[kinyoklion]

Summary

A flagValues entry in an override file expands into a flag that is on and serves its value by fallthrough (OVERRIDE spec 1.3.2.1). That flag has no client-side availability, so allFlagsState with clientSideOnly leaves it out, even when the flag it overrides is available to client-side SDKs. A client-side SDK bootstrapped from that state then evaluates the flag with its own default instead of the overridden value.

This is the intended behavior: making value-only overrides available to client-side SDKs would expose overridden server-only flags to browsers. The FileOverrideSourceOptions documentation now says so and names the way to override a flag that client-side SDKs use: a full definition in flags with "clientSideAvailability": { "usingEnvironmentId": true }. The Node SDK reads client-side availability from clientSideAvailability.usingEnvironmentId only.

A test in LDClientImpl.fileOverrides.test.ts pins both halves: from one override file, the full definition with client-side availability is in the client-side-only state and the value-only entry is not, while both are in the full state.

The other server-side SDKs get the same note.

_{Opened from termag}

SDK-3419

---

Note

Overview
Documents that flagValues overrides are server-only: they still expand to on/fallthrough flags for evaluation, but allFlagsState({ clientSideOnly: true }) omits them even when the underlying LaunchDarkly flag is client-visible—by design, so value-only overrides do not leak server-only flags to browsers.

The FileOverrideSourceOptions JSDoc now states that workaround: put a full entry under flags with clientSideAvailability: { usingEnvironmentId: true }.

Adds a file-override integration test that loads both a flagValues entry and a client-side flags definition from one file and asserts the full state includes both keys while the client-side-only state includes only the full definition.

^{Reviewed by Cursor Bugbot for commit 7a8a5ab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kinyoklion]

bugbot review

[github-actions]

@launchdarkly/js-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 32220 bytes
Compressed size limit: 32500
Uncompressed size: 152548 bytes

[github-actions]

@launchdarkly/js-client-sdk size report
This is the brotli compressed size of the ESM build.
Compressed size: 34386 bytes
Compressed size limit: 35000
Uncompressed size: 122562 bytes

[github-actions]

@launchdarkly/js-client-sdk-common size report
This is the brotli compressed size of the ESM build.
Compressed size: 25998 bytes
Compressed size limit: 44000
Uncompressed size: 167978 bytes

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7a8a5ab. Configure here.}