs = parseIsoDate(expiresAt);
+		if (expiresMs === void 0) throw new FlagRegistryError("INVALID_DATE", `Flag "${key}" has invalid expiresAt ${JSON.stringify(expiresAt)}`, key);
+		if (expiresMs <= createdMs) throw new FlagRegistryError("EXPIRY_NOT_AFTER_CREATION", `Flag "${key}" expires at ${String(expiresAt)}, which is not after createdAt`, key);
+	}
+	const maxDays = maxLifetimeDays[kind];
+	if (maxDays !== null) {
+		if (expiresMs === void 0) throw new FlagRegistryError("MISSING_EXPIRY", `Flag "${key}" (${kind}) needs an expiresAt, the maximum lifetime is ${maxDays} days`, key);
+		if (expiresMs - createdMs > maxDays * 864e5) throw new FlagRegistryError("EXCEEDS_MAX_LIFETIME", `Flag "${key}" (${kind}) lives longer than the maximum of ${maxDays} days`, key);
+	}
+	const description = record.description;
+	if (description !== void 0 && typeof description !== "string") throw new FlagRegistryError("INVALID_DESCRIPTION", `Flag "${key}" has a non-string description`, key);
+	const flag = {
+		key,
+		owner,
+		kind,
+		createdAt
+	};
+	if (expiresAt !== void 0) flag.expiresAt = expiresAt;
+	if (description !== void 0) flag.description = description;
+	return flag;
+}
+// src/scan.ts
+const DEFAULT_FUNCTIONS = [
+	"isEnabled",
+	"getFlag",
+	"flag",
+	"evaluate"
+];
+/** Upper bound for a key literal. Longer literals are ignored. */
+const MAX_LITERAL_LENGTH = 100;
+/**
+* Finds flag keys in source text.
+*
+* Recognized forms, with single or double quotes:
+* - `isEnabled("key")`, `getFlag('key')` and the other configured function names
+* - `flags.key` (identifier-style keys only)
+* - `flags["key"]`
+*
+* Text in comments, and template literals (backticks), are ignored, including `${...}`
+* placeholders in template literals that are not code. Calls inside `${...}` are still scanned.
+* Calls and property access written inside a quoted string (`"isEnabled('x')"`) are ignored,
+* because they are text, not code.
+* This function does not read files. The caller passes the text.
+*
+* Limitations: regex literals containing quotes are not understood. A quote inside a
+* regex literal can hide code on the same line.
+*/
+function findFlagKeysInSource(sourceText, options) {
+	const functions = options?.functions ?? DEFAULT_FUNCTIONS;
+	const { code, stringRanges } = maskWithStrings(sourceText);
+	const keys = /* @__PURE__ */ new Set();
+	if (functions.length > 0) {
+		const alternation = functions.map(escapeRegExp).join("|");
+		const callPattern = new RegExp(String.raw`\b(?:${alternation})\s*\(\s*(["'])([^"'\\\r\n]{1,${MAX_LITERAL_LENGTH}})\1(?=\s*[,)])`, "g");
+		for (const match of code.matchAll(callPattern)) {
+			if (isInRanges(stringRanges, match.index)) continue;
+			const key = match[2];
+			if (key !== void 0) keys.add(key);
+		}
+	}
+	for (const match of code.matchAll(/\bflags\.([a-z][a-z0-9]*)(?![\w.-]|\s*\()/g)) {
+		if (isInRanges(stringRanges, match.index)) continue;
+		const key = match[1];
+		if (key !== void 0) keys.add(key);
+	}
+	const bracketPattern = new RegExp(String.raw`\bflags\s*\[\s*(["'])([^"'\\\r\n]{1,${MAX_LITERAL_LENGTH}})\1\s*\]`, "g");
+	for (const match of code.matchAll(bracketPattern)) {
+		if (isInRanges(stringRanges, match.index)) continue;
+		const key = match[2];
+		if (key !== void 0) keys.add(key);
+	}
+	return keys;
+}
+/**
+* Like `maskNonCode`, and also returns the ranges of quoted string literals as flat
+* `[start, end, start, end, ...]` pairs (end is exclusive), in source order.
+*/
+function maskWithStrings(source) {
+	const out = source.split("");
+	const n = source.length;
+	const stringRanges = [];
+	const frames = [{
+		kind: "code",
+		braces: 0,
+		interpolation: false
+	}];
+	const mask = (from, to) => {
+		for (let k = from; k < to; k++) if (out[k] !== "\n" && out[k] !== "\r") out[k] = " ";
+	};
+	let i = 0;
+	while (i < n) {
+		const top = frames[frames.length - 1];
+		if (top === void 0) break;
+		const ch = source[i];
+		const next = source[i + 1];
+		if (top.kind === "template") {
+			if (ch === "\\") {
+				mask(i, i + 2);
+				i += 2;
+			} else if (ch === "`") {
+				mask(i, i + 1);
+				frames.pop();
+				i++;
+			} else if (ch === "$" && next === "{") {
+				mask(i, i + 2);
+				frames.push({
+					kind: "code",
+					braces: 0,
+					interpolation: true
+				});
+				i += 2;
+			} else {
+				mask(i, i + 1);
+				i++;
+			}
+			continue;
+		}
+		if (ch === "/" && next === "/") {
+			const newline = source.indexOf("\n", i);
+			const end = newline === -1 ? n : newline;
+			mask(i, end);
+			i = end;
+		} else if (ch === "/" && next === "*") {
+			const close = source.indexOf("*/", i + 2);
+			const end = close === -1 ? n : close + 2;
+			mask(i, end);
+			i = end;
+		} else if (ch === "\"" || ch === "'") {
+			let j = i + 1;
+			while (j < n && source[j] !== ch && source[j] !== "\n") j += source[j] === "\\" ? 2 : 1;
+			const end = source[j] === ch ? j + 1 : j;
+			stringRanges.push(i, end);
+			i = end;
+		} else if (ch === "`") {
+			mask(i, i + 1);
+			frames.push({ kind: "template" });
+			i++;
+		} else if (ch === "{") {
+			top.braces++;
+			i++;
+		} else if (ch === "}") {
+			if (top.interpolation && top.braces === 0) {
+				mask(i, i + 1);
+				frames.pop();
+			} else if (top.braces > 0) top.braces--;
+			i++;
+		} else i++;
+	}
+	return {
+		code: out.join(""),
+		stringRanges
+	};
+}
+/** True when `index` lies in one of the sorted `[start, end)` pairs of `ranges`. */
+function isInRanges(ranges, index) {
+	if (index === void 0) return false;
+	let lo = 0;
+	let hi = ranges.length / 2 - 1;
+	while (lo <= hi) {
+		const mid = lo + hi >> 1;
+		const start = ranges[mid * 2] ?? 0;
+		const end = ranges[mid * 2 + 1] ?? 0;
+		if (index < start) hi = mid - 1;
+		else if (index >= end) lo = mid + 1;
+		else return true;
+	}
+	return false;
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+exports.DEFAULT_MAX_LIFETIME_DAYS = DEFAULT_MAX_LIFETIME_DAYS;
+exports.FlagHygieneError = FlagHygieneError;
+exports.FlagRegistryError = FlagRegistryError;
+exports.assertFlagHygiene = assertFlagHygiene;
+exports.checkFlagHygiene = checkFlagHygiene;
+exports.defineFlags = defineFlags;
+exports.findFlagKeysInSource = findFlagKeysInSource;
+
+//# sourceMappingURL=index.cjs.map