@scalemule/nextjs 0.0.10 → 0.0.12

package/dist/index.d.mts

@@ -26,6 +26,8 @@ interface ScaleMuleContextValue {
     publishableKey?: string;
     /** Gateway URL for direct API calls */
     gatewayUrl?: string;
+    /** Server-evaluated flag values to bootstrap the client (eliminates loading flash) */
+    bootstrapFlags?: Record<string, unknown>;
 }
 interface ScaleMuleProviderProps extends ScaleMuleConfig {
     children: ReactNode;
@@ -35,8 +37,10 @@ interface ScaleMuleProviderProps extends ScaleMuleConfig {
     onLogout?: () => void;
     /** Called on authentication error */
     onAuthError?: (error: ApiError) => void;
+    /** Server-evaluated flag values to bootstrap the client (eliminates loading flash) */
+    bootstrapFlags?: Record<string, unknown>;
 }
-declare function ScaleMuleProvider({ apiKey, applicationId, environment, gatewayUrl, debug, storage, analyticsProxyUrl, authProxyUrl, publishableKey, children, onLogin, onLogout, onAuthError, }: ScaleMuleProviderProps): react_jsx_runtime.JSX.Element;
+declare function ScaleMuleProvider({ apiKey, applicationId, environment, gatewayUrl, debug, storage, analyticsProxyUrl, authProxyUrl, publishableKey, children, onLogin, onLogout, onAuthError, bootstrapFlags, }: ScaleMuleProviderProps): react_jsx_runtime.JSX.Element;
 declare function useScaleMule(): ScaleMuleContextValue;
 declare function useScaleMuleClient(): ScaleMuleClient;
 

package/dist/index.d.ts

@@ -26,6 +26,8 @@ interface ScaleMuleContextValue {
     publishableKey?: string;
     /** Gateway URL for direct API calls */
     gatewayUrl?: string;
+    /** Server-evaluated flag values to bootstrap the client (eliminates loading flash) */
+    bootstrapFlags?: Record<string, unknown>;
 }
 interface ScaleMuleProviderProps extends ScaleMuleConfig {
     children: ReactNode;
@@ -35,8 +37,10 @@ interface ScaleMuleProviderProps extends ScaleMuleConfig {
     onLogout?: () => void;
     /** Called on authentication error */
     onAuthError?: (error: ApiError) => void;
+    /** Server-evaluated flag values to bootstrap the client (eliminates loading flash) */
+    bootstrapFlags?: Record<string, unknown>;
 }
-declare function ScaleMuleProvider({ apiKey, applicationId, environment, gatewayUrl, debug, storage, analyticsProxyUrl, authProxyUrl, publishableKey, children, onLogin, onLogout, onAuthError, }: ScaleMuleProviderProps): react_jsx_runtime.JSX.Element;
+declare function ScaleMuleProvider({ apiKey, applicationId, environment, gatewayUrl, debug, storage, analyticsProxyUrl, authProxyUrl, publishableKey, children, onLogin, onLogout, onAuthError, bootstrapFlags, }: ScaleMuleProviderProps): react_jsx_runtime.JSX.Element;
 declare function useScaleMule(): ScaleMuleContextValue;
 declare function useScaleMuleClient(): ScaleMuleClient;
 

