@nebulr-group/bridge-svelte 0.1.0-beta.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Nebulr AB
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,63 @@
+
+## @nebulr-group/bridge-svelte
+
+[![MadeWithSvelte.com shield](https://madewithsvelte.com/storage/repo-shields/5996-shield.svg)](https://madewithsvelte.com/p/the-bridge/shield-link)
+
+
+Bridge Svelte library. Add Bridge auth, feature flags, and payments to your SvelteKit 2 + Svelte 5 apps.
+
+### Install
+
+```bash
+npm i @nebulr-group/bridge-svelte
+```
+
+### Usage
+
+See the `demo/` app in the monorepo for end-to-end wiring.
+
+### Build
+
+
+```bash
+npm run build
+```
+
+Artifacts are emitted to `dist/` via `svelte-package`.
+
+### Release (branch-protected main)
+
+```bash
+# 1) Create release branch
+git checkout -b release/v0.1.0-beta.1
+git push -u origin release/v0.1.0-beta.1
+
+# 2) Open a PR: release/v0.1.0-beta.1 -> main, approve and merge
+
+# 3) After merge to main, tag and push
+git checkout main && git pull
+git tag v0.1.0-beta.1
+git push origin v0.1.0-beta.1
+
+# 4) Monitor GitHub Actions "Publish to npm"
+```
+
+### Commit signing (required)
+
+Ensure your commits are verified before opening PRs:
+
+```bash
+# Option A: SSH signing (recommended)
+git config --global gpg.format ssh
+git config --global user.signingkey ~/.ssh/id_ed25519.pub
+git config --global commit.gpgsign true
+
+# Option B: GPG signing
+gpg --full-generate-key
+gpg --list-secret-keys --keyid-format=long
+git config --global user.signingkey <KEY_ID>
+git config --global commit.gpgsign true
+```
+
+### License
+MIT © thebridgedev

package/dist/auth/route-guard.d.ts

@@ -0,0 +1,2 @@
+export type { FlagRequirement, NavigationDecision, RouteGuard, RouteGuardConfig, RouteRule } from '@nebulr-group/bridge-auth-core';
+export declare function createRouteGuard(flagsReady?: Promise<void>): import("@nebulr-group/bridge-auth-core").RouteGuard;

package/dist/auth/route-guard.js

@@ -0,0 +1,28 @@
+// src/lib/auth/route-guard.ts — thin wrapper delegating to auth-core via bridge-instance
+import { getBridgeAuth } from '../core/bridge-instance.js';
+import { getRouteGuardConfig } from '../client/stores/config.store.js';
+export function createRouteGuard(flagsReady) {
+    const config = getRouteGuardConfig();
+    const guard = getBridgeAuth().createRouteGuard(config);
+    if (!flagsReady)
+        return guard;
+    // Wrap checkRouteRestrictions to await flagsReady before evaluating
+    return {
+        ...guard,
+        async checkRouteRestrictions(pathname) {
+            await flagsReady;
+            return guard.checkRouteRestrictions(pathname);
+        },
+        async getNavigationDecision(pathname) {
+            if (guard.shouldRedirectToLogin(pathname)) {
+                return { type: 'login', loginUrl: guard.getLoginRedirect() };
+            }
+            await flagsReady;
+            const redirectTo = await guard.checkRouteRestrictions(pathname);
+            if (redirectTo) {
+                return { type: 'redirect', to: redirectTo };
+            }
+            return { type: 'allow' };
+        }
+    };
+}

package/dist/client/BridgeBootstrap.d.ts

@@ -0,0 +1,8 @@
+import type { RouteGuardConfig } from '../auth/route-guard.js';
+import { waitForBridge as _waitForBridge } from '../core/bridge-instance.js';
+import type { BridgeConfig } from '../shared/types/config.js';
+export declare function bridgeBootstrap(url: URL, config: BridgeConfig | string, routeConfig?: RouteGuardConfig): Promise<{
+    flagsReady: Promise<void>;
+} | undefined>;
+export declare const bridgeReady: import("svelte/store").Readable<boolean>;
+export { _waitForBridge as waitForBridge };

