@nebulr-group/bridge-svelte 0.4.0-beta.2 → 0.4.0-beta.4

package/dist/client/BridgeBootstrap.js

@@ -5,7 +5,6 @@ import { createRouteGuard } from '../auth/route-guard.js';
 import { getBridgeAuth, bridgeReadyStore, markReady, waitForBridge as _waitForBridge, } from '../core/bridge-instance.js';
 import { installBridgeAuthFetch } from '../core/bridge-runtime.js';
 import { useBridge } from '@nebulr-group/bridge-auth-core';
-import { featureFlags } from '../shared/feature-flag.js';
 import { logger } from '../shared/logger.js';
 import { bridgeConfig, getConfig } from './stores/config.store.js';
 export async function bridgeBootstrap(url, config, routeConfig = { rules: [], defaultAccess: 'protected' }, kitFetch) {
@@ -158,11 +157,17 @@ export async function bridgeBootstrap(url, config, routeConfig = { rules: [], de
     catch {
         // Non-fatal — gate fails open; the notice hydrates lazily on first render.
     }
-    // 3. Fire flag fetch without awaiting so GQL queries can start in parallel.
-    //    The flagsReady promise is passed to the guard and returned to callers
-    //    so routes that need flags can still await before rendering.
-    //    Swallow errors — feature flag failures should never crash the bootstrap.
-    const flagsReady = featureFlags.refresh().catch((err) => {
+    // 3. Warm the route-guard's flag cache without awaiting so GQL queries can
+    //    start in parallel. `loadFeatureFlags()` populates the same auth-core
+    //    FeatureFlagService the route guard evaluates `featureFlag` rules
+    //    against; the flagsReady promise is passed to the guard and returned to
+    //    callers so routes that gate on flags can await before rendering.
+    //    (Component/programmatic flag reads use FF 2.0 `useFlag` / <FeatureFlag>.)
+    //    Errors are logged, never thrown — flag failures must not crash bootstrap.
+    const flagsReady = getBridgeAuth()
+        .loadFeatureFlags()
+        .then(() => { })
+        .catch((err) => {
         logger.warn('[bridgeBootstrap] Feature flags failed to load:', err);
     });
     // 4. Handle route guarding and redirects

package/dist/core/bridge-instance.d.ts

@@ -39,8 +39,6 @@ export declare const isOnboarded: Readable<boolean>;
 export declare const hasMultiTenantAccess: Readable<boolean>;
 /** Tenant users for multi-tenant selection */
 export declare const tenantUsersStore: Readable<TenantUser[]>;
-/** Feature flags map */
-export declare const flagsStore: Readable<Record<string, boolean>>;
 /** Bridge ready state */
 export declare const bridgeReadyStore: Readable<boolean>;
 /** App-level config (SSO providers, feature flags, etc.) — loaded anonymously on init */
@@ -56,6 +54,5 @@ export declare const subscriptionStore: Readable<SubscriptionState>;
 export declare function loadSubscription(): Promise<void>;
 /** Lazy proxy to the BridgeAuth singleton — call methods directly: `auth.getToken()`, `auth.logout()`, etc. */
 export declare const auth: BridgeAuth;
-export declare const _flagsWritable: Writable<Record<string, boolean>>;
 export declare const _profileWritable: Writable<Profile | null | undefined>;
 export declare const _errorWritable: Writable<string | null>;

