@nebulr-group/bridge-svelte 0.4.2 → 0.4.4

package/dist/auth/route-guard.d.ts

@@ -1,2 +1,12 @@
 export type { FlagRequirement, NavigationDecision, RouteGuard, RouteGuardConfig, RouteRule } from '@nebulr-group/bridge-auth-core';
 export declare function createRouteGuard(flagsReady?: Promise<void>): import("@nebulr-group/bridge-auth-core").RouteGuard;
+/**
+ * Does any route rule's `featureFlag` requirement mention this key?
+ * (TBP-575.)
+ *
+ * The live re-check runs on every flag mutation the app receives, and most of
+ * them have nothing to do with routing. Without this filter, flipping any flag
+ * in a busy app would cost a `bulkEvaluate` round-trip on every connected
+ * client — so this is a cost guard, not a correctness one.
+ */
+export declare function routeRulesReferenceFlag(key: string): boolean;

package/dist/auth/route-guard.js

@@ -26,3 +26,27 @@ export function createRouteGuard(flagsReady) {
         }
     };
 }
+/**
+ * Does any route rule's `featureFlag` requirement mention this key?
+ * (TBP-575.)
+ *
+ * The live re-check runs on every flag mutation the app receives, and most of
+ * them have nothing to do with routing. Without this filter, flipping any flag
+ * in a busy app would cost a `bulkEvaluate` round-trip on every connected
+ * client — so this is a cost guard, not a correctness one.
+ */
+export function routeRulesReferenceFlag(key) {
+    const rules = getRouteGuardConfig()?.rules ?? [];
+    return rules.some((rule) => {
+        const req = rule.featureFlag;
+        if (!req)
+            return false;
+        if (typeof req === 'string')
+            return req === key;
+        if ('any' in req)
+            return req.any.includes(key);
+        if ('all' in req)
+            return req.all.includes(key);
+        return false;
+    });
+}

package/dist/auth/route-guard.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/route-guard.test.js

@@ -0,0 +1,48 @@
+// TBP-575 — the filter that decides whether a flag change is worth re-checking
+// the current route for.
+//
+// Getting this wrong is silent in both directions: too narrow and the live
+// re-check never fires (the feature looks broken), too wide and every flag
+// flip costs every connected client a bulkEvaluate round-trip.
+import { describe, it, expect, vi } from 'vitest';
+let _rules = [];
+vi.mock('../client/stores/config.store.js', () => ({
+    getRouteGuardConfig: () => ({ rules: _rules }),
+}));
+vi.mock('../core/bridge-instance.js', () => ({
+    getBridgeAuth: () => ({ createRouteGuard: () => ({}) }),
+}));
+const { routeRulesReferenceFlag } = await import('./route-guard.js');
+describe('routeRulesReferenceFlag', () => {
+    it('matches a plain string requirement', () => {
+        _rules = [{ match: '/lab', featureFlag: 'holo-experimental' }];
+        expect(routeRulesReferenceFlag('holo-experimental')).toBe(true);
+        expect(routeRulesReferenceFlag('something-else')).toBe(false);
+    });
+    it('matches inside an `any` requirement', () => {
+        _rules = [{ match: '/lab', featureFlag: { any: ['a', 'b'] } }];
+        expect(routeRulesReferenceFlag('b')).toBe(true);
+        expect(routeRulesReferenceFlag('c')).toBe(false);
+    });
+    it('matches inside an `all` requirement', () => {
+        _rules = [{ match: '/lab', featureFlag: { all: ['a', 'b'] } }];
+        expect(routeRulesReferenceFlag('a')).toBe(true);
+        expect(routeRulesReferenceFlag('c')).toBe(false);
+    });
+    it('ignores rules with no flag requirement', () => {
+        _rules = [{ match: '/public', public: true }, { match: '/billing', billing: 'hard' }];
+        expect(routeRulesReferenceFlag('anything')).toBe(false);
+    });
+    it('scans every rule, not just the first', () => {
+        _rules = [
+            { match: '/a', featureFlag: 'one' },
+            { match: '/b', public: true },
+            { match: '/c', featureFlag: 'two' },
+        ];
+        expect(routeRulesReferenceFlag('two')).toBe(true);
+    });
+    it('survives an empty or absent rule set', () => {
+        _rules = [];
+        expect(routeRulesReferenceFlag('x')).toBe(false);
+    });
+});

