@nebulr-group/bridge-svelte 0.1.0 → 0.2.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 thebridgedev
+Copyright (c) 2025 Nebulr AB
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -19,5 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
-

package/README.md

@@ -1,6 +1,8 @@
 
 ## @nebulr-group/bridge-svelte
 
+[![MadeWithSvelte.com shield](https://madewithsvelte.com/storage/repo-shields/5996-shield.svg)](https://madewithsvelte.com/p/the-bridge/shield-link)
+
 
 Bridge Svelte library. Add Bridge auth, feature flags, and payments to your SvelteKit 2 + Svelte 5 apps.
 

package/dist/auth/route-guard.js

@@ -57,7 +57,15 @@ export function createRouteGuard() {
     }
     function shouldRedirectToLogin(pathname) {
         const isProtected = isProtectedRoute(pathname);
+        const tokens = auth.getToken();
         const authenticated = get(isAuthenticated);
+        logger.debug(`[route-guard] shouldRedirectToLogin check`, {
+            pathname,
+            isProtected,
+            hasTokens: !!tokens?.accessToken,
+            authenticated,
+            tokenStoreValue: tokens
+        });
         if (isProtectedRoute(pathname) && !get(isAuthenticated)) {
             logger.debug(`[route-guard] path ${pathname} is protected and user is not authenticated`);
             return true;

package/dist/client/BridgeBootstrap.d.ts

@@ -1,3 +1,5 @@
 import type { RouteGuardConfig } from '../auth/route-guard.js';
 import type { BridgeConfig } from '../shared/types/config.js';
 export declare function bridgeBootstrap(url: URL, config: BridgeConfig | string, routeConfig?: RouteGuardConfig): Promise<void>;
+export declare const bridgeReady: import("svelte/store").Writable<boolean>;
+export declare function waitForBridge(): Promise<void>;

