@nebulr-group/bridge-svelte 0.3.2 → 0.4.0-beta.0

package/dist/client/BridgeBootstrap.d.ts

@@ -1,7 +1,7 @@
 import type { RouteGuardConfig } from '../auth/route-guard.js';
 import { waitForBridge as _waitForBridge } from '../core/bridge-instance.js';
 import type { BridgeConfig } from '../shared/types/config.js';
-export declare function bridgeBootstrap(url: URL, config: BridgeConfig | string, routeConfig?: RouteGuardConfig): Promise<{
+export declare function bridgeBootstrap(url: URL, config: BridgeConfig | string, routeConfig?: RouteGuardConfig, kitFetch?: typeof globalThis.fetch): Promise<{
     flagsReady: Promise<void>;
 } | undefined>;
 export declare const bridgeReady: import("svelte/store").Readable<boolean>;

package/dist/client/BridgeBootstrap.js

@@ -1,12 +1,13 @@
 // src/lib/bridge/bootstrap.ts
-import { isRedirect, redirect } from '@sveltejs/kit';
+import { redirect, isRedirect } from '@sveltejs/kit';
 import { get } from 'svelte/store';
 import { createRouteGuard } from '../auth/route-guard.js';
 import { getBridgeAuth, bridgeReadyStore, markReady, waitForBridge as _waitForBridge, } from '../core/bridge-instance.js';
+import { useBridge } from '@nebulr-group/bridge-auth-core';
 import { featureFlags } from '../shared/feature-flag.js';
 import { logger } from '../shared/logger.js';
 import { bridgeConfig, getConfig } from './stores/config.store.js';
-export async function bridgeBootstrap(url, config, routeConfig = { rules: [], defaultAccess: 'protected' }) {
+export async function bridgeBootstrap(url, config, routeConfig = { rules: [], defaultAccess: 'protected' }, kitFetch) {
     // If we've already completed bootstrap once, short-circuit
     if (get(bridgeReadyStore)) {
         return;
@@ -20,49 +21,85 @@ export async function bridgeBootstrap(url, config, routeConfig = { rules: [], de
     }
     // 1. Initialize configuration (synchronously) — this also calls initBridge()
     bridgeConfig.initConfig(finalConfig, routeConfig);
-    // 1a. If we're on bridge OAuth callback route, let bridge dedicated route handle it
+    // 1a. Unified callback handler — detects what is calling back and routes accordingly
     try {
         const resolvedCallbackUrl = getConfig().callbackUrl;
         const callbackPath = resolvedCallbackUrl ? new URL(resolvedCallbackUrl).pathname : null;
         if (callbackPath && url.pathname === callbackPath) {
-            logger.debug('[bridgeBootstrap] callback route detected, skipping bootstrap flow');
-            const bridge = getBridgeAuth();
+            logger.debug('[bridgeBootstrap] callback route detected');
             const code = url.searchParams.get('code');
-            logger.debug('[bridgeBootstrap] callback code check', { hasCode: !!code, pathname: url.pathname });
+            const sessionId = url.searchParams.get('session_id');
+            const stripeSuccess = url.searchParams.has('stripe_success');
+            const stripeCancel = url.searchParams.has('stripe_cancel');
+            // Strip any session_id Stripe appends to the redirect param destination
+            const rawRedirect = url.searchParams.get('redirect') ?? '/subscription';
+            const redirectTo = rawRedirect.split('?')[0];
             if (code) {
+                // OAuth callback
+                const bridge = getBridgeAuth();
                 try {
-                    logger.debug('[bridgeBootstrap] calling handleCallback');
-                    await bridge.handleCallback(code);
-                    // Verify tokens before redirect
-                    const tokensAfterCallback = bridge.getTokens();
-                    const isAuthAfterCallback = !!tokensAfterCallback?.accessToken;
-                    logger.debug('[bridgeBootstrap] after handleCallback', {
-                        hasTokens: !!tokensAfterCallback?.accessToken,
-                        isAuthenticated: isAuthAfterCallback
-                    });
-                    // Redirect bridge user to bridge home page after bridge callback is handled
-                    // Preserve payment status if present (from post-payment redirect)
+                    logger.debug('[bridgeBootstrap] OAuth callback — calling handleCallback');
+                    // bridge-auth-core calls history.replaceState to strip ?code= from the URL.
+                    // SvelteKit intercepts replaceState as a navigation event, cancelling the
+                    // current load before our redirect can propagate. Use the native prototype
+                    // method directly so the URL is cleaned up without triggering SvelteKit's
+                    // navigation interceptor.
+                    const svelteReplaceState = history.replaceState;
+                    history.replaceState = History.prototype.replaceState.bind(history);
+                    try {
+                        await bridge.handleCallback(code);
+                    }
+                    finally {
+                        history.replaceState = svelteReplaceState;
+                    }
                     const payment = url.searchParams.get('payment');