package/dist/core/bridge-instance.js

@@ -14,7 +14,6 @@ let _instance = null;
 const _tokens = writable(null);
 const _appConfig = writable(null);
 const _profile = writable(undefined);
-const _flags = writable({});
 const _authState = writable('unauthenticated');
 const _isLoading = writable(true);
 const _error = writable(null);
@@ -46,19 +45,18 @@ export function initBridge(config) {
     if (existingTokens) {
         _tokens.set(existingTokens);
         // Fetch profile for existing tokens
-        _instance.getProfile().then((p) => _profile.set(p ?? null)).catch(() => { });
+        _instance.getProfile().then((p) => _profile.set(p ?? null)).catch((err) => logger.warn('[bridge-instance] profile fetch failed:', err));
     }
     _authState.set(_instance.getAuthState());
     _isLoading.set(false);
     // Wire auth-core events → Svelte stores
     _instance.on('auth:login', (tokens) => {
         _tokens.set(tokens);
-        _instance.getProfile().then((p) => _profile.set(p ?? null)).catch(() => { });
+        _instance.getProfile().then((p) => _profile.set(p ?? null)).catch((err) => logger.warn('[bridge-instance] profile fetch failed:', err));
     });
     _instance.on('auth:logout', () => {
         _tokens.set(null);
         _profile.set(null);
-        _flags.set({});
     });
     _instance.on('auth:token-refreshed', (tokens) => {
         _tokens.set(tokens);
@@ -77,9 +75,8 @@ export function initBridge(config) {
     });
     _instance.on('auth:workspace-changed', (tokens) => {
         _tokens.set(tokens);
-        _flags.set({});
         _subscriptionWritable.set({ status: null, plans: null, loading: false, error: null });
-        _instance.getProfile().then((p) => _profile.set(p ?? null)).catch(() => { });
+        _instance.getProfile().then((p) => _profile.set(p ?? null)).catch((err) => logger.warn('[bridge-instance] profile fetch failed:', err));
     });
     _instance.on('auth:error', (err) => {
         _error.set(err.message);
@@ -150,8 +147,6 @@ export const isOnboarded = _isOnboarded;
 export const hasMultiTenantAccess = _hasMultiTenantAccess;
 /** Tenant users for multi-tenant selection */
 export const tenantUsersStore = _tenantUsers;
-/** Feature flags map */
-export const flagsStore = _flags;
 /** Bridge ready state */
 export const bridgeReadyStore = _ready;
 /** App-level config (SSO providers, feature flags, etc.) — loaded anonymously on init */
@@ -183,11 +178,10 @@ export async function loadSubscription() {
 export const auth = new Proxy({}, {
     get(_, prop) {
         const instance = getBridgeAuth();
-        const value = instance[prop];
+        const value = Reflect.get(instance, prop);
         return typeof value === 'function' ? value.bind(instance) : value;
     },
 });
 // ── Internal-only store writers (for use by wrapper modules) ───────────────────
-export const _flagsWritable = _flags;
 export const _profileWritable = _profile;
 export const _errorWritable = _error;

package/dist/core/bridge-runtime.js

@@ -104,6 +104,10 @@ export function startBridgeRuntime(options = {}) {
         getAuthToken: () => _currentAuthToken,
     });
     let _connectedOnce = false;
+    // Set just before we call _realtime.reauthorize() so the resulting
+    // reconnect's setOnOpen handler knows the token is already fresh and skips
+    // its proactive refresh — see the loop note in setOnOpen below.
+    let _reauthInFlight = false;
     _realtime.setOnOpen(() => {
         _setRealtimeStatus('open');
         // On reconnect (not initial connect), proactively refresh tokens.
@@ -111,7 +115,18 @@ export function startBridgeRuntime(options = {}) {
         // client missed the user.state_changed broadcast. Refreshing here
         // syncs tokens before the first post-reconnect request can fail with
         // TOKEN_VERSION_STALE.
-        if (_connectedOnce) {
+        //
+        // EXCEPT when this reconnect was caused by our OWN reauthorize() below
+        // (a token-only refresh). In that case the token is already current, so
+        // refreshing again would mint yet another JWT, which the tokenStore
+        // subscription would see as a change and reauthorize() again → reconnect
+        // → setOnOpen → refresh → … an unbounded loop that hammers /auth/token
+        // (observed ~32 cycles/sec, jamming the page's main thread and stalling
+        // every downstream wait). Only genuine, externally-triggered reconnects
+        // (network blips, server restarts) should trigger the catch-up refresh.
+        const causedByReauthorize = _reauthInFlight;
+        _reauthInFlight = false;
+        if (_connectedOnce && !causedByReauthorize) {
             getBridgeAuth().refreshTokens().catch(() => { });
         }
         _connectedOnce = true;
@@ -224,6 +239,10 @@ export function startBridgeRuntime(options = {}) {
         // Centrifugo's connection-token TTL drops it. Force a reauthorize so the
         // server re-validates against the new token immediately.
         if (prevAuthToken && _currentAuthToken && prevAuthToken !== _currentAuthToken) {
+            // Flag this as a self-induced reconnect so setOnOpen does NOT fire its
+            // proactive refresh (which would mint a new token → land back here →
+            // loop forever). The token we're reauthorizing with is already current.
+            _reauthInFlight = true;
             void _realtime.reauthorize();
         }
     });