package/dist/client/BridgeBootstrap.js

@@ -1,11 +1,27 @@
 // src/lib/bridge/bootstrap.ts
-import { redirect } from '@sveltejs/kit';
+import { isRedirect, redirect } from '@sveltejs/kit';
+import { get, writable } from 'svelte/store';
 import { createRouteGuard } from '../auth/route-guard.js';
 import { featureFlags } from '../shared/feature-flag.js';
 import { logger } from '../shared/logger.js';
 import { auth, maybeRefreshNow } from '../shared/services/auth.service.js';
 import { bridgeConfig } from './stores/config.store.js';
+const bridgeReadyStore = writable(false);
+let resolveReady = null;
+const bridgeReadyPromise = new Promise((resolve) => {
+    resolveReady = resolve;
+});
+function markBridgeReady() {
+    if (get(bridgeReadyStore))
+        return;
+    bridgeReadyStore.set(true);
+    resolveReady?.();
+}
 export async function bridgeBootstrap(url, config, routeConfig = { rules: [], defaultAccess: 'protected' }) {
+    // If we've already completed bootstrap once, short-circuit
+    if (get(bridgeReadyStore)) {
+        return;
+    }
     const finalConfig = typeof config === 'string' ? { appId: config } : config;
     // 1. Initialize configuration (synchronously)
     bridgeConfig.initConfig(finalConfig, routeConfig);
@@ -16,19 +32,41 @@ export async function bridgeBootstrap(url, config, routeConfig = { rules: [], de
             logger.debug('[bridgeBootstrap] callback route detected, skipping bootstrap flow');
             const { handleCallback } = auth;
             const code = url.searchParams.get('code');
+            logger.debug('[bridgeBootstrap] callback code check', { hasCode: !!code, pathname: url.pathname });
             if (code) {
                 try {
+                    logger.debug('[bridgeBootstrap] calling handleCallback');
                     await handleCallback(code);
+                    // Verify tokens before redirect
+                    const tokensAfterCallback = auth.getToken();
+                    const isAuthAfterCallback = !!tokensAfterCallback?.accessToken;
+                    logger.debug('[bridgeBootstrap] after handleCallback', {
+                        hasTokens: !!tokensAfterCallback?.accessToken,
+                        isAuthenticated: isAuthAfterCallback
+                    });
                     // Redirect bridge user to bridge home page after bridge callback is handled
-                    redirect(303, '/');
+                    // Preserve payment status if present (from post-payment redirect)
+                    const payment = url.searchParams.get('payment');
+                    const redirectUrl = payment ? `/?payment=${payment}` : '/';
+                    logger.debug('[bridgeBootstrap] redirecting to', { redirectUrl, payment });
+                    redirect(303, redirectUrl);
                 }
                 catch (err) {
-                    logger.error('Auth callback error:', err);
+                    if (isRedirect(err)) {
+                        throw err; // Re-throw redirect so SvelteKit can handle it
+                    }
+                    logger.error('[bridgeBootstrap] Auth callback error:', err);
                 }
             }
+            else {
+                logger.warn('[bridgeBootstrap] callback route detected but no code parameter');
+            }
         }
     }
     catch (e) {
+        if (isRedirect(e)) {
+            throw e; // Re-throw redirect so SvelteKit can handle it
+        }
         logger.warn('[bridgeBootstrap] failed parsing callbackUrl', e);
     }
     // 2. Ensure tokens are fresh if needed
@@ -37,6 +75,14 @@ export async function bridgeBootstrap(url, config, routeConfig = { rules: [], de
     await featureFlags.refresh();
     // 4. Handle route guarding and redirects
     const guard = createRouteGuard();
+    // Check auth state before route guard decision
+    const currentTokens = auth.getToken();
+    const currentAuth = !!currentTokens?.accessToken;
+    logger.debug('[bridgeBootstrap] before route guard check', {
+        pathname: url.pathname,
+        hasTokens: !!currentTokens?.accessToken,
+        isAuthenticated: currentAuth
+    });
     const decision = await guard.getNavigationDecision(url.pathname);
     logger.debug('[bridgeBootstrap] navigation decision', decision);
     if (decision.type === 'login') {
@@ -46,4 +92,9 @@ export async function bridgeBootstrap(url, config, routeConfig = { rules: [], de
         redirect(303, decision.to);
     }
     logger.debug('[bridgeBootstrap] in bridge end');
+    markBridgeReady();
+}
+export const bridgeReady = bridgeReadyStore;
+export function waitForBridge() {
+    return bridgeReadyPromise;
 }

package/dist/client/components/FeatureFlag.svelte

@@ -3,19 +3,35 @@
   import { onMount } from 'svelte';
   import { isFeatureEnabled } from '../../shared/feature-flag.js';
 
-  let { flagName, forceLive = false, negate = false, children }: { flagName: string; forceLive?: boolean; negate?: boolean; children?: Snippet } = $props();
+  type FlagRenderArgs = { enabled: boolean; rawEnabled: boolean };
 
-  let enabled = $state(false);
+  let {
+    flagName,
+    forceLive = false,
+    negate = false,
+    renderWhenDisabled = false,
+    children
+  }: {
+    flagName: string;
+    forceLive?: boolean;
+    negate?: boolean;
+    renderWhenDisabled?: boolean;
+    children?: Snippet<[FlagRenderArgs]>;
+  } = $props();
 
-  let shouldRender = $derived(() => negate ? !enabled : enabled);
+  let enabled = $state(false);
+  let rawEnabled = $derived(enabled);
+  let effectiveEnabled = $derived(negate ? !enabled : enabled);
 
   onMount(async () => {
     enabled = await isFeatureEnabled(flagName, forceLive);
   });
 </script>
 
-{#if shouldRender}
-  {#if children}
-    {@render children()}
+{#if children}
+  {#if renderWhenDisabled}
+    {@render children({ enabled: effectiveEnabled, rawEnabled })}
+  {:else if effectiveEnabled}
+    {@render children({ enabled: true, rawEnabled })}
   {/if}
 {/if}

package/dist/client/components/FeatureFlag.svelte.d.ts

@@ -1,9 +1,14 @@
 import type { Snippet } from 'svelte';
+type FlagRenderArgs = {
+    enabled: boolean;
+    rawEnabled: boolean;
+};
 type $$ComponentProps = {
     flagName: string;
     forceLive?: boolean;
     negate?: boolean;
-    children?: Snippet;
+    renderWhenDisabled?: boolean;
+    children?: Snippet<[FlagRenderArgs]>;
 };
 declare const FeatureFlag: import("svelte").Component<$$ComponentProps, {}, "">;
 type FeatureFlag = ReturnType<typeof FeatureFlag>;

package/dist/client/components/team/TeamManagement.svelte

@@ -4,67 +4,75 @@
   import { auth } from '../../../shared/services/auth.service.js';
   import { getConfig } from '../../stores/config.store.js';
 