package/dist/index.js

@@ -817,7 +817,8 @@ function ScaleMuleProvider({
   children,
   onLogin,
   onLogout,
-  onAuthError
+  onAuthError,
+  bootstrapFlags
 }) {
   const [user, setUser] = react.useState(null);
   const [initializing, setInitializing] = react.useState(true);
@@ -929,9 +930,10 @@ function ScaleMuleProvider({
       analyticsProxyUrl,
       authProxyUrl,
       publishableKey,
-      gatewayUrl: gatewayUrl || (environment === "dev" ? "https://api-dev.scalemule.com" : "https://api.scalemule.com")
+      gatewayUrl: gatewayUrl || (environment === "dev" ? "https://api-dev.scalemule.com" : "https://api.scalemule.com"),
+      bootstrapFlags
     }),
-    [client, user, handleSetUser, initializing, error, analyticsProxyUrl, authProxyUrl, publishableKey, gatewayUrl, environment]
+    [client, user, handleSetUser, initializing, error, analyticsProxyUrl, authProxyUrl, publishableKey, gatewayUrl, environment, bootstrapFlags]
   );
   return /* @__PURE__ */ jsxRuntime.jsx(ScaleMuleContext.Provider, { value, children });
 }
@@ -2851,9 +2853,20 @@ function useFeatureFlags(options = {}) {
     keys,
     enabled = true
   } = options;
-  const { client } = useScaleMule();
-  const [flags, setFlags] = react.useState({});
-  const [loading, setLoading] = react.useState(enabled);
+  const { client, publishableKey, gatewayUrl, bootstrapFlags } = useScaleMule();
+  const initialFlags = react.useMemo(() => {
+    if (!bootstrapFlags) return {};
+    const result = {};
+    for (const [key, value] of Object.entries(bootstrapFlags)) {
+      if (value && typeof value === "object" && "flag_key" in value) {
+        result[key] = value;
+      }
+    }
+    return result;
+  }, [bootstrapFlags]);
+  const hasBootstrap = Object.keys(initialFlags).length > 0;
+  const [flags, setFlags] = react.useState(initialFlags);
+  const [loading, setLoading] = react.useState(enabled && !hasBootstrap);
   const [error, setError] = react.useState(null);
   const contextRef = react.useRef(context);
   const keysKey = react.useMemo(() => keys && keys.length > 0 ? [...keys].sort().join("|") : "", [keys]);
@@ -2868,7 +2881,25 @@ function useFeatureFlags(options = {}) {
     setLoading(true);
     try {
       const payload = keys && keys.length > 0 ? { flag_keys: keys, environment, context: contextRef.current } : { environment, context: contextRef.current };
-      const result = keys && keys.length > 0 ? await client.post("/v1/flags/evaluate/batch", payload) : await client.post("/v1/flags/evaluate/all", payload);
+      const endpoint = keys && keys.length > 0 ? "/v1/flags/evaluate/batch" : "/v1/flags/evaluate/all";
+      let result;
+      if (publishableKey && gatewayUrl) {
+        const response = await fetch(`${gatewayUrl}${endpoint}`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "x-api-key": publishableKey
+          },
+          body: JSON.stringify(payload)
+        });
+        if (!response.ok) {
+          throw new Error(`Flag evaluation failed: ${response.status}`);
+        }
+        const json = await response.json();
+        result = json.data || json || {};
+      } else {
+        result = await client.post(endpoint, payload);
+      }
       setFlags(result || {});
       setError(null);
     } catch (err) {
@@ -2876,7 +2907,7 @@ function useFeatureFlags(options = {}) {
     } finally {
       setLoading(false);
     }
-  }, [client, enabled, environment, keys, keysKey]);
+  }, [client, enabled, environment, keys, keysKey, publishableKey, gatewayUrl]);
   react.useEffect(() => {
     void refresh();
   }, [refresh]);