package/dist/core/bridge.d.ts

@@ -8,10 +8,9 @@
  * follow-up sub-tickets (TBP-322 `.load()` semantics + TBP-323 reactive
  * binding for loaded slices).
  *
- * Backward compat: this is purely additive. The legacy module-level stores
- * (`subscriptionStore`, `flagsStore`, `appConfigStore`, etc.) continue to
- * exist and are populated by the same internal state — TBP-324 wraps them
- * in deprecation warnings; for now both surfaces coexist.
+ * Backward compat: this is purely additive. The module-level stores
+ * (`subscriptionStore`, `appConfigStore`, etc.) continue to exist and are
+ * populated by the same internal state; both surfaces coexist.
  *
  * Note: `useBridge()` (Svelte context hook) lands in TBP-320. This module
  * only exposes the singleton aggregate `bridge`; consumers can import it

package/dist/core/bridge.js

@@ -8,10 +8,9 @@
  * follow-up sub-tickets (TBP-322 `.load()` semantics + TBP-323 reactive
  * binding for loaded slices).
  *
- * Backward compat: this is purely additive. The legacy module-level stores
- * (`subscriptionStore`, `flagsStore`, `appConfigStore`, etc.) continue to
- * exist and are populated by the same internal state — TBP-324 wraps them
- * in deprecation warnings; for now both surfaces coexist.
+ * Backward compat: this is purely additive. The module-level stores
+ * (`subscriptionStore`, `appConfigStore`, etc.) continue to exist and are
+ * populated by the same internal state; both surfaces coexist.
  *
  * Note: `useBridge()` (Svelte context hook) lands in TBP-320. This module
  * only exposes the singleton aggregate `bridge`; consumers can import it

package/dist/core/bridge.test.js

@@ -218,7 +218,7 @@ describe('bridge.app.plans lazy slice (Phase 4, TBP-321/322)', () => {
     });
     it('apply() updates a loaded slice (TBP-323 reactive binding primitive)', async () => {
         await bridge.app.plans.load();
-        bridge.app.plans.apply([{ key: 'enterprise', name: 'Enterprise' }]);
-        expect(get(bridge.app.plans)).toEqual([{ key: 'enterprise', name: 'Enterprise' }]);
+        bridge.app.plans.apply([{ key: 'enterprise', name: 'Enterprise', prices: [] }]);
+        expect(get(bridge.app.plans)).toEqual([{ key: 'enterprise', name: 'Enterprise', prices: [] }]);
     });
 });

package/dist/flags/bootstrap.js

@@ -27,11 +27,10 @@ export class BrowserIdentityStorage {
     constructor(mode, key = 'bridge.anon_id') {
         this.mode = mode;
         this.key = key;
-        if (typeof globalThis === 'undefined' || !globalThis.window) {
+        if (typeof window === 'undefined') {
             throw new Error('BrowserIdentityStorage requires a window — use MemoryIdentityStorage on the server');
         }
-        const w = globalThis.window;
-        this.storage = mode === 'persistent' ? w.localStorage : w.sessionStorage;
+        this.storage = mode === 'persistent' ? window.localStorage : window.sessionStorage;
     }
     read() {
         try {

