@scalemule/nextjs 0.0.11 → 0.0.13

package/dist/index.d.mts

@@ -26,6 +26,8 @@ interface ScaleMuleContextValue {
     publishableKey?: string;
     /** Gateway URL for direct API calls */
     gatewayUrl?: string;
+    /** Server-evaluated flag values to bootstrap the client (eliminates loading flash) */
+    bootstrapFlags?: Record<string, unknown>;
 }
 interface ScaleMuleProviderProps extends ScaleMuleConfig {
     children: ReactNode;
@@ -35,8 +37,10 @@ interface ScaleMuleProviderProps extends ScaleMuleConfig {
     onLogout?: () => void;
     /** Called on authentication error */
     onAuthError?: (error: ApiError) => void;
+    /** Server-evaluated flag values to bootstrap the client (eliminates loading flash) */
+    bootstrapFlags?: Record<string, unknown>;
 }
-declare function ScaleMuleProvider({ apiKey, applicationId, environment, gatewayUrl, debug, storage, analyticsProxyUrl, authProxyUrl, publishableKey, children, onLogin, onLogout, onAuthError, }: ScaleMuleProviderProps): react_jsx_runtime.JSX.Element;
+declare function ScaleMuleProvider({ apiKey, applicationId, environment, gatewayUrl, debug, storage, analyticsProxyUrl, authProxyUrl, publishableKey, children, onLogin, onLogout, onAuthError, bootstrapFlags, }: ScaleMuleProviderProps): react_jsx_runtime.JSX.Element;
 declare function useScaleMule(): ScaleMuleContextValue;
 declare function useScaleMuleClient(): ScaleMuleClient;
 

package/dist/index.d.ts

@@ -26,6 +26,8 @@ interface ScaleMuleContextValue {
     publishableKey?: string;
     /** Gateway URL for direct API calls */
     gatewayUrl?: string;
+    /** Server-evaluated flag values to bootstrap the client (eliminates loading flash) */
+    bootstrapFlags?: Record<string, unknown>;
 }
 interface ScaleMuleProviderProps extends ScaleMuleConfig {
     children: ReactNode;
@@ -35,8 +37,10 @@ interface ScaleMuleProviderProps extends ScaleMuleConfig {
     onLogout?: () => void;
     /** Called on authentication error */
     onAuthError?: (error: ApiError) => void;
+    /** Server-evaluated flag values to bootstrap the client (eliminates loading flash) */
+    bootstrapFlags?: Record<string, unknown>;
 }
-declare function ScaleMuleProvider({ apiKey, applicationId, environment, gatewayUrl, debug, storage, analyticsProxyUrl, authProxyUrl, publishableKey, children, onLogin, onLogout, onAuthError, }: ScaleMuleProviderProps): react_jsx_runtime.JSX.Element;
+declare function ScaleMuleProvider({ apiKey, applicationId, environment, gatewayUrl, debug, storage, analyticsProxyUrl, authProxyUrl, publishableKey, children, onLogin, onLogout, onAuthError, bootstrapFlags, }: ScaleMuleProviderProps): react_jsx_runtime.JSX.Element;
 declare function useScaleMule(): ScaleMuleContextValue;
 declare function useScaleMuleClient(): ScaleMuleClient;
 