package/dist/index.mjs

@@ -815,7 +815,8 @@ function ScaleMuleProvider({
   children,
   onLogin,
   onLogout,
-  onAuthError
+  onAuthError,
+  bootstrapFlags
 }) {
   const [user, setUser] = useState(null);
   const [initializing, setInitializing] = useState(true);
@@ -927,9 +928,10 @@ function ScaleMuleProvider({
       analyticsProxyUrl,
       authProxyUrl,
       publishableKey,
-      gatewayUrl: gatewayUrl || (environment === "dev" ? "https://api-dev.scalemule.com" : "https://api.scalemule.com")
+      gatewayUrl: gatewayUrl || (environment === "dev" ? "https://api-dev.scalemule.com" : "https://api.scalemule.com"),
+      bootstrapFlags
     }),
-    [client, user, handleSetUser, initializing, error, analyticsProxyUrl, authProxyUrl, publishableKey, gatewayUrl, environment]
+    [client, user, handleSetUser, initializing, error, analyticsProxyUrl, authProxyUrl, publishableKey, gatewayUrl, environment, bootstrapFlags]
   );
   return /* @__PURE__ */ jsx(ScaleMuleContext.Provider, { value, children });
 }
@@ -2849,9 +2851,20 @@ function useFeatureFlags(options = {}) {
     keys,
     enabled = true
   } = options;
-  const { client } = useScaleMule();
-  const [flags, setFlags] = useState({});
-  const [loading, setLoading] = useState(enabled);
+  const { client, publishableKey, gatewayUrl, bootstrapFlags } = useScaleMule();
+  const initialFlags = useMemo(() => {
+    if (!bootstrapFlags) return {};
+    const result = {};
+    for (const [key, value] of Object.entries(bootstrapFlags)) {
+      if (value && typeof value === "object" && "flag_key" in value) {
+        result[key] = value;
+      }
+    }
+    return result;
+  }, [bootstrapFlags]);
+  const hasBootstrap = Object.keys(initialFlags).length > 0;
+  const [flags, setFlags] = useState(initialFlags);
+  const [loading, setLoading] = useState(enabled && !hasBootstrap);
   const [error, setError] = useState(null);
   const contextRef = useRef(context);
   const keysKey = useMemo(() => keys && keys.length > 0 ? [...keys].sort().join("|") : "", [keys]);
@@ -2866,7 +2879,25 @@ function useFeatureFlags(options = {}) {
     setLoading(true);
     try {
       const payload = keys && keys.length > 0 ? { flag_keys: keys, environment, context: contextRef.current } : { environment, context: contextRef.current };
-      const result = keys && keys.length > 0 ? await client.post("/v1/flags/evaluate/batch", payload) : await client.post("/v1/flags/evaluate/all", payload);
+      const endpoint = keys && keys.length > 0 ? "/v1/flags/evaluate/batch" : "/v1/flags/evaluate/all";
+      let result;
+      if (publishableKey && gatewayUrl) {
+        const response = await fetch(`${gatewayUrl}${endpoint}`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "x-api-key": publishableKey
+          },
+          body: JSON.stringify(payload)
+        });
+        if (!response.ok) {
+          throw new Error(`Flag evaluation failed: ${response.status}`);
+        }
+        const json = await response.json();
+        result = json.data || json || {};
+      } else {
+        result = await client.post(endpoint, payload);
+      }
       setFlags(result || {});
       setError(null);
     } catch (err) {
@@ -2874,7 +2905,7 @@ function useFeatureFlags(options = {}) {
     } finally {
       setLoading(false);
     }
-  }, [client, enabled, environment, keys, keysKey]);
+  }, [client, enabled, environment, keys, keysKey, publishableKey, gatewayUrl]);
   useEffect(() => {
     void refresh();
   }, [refresh]);

package/dist/server/index.d.mts

@@ -433,6 +433,43 @@ declare function apiHandler(handler: HandlerFn, options?: HandlerOptions): (requ
     params: Promise<Record<string, string | string[]>>;
 }) => Promise<Response>;
 
+/**
+ * Server-side flag bootstrapping for Next.js layouts.
+ *
+ * Evaluates feature flags on the server during SSR so the client
+ * has correct values on first render -- no loading flash, no race condition.
+ *
+ * @example
+ * ```ts
+ * // app/layout.tsx
+ * import { getBootstrapFlags } from '@scalemule/nextjs/server'
+ *
+ * export default async function RootLayout({ children }) {
+ *   const bootstrapFlags = await getBootstrapFlags(['analytics.tracking_enabled'])
+ *   return (
+ *     <Providers bootstrapFlags={bootstrapFlags}>
+ *       {children}
+ *     </Providers>
+ *   )
+ * }
+ * ```
+ */
+/**
+ * Evaluate feature flags server-side for bootstrapping the client provider.
+ *
+ * Extracts the client IP from request headers (x-forwarded-for, x-real-ip)
+ * and passes it as ip_address in the evaluation context so IP-based targeting
+ * rules work correctly.
+ *
+ * Returns a Record that can be passed directly to ScaleMuleProvider's
+ * bootstrapFlags prop.
+ *
+ * @param flagKeys - Array of flag keys to evaluate
+ * @param environment - Environment name (default: 'prod')
+ * @param extraContext - Additional context attributes to include
+ */
+declare function getBootstrapFlags(flagKeys: string[], environment?: string, extraContext?: Record<string, unknown>): Promise<Record<string, unknown>>;
+
 /**
  * Next.js Middleware Helpers
  *
@@ -868,4 +905,4 @@ declare function invalidateBundleCache(key?: string): void;
  */
 declare function prefetchBundles(keys: string[]): Promise<void>;
 
-export { type AnalyticsRoutesConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };
+export { type AnalyticsRoutesConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/dist/server/index.d.ts

@@ -433,6 +433,43 @@ declare function apiHandler(handler: HandlerFn, options?: HandlerOptions): (requ
     params: Promise<Record<string, string | string[]>>;
 }) => Promise<Response>;
 
