
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@strav/flag
Advanced tools
Strav feature-flag primitive — FlagManager + scope-aware resolution + in-memory store, with Postgres store, HTTP middleware, and CLI commands shipped under subpaths. Mirrors @strav/cache: kernel-free core in the root, every backend/integration under its o
Feature flags for Strav 1.x. Define
flags, scope them per user / team / tenant, persist resolutions in-memory or in
Postgres, and gate routes with an HTTP middleware. Mirrors the shape of
@strav/cache — kernel-free core in the root, drivers and integrations under
subpaths.
bun add @strav/flag
import { FlagManager, FlagProvider } from '@strav/flag'
// Wire the provider (in-memory store by default).
new FlagProvider({
define(flags) {
flags.define('beta-ui', (scope) => scope.startsWith('User:1'))
flags.define('upload-limit', 25)
},
})
// Resolve and read.
const flags = app.resolve(FlagManager)
if (await flags.active('beta-ui', user)) { ... }
if (await flags.for(team).active('analytics')) { ... }
const limit = await flags.value('upload-limit') // 25
| Subpath | Driver | Use case |
|---|---|---|
| (root) | MemoryFlagStore | dev / tests / single-process apps |
@strav/flag/postgres | PostgresFlagStore | multi-node deployments (cross-process) |
Swap providers — both register under the same FlagManager token:
import { PostgresFlagProvider, applyFlagMigration } from '@strav/flag/postgres'
// Migration:
await applyFlagMigration(db)
// Provider:
providers: [
new PostgresFlagProvider({
define(flags) {
flags.define('beta-ui', (scope) => scope.startsWith('User:'))
},
}),
]
import { ensureFeature } from '@strav/flag/http'
router.get('/beta', ensureFeature('beta-ui'), betaHandler)
router.group(
{ middleware: [authMiddleware(), ensureFeature('analytics')] },
(r) => r.get('/insights', insights),
)
Default scope is ctx.auth?.user. Pass scopeFrom for team / tenant / custom
subjects.
bun strav flag:list # list stored flags + values
bun strav flag:activate beta-ui # global on
bun strav flag:activate beta-ui '"control"' --scope User:42
bun strav flag:deactivate beta-ui --scope User:42
bun strav flag:purge beta-ui # drop stored values → re-resolve
Register the commands provider alongside the flag provider:
import { FlagConsoleProvider } from '@strav/flag/console'
providers: [
new FlagProvider({ /* … */ }),
new FlagConsoleProvider(),
]
// config/flag.ts
export default { strictScopes: true }
With strictScopes: true, reading a flag without a scope throws
MissingScopeError instead of silently evaluating the global value. Catches the
common bug where middleware forgets to pass ctx.auth.user. Writes keep the
loose semantics — activateForEveryone() makes a global write explicit.
activate / deactivate accept an optional actor: { type, id } that flows
into the flag:updated event payload alongside previous (the prior stored
value). Subscribe via EventBus to wire an audit log without coupling
@strav/flag to @strav/audit:
app.resolve(EventBus).on('flag:updated', (e) => {
if (!e.actor) return
auditLog.record({
actor: e.actor,
on: 'feature_flag',
feature: e.feature,
scope: e.scope,
diff: { from: e.previous, to: e.value },
})
})
MIT
FAQs
Strav feature-flag primitive — FlagManager + scope-aware resolution + in-memory store, with Postgres store, HTTP middleware, and CLI commands shipped under subpaths. Mirrors @strav/cache: kernel-free core in the root, every backend/integration under its o
The npm package @strav/flag receives a total of 0 weekly downloads. As such, @strav/flag popularity was classified as not popular.
We found that @strav/flag demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.