@nebulr-group/bridge-svelte 0.9.0 → 0.9.1-beta.0

package/README.md

@@ -1,18 +1,35 @@
+<p align="center">
+  <a href="https://thebridge.dev/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/thebridgedev/bridge-svelte/main/.github/assets/banner.png"><img src="https://raw.githubusercontent.com/thebridgedev/bridge-svelte/main/.github/assets/banner-light.png" alt="The Bridge for SvelteKit" width="100%"></picture></a>
+</p>
 
-## @nebulr-group/bridge-svelte
+<p align="center">
+  <a href="https://www.npmjs.com/package/@nebulr-group/bridge-svelte"><img src="https://img.shields.io/npm/v/@nebulr-group/bridge-svelte?color=20006b&label=npm" alt="npm version"></a>
+  <a href="https://github.com/thebridgedev/bridge-svelte/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/@nebulr-group/bridge-svelte?color=20006b" alt="MIT license"></a>
+  <a href="https://madewithsvelte.com/p/the-bridge/shield-link"><img src="https://madewithsvelte.com/storage/repo-shields/5996-shield.svg" alt="Made with Svelte"></a>
+</p>
 
-[![MadeWithSvelte.com shield](https://madewithsvelte.com/storage/repo-shields/5996-shield.svg)](https://madewithsvelte.com/p/the-bridge/shield-link)
+<p align="center">
+  <a href="https://thebridge.dev/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte"><b>Website</b></a> ·
+  <a href="https://thebridge.dev/docs/quickstart/svelte/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte"><b>Quickstart</b></a> ·
+  <a href="https://thebridge.dev/docs/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte"><b>Docs</b></a> ·
+  <a href="https://thebridge.dev/docs/ai-assistants/mcp/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte"><b>Set up with your AI assistant</b></a>
+</p>
 
+# The Bridge for SvelteKit
 
-Bridge Svelte library. Add Bridge auth, feature flags, and payments to your SvelteKit 2 + Svelte 5 apps.
+`@nebulr-group/bridge-svelte` adds sign-in, workspaces and roles, feature flags, Stripe subscriptions and plan limits to a SvelteKit 2 + Svelte 5 app, with one `.env` line and three files.
 
-### Install
+**[The Bridge](https://thebridge.dev/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte)** is a hosted backend for SaaS apps. It gives you sign-in (passwords, magic links, passkeys, social login and SSO), multi-tenant workspaces with roles, Stripe subscriptions with plan limits, and feature flags, all managed from one dashboard. Your AI coding assistant can set it up for you through the [Bridge MCP server](https://thebridge.dev/docs/ai-assistants/mcp/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte).
+
+> **Let your AI assistant set it up.** Connect the [Bridge MCP server](https://thebridge.dev/docs/ai-assistants/mcp/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte) to Claude, Cursor, Copilot or Gemini CLI and ask it to add Bridge to your app. Not using MCP? Run `npx @nebulr-group/bridge-cli guide add-login` in your project: it detects your framework from `package.json` and prints the steps for your assistant to follow. `npx @nebulr-group/bridge-cli doctor` checks the result.
+
+## Install
 
 ```bash
 npm i @nebulr-group/bridge-svelte
 ```
 
-### Usage
+## Usage
 
 The whole integration is one `.env` line and three files:
 
@@ -52,48 +69,28 @@ A stage or local app also sets `VITE_BRIDGE_API_BASE_URL`. Add `loginRoute: '/au
 
 [How Bridge works](https://github.com/thebridgedev/bridge-svelte/blob/main/learning/mechanisms.md) explains plan limits, the three UI levels and the four customisation levels; the [learning docs](https://github.com/thebridgedev/bridge-svelte/tree/main/learning) cover everything else. Coding agents: `npx @nebulr-group/bridge-cli guide svelte`.
 
-### Build
-
-
-```bash
-npm run build
-```
+## Learn more
 
-Artifacts are emitted to `dist/` via `svelte-package`.
+- [Quickstart](https://thebridge.dev/docs/quickstart/svelte/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte)
+- [Authentication](https://thebridge.dev/docs/auth/svelte/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte)
+- [Sign-in inside your app](https://thebridge.dev/docs/sdk-auth/svelte/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte)
+- [Feature flags](https://thebridge.dev/docs/feature-flags/svelte/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte)
+- [Branding](https://thebridge.dev/docs/branding/svelte/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte)
+- [Live updates](https://thebridge.dev/docs/live-updates/svelte/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte)
+- [Subscriptions and plan limits](https://thebridge.dev/docs/billing/how-it-works/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte)
 
-### Release (branch-protected main)
-
-```bash
-# 1) Create release branch
-git checkout -b release/v0.1.0-beta.1
-git push -u origin release/v0.1.0-beta.1
+## Other Bridge packages
 