package/dist/index.js

@@ -817,7 +817,8 @@ function ScaleMuleProvider({
   children,
   onLogin,
   onLogout,
-  onAuthError
+  onAuthError,
+  bootstrapFlags
 }) {
   const [user, setUser] = react.useState(null);
   const [initializing, setInitializing] = react.useState(true);
@@ -929,9 +930,10 @@ function ScaleMuleProvider({
       analyticsProxyUrl,
       authProxyUrl,
       publishableKey,
-      gatewayUrl: gatewayUrl || (environment === "dev" ? "https://api-dev.scalemule.com" : "https://api.scalemule.com")
+      gatewayUrl: gatewayUrl || (environment === "dev" ? "https://api-dev.scalemule.com" : "https://api.scalemule.com"),
+      bootstrapFlags
     }),
-    [client, user, handleSetUser, initializing, error, analyticsProxyUrl, authProxyUrl, publishableKey, gatewayUrl, environment]
+    [client, user, handleSetUser, initializing, error, analyticsProxyUrl, authProxyUrl, publishableKey, gatewayUrl, environment, bootstrapFlags]
   );
   return /* @__PURE__ */ jsxRuntime.jsx(ScaleMuleContext.Provider, { value, children });
 }
@@ -2851,9 +2853,20 @@ function useFeatureFlags(options = {}) {
     keys,
     enabled = true
   } = options;
-  const { client, publishableKey, gatewayUrl } = useScaleMule();
-  const [flags, setFlags] = react.useState({});
-  const [loading, setLoading] = react.useState(enabled);
+  const { client, publishableKey, gatewayUrl, bootstrapFlags } = useScaleMule();
+  const initialFlags = react.useMemo(() => {
+    if (!bootstrapFlags) return {};
+    const result = {};
+    for (const [key, value] of Object.entries(bootstrapFlags)) {
+      if (value && typeof value === "object" && "flag_key" in value) {
+        result[key] = value;
+      }
+    }
+    return result;
+  }, [bootstrapFlags]);
+  const hasBootstrap = Object.keys(initialFlags).length > 0;
+  const [flags, setFlags] = react.useState(initialFlags);
+  const [loading, setLoading] = react.useState(enabled && !hasBootstrap);
   const [error, setError] = react.useState(null);
   const contextRef = react.useRef(context);
   const keysKey = react.useMemo(() => keys && keys.length > 0 ? [...keys].sort().join("|") : "", [keys]);
@@ -2895,9 +2908,15 @@ function useFeatureFlags(options = {}) {
       setLoading(false);
     }
   }, [client, enabled, environment, keys, keysKey, publishableKey, gatewayUrl]);
+  const bootstrapCoversKeys = react.useMemo(() => {
+    if (!hasBootstrap || !keys || keys.length === 0) return false;
+    return keys.every((k) => k in initialFlags);
+  }, [hasBootstrap, keys, initialFlags]);
   react.useEffect(() => {
-    void refresh();
-  }, [refresh]);
+    if (!bootstrapCoversKeys) {
+      void refresh();
+    }
+  }, [refresh, bootstrapCoversKeys]);
   const isEnabled = react.useCallback(
     (flagKey, fallback = false) => {
       const evaluation = flags[flagKey];

package/dist/index.mjs

@@ -815,7 +815,8 @@ function ScaleMuleProvider({
   children,
   onLogin,
   onLogout,
-  onAuthError
+  onAuthError,
+  bootstrapFlags
 }) {
   const [user, setUser] = useState(null);
   const [initializing, setInitializing] = useState(true);
@@ -927,9 +928,10 @@ function ScaleMuleProvider({
       analyticsProxyUrl,
       authProxyUrl,
       publishableKey,
-      gatewayUrl: gatewayUrl || (environment === "dev" ? "https://api-dev.scalemule.com" : "https://api.scalemule.com")
+      gatewayUrl: gatewayUrl || (environment === "dev" ? "https://api-dev.scalemule.com" : "https://api.scalemule.com"),
+      bootstrapFlags
     }),
-    [client, user, handleSetUser, initializing, error, analyticsProxyUrl, authProxyUrl, publishableKey, gatewayUrl, environment]
+    [client, user, handleSetUser, initializing, error, analyticsProxyUrl, authProxyUrl, publishableKey, gatewayUrl, environment, bootstrapFlags]
   );
   return /* @__PURE__ */ jsx(ScaleMuleContext.Provider, { value, children });
 }
@@ -2849,9 +2851,20 @@ function useFeatureFlags(options = {}) {
     keys,
     enabled = true
   } = options;
-  const { client, publishableKey, gatewayUrl } = useScaleMule();
-  const [flags, setFlags] = useState({});
-  const [loading, setLoading] = useState(enabled);
+  const { client, publishableKey, gatewayUrl, bootstrapFlags } = useScaleMule();
+  const initialFlags = useMemo(() => {
+    if (!bootstrapFlags) return {};
+    const result = {};
+    for (const [key, value] of Object.entries(bootstrapFlags)) {
+      if (value && typeof value === "object" && "flag_key" in value) {
+        result[key] = value;
+      }
+    }
+    return result;
+  }, [bootstrapFlags]);
+  const hasBootstrap = Object.keys(initialFlags).length > 0;
+  const [flags, setFlags] = useState(initialFlags);
+  const [loading, setLoading] = useState(enabled && !hasBootstrap);
   const [error, setError] = useState(null);
   const contextRef = useRef(context);
   const keysKey = useMemo(() => keys && keys.length > 0 ? [...keys].sort().join("|") : "", [keys]);
@@ -2893,9 +2906,15 @@ function useFeatureFlags(options = {}) {
       setLoading(false);
     }
   }, [client, enabled, environment, keys, keysKey, publishableKey, gatewayUrl]);
+  const bootstrapCoversKeys = useMemo(() => {
+    if (!hasBootstrap || !keys || keys.length === 0) return false;
+    return keys.every((k) => k in initialFlags);
+  }, [hasBootstrap, keys, initialFlags]);
   useEffect(() => {
-    void refresh();
-  }, [refresh]);
+    if (!bootstrapCoversKeys) {
+      void refresh();
+    }
+  }, [refresh, bootstrapCoversKeys]);
   const isEnabled = useCallback(
     (flagKey, fallback = false) => {
       const evaluation = flags[flagKey];