package/dist/client/BridgeBootstrap.svelte

@@ -2,7 +2,7 @@
   import { beforeNavigate, goto } from '$app/navigation';
   import { page } from '$app/stores';
   import { onMount, onDestroy } from 'svelte';
-  import { createRouteGuard } from '../auth/route-guard.js';
+  import { createRouteGuard, routeRulesReferenceFlag } from '../auth/route-guard.js';
   import {
     getBridgeAuth,
     isAuthenticated,
@@ -14,6 +14,7 @@
   import { setBridgeContext } from '../core/use-bridge.js';
   import { getConfig } from './stores/config.store.js';
   import {
+    onBridgeFlagChange,
     startBridgeRuntime,
     stopBridgeRuntime,
     type StartBridgeRuntimeOptions,
@@ -91,6 +92,31 @@
     }
   }
 
+  // TBP-575 — re-evaluate the CURRENT route when a flag it depends on changes.
+  //
+  // Route rules are only evaluated on navigation. Without this, flipping a
+  // flag off never ejects the user sitting on the route it gates — they keep
+  // the page until they happen to navigate. That makes a route flag useless as
+  // a kill switch, which is most of the reason to put a flag on a route.
+  //
+  // Debounced because one admin action can emit several flag messages, and
+  // each re-check costs a bulkEvaluate round-trip.
+  let _recheckTimer: ReturnType<typeof setTimeout> | undefined;
+  let _stopFlagWatch: (() => void) | undefined;
+
+  function scheduleRouteRecheck() {
+    if (_recheckTimer) clearTimeout(_recheckTimer);
+    _recheckTimer = setTimeout(() => {
+      _recheckTimer = undefined;
+      // No `cancel` here: there is no navigation in flight to cancel. A denied
+      // verdict redirects the user off the page they are already on.
+      handleRoute(window.location.pathname).catch(() => {
+        /* a failed re-check must never break the page; the next navigation
+           re-evaluates anyway */
+      });
+    }, 150);
+  }
+
   // Stash a teardown for the dynamically-attached capabilities (today: flags).
   let _capabilityStop: (() => Promise<void>) | undefined;
 
@@ -99,6 +125,13 @@
     // attach, session.snapshot fanout, billing-family event dispatch.
     startBridgeRuntime(runtime);
 
+    // TBP-575 — subscribe AFTER the runtime exists so the hook is registered
+    // on the live client. Filtered to keys the route rules actually name; a
+    // flag nothing routes on must not cost every client a round-trip.
+    _stopFlagWatch = onBridgeFlagChange((change) => {
+      if (routeRulesReferenceFlag(change.key)) scheduleRouteRecheck();
+    });
+
     // Fetch app config outside load() so we use the correct fetch context.
     // LoginForm also calls ensureAppConfig() — both share the same in-flight promise.
     void ensureAppConfig();
@@ -130,6 +163,12 @@
   });
 
   onDestroy(() => {
+    if (_recheckTimer) {
+      clearTimeout(_recheckTimer);
+      _recheckTimer = undefined;
+    }
+    _stopFlagWatch?.();
+    _stopFlagWatch = undefined;
     void (async () => {
       if (_capabilityStop) {
         try { await _capabilityStop(); } catch { /* ignore */ }