-                    const redirectUrl = payment ? `/?payment=${payment}` : '/';
-                    logger.debug('[bridgeBootstrap] redirecting to', { redirectUrl, payment });
-                    redirect(303, redirectUrl);
+                    redirect(303, payment ? `/?payment=${payment}` : '/');
                 }
                 catch (err) {
-                    if (isRedirect(err)) {
-                        throw err; // Re-throw redirect so SvelteKit can handle it
+                    if (isRedirect(err))
+                        throw err;
+                    logger.error('[bridgeBootstrap] OAuth callback error:', err);
+                }
+            }
+            else if (stripeSuccess && sessionId) {
+                // Stripe payment success — verify with bridge-api (server calls Stripe directly),
+                // then refresh tokens so the new JWT has shouldSelectPlan: false before redirect.
+                logger.debug('[bridgeBootstrap] Stripe success callback — confirming with bridge-api');
+                const bridge = getBridgeAuth();
+                const ctx = bridge.getApiContext();
+                try {
+                    const res = await (kitFetch ?? fetch)(`${ctx.apiBaseUrl}/v1/account/stripe/confirm-checkout`, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({ sessionId, appId: ctx.appId }),
+                    });
+                    if (!res.ok) {
+                        logger.warn('[bridgeBootstrap] confirm-checkout failed', res.status);
+                        redirect(303, getConfig().billing?.paymentErrorRoute ?? '/payment-error');
                     }
-                    logger.error('[bridgeBootstrap] Auth callback error:', err);
+                    await bridge.refreshTokens();
+                    redirect(303, redirectTo);
+                }
+                catch (err) {
+                    if (isRedirect(err))
+                        throw err;
+                    logger.warn('[bridgeBootstrap] confirm-checkout error', err);
+                    redirect(303, getConfig().billing?.paymentErrorRoute ?? '/payment-error');
                 }
             }
+            else if (stripeCancel) {
+                // Stripe payment cancelled
+                logger.debug('[bridgeBootstrap] Stripe cancel callback — redirecting to', redirectTo);
+                redirect(303, redirectTo);
+            }
             else {
-                logger.warn('[bridgeBootstrap] callback route detected but no code parameter');
+                logger.warn('[bridgeBootstrap] callback route reached with no recognised signal');
             }
         }
     }
     catch (e) {
-        if (isRedirect(e)) {
-            throw e; // Re-throw redirect so SvelteKit can handle it
-        }
+        if (isRedirect(e))
+            throw e;
         logger.warn('[bridgeBootstrap] failed parsing callbackUrl', e);
     }
     // 2. Ensure tokens are fresh if needed
@@ -75,6 +112,46 @@ export async function bridgeBootstrap(url, config, routeConfig = { rules: [], de
     catch {
         // Non-fatal — stale tokens will be caught by route guard
     }
+    // 2b. Paywall redirect — fires before any page renders. Reads shouldSelectPlan
+    //     and paymentsAutoRedirect from getSubscriptionStatus(). Only redirects when:
+    //     - billing.paywallRoute is configured
+    //     - the current path is not already the paywall route (no redirect loop)
+    //     - the tenant is authenticated but has not selected a plan
+    //     - the app has not opted out via paymentsAutoRedirect: false
+    try {
+        const paywallRoute = getConfig().billing?.paywallRoute;
+        if (paywallRoute && url.pathname !== paywallRoute) {
+            const bridge = getBridgeAuth();
+            if (bridge.isAuthenticated()) {
+                const status = await bridge.getSubscriptionStatus();
+                if (status?.shouldSelectPlan === true && status?.paymentsAutoRedirect !== false) {
+                    logger.debug('[bridgeBootstrap] paywall redirect', paywallRoute);
+                    redirect(303, paywallRoute);
+                }
+            }
+        }
+    }
+    catch (e) {
+        if (isRedirect(e))
+            throw e;
+        // Non-fatal — fail open if subscription fetch errors
+    }
+    // 2c. Auto-manage billing state so the notice/gate render without the
+    //     integrator wiring a mount, and `hard` billing route rules can decide.
+    try {
+        const bridge = getBridgeAuth();
+        const ctx = bridge.getApiContext();
+        if (ctx.accessToken) {
+            await useBridge().subscription.mount({
+                apiBaseUrl: ctx.apiBaseUrl,
+                accessToken: ctx.accessToken,
+                appId: ctx.appId,
+            });
+        }
+    }
+    catch {
+        // Non-fatal — gate fails open; the notice hydrates lazily on first render.
+    }
     // 3. Fire flag fetch without awaiting so GQL queries can start in parallel.
     //    The flagsReady promise is passed to the guard and returned to callers
     //    so routes that need flags can still await before rendering.