package/dist/server/index.d.mts

@@ -433,6 +433,52 @@ declare function apiHandler(handler: HandlerFn, options?: HandlerOptions): (requ
     params: Promise<Record<string, string | string[]>>;
 }) => Promise<Response>;
 
+/**
+ * Server-side flag bootstrapping for Next.js layouts.
+ *
+ * Evaluates feature flags on the server during SSR so the client
+ * has correct values on first render -- no loading flash, no race condition.
+ *
+ * Results are cached in-memory with a configurable TTL (default: 60s) to
+ * prevent excessive API calls. Since feature flags change infrequently,
+ * a short cache window is fine and avoids hammering the flags service on
+ * every page render.
+ *
+ * @example
+ * ```ts
+ * // app/layout.tsx
+ * import { getBootstrapFlags } from '@scalemule/nextjs/server'
+ *
+ * export default async function RootLayout({ children }) {
+ *   const bootstrapFlags = await getBootstrapFlags(['analytics.tracking_enabled'])
+ *   return (
+ *     <Providers bootstrapFlags={bootstrapFlags}>
+ *       {children}
+ *     </Providers>
+ *   )
+ * }
+ * ```
+ */
+/**
+ * Evaluate feature flags server-side for bootstrapping the client provider.
+ *
+ * Extracts the client IP from request headers (x-forwarded-for, x-real-ip)
+ * and passes it as ip_address in the evaluation context so IP-based targeting
+ * rules work correctly.
+ *
+ * Results are cached in-memory for `cacheTtlMs` milliseconds (default: 60s).
+ * Pass `cacheTtlMs: 0` to disable caching.
+ *
+ * Returns a Record that can be passed directly to ScaleMuleProvider's
+ * bootstrapFlags prop.
+ *
+ * @param flagKeys - Array of flag keys to evaluate
+ * @param environment - Environment name (default: 'prod')
+ * @param extraContext - Additional context attributes to include
+ * @param cacheTtlMs - Cache TTL in milliseconds (default: 60000). Set to 0 to disable.
+ */
+declare function getBootstrapFlags(flagKeys: string[], environment?: string, extraContext?: Record<string, unknown>, cacheTtlMs?: number): Promise<Record<string, unknown>>;
+
 /**
  * Next.js Middleware Helpers
  *
@@ -868,4 +914,4 @@ declare function invalidateBundleCache(key?: string): void;
  */
 declare function prefetchBundles(keys: string[]): Promise<void>;
 
-export { type AnalyticsRoutesConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };
+export { type AnalyticsRoutesConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/dist/server/index.d.ts

@@ -433,6 +433,52 @@ declare function apiHandler(handler: HandlerFn, options?: HandlerOptions): (requ
     params: Promise<Record<string, string | string[]>>;
 }) => Promise<Response>;
 