+/**
+ * Server-side flag bootstrapping for Next.js layouts.
+ *
+ * Evaluates feature flags on the server during SSR so the client
+ * has correct values on first render -- no loading flash, no race condition.
+ *
+ * @example
+ * ```ts
+ * // app/layout.tsx
+ * import { getBootstrapFlags } from '@scalemule/nextjs/server'
+ *
+ * export default async function RootLayout({ children }) {
+ *   const bootstrapFlags = await getBootstrapFlags(['analytics.tracking_enabled'])
+ *   return (
+ *     <Providers bootstrapFlags={bootstrapFlags}>
+ *       {children}
+ *     </Providers>
+ *   )
+ * }
+ * ```
+ */
+/**
+ * Evaluate feature flags server-side for bootstrapping the client provider.
+ *
+ * Extracts the client IP from request headers (x-forwarded-for, x-real-ip)
+ * and passes it as ip_address in the evaluation context so IP-based targeting
+ * rules work correctly.
+ *
+ * Returns a Record that can be passed directly to ScaleMuleProvider's
+ * bootstrapFlags prop.
+ *
+ * @param flagKeys - Array of flag keys to evaluate
+ * @param environment - Environment name (default: 'prod')
+ * @param extraContext - Additional context attributes to include
+ */
+declare function getBootstrapFlags(flagKeys: string[], environment?: string, extraContext?: Record<string, unknown>): Promise<Record<string, unknown>>;
+
 /**
  * Next.js Middleware Helpers
  *
@@ -868,4 +905,4 @@ declare function invalidateBundleCache(key?: string): void;
  */
 declare function prefetchBundles(keys: string[]): Promise<void>;
 
-export { type AnalyticsRoutesConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };
+export { type AnalyticsRoutesConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/dist/server/index.js

@@ -28,40 +28,40 @@ function validateIP(ip) {
   return void 0;
 }
 function extractClientContext(request) {
-  const headers = request.headers;
+  const headers2 = request.headers;
   let ip;
-  const cfConnectingIp = headers.get("cf-connecting-ip");
+  const cfConnectingIp = headers2.get("cf-connecting-ip");
   if (cfConnectingIp) {
     ip = validateIP(cfConnectingIp);
   }
   if (!ip) {
-    const doConnectingIp = headers.get("do-connecting-ip");
+    const doConnectingIp = headers2.get("do-connecting-ip");
     if (doConnectingIp) {
       ip = validateIP(doConnectingIp);
     }
   }
   if (!ip) {
-    const realIp = headers.get("x-real-ip");
+    const realIp = headers2.get("x-real-ip");
     if (realIp) {
       ip = validateIP(realIp);
     }
   }
   if (!ip) {
-    const forwardedFor = headers.get("x-forwarded-for");
+    const forwardedFor = headers2.get("x-forwarded-for");
     if (forwardedFor) {
       const firstIp = forwardedFor.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const vercelForwarded = headers.get("x-vercel-forwarded-for");
+    const vercelForwarded = headers2.get("x-vercel-forwarded-for");
     if (vercelForwarded) {
       const firstIp = vercelForwarded.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const trueClientIp = headers.get("true-client-ip");
+    const trueClientIp = headers2.get("true-client-ip");
     if (trueClientIp) {
       ip = validateIP(trueClientIp);
     }
@@ -69,9 +69,9 @@ function extractClientContext(request) {
   if (!ip && request.ip) {
     ip = validateIP(request.ip);
   }
-  const userAgent = headers.get("user-agent") || void 0;
-  const deviceFingerprint = headers.get("x-device-fingerprint") || void 0;
-  const referrer = headers.get("referer") || void 0;
+  const userAgent = headers2.get("user-agent") || void 0;
+  const deviceFingerprint = headers2.get("x-device-fingerprint") || void 0;
+  const referrer = headers2.get("referer") || void 0;
   return {
     ip,
     userAgent,
@@ -80,9 +80,9 @@ function extractClientContext(request) {
   };
 }
 function extractClientContextFromReq(req) {
-  const headers = req.headers;
+  const headers2 = req.headers;
   const getHeader = (name) => {
-    const value = headers[name.toLowerCase()];
+    const value = headers2[name.toLowerCase()];
     if (Array.isArray(value)) {
       return value[0];
     }
@@ -139,24 +139,24 @@ function extractClientContextFromReq(req) {
   };
 }
 function buildClientContextHeaders(context) {
-  const headers = {};
+  const headers2 = {};
   if (!context) {
-    return headers;
+    return headers2;
   }
   if (context.ip) {
-    headers["x-sm-forwarded-client-ip"] = context.ip;
-    headers["X-Client-IP"] = context.ip;
+    headers2["x-sm-forwarded-client-ip"] = context.ip;
+    headers2["X-Client-IP"] = context.ip;
   }
   if (context.userAgent) {
-    headers["X-Client-User-Agent"] = context.userAgent;
+    headers2["X-Client-User-Agent"] = context.userAgent;
   }
   if (context.deviceFingerprint) {
-    headers["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
+    headers2["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
   }
   if (context.referrer) {
-    headers["X-Client-Referrer"] = context.referrer;
+    headers2["X-Client-Referrer"] = context.referrer;
   }
-  return headers;
+  return headers2;
 }
 