-# 2) Open a PR: release/v0.1.0-beta.1 -> main, approve and merge
+| Package | For |
+|---|---|
+| [`@nebulr-group/bridge-react`](https://www.npmjs.com/package/@nebulr-group/bridge-react) | React |
+| [`@nebulr-group/bridge-nextjs`](https://www.npmjs.com/package/@nebulr-group/bridge-nextjs) | Next.js |
+| [`@nebulr-group/bridge-angular`](https://www.npmjs.com/package/@nebulr-group/bridge-angular) | Angular |
+| [`@nebulr-group/bridge-nestjs`](https://www.npmjs.com/package/@nebulr-group/bridge-nestjs) | NestJS |
+| [`@nebulr-group/bridge-express`](https://www.npmjs.com/package/@nebulr-group/bridge-express) | Express |
+| [`@nebulr-group/bridge-cli`](https://www.npmjs.com/package/@nebulr-group/bridge-cli) | CLI for people and AI agents |
+| [`@nebulr-group/bridge-auth-core`](https://www.npmjs.com/package/@nebulr-group/bridge-auth-core) | Any JavaScript app (core) |
 
-# 3) After merge to main, tag and push
-git checkout main && git pull
-git tag v0.1.0-beta.1
-git push origin v0.1.0-beta.1
-
-# 4) Monitor GitHub Actions "Publish to npm"
-```
-
-### Commit signing (required)
-
-Ensure your commits are verified before opening PRs:
-
-```bash
-# Option A: SSH signing (recommended)
-git config --global gpg.format ssh
-git config --global user.signingkey ~/.ssh/id_ed25519.pub
-git config --global commit.gpgsign true
-
-# Option B: GPG signing
-gpg --full-generate-key
-gpg --list-secret-keys --keyid-format=long
-git config --global user.signingkey <KEY_ID>
-git config --global commit.gpgsign true
-```
+## License
 
-### License
-MIT © thebridgedev
+[MIT](https://github.com/thebridgedev/bridge-svelte/blob/main/LICENSE) © Nebulr. Built by [The Bridge](https://thebridge.dev/?utm_source=npm&utm_medium=readme&utm_campaign=bridge-svelte).

package/dist/core/billing-store.d.ts

@@ -42,6 +42,18 @@ export declare function ensureBillingState(maxAgeMs?: number): Promise<void>;
  * every trigger of the refresh rule call. Never rejects.
  */
 export declare function refreshBilling(): Promise<void>;
+/**
+ * TBP-810 — re-read the plan's features after a checkout return or a plan
+ * change. Bridge does not always push `entitlements.changed` for a plan change,
+ * and nothing else re-read them, so flags kept the old plan's answer.
+ *
+ * Not `entitlementsStore.refresh()`: that marks the store unloaded while it
+ * fetches, and every flag evaluated in that window reads "not entitled". This
+ * keeps the current map until the new one arrives, then writes it to both
+ * copies (auth-core's, which flags read, and `bridge.tenant.entitlements`).
+ * Never rejects.
+ */
+export declare function refreshEntitlements(): Promise<void>;
 /** On mount: read what has not been read, or was read more than 30 s ago. */
 export declare function ensureBilling(maxAgeMs?: number): Promise<void>;
 /** Live events after which the billing stores are re-read. */