-  let iframeUrl: string | null = null;
-  let error: string | null = null;
-  let isLoading = true;
+  let iframeUrl = $state<string | null>(null);
+  let error = $state<string | null>(null);
+  let isLoading = $state(true);
 
   async function getHandoverCode(accessToken: string) {
     const config = getConfig();
     const authBaseUrl = config.authBaseUrl;
     const appId = config.appId;
 
-    try {
-      const response = await fetch(
-        `${authBaseUrl}/handover/code/${appId}`,
-        {
-          method: 'POST',
-          headers: {
-            'Content-Type': 'application/json',
-          },
-          body: JSON.stringify({ accessToken }),
-        }
-      );
-
-      if (!response.ok) {
-        const errorText = await response.text();
-        logger.error(`Failed to get handover code: ${response.status} ${response.statusText}`, errorText);
-        throw new Error(`Failed to get handover code: ${response.statusText}`);
-      }
+    logger.debug('[TeamManagement] getHandoverCode called', { authBaseUrl, appId });
 
-      const data = await response.json();
-      if (!data.code) {
-        logger.error('No handover code in response:', data);
-        throw new Error('Failed to get handover code: No code in response');
+    const response = await fetch(
+      `${authBaseUrl}/handover/code/${appId}`,
+      {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ 
+          accessToken,
+          redirectUri: config.callbackUrl || `${window.location.origin}/auth/oauth-callback`
+        }),
       }
+    );
 
-      // Create bridge team management URL with bridge handover code
-      const baseUrl = config.teamManagementUrl;
-      return `${baseUrl}?code=${data.code}`;
-    } catch (err) {
-      logger.error('Error getting handover code:', err);
-      throw err;
+    logger.debug('[TeamManagement] handover response status:', response.status);
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      logger.error(`[TeamManagement] Failed to get handover code: ${response.status} ${response.statusText}`, errorText);
+      throw new Error(`Failed to get handover code: ${response.status} - ${errorText}`);
     }
+
+    const data = await response.json();
+    logger.debug('[TeamManagement] handover response data:', data);
+    
+    if (!data.code) {
+      logger.error('[TeamManagement] No handover code in response:', data);
+      throw new Error('Failed to get handover code: No code in response');
+    }
+
+    // Use the teamManagementUrl which points to bridge-api's user-management-portal endpoint
+    // bridge-api handles the redirect to cloud-views with proper handover
+    const baseUrl = config.teamManagementUrl;
+    const url = `${baseUrl}?code=${data.code}`;
+    logger.debug('[TeamManagement] constructed iframe URL:', url);
+    return url;
   }
 
   onMount(async () => {
-    logger.debug('TeamManagement onMount');
+    logger.debug('[TeamManagement] onMount started');
     try {
-      if (!auth.isAuthenticated) {
-        logger.debug('TeamManagement onMount: User is not authenticated');
-        throw new Error('User must be authenticated to access team management');
-      }
+      // Get token directly - auth.getToken() returns the current token synchronously
       const token = auth.getToken();
-      // Get bridge access token from your auth store
+      logger.debug('[TeamManagement] token check:', { hasToken: !!token, hasAccessToken: !!token?.accessToken });
+      
       const accessToken = token?.accessToken;
       if (!accessToken) {
-        throw new Error('No access token available');
+        throw new Error('No access token available. Please log in first.');
       }
 