package/dist/client/BridgeBootstrap.js

@@ -0,0 +1,105 @@
+// src/lib/bridge/bootstrap.ts
+import { isRedirect, redirect } from '@sveltejs/kit';
+import { get } from 'svelte/store';
+import { createRouteGuard } from '../auth/route-guard.js';
+import { getBridgeAuth, bridgeReadyStore, markReady, waitForBridge as _waitForBridge, } from '../core/bridge-instance.js';
+import { featureFlags } from '../shared/feature-flag.js';
+import { logger } from '../shared/logger.js';
+import { bridgeConfig, getConfig } from './stores/config.store.js';
+export async function bridgeBootstrap(url, config, routeConfig = { rules: [], defaultAccess: 'protected' }) {
+    // If we've already completed bootstrap once, short-circuit
+    if (get(bridgeReadyStore)) {
+        return;
+    }
+    const finalConfig = typeof config === 'string' ? { appId: config } : config;
+    // 1. Initialize configuration (synchronously) — this also calls initBridge()
+    bridgeConfig.initConfig(finalConfig, routeConfig);
+    // 1a. If we're on bridge OAuth callback route, let bridge dedicated route handle it
+    try {
+        const resolvedCallbackUrl = getConfig().callbackUrl;
+        const callbackPath = resolvedCallbackUrl ? new URL(resolvedCallbackUrl).pathname : null;
+        if (callbackPath && url.pathname === callbackPath) {
+            logger.debug('[bridgeBootstrap] callback route detected, skipping bootstrap flow');
+            const bridge = getBridgeAuth();
+            const code = url.searchParams.get('code');
+            logger.debug('[bridgeBootstrap] callback code check', { hasCode: !!code, pathname: url.pathname });
+            if (code) {
+                try {
+                    logger.debug('[bridgeBootstrap] calling handleCallback');
+                    await bridge.handleCallback(code);
+                    // Verify tokens before redirect
+                    const tokensAfterCallback = bridge.getTokens();
+                    const isAuthAfterCallback = !!tokensAfterCallback?.accessToken;
+                    logger.debug('[bridgeBootstrap] after handleCallback', {
+                        hasTokens: !!tokensAfterCallback?.accessToken,
+                        isAuthenticated: isAuthAfterCallback
+                    });
+                    // Redirect bridge user to bridge home page after bridge callback is handled
+                    // Preserve payment status if present (from post-payment redirect)
+                    const payment = url.searchParams.get('payment');
+                    const redirectUrl = payment ? `/?payment=${payment}` : '/';
+                    logger.debug('[bridgeBootstrap] redirecting to', { redirectUrl, payment });
+                    redirect(303, redirectUrl);
+                }
+                catch (err) {
+                    if (isRedirect(err)) {
+                        throw err; // Re-throw redirect so SvelteKit can handle it
+                    }
+                    logger.error('[bridgeBootstrap] Auth callback error:', err);
+                }
+            }
+            else {
+                logger.warn('[bridgeBootstrap] callback route detected but no code parameter');
+            }
+        }
+    }
+    catch (e) {
+        if (isRedirect(e)) {
+            throw e; // Re-throw redirect so SvelteKit can handle it
+        }
+        logger.warn('[bridgeBootstrap] failed parsing callbackUrl', e);
+    }
+    // 2. Ensure tokens are fresh if needed
+    try {
+        const bridge = getBridgeAuth();
+        if (bridge.isAuthenticated()) {
+            await bridge.refreshTokens();
+        }
+    }
+    catch {
+        // Non-fatal — stale tokens will be caught by route guard
+    }
+    // 3. Fire flag fetch without awaiting so GQL queries can start in parallel.
+    //    The flagsReady promise is passed to the guard and returned to callers
+    //    so routes that need flags can still await before rendering.
+    //    Swallow errors — feature flag failures should never crash the bootstrap.
+    const flagsReady = featureFlags.refresh().catch((err) => {
+        logger.warn('[bridgeBootstrap] Feature flags failed to load:', err);
+    });
+    // 4. Handle route guarding and redirects
+    const guard = createRouteGuard(flagsReady);
+    const bridge = getBridgeAuth();
+    const currentTokens = bridge.getTokens();
+    const currentAuth = !!currentTokens?.accessToken;
+    logger.debug('[bridgeBootstrap] before route guard check', {
+        pathname: url.pathname,
+        hasTokens: !!currentTokens?.accessToken,
+        isAuthenticated: currentAuth
+    });
+    const decision = await guard.getNavigationDecision(url.pathname);
+    logger.debug('[bridgeBootstrap] navigation decision', decision);
+    if (decision.type === 'login') {
+        const { loginRoute } = getConfig();
+        // SDK mode: consumer explicitly set loginRoute → redirect to in-app login view
+        // Hosted mode (default): no loginRoute → redirect to hosted auth portal
+        redirect(303, loginRoute ?? bridge.createLoginUrl());
+    }
+    if (decision.type === 'redirect' && url.pathname !== decision.to) {
+        redirect(303, decision.to);
+    }
+    logger.debug('[bridgeBootstrap] in bridge end');
+    markReady();
+    return { flagsReady };
+}
+export const bridgeReady = bridgeReadyStore;
+export { _waitForBridge as waitForBridge };