package/dist/core/billing-store.js

@@ -21,6 +21,7 @@
  */
 import { fetchBillingState, useBridge as useBillingBridge, } from '@nebulr-group/bridge-auth-core';
 import { billingRetryDelay, ensureSubscription, getBridgeAuth, loadSubscription, subscriptionWanted, tokenStore, } from './bridge-instance.js';
+import { applyEntitlementsChanged } from './snapshot-stores.js';
 import { logger } from '../shared/logger.js';
 /** A read older than this is re-read when the tab regains focus. */
 export const BILLING_STALE_AFTER_MS = 30_000;
@@ -175,6 +176,7 @@ export async function refreshBilling() {
             reads.push(loadSubscription());
         if (_stateWanted || stateInStore())
             reads.push(refreshBillingState());
+        reads.push(refreshEntitlements());
         await Promise.all(reads);
     }
     catch (err) {
@@ -182,6 +184,69 @@ export async function refreshBilling() {
         logger.debug('[bridge-billing] refresh skipped:', err);
     }
 }
+// ── Entitlements (what `bridge:billing.entitlement.*` flag rules read) ───────
+let _entInflight = null;
+let _entAgain = false;
+/**
+ * TBP-810 — re-read the plan's features after a checkout return or a plan
+ * change. Bridge does not always push `entitlements.changed` for a plan change,
+ * and nothing else re-read them, so flags kept the old plan's answer.
+ *
+ * Not `entitlementsStore.refresh()`: that marks the store unloaded while it
+ * fetches, and every flag evaluated in that window reads "not entitled". This
+ * keeps the current map until the new one arrives, then writes it to both
+ * copies (auth-core's, which flags read, and `bridge.tenant.entitlements`).
+ * Never rejects.
+ */
+export function refreshEntitlements() {
+    if (_entInflight) {
+        _entAgain = true;
+        return _entInflight;
+    }
+    _entInflight = (async () => {
+        try {
+            do {
+                _entAgain = false;
+                await readEntitlementsOnce();
+            } while (_entAgain);
+        }
+        finally {
+            _entInflight = null;
+        }
+    })();
+    return _entInflight;
+}
+async function readEntitlementsOnce() {
+    try {
+        // Nothing loaded them yet: there is no old answer to correct, and an app
+        // that never reads entitlements makes no extra request.
+        const store = useBillingBridge().entitlementsStore;
+        if (!store?.isHydrated())
+            return;
+        const opts = billingReadOptions();
+        if (!opts)
+            return;
+        const res = await globalThis.fetch(`${opts.apiBaseUrl.replace(/\/+$/, '')}/entitlements`, {
+            method: 'GET',
+            headers: { Authorization: `Bearer ${opts.accessToken}`, 'x-app-id': opts.appId ?? '' },
+        });
+        if (!res.ok)
+            return;
+        const body = (await res.json());
+        const map = body?.entitlements;
+        if (!map || typeof map !== 'object' || Array.isArray(map))
+            return;
+        // Signed out or switched workspace while this was in flight.
+        if (tokenChangedWorkspace(opts.accessToken))
+            return;
+        store.applyEntitlementsChanged(map);
+        applyEntitlementsChanged({ entitlements: map });
+    }
+    catch (err) {
+        // Best-effort: the next plan event, reconnect or token renewal repairs it.
+        logger.debug('[bridge-billing] entitlements refresh skipped:', err);
+    }
+}
 /** On mount: read what has not been read, or was read more than 30 s ago. */
 export async function ensureBilling(maxAgeMs = BILLING_STALE_AFTER_MS) {
     try {
@@ -295,4 +360,6 @@ export function __resetBillingStoreForTests() {
     _stateLoadedAt = 0;
     _stateWanted = false;
     _stateToken = null;
+    _entInflight = null;
+    _entAgain = false;
 }

package/dist/flags/bootstrap.js

@@ -245,8 +245,30 @@ export function createBridgeFlags(config = {}) {
         });
         notifyAllFlagsChanged();
     });
+    // TBP-810 — the billing provider reads these stores at eval time, so a
+    // mounted `<FeatureFlag>` / `useFlag()` only sees a plan change if something
+    // re-evaluates after the store moved. Without this, an upgraded user kept
+    // the old plan's answer until the component re-mounted. One re-eval per
+    // burst: plan_changed, entitlements and quota updates land together.
+    let _billingReevalQueued = false;
+    const onBillingStoreChange = () => {
+        if (_billingReevalQueued)
+            return;
+        _billingReevalQueued = true;
+        queueMicrotask(() => {
+            _billingReevalQueued = false;
+            notifyAllFlagsChanged();
+        });
+    };
+    const unsubscribeBilling = [
+        useBridge().subscription.subscribe(onBillingStoreChange),
+        useBridge().quotas.subscribe(onBillingStoreChange),
+        useBridge().entitlementsStore.subscribe(onBillingStoreChange),
+    ];
     const stop = async () => {
         unsubscribeAuth();
+        for (const off of unsubscribeBilling)
+            off();
         unsubscribeOpen();
         await telemetry.stop();
     };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nebulr-group/bridge-svelte",
-  "version": "0.9.0",
-  "description": "Bridge Svelte library, This library helps you to add bridge authentication and feature flags, and payments to your svelte application.",
+  "version": "0.9.1-beta.0",
+  "description": "The Bridge for SvelteKit: sign-in, workspaces and roles, feature flags, Stripe subscriptions and plan limits in one .env line and three files.",
   "author": "Iman Pouya",
   "license": "MIT",
   "repository": {
@@ -11,7 +11,7 @@
   "bugs": {
     "url": "https://github.com/thebridgedev/bridge-svelte/issues"
   },
-  "homepage": "https://thebridge.dev",
+  "homepage": "https://thebridge.dev/docs/quickstart/svelte/",
   "scripts": {
     "dev": "vite dev",
     "build": "bun run prepack",
@@ -82,12 +82,23 @@
   },
   "keywords": [
     "svelte",
+    "sveltekit",
+    "svelte5",
+    "passkeys",
+    "magic-link",
+    "the-bridge",
     "bridge",
-    "nebulr",
+    "authentication",
     "auth",
+    "login",
+    "sso",
     "feature-flags",
-    "payments",
     "stripe",
-    "saas control center"
+    "subscriptions",
+    "billing",
+    "plan-limits",
+    "multi-tenant",
+    "rbac",
+    "saas"
   ]
 }