       iframeUrl = await getHandoverCode(accessToken);
+      logger.debug('[TeamManagement] iframe URL set:', iframeUrl);
     } catch (err) {
+      logger.error('[TeamManagement] Error:', err);
       error = err instanceof Error ? err.message : 'Failed to load team management';
     } finally {
       isLoading = false;
+      logger.debug('[TeamManagement] loading complete, isLoading:', isLoading);
     }
   });
 </script>

package/dist/client/components/team/TeamManagement.svelte.d.ts

@@ -1,18 +1,3 @@
-interface $$__sveltets_2_IsomorphicComponent<Props extends Record<string, any> = any, Events extends Record<string, any> = any, Slots extends Record<string, any> = any, Exports = {}, Bindings = string> {
-    new (options: import('svelte').ComponentConstructorOptions<Props>): import('svelte').SvelteComponent<Props, Events, Slots> & {
-        $$bindings?: Bindings;
-    } & Exports;
-    (internal: unknown, props: {
-        $$events?: Events;
-        $$slots?: Slots;
-    }): Exports & {
-        $set?: any;
-        $on?: any;
-    };
-    z_$$bindings?: Bindings;
-}
-declare const TeamManagement: $$__sveltets_2_IsomorphicComponent<Record<string, never>, {
-    [evt: string]: CustomEvent<any>;
-}, {}, {}, string>;
-type TeamManagement = InstanceType<typeof TeamManagement>;
+declare const TeamManagement: import("svelte").Component<Record<string, never>, {}, "">;
+type TeamManagement = ReturnType<typeof TeamManagement>;
 export default TeamManagement;

package/dist/client/stores/config.store.js

@@ -2,9 +2,9 @@
 import { derived, writable } from 'svelte/store';
 import { logger } from '../../shared/logger.js';
 const DEFAULT_CONFIG = {
-    authBaseUrl: 'https://auth.nblocks.cloud',
-    backendlessBaseUrl: 'https://backendless.nblocks.cloud',
-    teamManagementUrl: 'https://backendless.nblocks.cloud/user-management-portal/users',
+    authBaseUrl: 'https://api.thebridge.dev/auth',
+    teamManagementUrl: 'https://api.thebridge.dev/cloud-views/user-management-portal/users',
+    cloudViewsUrl: 'https://api.thebridge.dev/cloud-views',
     defaultRedirectRoute: '/',
     loginRoute: '/login',
     debug: false
@@ -20,10 +20,23 @@ export const bridgeConfig = {
         if (!config?.appId) {
             throw new Error('Bridge appId is required but was not provided in bridge configuration.');
         }
+        // Default to /auth/oauth-callback if not provided
+        const DEFAULT_CALLBACK_PATH = '/auth/oauth-callback';
+        const defaultCallback = typeof window !== 'undefined'
+            ? `${window.location.origin}${DEFAULT_CALLBACK_PATH}`
+            : undefined;
         const merged = {
             ...DEFAULT_CONFIG,
+            callbackUrl: defaultCallback,
             ...config
         };
+        // Use user provided callbackUrl if present, otherwise use default
+        if (config.callbackUrl) {
+            merged.callbackUrl = config.callbackUrl;
+        }
+        else if (!merged.callbackUrl && defaultCallback) {
+            merged.callbackUrl = defaultCallback;
+        }
         // Set bridge full config and mark it as loaded
         set({
             config: merged,

package/dist/index.d.ts

@@ -9,5 +9,6 @@ export * from './shared/feature-flag.js';
 export * from './auth/route-guard.js';
 export * from './shared/profile.js';
 export * from './shared/services/auth.service.js';
+export * from './shared/services/plan.service.js';
 export * from './shared/types/config.js';
 export { logger } from './shared/logger.js';

package/dist/index.js

@@ -14,6 +14,7 @@ export * from './auth/route-guard.js';
 // Types
 export * from './shared/profile.js'; // If this exists
 export * from './shared/services/auth.service.js';
+export * from './shared/services/plan.service.js';
 export * from './shared/types/config.js';
 // Logger
 export { logger } from './shared/logger.js';