package/dist/client/BridgeBootstrap.svelte

@@ -1,15 +1,33 @@
 <script lang="ts">
   import { beforeNavigate, goto } from '$app/navigation';
-  import { onMount } from 'svelte';
+  import { onMount, onDestroy } from 'svelte';
   import { createRouteGuard } from '../auth/route-guard.js';
   import { getBridgeAuth } from '../core/bridge-instance.js';
+  import { bridge as bridgeSurface } from '../core/bridge.js';
+  import { setBridgeContext } from '../core/use-bridge.js';
   import { getConfig } from './stores/config.store.js';
+  import {
+    startBridgeRuntime,
+    stopBridgeRuntime,
+    type StartBridgeRuntimeOptions,
+  } from '../core/bridge-runtime.js';
+  import { loadSubscription, ensureAppConfig } from '../core/bridge-instance.js';
 
-  // Props: require config to be passed by consumer, now including onBootstrapComplete
-  let {onBootstrapComplete }: {
-    onBootstrapComplete?: () => void
+  // Props: optional `runtime` overrides for advanced/debug use (websocketFactory,
+  // reconnect overrides, etc.); `onBootstrapComplete` callback fires after the
+  // runtime + any auto-detected capabilities (flags) have attached.
+  let {
+    runtime,
+    onBootstrapComplete,
+  }: {
+    runtime?: StartBridgeRuntimeOptions;
+    onBootstrapComplete?: () => void;
   } = $props();
 
+  // Phase 4 (TBP-288/320) — expose the unified bridge surface via Svelte
+  // context so descendants can call `useBridge()`.
+  setBridgeContext(bridgeSurface);
+
   const guard = createRouteGuard();
 
   async function handleRoute(pathname: string, cancel?: () => void) {
@@ -31,11 +49,54 @@
     }
   }
 
