feat(feature-flags): AppConfig-backed gated feature flags

[TheodoreSpeaks]

Summary

• New lib/core/config/feature-flags.ts: runtime feature flags gated by org id, user id, or admin — AppConfig-backed on prod (reuses fetchAppConfigProfile), with an in-file DEFAULT_FEATURE_FLAGS fallback off-prod (no env var)
• Renamed the old env/deployment-detection module feature-flags.ts → env-flags.ts (it was never gated flags); rewrote all importers + the shared test mock (featureFlagsMock → envFlagsMock)
• Admin gate resolved internally and lazily via new isPlatformAdmin(userId) reading the DB replica (dbReplica); only queries when admins is the deciding clause
• add-feature-flag skill for Claude + Cursor
• Infra (separate repo): adds a feature-flags AppConfig ConfigurationProfile alongside access-control

Type of Change

• New feature

Testing

Tested manually. New feature-flags.test.ts (13 tests) + renamed-mock consumers pass. bun run lint, check:api-validation:strict, tsc --noEmit, and cdk synth all clean.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jun 16, 2026 12:17am

[cursor]

PR Summary

Medium Risk
Wide import rename is mechanical but touches auth, billing, and security paths; the new admin gate adds a replica read on admin-only flag evaluation.

Overview
Introduces runtime, per-request feature flags in feature-flags.ts (getFeatureFlags, isFeatureEnabled) backed by the AppConfig feature-flags profile on hosted deployments, with in-file DEFAULT_FEATURE_FLAGS when AppConfig is off. Rules can match globally, by org/user allowlists, or platform admins; admin checks use a new lazy isPlatformAdmin on dbReplica.

The previous feature-flags.ts (deploy-time booleans like isHosted, isBillingEnabled) is renamed to env-flags.ts and all importers, CI validation, and the shared test mock (featureFlagsMock → envFlagsMock) are updated accordingly. Claude/Cursor add-feature-flag skills document how to add gated flags vs env flags.

^{Reviewed by Cursor Bugbot for commit d13b230. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d0e0660. Configure here.}