package/dist/shared/feature-flag.js

@@ -8,11 +8,14 @@ let lastFetchTime = 0;
 export async function loadFeatureFlags() {
     const tokens = get(auth.token);
     const appId = tokens?.appId ?? getConfig().appId;
+    // We should prefer the token from the store as it is more likely to be up to date
     const accessToken = tokens?.accessToken;
-    const backendlessBaseUrl = getConfig().backendlessBaseUrl;
+    const cloudViewsUrl = getConfig().cloudViewsUrl;
     if (!appId)
         return;
-    const url = `${backendlessBaseUrl}/flags/bulkEvaluate/${appId}`;
+    // Log the token we are using to fetch flags (partial for security)
+    logger.debug(`[feature-flag] fetching flags with token: ${accessToken ? accessToken.substring(0, 10) + '...' : 'none'}`);
+    const url = `${cloudViewsUrl}/flags/bulkEvaluate/${appId}`;
     const body = accessToken ? { accessToken } : {};
     const res = await fetch(url, {
         method: 'POST',
@@ -33,7 +36,7 @@ export async function isFeatureEnabled(flag, forceLive = false) {
     const tokens = get(auth.token);
     const appId = tokens?.appId ?? getConfig().appId;
     const accessToken = tokens?.accessToken;
-    const backendlessBaseUrl = getConfig().backendlessBaseUrl;
+    const cloudViewsUrl = getConfig().cloudViewsUrl;
     if (!appId)
         return false;
     logger.debug(`[feature-flag] is flag:${flag}: enabled: ${get(cachedFlags)[flag]}`);
@@ -43,7 +46,7 @@ export async function isFeatureEnabled(flag, forceLive = false) {
     if (!forceLive)
         await loadFeatureFlags();
     if (forceLive) {
-        const url = `${backendlessBaseUrl}/flags/evaluate/${appId}/${flag}`;
+        const url = `${cloudViewsUrl}/flags/evaluate/${appId}/${flag}`;
         const body = accessToken ? { accessToken } : {};
         const res = await fetch(url, {
             method: 'POST',

package/dist/shared/profile.js

@@ -1,6 +1,7 @@
 // src/lib/auth/profile.ts
 import { createRemoteJWKSet, errors as joseErrors, jwtVerify } from 'jose';
 import { derived, get, writable } from 'svelte/store';
+import { waitForBridge } from '../client/BridgeBootstrap.js';
 import { getConfig } from '../client/stores/config.store.js';
 import { auth } from './services/auth.service.js';
 const profile = writable(undefined);
@@ -35,8 +36,8 @@ function ensureVerifier() {
     const config = getConfig();
     if (!jwks || expectedIssuer !== config.authBaseUrl || expectedAudience !== config.appId) {
         jwks = createRemoteJWKSet(new URL(`${config.authBaseUrl}/.well-known/jwks.json`));
-        expectedIssuer = config.authBaseUrl;
-        expectedAudience = config.appId;
+        expectedIssuer = config.authBaseUrl ?? null;
+        expectedAudience = config.appId ?? null;
     }
 }
 async function verifyToken(idToken) {
@@ -77,10 +78,12 @@ async function updateProfile(idToken) {
     if (result)
         error.set(null);
 }
-// 🔁 Auto-sync profile with token
-auth.token.subscribe(($token) => {
-    const idToken = $token?.idToken || null;
-    updateProfile(idToken);
+// 🔁 Auto-sync profile with token after bridge is ready
+waitForBridge().then(() => {
+    auth.token.subscribe(($token) => {
+        const idToken = $token?.idToken || null;
+        updateProfile(idToken);
+    });
 });
 const isOnboarded = derived(profile, ($profile) => $profile?.onboarded ?? false);
 const hasMultiTenantAccess = derived(profile, ($profile) => $profile?.multiTenantAccess ?? false);