package/dist/index.d.ts

@@ -5,10 +5,10 @@ export type { SubscriptionState } from './core/bridge-instance.js';
 export { bridge } from './core/bridge.js';
 export type { BridgeSurface, BridgeAppSurface, BridgeTenantSurface, } from './core/bridge.js';
 export type { BrandingSnapshot, SubscriptionSnapshot, UserSnapshot, SessionSnapshotData, } from './core/snapshot-stores.js';
-export type { BridgeEventHandlers } from './core/events.js';
+export type { BridgeEventHandlers, BridgeEventsDispatcher } from './core/events.js';
 export { default as BridgeBootstrap, default as BridgeProvider } from './client/BridgeBootstrap.svelte';
 export { default as ApiTokenManagement } from './client/components/developer/ApiTokenManagement.svelte';
-export { default as FeatureFlag } from './client/components/FeatureFlag.svelte';
+export { default as FeatureFlag } from './flags/FeatureFlag.svelte';
 export { default as ProfileName } from './client/components/ProfileName.svelte';
 export { default as TeamManagementPanel } from './client/components/team/TeamManagementPanel.svelte';
 export { default as TeamUserList } from './client/components/team/TeamUserList.svelte';
@@ -31,7 +31,6 @@ export { default as BridgeSubscriptionStatus } from './client/components/subscri
 export { default as BridgeBillingNotice } from './client/components/subscription/BridgeBillingNotice.svelte';
 export { default as BridgePaywall } from './client/components/subscription/BridgePaywall.svelte';
 export { default as BridgeQuotaBanner } from './client/components/subscription/BridgeQuotaBanner.svelte';
-export * from './shared/feature-flag.js';
 export * from './auth/route-guard.js';
 export * from './shared/profile.js';
 export * from './shared/types/config.js';
@@ -41,6 +40,7 @@ export type { RedditConversionEvent, RedditEcommerce, RedditEcommerceItem, Reddi
 export { sha256Email } from './client/tracking/pii-hashing.js';
 export type { AuthConfigResponse, AuthResult, AuthState, BridgeAuthConfig, BridgeAuthEventName, BridgeAuthEvents, FederationConnection, MagicLinkResult, MfaResult, PasskeyAuthOptions, PasskeyRegistrationOptions, PasskeyVerificationResult, SignupResult, SsoOptions, SsoResult, TenantUser, } from '@nebulr-group/bridge-auth-core';
 export { BridgeAuth, BridgeAuthError, HttpError, TeamService, ApiTokenService } from '@nebulr-group/bridge-auth-core';
+export type { SessionStalePayload } from '@nebulr-group/bridge-auth-core';
 export type { ApiToken, CreateApiTokenInput, CreateApiTokenResponse, } from '@nebulr-group/bridge-auth-core';
 export type { TeamProfile, TeamProfileUpdateInput, TeamUser, TeamUserListResult, TeamUserUpdateInput, TeamWorkspace, TeamWorkspaceUpdateInput, } from '@nebulr-group/bridge-auth-core';
 export type { Plan, PriceOfferSdk, SubscriptionStatus, CheckoutSession, Workspace, } from '@nebulr-group/bridge-auth-core';

package/dist/index.js

@@ -16,7 +16,7 @@ export { bridge } from './core/bridge.js';
 // Components (Svelte components must have `export default`)
 export { default as BridgeBootstrap, default as BridgeProvider } from './client/BridgeBootstrap.svelte';
 export { default as ApiTokenManagement } from './client/components/developer/ApiTokenManagement.svelte';
-export { default as FeatureFlag } from './client/components/FeatureFlag.svelte';
+export { default as FeatureFlag } from './flags/FeatureFlag.svelte';
 export { default as ProfileName } from './client/components/ProfileName.svelte';
 export { default as TeamManagementPanel } from './client/components/team/TeamManagementPanel.svelte';
 export { default as TeamUserList } from './client/components/team/TeamUserList.svelte';
@@ -49,8 +49,6 @@ export { default as BridgeBillingNotice } from './client/components/subscription
 export { default as BridgePaywall } from './client/components/subscription/BridgePaywall.svelte';
 // Billing 2.0 (Phase C / US-11) — live quota counter banner.
 export { default as BridgeQuotaBanner } from './client/components/subscription/BridgeQuotaBanner.svelte';
-// Feature flags
-export * from './shared/feature-flag.js';
 // Auth route guards
 export * from './auth/route-guard.js';
 // Types