package/dist/core/bridge-runtime.d.ts

@@ -41,7 +41,7 @@
  * instance. Call `stopBridgeRuntime()` (e.g. on `<BridgeBootstrap />` destroy)
  * to flush the realtime client and unsubscribe from the token store.
  */
-import { RealtimeClient, type RealtimeClientConfig, type SessionSnapshotMessage } from '@nebulr-group/bridge-auth-core';
+import { RealtimeClient, type FlagChange, type RealtimeClientConfig, type SessionSnapshotMessage } from '@nebulr-group/bridge-auth-core';
 /**
  * Advanced runtime overrides. Product consumers never pass these; tests,
  * Storybook harnesses, and the demo workspace use them to override the
@@ -96,6 +96,13 @@ export declare function getCurrentAuthToken(): string | undefined;
 export declare function onBridgeRealtimeOpen(handler: () => void): () => void;
 /** Subscribe to realtime `close` events. Returns an unsubscribe fn. */
 export declare function onBridgeRealtimeClose(handler: () => void): () => void;
+/**
+ * Subscribe to realtime flag mutations (TBP-575). Returns an unsubscribe fn.
+ *
+ * The route-guard cache is already invalidated before subscribers run, so a
+ * handler that re-evaluates a route will read fresh values.
+ */
+export declare function onBridgeFlagChange(handler: (change: FlagChange) => void): () => void;
 /** Subscribe to `session.snapshot` messages. Returns an unsubscribe fn. */
 export declare function onBridgeRealtimeSnapshot(handler: (msg: SessionSnapshotMessage) => void): () => void;
 /**

package/dist/core/bridge-runtime.js

@@ -55,6 +55,9 @@ let _originalFetch;
 const _onOpenSubs = new Set();
 const _onCloseSubs = new Set();
 const _onSnapshotSubs = new Set();
+// TBP-575 — realtime flag mutations, fanned out so the route guard can
+// invalidate its (separate) cache and re-evaluate the current route.
+const _onFlagChangeSubs = new Set();
 const _onUserStateSubs = new Set();
 /**
  * Start the Bridge runtime. Idempotent — repeated calls are a no-op. Reads
@@ -146,6 +149,34 @@ export function startBridgeRuntime(options = {}) {
             catch { /* subscriber errors swallowed */ }
         }
     });
+    // TBP-575 — connected, handshaken, and subscribed to nothing. Distinct from
+    // 'closed': the socket is alive, so no reconnect is coming, but nothing will
+    // ever arrive on it. Surfacing this is the whole point — this state used to
+    // report as 'open'.
+    // Guarded: bridge-svelte and auth-core version independently, so a consumer
+    // can resolve an older auth-core that has no such hook. An unguarded call
+    // would crash bootstrap — a worse failure than the missing signal.
+    _realtime.setOnDegraded?.(() => {
+        _setRealtimeStatus('degraded');
+    });
+    // TBP-575 — a flag changed on the wire. Two caches need to hear about it and
+    // only one of them was ever told:
+    //   - BridgeFlags (FF 2.0)      — driven by realtime already, via attach()
+    //   - FeatureFlagService        — what ROUTE GUARDS read, 5-min TTL, deaf
+    // Invalidating here is what makes a route flag take effect on the next
+    // navigation instead of up to five minutes later.
+    _realtime.setOnFlagChange?.((change) => {
+        try {
+            getBridgeAuth().invalidateFeatureFlagCache();
+        }
+        catch { /* auth instance may not exist yet; next hydrate covers it */ }
+        for (const fn of _onFlagChangeSubs) {
+            try {
+                fn(change);
+            }
+            catch { /* subscriber errors swallowed */ }
+        }
+    });
     _realtime.setOnSnapshot((msg) => {
         try {
             applySessionSnapshot(msg.data);
@@ -300,6 +331,16 @@ export function onBridgeRealtimeClose(handler) {
     _onCloseSubs.add(handler);
     return () => _onCloseSubs.delete(handler);
 }
+/**
+ * Subscribe to realtime flag mutations (TBP-575). Returns an unsubscribe fn.
+ *
+ * The route-guard cache is already invalidated before subscribers run, so a
+ * handler that re-evaluates a route will read fresh values.
+ */
+export function onBridgeFlagChange(handler) {
+    _onFlagChangeSubs.add(handler);
+    return () => _onFlagChangeSubs.delete(handler);
+}
 /** Subscribe to `session.snapshot` messages. Returns an unsubscribe fn. */
 export function onBridgeRealtimeSnapshot(handler) {
     _onSnapshotSubs.add(handler);
@@ -321,6 +362,7 @@ export function __resetBridgeRuntime() {
     _onOpenSubs.clear();
     _onCloseSubs.clear();
     _onSnapshotSubs.clear();
+    _onFlagChangeSubs.clear();
     _onUserStateSubs.clear();
     _currentAuthToken = undefined;
     if (_unsubscribeAuth) {