package/dist/shared/services/auth.service.js

@@ -25,9 +25,20 @@ if (browser) {
 }
 // --- API ---
 function setTokens(tokens) {
+    logger.debug('[auth] setTokens called', {
+        hasAccessToken: !!tokens?.accessToken,
+        hasRefreshToken: !!tokens?.refreshToken,
+        hasIdToken: !!tokens?.idToken
+    });
     tokenStore.set(tokens);
-    if (browser)
+    if (browser) {
         localStorage.setItem(TOKEN_KEY, JSON.stringify(tokens));
+        logger.debug('[auth] tokens stored in localStorage');
+    }
+    // Verify tokens are set
+    const current = get(tokenStore);
+    const isAuth = !!current?.accessToken;
+    logger.debug('[auth] tokens set, isAuthenticated check:', isAuth);
     scheduleTokenRefresh();
 }
 function clearTokens() {
@@ -36,6 +47,16 @@ function clearTokens() {
         localStorage.removeItem(TOKEN_KEY);
     stopAutoRefresh();
 }
+async function logout() {
+    // Clear local storage tokens first
+    clearTokens();
+    // Redirect to backend logout endpoint to clear all authentication cookies
+    if (browser) {
+        const config = getConfig();
+        const logoutUrl = `${config.authBaseUrl}/url/logout/${config.appId}`;
+        window.location.href = logoutUrl;
+    }
+}
 async function login(options = {}) {
     const loginUrl = createLoginUrl(options);
     if (browser) {
@@ -52,8 +73,10 @@ function createLoginUrl(options = {}) {
     return redirectUri ? `${base}?cv_env=bridge&redirect_uri=${encodeURIComponent(redirectUri)}` : base;
 }
 async function handleCallback(code) {
+    logger.debug('[auth] handleCallback called with code:', code ? 'present' : 'missing');
     const config = getConfig();
     const url = `${config.authBaseUrl}/token/code/${config.appId}`;
+    logger.debug('[auth] exchanging code for tokens', { url, appId: config.appId, callbackUrl: config.callbackUrl });
     const response = await fetch(url, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -77,14 +100,23 @@ async function handleCallback(code) {
             // If parsing JSON fails, use bridge generic message or response status text
             errorMessage = `Failed to exchange code for tokens: ${response.statusText || 'Unknown error'}`;
         }
+        logger.error('[auth] handleCallback failed', errorMessage);
         throw new Error(errorMessage);
     }
     const data = await response.json();
+    logger.debug('[auth] token exchange successful, setting tokens');
     setTokens({
         accessToken: data.access_token,
         refreshToken: data.refresh_token,
         idToken: data.id_token
     });
+    // Double-check after setting
+    const finalCheck = get(tokenStore);
+    const finalAuth = get(isAuthenticated);
+    logger.debug('[auth] handleCallback completed', {
+        tokensSet: !!finalCheck?.accessToken,
+        isAuthenticated: finalAuth
+    });
 }
 async function refreshToken(refreshToken) {
     const config = getConfig();
@@ -200,7 +232,7 @@ export const auth = {
     isLoading,
     error,
     login,
-    logout: clearTokens,
+    logout,
     handleCallback,
     refreshToken,
     createLoginUrl,

package/dist/shared/services/plan.service.d.ts

@@ -0,0 +1,7 @@
+declare function setSecurityCookie(): Promise<void>;
+declare function redirectToPlanSelection(): Promise<void>;
+export declare const planService: {
+    redirectToPlanSelection: typeof redirectToPlanSelection;
+    setSecurityCookie: typeof setSecurityCookie;
+};
+export { };