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-svelte",
-  "version": "0.4.0-beta.2",
+  "version": "0.4.0-beta.4",
   "description": "Bridge Svelte library, This library helps you to add bridge authentication and feature flags, and payments to your svelte application.",
   "author": "Iman Pouya",
   "license": "MIT",
@@ -67,7 +67,7 @@
     }
   },
   "dependencies": {
-    "@nebulr-group/bridge-auth-core": "0.4.0-beta.2"
+    "@nebulr-group/bridge-auth-core": "0.4.0-beta.5"
   },
   "devDependencies": {
     "@sveltejs/kit": "^2.16.0",

package/dist/client/components/FeatureFlag.svelte

@@ -1,37 +0,0 @@
-<script lang="ts">
-  import type { Snippet } from 'svelte';
-  import { onMount } from 'svelte';
-  import { isFeatureEnabled } from '../../shared/feature-flag.js';
-
-  type FlagRenderArgs = { enabled: boolean; rawEnabled: boolean };
-
-  let {
-    flagName,
-    forceLive = false,
-    negate = false,
-    renderWhenDisabled = false,
-    children
-  }: {
-    flagName: string;
-    forceLive?: boolean;
-    negate?: boolean;
-    renderWhenDisabled?: boolean;
-    children?: Snippet<[FlagRenderArgs]>;
-  } = $props();
-
-  let enabled = $state(false);
-  let rawEnabled = $derived(enabled);
-  let effectiveEnabled = $derived(negate ? !enabled : enabled);
-
-  onMount(async () => {
-    enabled = await isFeatureEnabled(flagName, forceLive);
-  });
-</script>
-
-{#if children}
-  {#if renderWhenDisabled}
-    {@render children({ enabled: effectiveEnabled, rawEnabled })}
-  {:else if effectiveEnabled}
-    {@render children({ enabled: true, rawEnabled })}
-  {/if}
-{/if}

package/dist/client/components/FeatureFlag.svelte.d.ts

@@ -1,15 +0,0 @@
-import type { Snippet } from 'svelte';
-type FlagRenderArgs = {
-    enabled: boolean;
-    rawEnabled: boolean;
-};
-type $$ComponentProps = {
-    flagName: string;
-    forceLive?: boolean;
-    negate?: boolean;
-    renderWhenDisabled?: boolean;
-    children?: Snippet<[FlagRenderArgs]>;
-};
-declare const FeatureFlag: import("svelte").Component<$$ComponentProps, {}, "">;
-type FeatureFlag = ReturnType<typeof FeatureFlag>;
-export default FeatureFlag;

package/dist/shared/feature-flag.d.ts

@@ -1,6 +0,0 @@
-export declare function loadFeatureFlags(): Promise<void>;
-export declare function isFeatureEnabled(flag: string, forceLive?: boolean): Promise<boolean>;
-export declare const featureFlags: {
-    flags: import("svelte/store").Writable<Record<string, boolean>>;
-    refresh: typeof loadFeatureFlags;
-};

package/dist/shared/feature-flag.js

@@ -1,13 +0,0 @@
-// src/lib/shared/feature-flag.ts — thin wrapper delegating to bridge-instance
-import { getBridgeAuth, _flagsWritable, flagsStore } from '../core/bridge-instance.js';
-export async function loadFeatureFlags() {
-    const flags = await getBridgeAuth().loadFeatureFlags();
-    _flagsWritable.set(flags);
-}
-export async function isFeatureEnabled(flag, forceLive = false) {
-    return getBridgeAuth().isFeatureEnabled(flag, { forceLive });
-}
-export const featureFlags = {
-    flags: flagsStore,
-    refresh: loadFeatureFlags
-};