 // src/server/client.ts
@@ -541,7 +541,7 @@ var ScaleMuleServer = class {
         formData.append("file", blob, file.filename);
         formData.append("sm_user_id", userId);
         const url = `${this.gatewayUrl}/v1/storage/upload`;
-        const headers = {
+        const headers2 = {
           "x-api-key": this.apiKey,
           "x-user-id": userId,
           ...buildClientContextHeaders(options?.clientContext)
@@ -552,7 +552,7 @@ var ScaleMuleServer = class {
         try {
           const response = await fetch(url, {
             method: "POST",
-            headers,
+            headers: headers2,
             body: formData
           });
           const text = await response.text();
@@ -763,14 +763,14 @@ var ScaleMuleServer = class {
    */
   async request(method, path, options = {}) {
     const url = `${this.gatewayUrl}${path}`;
-    const headers = {
+    const headers2 = {
       "x-api-key": this.apiKey,
       "Content-Type": "application/json",
       // Forward client context headers if provided
       ...buildClientContextHeaders(options.clientContext)
     };
     if (options.sessionToken) {
-      headers["Authorization"] = `Bearer ${options.sessionToken}`;
+      headers2["Authorization"] = `Bearer ${options.sessionToken}`;
     }
     if (this.debug) {
       console.log(`[ScaleMule Server] ${method} ${path}`);
@@ -781,7 +781,7 @@ var ScaleMuleServer = class {
     try {
       const response = await fetch(url, {
         method,
-        headers,
+        headers: headers2,
         body: options.body ? JSON.stringify(options.body) : void 0
       });
       const text = await response.text();
@@ -852,45 +852,45 @@ function createClearCookieHeader(name, options = {}) {
   return cookie;
 }
 function withSession(loginResponse, responseBody, options = {}) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append(
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, loginResponse.session_token, options)
   );
-  headers.append(
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, loginResponse.user.id, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers
+    headers: headers2
   });
 }
 function withRefreshedSession(sessionToken, userId, responseBody, options = {}) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append(
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, sessionToken, options)
   );
-  headers.append(
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, userId, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers
+    headers: headers2
   });
 }
 function clearSession(responseBody, options = {}, status = 200) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
-  headers.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
+  headers2.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
   return new Response(JSON.stringify({ success: status < 300, data: responseBody }), {
     status,
-    headers
+    headers: headers2
   });
 }
 async function getSession() {
@@ -1765,6 +1765,31 @@ function createWebhookHandler(config = {}) {
     }
   };
 }
+var _serverClient = null;
+function getClient() {
+  if (!_serverClient) {
+    _serverClient = createServerClient();
+  }
+  return _serverClient;
+}
+async function getBootstrapFlags(flagKeys, environment = "prod", extraContext = {}) {
+  try {
+    const hdrs = await headers.headers();
+    const forwardedFor = hdrs.get("x-forwarded-for");
+    const realIp = hdrs.get("x-real-ip") || hdrs.get("x-real-client-ip");
+    const clientIp = realIp || (forwardedFor ? forwardedFor.split(",")[0].trim() : void 0);
+    const context = {
+      ...extraContext
+    };
+    if (clientIp) {
+      context.ip_address = clientIp;
+    }
+    const result = await getClient().flags.evaluateBatch(flagKeys, context, environment);
+    return result || {};
+  } catch {
+    return {};
+  }
+}
 function globToRegex(pattern) {
   const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
   return new RegExp(`^${escaped}$`);
@@ -2077,6 +2102,7 @@ exports.extractClientContextFromReq = extractClientContextFromReq;
 exports.generateCSRFToken = generateCSRFToken;
 exports.getAppSecret = getAppSecret;
 exports.getAppSecretOrDefault = getAppSecretOrDefault;
+exports.getBootstrapFlags = getBootstrapFlags;
 exports.getBundle = getBundle;
 exports.getCSRFToken = getCSRFToken;
 exports.getMySqlBundle = getMySqlBundle;

