Feature flags, evaluated inside your process.

# Mint an SDK token: a durable, revocable REFRESH credential returned ONCE.
# Put it in WAGLE_API_TOKEN; the SDK exchanges it for short access tokens.
# User token, admin-gated. Omit "class" for backend trust; pass
# "TRUST_CLASS_FRONTEND" for a browser bundle that must never see a server_only flag.
curl -sS $WAGLE_URL/api.sdk.v1.SdkTokenService/CreateSdkToken \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $WAGLE_TOKEN" \
  -d '{"project":"baseline","name":"web-app"}'
# -> {"token":"<refresh-credential, shown once>","models":{"sdkTokens":[...]},"graphs":[...]}

# Programmatic access uses an SDK token: a durable, revocable REFRESH
# credential a logged-in console user mints once (CreateSdkToken — see below),
# stored in WAGLE_API_TOKEN. It is READ-ONLY: eval + sync only (SPEC D46).
# The SDK exchanges it for short 24h access tokens automatically; here is that
# exchange by hand — a PUBLIC call, the credential in the body is the auth.
curl -sS $WAGLE_URL/api.sdk.v1.SdkTokenService/RefreshSdkToken \
  -H 'Content-Type: application/json' \
  -d '{"refreshToken":"$WAGLE_API_TOKEN"}'
# -> {"accessToken":"<jwt, 24h>"}
# Pass that access token as Authorization: Bearer on eval / sync.

// go get github.com/unirakun/wagle-sdks/go
import wagle "github.com/unirakun/wagle-sdks/go"

// The SDK owns its transport: it dials https://api.wagle.sh over TLS and reads
// its bearer from WAGLE_API_TOKEN — the once-shown token from the console's
// "SDK Tokens" settings card. project is the opaque project UUID (D44), not its
// display name. New blocks until the first seed lands (fails fast on error),
// so the returned client is ready to Evaluate.
client, err := wagle.New("baseline", "production")
if err != nil {
	// initial seed failed
}
defer client.Close()

// Point at another server / pass the token explicitly / dial local h2c:
// client, err = wagle.New("baseline", "production",
// 	wagle.WithURL("$WAGLE_URL"),        // default https://api.wagle.sh
// 	wagle.WithToken(os.Getenv("MY_TOKEN")), // default WAGLE_API_TOKEN
// 	wagle.WithInsecure())                   // cleartext h2c for local dev

// A pure, local, lock-free read of the held snapshot — zero network hop.
// attrs may be nil (empty context).
res, err := client.Evaluate("new-checkout", "user-42", map[string]string{"plan": "pro"})
if err != nil {
	// a pinned eval error, e.g. flag not found
}
// res.VariationKey / res.Value / res.Reason / res.ValueType

// pnpm add @wagleflags/sdk
import { createWagleClient } from "@wagleflags/sdk";

const client = createWagleClient({
  url: "$WAGLE_URL",
  project: "baseline",
  environment: "production",
  token: process.env.WAGLE_API_TOKEN, // the SDK refresh credential (SPEC D46)
});

await client.ready(); // resolves after the first seed

client.close(); // stop the pump when done

// A pure, local read of the held snapshot — zero per-eval network hop.
const res = client.evaluate("new-checkout", {
  entityId: "user-42",
  attributes: { plan: "pro" },
});
// res is a Trace ({ variationKey, value, reason, ... })
// or an EvaluationError — narrow with isEvalError.

import { useFlag } from "@wagleflags/sdk/react";

function Checkout({ client }: { client: WagleClient }) {
  // Re-renders live when a poll swaps the snapshot; evaluates locally.
  const value = useFlag(client, "new-checkout", {
    entityId: "user-42",
    attributes: { plan: "pro" },
  });
  return value === "true" ? <NewCheckout /> : <OldCheckout />;
}

// useFlag -> the served value string (undefined when unresolved);
// useEvaluate -> the full Trace | EvaluationError (reason, bucket, ...).

// Untrusted client bundle (web/mobile)? Use the BROWSER-trust twin: the
// same seed -> poll -> local-eval loop, but a server_only flag never
// enters its store. Pair it with a frontend-class SDK token.
import { createWagleFrontendClient } from "@wagleflags/sdk/frontend";

const client = createWagleFrontendClient({
  url: "$WAGLE_URL",
  project: "baseline",
  environment: "production",
  token: "<frontend-sdk-token>",
});

// New seeds once from SyncService.Get, then re-checks on an interval.
// Each poll sends the held version; when nothing changed the server answers
// with a tiny "unchanged" response, so short intervals stay cheap. The
// interval is your freshness-vs-cost dial: 5-30s interactive, 60-300s batch.
client, err := wagle.New("baseline", "production",
	wagle.WithPollInterval(15*time.Second), // default 30s
)
if err != nil {
	// initial seed failed
}
defer client.Close()

v := client.Version() // the held (project, environment) config version

// createWagleClient seeds once via sync.Get, then re-checks on an
// interval. Each poll sends the held version; when nothing changed the server
// answers with a tiny "unchanged" response, so short intervals stay cheap.
const client = createWagleClient({
  url: "$WAGLE_URL",
  project: "baseline",
  environment: "production",
  token: process.env.WAGLE_API_TOKEN,
  pollIntervalMs: 15_000, // the freshness-vs-cost dial (default 30_000)
});

await client.ready();
client.getSnapshot().version; // the held config version

# A segment is a reusable named predicate over context attributes. Conditions
# are ANDed; operators are OPERATOR_EQ / OPERATOR_IN here (no nesting).
curl -sS $WAGLE_URL/api.admin.v1.AdminService/CreateSegment \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $WAGLE_TOKEN" \
  -d '{
    "project": "baseline",
    "environment": "production",
    "segment": {
      "key": "beta-testers",
      "conditions": [
        {"attribute": "plan", "op": "OPERATOR_IN", "values": ["pro", "enterprise"]}
      ]
    }
  }'
# -> {"models":{"segments":[...]},"graphs":[...],"version":"..."}