+  // Stash a teardown for the dynamically-attached capabilities (today: flags).
+  let _capabilityStop: (() => Promise<void>) | undefined;
+
   onMount(async () => {
+    // Start the core runtime — realtime client, channel scoping, billing-store
+    // attach, session.snapshot fanout, billing-family event dispatch.
+    startBridgeRuntime(runtime);
+
+    // Fetch app config outside load() so we use the correct fetch context.
+    // LoginForm also calls ensureAppConfig() — both share the same in-flight promise.
+    void ensureAppConfig();
+
+    // Sync subscription when landing on any page after Stripe checkout success.
+    // BridgeBootstrap.ts runs server-side where sessionStorage is unavailable,
+    // so we write it here (client onMount) before calling loadSubscription().
+    const sessionId = new URLSearchParams(window.location.search).get('session_id');
+    if (sessionId) {
+      sessionStorage.setItem('bridge_checkout_session_id', sessionId);
+      loadSubscription().catch(() => { /* non-fatal */ });
+    }
+
+    // Auto-detect Feature Flags 2.0. If `@nebulr-group/bridge-svelte/flags` is
+    // on the dependency graph, attach the flag-specific runtime onto the
+    // already-started core (BridgeFlags instance, attribute providers,
+    // telemetry, hydrate, reactivity). The dynamic import means auth-only apps
+    // never pull the flags bundle.
+    try {
+      const flagsMod = await import('../flags/bootstrap.js');
+      const bundle = flagsMod.createBridgeFlags();
+      _capabilityStop = bundle.stop;
+    } catch {
+      // /flags entry not installed — auth-only app, skip flag attach.
+    }
+
     // Auth-core manages auto-refresh internally — no startAutoRefresh() needed
     if (onBootstrapComplete) onBootstrapComplete();
   });
 
+  onDestroy(() => {
+    void (async () => {
+      if (_capabilityStop) {
+        try { await _capabilityStop(); } catch { /* ignore */ }
+        _capabilityStop = undefined;
+      }
+      await stopBridgeRuntime();
+    })();
+  });
+
   beforeNavigate(async ({ to, cancel }) => {
     if (!to) return;
     await handleRoute(to.url.pathname, cancel);

package/dist/client/BridgeBootstrap.svelte.d.ts

@@ -1,4 +1,6 @@
+import { type StartBridgeRuntimeOptions } from '../core/bridge-runtime.js';
 type $$ComponentProps = {
+    runtime?: StartBridgeRuntimeOptions;
     onBootstrapComplete?: () => void;
 };
 declare const BridgeBootstrap: import("svelte").Component<$$ComponentProps, {}, "">;

package/dist/client/BridgeProvider.svelte

@@ -0,0 +1,31 @@
+<!--
+  Phase 4 (TBP-288/320) — minimal context provider for the bridge surface.
+
+  Wrap your app:
+    <BridgeProvider>
+      <YourApp />
+    </BridgeProvider>
+
+  Without props, it sets the module-level singleton into context. To override
+  (SSR, multi-tenant tests, storybook), pass `{ bridge }`.
+
+  Distinct from <BridgeBootstrap>: that one orchestrates the full bootstrap
+  side effects (OAuth callback, route guards, billing mount). This is just
+  a thin context-setting wrapper. The two are composable — wrap
+  <BridgeBootstrap> in a <BridgeProvider> if you need both.
+-->
+<script lang="ts">
+  import { bridge as singleton } from '../core/bridge.js';
+  import { setBridgeContext } from '../core/use-bridge.js';
+  import type { BridgeSurface } from '../core/bridge.js';
+
+  interface Props {
+    bridge?: BridgeSurface;
+    children?: import('svelte').Snippet;
+  }
+  const { bridge = singleton, children }: Props = $props();
+
+  setBridgeContext(bridge);
+</script>
+
+{@render children?.()}

package/dist/client/BridgeProvider.svelte.d.ts

@@ -0,0 +1,8 @@
+import type { BridgeSurface } from '../core/bridge.js';
+interface Props {
+    bridge?: BridgeSurface;
+    children?: import('svelte').Snippet;
+}
+declare const BridgeProvider: import("svelte").Component<Props, {}, "">;
+type BridgeProvider = ReturnType<typeof BridgeProvider>;
+export default BridgeProvider;

