feat(feature-flags): Handle all feature flag lifecycle events

[stanleyphu]

Why

Namespaced feature flag events currently fall through to raw snake_case data, and callers cannot use their names in typed Events API filters. All eight flag, rule and target lifecycle events now produce typed camelCase data and context through event listing and verified webhooks. Flag owner/environment fields, update history including a flag's previous owner and a rule's previous value, optional rule actors, and both historical value-bearing targets and current rule memberships are preserved.

This draft targets codex/auth-7099-rule-management to reuse the management resource contracts and should retarget main after those resources land. Delivery still depends on the event launch: webhook subscription enums need published-spec regeneration, and rule-update webhook delivery needs API catalog registration.

Not covered by CI

• Ran the new boundary suite against the previous SDK: 26 new-contract checks failed because payloads remained snake_case; all four historical event checks passed. All 30 checks pass after the change.
• The previous-owner cases (previous_attributes.data.owner set and null) and the rule previous-value cases (previous_attributes.data.value, plus empty previous_attributes) fail through both listing and webhooks without the serializer changes and pass with them.
• Exercised the built Node ESM/CJS and worker ESM/CJS entrypoints with all eight names, both target formats, Events API fixture responses and independently signed webhook bytes. All four entrypoints passed.
• Compiled an external consumer against built Node and worker declarations, including all eight exported event interfaces, typed filters and discriminant narrowing.

Proof

A signed fixture containing feature_flags.flag_target.created with rule_id: "flag_rule_test", environment_id: "environment_test", target_id: "org_test" and context client_id: "client_test" returns data.ruleId, data.environmentId, data.targetId and context.clientId. The membership result omits value; the historical target result retains valueType: "boolean" and value: false and omits ruleId. Listing the same fixture produces the identical event in all four built entrypoints.

These checks use API-schema fixtures and local signatures, not live webhook delivery. Before release, verify actual delivery and published subscription enums when the event launch is enabled.

Fixes AUTH-7214

[linear-code]

AUTH-7214

[stanleyphu]

@greptileai review

[stanleyphu]

@greptileai review this draft

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The SDK changes appear safe to merge, with event delivery still subject to the stated launch dependencies.

Summary

Adds typed support for all eight namespaced feature flag lifecycle events.

• Feature flag lifecycle events return typed camelCase data.

No actionable issues found. stanleyphu explicitly defers webhook subscription enum regeneration and rule-update delivery registration until the event launch. Those launch dependencies remain outside this draft. This review checked code and tests; it did not run them.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Events API response] --> C[deserializeEvent]
  B[Signed webhook] --> V[Verify signature]
  V --> P[Parse verified payload]
  P --> C
  C --> F[Flag data and update history]
  C --> R[Rule data and context]
  C --> T[Membership or historical target]

Loading

_{Reviews (4) · Last reviewed commit: "fix(feature-flags): Keep the previous va..." · Reviewed by Greptile}

[stanleyphu]

@greptileai review this draft

[stanleyphu]

@greptileai review this draft