package/dist/shared/services/plan.service.js

@@ -0,0 +1,90 @@
+// src/lib/shared/services/plan.service.ts
+import { browser } from '$app/environment';
+import { getConfig } from '../../client/stores/config.store.js';
+import { logger } from '../logger.js';
+import { auth } from './auth.service.js';
+/**
+ * Sets the security cookie required for Bridge redirects
+ */
+async function setSecurityCookie() {
+    if (!browser) {
+        throw new Error('Plan redirects are only available in the browser');
+    }
+    const config = getConfig();
+    const cloudViewsUrl = config.cloudViewsUrl;
+    if (!cloudViewsUrl) {
+        throw new Error('cloudViewsUrl must be configured');
+    }
+    const tokenSet = auth.getToken();
+    const token = tokenSet?.accessToken;
+    if (!token) {
+        throw new Error('No access token available. Please log in first.');
+    }
+    try {
+        const response = await fetch(`${cloudViewsUrl}/security/setCookie`, {
+            method: 'POST',
+            credentials: 'include',
+            headers: {
+                'Authorization': `Bearer ${token}`,
+                'Content-Type': 'application/json'
+            }
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to set security cookie: ${response.statusText}`);
+        }
+        logger.debug('[plan] Security cookie set successfully');
+    }
+    catch (error) {
+        logger.error('[plan] Failed to set security cookie', error);
+        throw error;
+    }
+}
+/**
+ * Redirects to Bridge's tenant plan selection page
+ * This allows users to view available plans and upgrade/downgrade
+ * USES the handover protocol for secure cross-domain authentication
+ */
+async function redirectToPlanSelection() {
+    if (!browser) {
+        throw new Error('Plan redirects are only available in the browser');
+    }
+    const config = getConfig();
+    const authBaseUrl = config.authBaseUrl;
+    const cloudViewsUrl = config.cloudViewsUrl;
+    try {
+        const tokenSet = auth.getToken();
+        const accessToken = tokenSet?.accessToken;
+        if (!accessToken) {
+            throw new Error('No access token available. Please log in first.');
+        }
+        // 1. Get the handover code from the Auth API
+        // We call the auth-api to exchange our access token for a short-lived handover code
+        const handoverResponse = await fetch(`${authBaseUrl}/handover/code/${config.appId}`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ accessToken }),
+        });
+        if (!handoverResponse.ok) {
+            throw new Error(`Failed to get handover code: ${handoverResponse.statusText}`);
+        }
+        const { code } = await handoverResponse.json();
+        if (!code) {
+            throw new Error('Handover response did not contain a code');
+        }
+        // 2. Redirect to the Bridge API entry point which will land us on the plan selection page in cloud-views
+        // This entry point will handle the final redirect to the correct cloud-views domain and flow
+        const redirectUrl = `${cloudViewsUrl}/subscription-portal/selectPlan?code=${code}`;
+        logger.debug('[plan] Redirecting to plan selection via handover', redirectUrl);
+        window.location.href = redirectUrl;
+    }
+    catch (error) {
+        logger.error('[plan] Failed to redirect to plan selection', error);
+        throw error;
+    }
+}
+export const planService = {
+    redirectToPlanSelection,
+    setSecurityCookie
+};

package/dist/shared/types/config.d.ts

@@ -11,14 +11,9 @@ export interface BridgeConfig {
     callbackUrl?: string;
     /**
      * The base URL for Bridge auth services
-     * @default 'https://auth.nblocks.cloud'
+     * @default 'https://api.thebridge.dev/auth'
      */
     authBaseUrl?: string;
-    /**
-     * The base URL for Bridge backendless services
-     * @default 'https://backendless.nblocks.cloud'
-     */
-    backendlessBaseUrl?: string;
     /**
      * Route to redirect to after login
      * @default '/'
@@ -31,9 +26,14 @@ export interface BridgeConfig {
     loginRoute?: string;
     /**
      * URL for bridge team management portal
-     * @default 'https://backendless.nblocks.cloud'
+     * @default 'https://api.thebridge.dev/cloud-views/user-management-portal/users'
      */
     teamManagementUrl?: string;
+    /**
+     * Base URL for bridge cloud-views service (for plan selection, payments, feature flags, etc.)
+     * @default 'https://api.thebridge.dev/cloud-views'
+     */
+    cloudViewsUrl?: string;
     /**
      * Debug mode
      * @default false

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nebulr-group/bridge-svelte",
-	"version": "0.1.0",
+	"version": "0.2.0",
 
 	"description": "Bridge Svelte library, This library helps you to add bridge authentication and feature flags, and payments to your svelte application.",
 	"author": "Iman Pouya",
@@ -12,7 +12,7 @@
 	"bugs": {
 		"url": "https://github.com/thebridgedev/bridge-svelte/issues"
 	},
-	"homepage": "https://github.com/thebridgedev/bridge-svelte#readme",
+	"homepage": "https://thebridge.dev",
 	"scripts": {
 	  "dev": "vite dev",
 	  "build": "bun run prepack",