package/dist/client/components/developer/ApiTokenManagement.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
   import type { HTMLAttributes } from 'svelte/elements';
   import { getBridgeAuth } from '../../../core/bridge-instance.js';
-  import type { ApiToken, AvailablePrivilege, CreateApiTokenInput } from '@thebridge/auth-core';
+  import type { ApiToken, AvailablePrivilege, CreateApiTokenInput } from '@nebulr-group/bridge-auth-core';
 
   interface Props extends HTMLAttributes<HTMLDivElement> {}
 

package/dist/client/components/sdk-auth/LoginForm.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
   import type { HTMLAttributes } from 'svelte/elements';
-  import type { AppConfig, FederationConnection } from '@thebridge/auth-core';
+  import type { AppConfig, FederationConnection } from '@nebulr-group/bridge-auth-core';
   import { onMount } from 'svelte';
   import { getBridgeAuth, authState, appConfigStore, ensureAppConfig } from '../../../core/bridge-instance.js';
   import { getConfig } from '../../stores/config.store.js';
@@ -83,12 +83,15 @@
   function buildSsoConnections(appConfig: AppConfig | null): FederationConnection[] {
     if (!appConfig) return [];
     const out: FederationConnection[] = [];
-    if (appConfig.googleSsoEnabled)   out.push({ id: 'google',   type: 'google',      name: 'Google' });
-    if (appConfig.azureAdSsoEnabled)  out.push({ id: 'azure',    type: 'ms-azure-ad', name: 'Microsoft' });
-    if (appConfig.linkedinSsoEnabled) out.push({ id: 'linkedin', type: 'linkedin',    name: 'LinkedIn' });
-    if (appConfig.githubSsoEnabled)   out.push({ id: 'github',   type: 'github',      name: 'GitHub' });
-    if (appConfig.facebookSsoEnabled) out.push({ id: 'facebook', type: 'facebook',    name: 'Facebook' });
-    if (appConfig.appleSsoEnabled)    out.push({ id: 'apple',    type: 'apple',       name: 'Apple' });
+    if (appConfig.googleSsoEnabled) out.push({ id: 'google', type: 'google', name: 'Google' });
+    if (appConfig.azureSsoEnabled)  out.push({ id: 'azure', type: 'ms-azure-ad', name: 'Microsoft' });
+    // Remaining providers (LinkedIn, GitHub, Facebook, Apple, custom SAML/OIDC)
+    // come from the canonical federationConnections list. Skip google/azure so
+    // they don't duplicate the built-in toggles above.
+    for (const conn of appConfig.federationConnections ?? []) {
+      if (conn.type === 'google' || conn.type === 'ms-azure-ad') continue;
+      out.push(conn);
+    }
     return out;
   }
 

package/dist/client/components/sdk-auth/LoginForm.svelte.d.ts

@@ -1,6 +1,6 @@
 import type { Snippet } from 'svelte';
 import type { HTMLAttributes } from 'svelte/elements';
-import type { FederationConnection } from '@thebridge/auth-core';
+import type { FederationConnection } from '@nebulr-group/bridge-auth-core';
 interface Props extends HTMLAttributes<HTMLDivElement> {
     /** Override signup link visibility. Default: derived from app config (signupEnabled). */
     showSignupLink?: boolean | undefined;

package/dist/client/components/sdk-auth/PasskeyLogin.svelte

@@ -44,7 +44,7 @@
       } else {
         // @ts-ignore — @simplewebauthn/browser is an optional peer dependency
         const mod = await import('@simplewebauthn/browser');
-        authResponse = await mod.startAuthentication({ optionsJSON: options, useBrowserAutofill: autofill });
+        authResponse = await mod.startAuthentication({ optionsJSON: options as any, useBrowserAutofill: autofill });
       }
 
       await getBridgeAuth().authenticateWithPasskey(authResponse);