package/dist/core/bridge-runtime.test.js

@@ -11,6 +11,9 @@ let _tokenStore;
 let _onOpen;
 let _onClose;
 let _onSnapshot;
+let _onDegraded;
+let _invalidateCalls = 0;
+let _onFlagChange;
 let _onUserState;
 const _channelScopeCalls = [];
 const _reauthCalls = [];
@@ -20,6 +23,9 @@ let _capturedRealtimeConfig;
 // Reset the spy state between tests.
 function resetSpies() {
     _onOpen = _onClose = _onSnapshot = _onUserState = undefined;
+    _onDegraded = undefined;
+    _onFlagChange = undefined;
+    _invalidateCalls = 0;
     _channelScopeCalls.length = 0;
     _reauthCalls.length = 0;
     _startCalls = 0;
@@ -34,6 +40,7 @@ vi.mock('./bridge-instance.js', () => ({
     getBridgeAuth: () => ({
         getApiContext: () => ({ appId: 'app-1', accessToken: null }),
         refreshTokens: async () => { },
+        invalidateFeatureFlagCache: () => { _invalidateCalls += 1; },
     }),
 }));
 vi.mock('../client/stores/config.store.js', () => ({
@@ -53,6 +60,8 @@ vi.mock('@nebulr-group/bridge-auth-core', () => {
         setOnOpen(fn) { _onOpen = fn; }
         setOnClose(fn) { _onClose = fn; }
         setOnSnapshot(fn) { _onSnapshot = fn; }
+        setOnDegraded(fn) { _onDegraded = fn; }
+        setOnFlagChange(fn) { _onFlagChange = fn; }
         setOnUserState(fn) { _onUserState = fn; }
         setAppId(v) { _channelScopeCalls.push({ method: 'setAppId', value: v }); }
         setWorkspaceId(v) { _channelScopeCalls.push({ method: 'setWorkspaceId', value: v }); }
@@ -80,7 +89,7 @@ afterEach(async () => {
     __resetBridgeRuntime();
 });
 // ── Imports under test ─────────────────────────────────────────────────────
-import { startBridgeRuntime, stopBridgeRuntime, getBridgeRealtime, onBridgeRealtimeOpen, onBridgeRealtimeClose, onBridgeRealtimeSnapshot, onBridgeRealtimeUserState, } from './bridge-runtime.js';
+import { startBridgeRuntime, stopBridgeRuntime, getBridgeRealtime, onBridgeRealtimeOpen, onBridgeRealtimeClose, onBridgeRealtimeSnapshot, onBridgeRealtimeUserState, onBridgeFlagChange, } from './bridge-runtime.js';
 import { realtimeStatus } from './realtime-status.js';
 // ── Helpers ────────────────────────────────────────────────────────────────
 function makeJwt(claims) {
@@ -201,3 +210,59 @@ describe('stopBridgeRuntime', () => {
         await expect(stopBridgeRuntime()).resolves.not.toThrow();
     });
 });
+// ─────────────────────────────────────────────────────────────────────────────
+// TBP-575 — route flags were never push-updated.
+//
+// Route guards read FeatureFlagService (a 5-minute TTL cache fed by
+// bulkEvaluate). `<FeatureFlag>` reads BridgeFlags. Realtime only ever wrote to
+// the second one, so a flag flip took up to five minutes to affect a route —
+// not because the TTL was wrong, but because nothing told that cache anything
+// had changed.
+// ─────────────────────────────────────────────────────────────────────────────
+describe('realtime flag changes reach the route-guard cache (TBP-575)', () => {
+    it('invalidates the route-guard flag cache on a flag mutation', () => {
+        startBridgeRuntime();
+        expect(_invalidateCalls).toBe(0);
+        _onFlagChange?.({ key: 'holo-experimental', kind: 'updated' });
+        expect(_invalidateCalls).toBe(1);
+    });
+    it('invalidates on removal too — a deleted flag changes route verdicts', () => {
+        startBridgeRuntime();
+        _onFlagChange?.({ key: 'holo-experimental', kind: 'removed' });
+        expect(_invalidateCalls).toBe(1);
+    });
+    it('fans the change out to subscribers so they can re-evaluate the route', () => {
+        startBridgeRuntime();
+        const seen = [];
+        const off = onBridgeFlagChange((c) => seen.push(c));
+        _onFlagChange?.({ key: 'holo-experimental', kind: 'updated' });
+        expect(seen).toEqual([{ key: 'holo-experimental', kind: 'updated' }]);
+        off();
+        _onFlagChange?.({ key: 'other', kind: 'updated' });
+        expect(seen).toHaveLength(1);
+    });
+    it('invalidates BEFORE notifying subscribers, so a re-check reads fresh values', () => {
+        startBridgeRuntime();
+        let invalidatedWhenNotified = -1;
+        onBridgeFlagChange(() => { invalidatedWhenNotified = _invalidateCalls; });
+        _onFlagChange?.({ key: 'x', kind: 'updated' });
+        expect(invalidatedWhenNotified).toBe(1);
+    });
+    it('a throwing subscriber does not stop the others', () => {
+        startBridgeRuntime();
+        let reached = false;
+        onBridgeFlagChange(() => { throw new Error('boom'); });
+        onBridgeFlagChange(() => { reached = true; });
+        _onFlagChange?.({ key: 'x', kind: 'updated' });
+        expect(reached).toBe(true);
+    });
+});
+describe('degraded realtime is reported as degraded, not open (TBP-575)', () => {
+    it('mirrors the degraded state into realtimeStatus', () => {
+        startBridgeRuntime();
+        _onDegraded?.();
+        // A socket that is connected but subscribed to nothing used to report
+        // 'open' — which is exactly how a dead transport passed for healthy.
+        expect(get(realtimeStatus)).toBe('degraded');
+    });
+});