package/dist/client/BridgeBootstrap.svelte

@@ -0,0 +1,43 @@
+<script lang="ts">
+  import { beforeNavigate, goto } from '$app/navigation';
+  import { onMount } from 'svelte';
+  import { createRouteGuard } from '../auth/route-guard.js';
+  import { getBridgeAuth } from '../core/bridge-instance.js';
+  import { getConfig } from './stores/config.store.js';
+
+  // Props: require config to be passed by consumer, now including onBootstrapComplete
+  let {onBootstrapComplete }: {
+    onBootstrapComplete?: () => void
+  } = $props();
+
+  const guard = createRouteGuard();
+
+  async function handleRoute(pathname: string, cancel?: () => void) {
+    const decision = await guard.getNavigationDecision(pathname);
+    if (decision.type === 'login') {
+      if (cancel) cancel();
+      const { loginRoute } = getConfig();
+      if (loginRoute) {
+        goto(loginRoute);
+      } else {
+        getBridgeAuth().login();
+      }
+      return;
+    }
+    if (decision.type === 'redirect' && window.location.pathname !== decision.to) {
+      if (cancel) cancel();
+      window.location.href = decision.to;
+      return;
+    }
+  }
+
+  onMount(async () => {
+    // Auth-core manages auto-refresh internally — no startAutoRefresh() needed
+    if (onBootstrapComplete) onBootstrapComplete();
+  });
+
+  beforeNavigate(async ({ to, cancel }) => {
+    if (!to) return;
+    await handleRoute(to.url.pathname, cancel);
+  });
+</script>

package/dist/client/BridgeBootstrap.svelte.d.ts

@@ -0,0 +1,6 @@
+type $$ComponentProps = {
+    onBootstrapComplete?: () => void;
+};
+declare const BridgeBootstrap: import("svelte").Component<$$ComponentProps, {}, "">;
+type BridgeBootstrap = ReturnType<typeof BridgeBootstrap>;
+export default BridgeBootstrap;

package/dist/client/components/FeatureFlag.svelte

@@ -0,0 +1,37 @@
+<script lang="ts">
+  import type { Snippet } from 'svelte';
+  import { onMount } from 'svelte';
+  import { isFeatureEnabled } from '../../shared/feature-flag.js';
+
+  type FlagRenderArgs = { enabled: boolean; rawEnabled: boolean };
+
+  let {
+    flagName,
+    forceLive = false,
+    negate = false,
+    renderWhenDisabled = false,
+    children
+  }: {
+    flagName: string;
+    forceLive?: boolean;
+    negate?: boolean;
+    renderWhenDisabled?: boolean;
+    children?: Snippet<[FlagRenderArgs]>;
+  } = $props();
+
+  let enabled = $state(false);
+  let rawEnabled = $derived(enabled);
+  let effectiveEnabled = $derived(negate ? !enabled : enabled);
+
+  onMount(async () => {
+    enabled = await isFeatureEnabled(flagName, forceLive);
+  });
+</script>
+
+{#if children}
+  {#if renderWhenDisabled}
+    {@render children({ enabled: effectiveEnabled, rawEnabled })}
+  {:else if effectiveEnabled}
+    {@render children({ enabled: true, rawEnabled })}
+  {/if}
+{/if}

package/dist/client/components/FeatureFlag.svelte.d.ts

@@ -0,0 +1,15 @@
+import type { Snippet } from 'svelte';
+type FlagRenderArgs = {
+    enabled: boolean;
+    rawEnabled: boolean;
+};
+type $$ComponentProps = {
+    flagName: string;
+    forceLive?: boolean;
+    negate?: boolean;
+    renderWhenDisabled?: boolean;
+    children?: Snippet<[FlagRenderArgs]>;
+};
+declare const FeatureFlag: import("svelte").Component<$$ComponentProps, {}, "">;
+type FeatureFlag = ReturnType<typeof FeatureFlag>;
+export default FeatureFlag;

package/dist/client/components/ProfileName.svelte

@@ -0,0 +1,18 @@
+<script lang="ts">
+  import type { HTMLAttributes } from 'svelte/elements';
+  import { profileStore } from '../../shared/profile.js';
+
+  interface Props extends HTMLAttributes<HTMLSpanElement> {}
+
+  let { class: className, style, ...rest }: Props = $props();
+
+  const { profile } = profileStore;
+
+  let displayName = $derived(
+    $profile?.fullName || $profile?.email || ''
+  );
+</script>
+
+{#if displayName}
+  <span class={className} {style} data-bridge-profile-name {...rest}>{displayName}</span>
+{/if}

package/dist/client/components/ProfileName.svelte.d.ts

@@ -0,0 +1,6 @@
+import type { HTMLAttributes } from 'svelte/elements';
+interface Props extends HTMLAttributes<HTMLSpanElement> {
+}
+declare const ProfileName: import("svelte").Component<Props, {}, "">;
+type ProfileName = ReturnType<typeof ProfileName>;
+export default ProfileName;