package/dist/client/components/sdk-auth/PasskeySetup.svelte

@@ -58,7 +58,7 @@
       } else {
         // @ts-ignore — @simplewebauthn/browser is an optional peer dependency
         const mod = await import('@simplewebauthn/browser');
-        regResponse = await mod.startRegistration({ optionsJSON: options });
+        regResponse = await mod.startRegistration({ optionsJSON: options as any });
       }
 
       const result = await getBridgeAuth().verifyPasskeyRegistration(regResponse, token);

package/dist/client/components/sdk-auth/SsoButton.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
   import type { HTMLButtonAttributes } from 'svelte/elements';
-  import type { FederationConnection } from '@thebridge/auth-core';
+  import type { FederationConnection } from '@nebulr-group/bridge-auth-core';
   import { getBridgeAuth } from '../../../core/bridge-instance.js';
   import Spinner from './shared/Spinner.svelte';
 

package/dist/client/components/sdk-auth/SsoButton.svelte.d.ts

@@ -1,6 +1,6 @@
 import type { Snippet } from 'svelte';
 import type { HTMLButtonAttributes } from 'svelte/elements';
-import type { FederationConnection } from '@thebridge/auth-core';
+import type { FederationConnection } from '@nebulr-group/bridge-auth-core';
 interface Props extends HTMLButtonAttributes {
     connection: FederationConnection;
     label?: string;

package/dist/client/components/sdk-auth/TenantSelector.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
   import type { HTMLAttributes } from 'svelte/elements';
-  import type { TenantUser } from '@thebridge/auth-core';
+  import type { TenantUser } from '@nebulr-group/bridge-auth-core';
   import { getBridgeAuth, tenantUsersStore } from '../../../core/bridge-instance.js';
   import AuthFormWrapper from './shared/AuthFormWrapper.svelte';
   import Spinner from './shared/Spinner.svelte';

package/dist/client/components/sdk-auth/TenantSelector.svelte.d.ts

@@ -1,6 +1,6 @@
 import type { Snippet } from 'svelte';
 import type { HTMLAttributes } from 'svelte/elements';
-import type { TenantUser } from '@thebridge/auth-core';
+import type { TenantUser } from '@nebulr-group/bridge-auth-core';
 interface Props extends HTMLAttributes<HTMLDivElement> {
     onSelect?: () => void;
     onError?: (error: Error) => void;

package/dist/client/components/sdk-auth/WorkspaceSelector.svelte

@@ -1,13 +1,13 @@
 <script lang="ts">
-  import type { HTMLDivAttributes } from 'svelte/elements';
+  import type { HTMLAttributes } from 'svelte/elements';
   import type { Snippet } from 'svelte';
-  import type { Workspace } from '@thebridge/auth-core';
+  import type { Workspace } from '@nebulr-group/bridge-auth-core';
   import { onMount } from 'svelte';
   import { getBridgeAuth, profileStore } from '../../../core/bridge-instance.js';
   import Spinner from './shared/Spinner.svelte';
   import Alert from './shared/Alert.svelte';
 
-  interface Props extends HTMLDivAttributes {
+  interface Props extends HTMLAttributes<HTMLDivElement> {
     onSwitch?: () => void;
     onError?: (error: Error) => void;
     workspaceItem?: Snippet<[{ workspace: Workspace; isActive: boolean; isLoading: boolean; onSelect: () => void }]>;

package/dist/client/components/sdk-auth/WorkspaceSelector.svelte.d.ts

@@ -1,7 +1,7 @@
-import type { HTMLDivAttributes } from 'svelte/elements';
+import type { HTMLAttributes } from 'svelte/elements';
 import type { Snippet } from 'svelte';
-import type { Workspace } from '@thebridge/auth-core';
-interface Props extends HTMLDivAttributes {
+import type { Workspace } from '@nebulr-group/bridge-auth-core';
+interface Props extends HTMLAttributes<HTMLDivElement> {
     onSwitch?: () => void;
     onError?: (error: Error) => void;
     workspaceItem?: Snippet<[{