package/dist/index.d.ts

@@ -41,6 +41,7 @@ export { sha256Email } from './client/tracking/pii-hashing.js';
 export type { AuthConfigResponse, AuthResult, AuthState, BridgeAuthConfig, BridgeAuthEventName, BridgeAuthEvents, FederationConnection, MagicLinkResult, MfaResult, PasskeyAuthOptions, PasskeyRegistrationOptions, PasskeyVerificationResult, SignupResult, SsoOptions, SsoResult, TenantUser, } from '@nebulr-group/bridge-auth-core';
 export { BridgeAuth, BridgeAuthError, HttpError, TeamService, ApiTokenService } from '@nebulr-group/bridge-auth-core';
 export type { SessionStalePayload } from '@nebulr-group/bridge-auth-core';
+export type { QuotaSnapshot } from '@nebulr-group/bridge-auth-core';
 export type { ApiToken, CreateApiTokenInput, CreateApiTokenResponse, } from '@nebulr-group/bridge-auth-core';
 export type { TeamProfile, TeamProfileUpdateInput, TeamUser, TeamUserListResult, TeamUserUpdateInput, TeamWorkspace, TeamWorkspaceUpdateInput, } from '@nebulr-group/bridge-auth-core';
 export type { Plan, PriceOfferSdk, SubscriptionStatus, CheckoutSession, Workspace, } from '@nebulr-group/bridge-auth-core';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-svelte",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Bridge Svelte library, This library helps you to add bridge authentication and feature flags, and payments to your svelte application.",
   "author": "Iman Pouya",
   "license": "MIT",
@@ -64,7 +64,7 @@
   },
   "dependencies": {
     "@simplewebauthn/browser": "^13.0.0",
-    "@nebulr-group/bridge-auth-core": "0.4.1"
+    "@nebulr-group/bridge-auth-core": "0.4.3"
   },
   "devDependencies": {
     "@sveltejs/kit": "^2.16.0",