package/dist/server/index.mjs

@@ -1,4 +1,4 @@
-import { cookies } from 'next/headers';
+import { cookies, headers } from 'next/headers';
 import { NextResponse } from 'next/server';
 import { createHmac, timingSafeEqual } from 'crypto';
 
@@ -26,40 +26,40 @@ function validateIP(ip) {
   return void 0;
 }
 function extractClientContext(request) {
-  const headers = request.headers;
+  const headers2 = request.headers;
   let ip;
-  const cfConnectingIp = headers.get("cf-connecting-ip");
+  const cfConnectingIp = headers2.get("cf-connecting-ip");
   if (cfConnectingIp) {
     ip = validateIP(cfConnectingIp);
   }
   if (!ip) {
-    const doConnectingIp = headers.get("do-connecting-ip");
+    const doConnectingIp = headers2.get("do-connecting-ip");
     if (doConnectingIp) {
       ip = validateIP(doConnectingIp);
     }
   }
   if (!ip) {
-    const realIp = headers.get("x-real-ip");
+    const realIp = headers2.get("x-real-ip");
     if (realIp) {
       ip = validateIP(realIp);
     }
   }
   if (!ip) {
-    const forwardedFor = headers.get("x-forwarded-for");
+    const forwardedFor = headers2.get("x-forwarded-for");
     if (forwardedFor) {
       const firstIp = forwardedFor.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const vercelForwarded = headers.get("x-vercel-forwarded-for");
+    const vercelForwarded = headers2.get("x-vercel-forwarded-for");
     if (vercelForwarded) {
       const firstIp = vercelForwarded.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const trueClientIp = headers.get("true-client-ip");
+    const trueClientIp = headers2.get("true-client-ip");
     if (trueClientIp) {
       ip = validateIP(trueClientIp);
     }
@@ -67,9 +67,9 @@ function extractClientContext(request) {
   if (!ip && request.ip) {
     ip = validateIP(request.ip);
   }
-  const userAgent = headers.get("user-agent") || void 0;
-  const deviceFingerprint = headers.get("x-device-fingerprint") || void 0;
-  const referrer = headers.get("referer") || void 0;
+  const userAgent = headers2.get("user-agent") || void 0;
+  const deviceFingerprint = headers2.get("x-device-fingerprint") || void 0;
+  const referrer = headers2.get("referer") || void 0;
   return {
     ip,
     userAgent,
@@ -78,9 +78,9 @@ function extractClientContext(request) {
   };
 }
 function extractClientContextFromReq(req) {
-  const headers = req.headers;
+  const headers2 = req.headers;
   const getHeader = (name) => {
-    const value = headers[name.toLowerCase()];
+    const value = headers2[name.toLowerCase()];
     if (Array.isArray(value)) {
       return value[0];
     }
@@ -137,24 +137,24 @@ function extractClientContextFromReq(req) {
   };
 }
 function buildClientContextHeaders(context) {
-  const headers = {};
+  const headers2 = {};
   if (!context) {
-    return headers;
+    return headers2;
   }
   if (context.ip) {
-    headers["x-sm-forwarded-client-ip"] = context.ip;
-    headers["X-Client-IP"] = context.ip;
+    headers2["x-sm-forwarded-client-ip"] = context.ip;
+    headers2["X-Client-IP"] = context.ip;
   }
   if (context.userAgent) {
-    headers["X-Client-User-Agent"] = context.userAgent;
+    headers2["X-Client-User-Agent"] = context.userAgent;
   }
   if (context.deviceFingerprint) {
-    headers["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
+    headers2["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
   }
   if (context.referrer) {
-    headers["X-Client-Referrer"] = context.referrer;
+    headers2["X-Client-Referrer"] = context.referrer;
   }
-  return headers;
+  return headers2;
 }
 