# Reference it from a flag rule — operator IN_SEGMENT, values = [segment key]:
#   "rules": [
#     {"conditions": [{"op": "OPERATOR_IN_SEGMENT", "values": ["beta-testers"]}],
#      "variationKey": "on"}
#   ]

// Segments arrive in the seed snapshot alongside the flags, so a rule that
// targets a segment (operator IN_SEGMENT) is resolved LOCALLY — zero extra
// network hop, same as any other rule. You just evaluate.
res, err := client.Evaluate("new-checkout", "user-42", map[string]string{"plan": "pro"})
if err != nil {
	// a pinned eval error
}
// When the entity's attributes place it in a targeted segment, res.Reason is
// the matched rule's Reason enum: TARGET_MATCH (fixed variation) or
// ROLLOUT (a percentage split).

curl -sS $WAGLE_URL/api.admin.v1.AdminService/CreateFlag \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $WAGLE_TOKEN" \
  -d '{
    "project": "baseline",
    "environment": "production",
    "flag": {
      "key": "new-checkout",
      "valueType": "VALUE_TYPE_BOOL",
      "variations": [
        {"key": "on", "value": "true"},
        {"key": "off", "value": "false"}
      ],
      "environments": {
        "production": {"enabled": true, "defaultVariationKey": "on", "offVariationKey": "off"}
      }
    }
  }'
# -> {"models":{"flags":[...]},"graphs":[...],"version":"1"}

curl -sS $WAGLE_URL/api.eval.v1.EvaluationService/Evaluate \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $WAGLE_TOKEN" \
  -d '{"project":"baseline","environment":"production","flagKey":"new-checkout","context":{"entityId":"user-42","attributes":{"plan":"pro"}}}'
# -> {"variationKey":"on","value":"true","reason":"REASON_DEFAULT","valueType":"VALUE_TYPE_BOOL"}

# Initial seed: the whole (project, environment) snapshot + its version.
curl -sS $WAGLE_URL/api.sync.v1.SyncService/Get \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $WAGLE_TOKEN" \
  -d '{"project":"baseline","environment":"production"}'
# -> {"models":{"flags":[...],"segments":[...]},"graphs":[...],"version":"1"}

# Efficient poll: send the version you hold — an unchanged poll returns a
# tiny no-change response instead of the whole snapshot.
curl -sS $WAGLE_URL/api.sync.v1.SyncService/Get \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $WAGLE_TOKEN" \
  -d '{"project":"baseline","environment":"production","sinceVersion":"1"}'
# -> {"version":"1","unchanged":true}

# The SDKs poll this same Get on an interval (default 30s, tunable):
# the freshness-vs-cost dial. An unchanged poll costs almost nothing.

# Project audit view: the latest version per entity, grouped by type.
curl -sS $WAGLE_URL/api.admin.v1.AdminService/GetHistory \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $WAGLE_TOKEN" \
  -d '{"project":"baseline","environment":"production"}'
# -> {"history":[{"type":"HISTORY_TYPE_FLAG_VERSION","entries":{...}}, ...],"version":"..."}

# One flag generation's full write timeline (oldest first), fetched by the
# flag's immutable UUID (flagId — SPEC D54; ids come from ListFlags). Each entry
# carries the protojson snapshot at that version for consecutive-version diffs.
# ("key":"new-checkout" is the compat request instead: it resolves the NEWEST
# generation only — a recreated key never concatenates its predecessor's rows.)
curl -sS $WAGLE_URL/api.admin.v1.AdminService/GetFlagHistory \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $WAGLE_TOKEN" \
  -d '{"project":"baseline","environment":"production","flagId":"<flag-uuid>"}'
# -> {"entries":[{"sourceId":"baseline/new-checkout","entityId":"<flag-uuid>",
#      "entityKey":"new-checkout","createdBy":"...","snapshot":"{...}"}, ...]}
# (protojson omits zero values: "deleted":true appears only on delete rows.)

# Errors are Connect JSON — {"code":"<snake_case>","message":"..."} with a
# mapped HTTP status. Eval/sync/admin are authenticated, so the gate answers
# first: with NO bearer token you get 401 unauthenticated. This needs no
# credential — Run it:
curl -sS $WAGLE_URL/api.eval.v1.EvaluationService/Evaluate \
  -H 'Content-Type: application/json' \
  -d '{"project":"baseline","environment":"production","flagKey":"missing"}'
# -> HTTP 401 {"code":"unauthenticated","message":"missing bearer token"}

# Once authenticated (against your OWN project) the pinned Evaluate errors show —
# these messages are stable across releases, clients may depend on the bytes:
#   missing flag:   HTTP 404 {"code":"not_found","message":"flag not found: baseline/production/missing"}
#   no environment: HTTP 400 {"code":"invalid_argument","message":"environment is required"}

{
  "mcpServers": {
    "wagle-admin": {
      "type": "http",
      "url": "$WAGLE_URL/mcp",
      "headers": { "Authorization": "Bearer <refresh-credential>" }
    }
  }
}

# Claude Code: register the endpoint once, then just ask.
claude mcp add --transport http wagle-admin \
  $WAGLE_URL/mcp \
  --header "Authorization: Bearer <refresh-credential>"

# The agent discovers the tools itself - you talk product, it picks the tool:
> Which flags are enabled in production, and which are still fully off?
> Turn new-checkout off in production.
> Roll new-checkout out to 25% in production, everyone else stays off.
> Create a bool flag "maintenance-banner" in production, default off.
> Who changed new-checkout recently, and what exactly changed?