 // src/server/client.ts
@@ -539,7 +539,7 @@ var ScaleMuleServer = class {
         formData.append("file", blob, file.filename);
         formData.append("sm_user_id", userId);
         const url = `${this.gatewayUrl}/v1/storage/upload`;
-        const headers = {
+        const headers2 = {
           "x-api-key": this.apiKey,
           "x-user-id": userId,
           ...buildClientContextHeaders(options?.clientContext)
@@ -550,7 +550,7 @@ var ScaleMuleServer = class {
         try {
           const response = await fetch(url, {
             method: "POST",
-            headers,
+            headers: headers2,
             body: formData
           });
           const text = await response.text();
@@ -761,14 +761,14 @@ var ScaleMuleServer = class {
    */
   async request(method, path, options = {}) {
     const url = `${this.gatewayUrl}${path}`;
-    const headers = {
+    const headers2 = {
       "x-api-key": this.apiKey,
       "Content-Type": "application/json",
       // Forward client context headers if provided
       ...buildClientContextHeaders(options.clientContext)
     };
     if (options.sessionToken) {
-      headers["Authorization"] = `Bearer ${options.sessionToken}`;
+      headers2["Authorization"] = `Bearer ${options.sessionToken}`;
     }
     if (this.debug) {
       console.log(`[ScaleMule Server] ${method} ${path}`);
@@ -779,7 +779,7 @@ var ScaleMuleServer = class {
     try {
       const response = await fetch(url, {
         method,
-        headers,
+        headers: headers2,
         body: options.body ? JSON.stringify(options.body) : void 0
       });
       const text = await response.text();
@@ -850,45 +850,45 @@ function createClearCookieHeader(name, options = {}) {
   return cookie;
 }
 function withSession(loginResponse, responseBody, options = {}) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append(
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, loginResponse.session_token, options)
   );
-  headers.append(
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, loginResponse.user.id, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers
+    headers: headers2
   });
 }
 function withRefreshedSession(sessionToken, userId, responseBody, options = {}) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append(
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, sessionToken, options)
   );
-  headers.append(
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, userId, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers
+    headers: headers2
   });
 }
 function clearSession(responseBody, options = {}, status = 200) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
-  headers.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
+  headers2.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
   return new Response(JSON.stringify({ success: status < 300, data: responseBody }), {
     status,
-    headers
+    headers: headers2
   });
 }
 async function getSession() {
@@ -1763,6 +1763,31 @@ function createWebhookHandler(config = {}) {
     }
   };
 }
+var _serverClient = null;
+function getClient() {
+  if (!_serverClient) {
+    _serverClient = createServerClient();
+  }
+  return _serverClient;
+}
+async function getBootstrapFlags(flagKeys, environment = "prod", extraContext = {}) {
+  try {
+    const hdrs = await headers();
+    const forwardedFor = hdrs.get("x-forwarded-for");
+    const realIp = hdrs.get("x-real-ip") || hdrs.get("x-real-client-ip");
+    const clientIp = realIp || (forwardedFor ? forwardedFor.split(",")[0].trim() : void 0);
+    const context = {
+      ...extraContext
+    };
+    if (clientIp) {
+      context.ip_address = clientIp;
+    }
+    const result = await getClient().flags.evaluateBatch(flagKeys, context, environment);
+    return result || {};
+  } catch {
+    return {};
+  }
+}
 function globToRegex(pattern) {
   const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
   return new RegExp(`^${escaped}$`);
@@ -2050,4 +2075,4 @@ async function prefetchBundles(keys) {
   await Promise.all(keys.map((key) => getBundle(key)));
 }
 
-export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, OAUTH_STATE_COOKIE_NAME, SESSION_COOKIE_NAME, ScaleMuleError, ScaleMuleServer, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createServerClient, createWebhookHandler, createWebhookRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, parseWebhookEvent, prefetchBundles, prefetchSecrets, registerVideoWebhook, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, verifyWebhookSignature, withAuth, withCSRFProtection, withCSRFToken, withSession };
+export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, OAUTH_STATE_COOKIE_NAME, SESSION_COOKIE_NAME, ScaleMuleError, ScaleMuleServer, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createServerClient, createWebhookHandler, createWebhookRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, parseWebhookEvent, prefetchBundles, prefetchSecrets, registerVideoWebhook, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, verifyWebhookSignature, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/nextjs",
-  "version": "0.0.10",
+  "version": "0.0.12",
   "description": "ScaleMule SDK for Next.js applications - authentication, storage, and user management",
   "main": "dist/index.js",
   "module": "dist/index.mjs",