+/**
+ * Server-side flag bootstrapping for Next.js layouts.
+ *
+ * Evaluates feature flags on the server during SSR so the client
+ * has correct values on first render -- no loading flash, no race condition.
+ *
+ * Results are cached in-memory with a configurable TTL (default: 60s) to
+ * prevent excessive API calls. Since feature flags change infrequently,
+ * a short cache window is fine and avoids hammering the flags service on
+ * every page render.
+ *
+ * @example
+ * ```ts
+ * // app/layout.tsx
+ * import { getBootstrapFlags } from '@scalemule/nextjs/server'
+ *
+ * export default async function RootLayout({ children }) {
+ *   const bootstrapFlags = await getBootstrapFlags(['analytics.tracking_enabled'])
+ *   return (
+ *     <Providers bootstrapFlags={bootstrapFlags}>
+ *       {children}
+ *     </Providers>
+ *   )
+ * }
+ * ```
+ */
+/**
+ * Evaluate feature flags server-side for bootstrapping the client provider.
+ *
+ * Extracts the client IP from request headers (x-forwarded-for, x-real-ip)
+ * and passes it as ip_address in the evaluation context so IP-based targeting
+ * rules work correctly.
+ *
+ * Results are cached in-memory for `cacheTtlMs` milliseconds (default: 60s).
+ * Pass `cacheTtlMs: 0` to disable caching.
+ *
+ * Returns a Record that can be passed directly to ScaleMuleProvider's
+ * bootstrapFlags prop.
+ *
+ * @param flagKeys - Array of flag keys to evaluate
+ * @param environment - Environment name (default: 'prod')
+ * @param extraContext - Additional context attributes to include
+ * @param cacheTtlMs - Cache TTL in milliseconds (default: 60000). Set to 0 to disable.
+ */
+declare function getBootstrapFlags(flagKeys: string[], environment?: string, extraContext?: Record<string, unknown>, cacheTtlMs?: number): Promise<Record<string, unknown>>;
+
 /**
  * Next.js Middleware Helpers
  *
@@ -868,4 +914,4 @@ declare function invalidateBundleCache(key?: string): void;
  */
 declare function prefetchBundles(keys: string[]): Promise<void>;
 
-export { type AnalyticsRoutesConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };
+export { type AnalyticsRoutesConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/dist/server/index.js

@@ -28,40 +28,40 @@ function validateIP(ip) {
   return void 0;
 }
 function extractClientContext(request) {
-  const headers = request.headers;
+  const headers2 = request.headers;
   let ip;
-  const cfConnectingIp = headers.get("cf-connecting-ip");
+  const cfConnectingIp = headers2.get("cf-connecting-ip");
   if (cfConnectingIp) {
     ip = validateIP(cfConnectingIp);
   }
   if (!ip) {
-    const doConnectingIp = headers.get("do-connecting-ip");
+    const doConnectingIp = headers2.get("do-connecting-ip");
     if (doConnectingIp) {
       ip = validateIP(doConnectingIp);
     }
   }
   if (!ip) {
-    const realIp = headers.get("x-real-ip");
+    const realIp = headers2.get("x-real-ip");
     if (realIp) {
       ip = validateIP(realIp);
     }
   }
   if (!ip) {
-    const forwardedFor = headers.get("x-forwarded-for");
+    const forwardedFor = headers2.get("x-forwarded-for");
     if (forwardedFor) {
       const firstIp = forwardedFor.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const vercelForwarded = headers.get("x-vercel-forwarded-for");
+    const vercelForwarded = headers2.get("x-vercel-forwarded-for");
     if (vercelForwarded) {
       const firstIp = vercelForwarded.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const trueClientIp = headers.get("true-client-ip");
+    const trueClientIp = headers2.get("true-client-ip");
     if (trueClientIp) {
       ip = validateIP(trueClientIp);
     }
@@ -69,9 +69,9 @@ function extractClientContext(request) {
   if (!ip && request.ip) {
     ip = validateIP(request.ip);
   }
-  const userAgent = headers.get("user-agent") || void 0;
-  const deviceFingerprint = headers.get("x-device-fingerprint") || void 0;
-  const referrer = headers.get("referer") || void 0;
+  const userAgent = headers2.get("user-agent") || void 0;
+  const deviceFingerprint = headers2.get("x-device-fingerprint") || void 0;
+  const referrer = headers2.get("referer") || void 0;
   return {
     ip,
     userAgent,
@@ -80,9 +80,9 @@ function extractClientContext(request) {
   };
 }
 function extractClientContextFromReq(req) {
-  const headers = req.headers;
+  const headers2 = req.headers;
   const getHeader = (name) => {
-    const value = headers[name.toLowerCase()];
+    const value = headers2[name.toLowerCase()];
     if (Array.isArray(value)) {
       return value[0];
     }
@@ -139,24 +139,24 @@ function extractClientContextFromReq(req) {
   };
 }
 function buildClientContextHeaders(context) {
-  const headers = {};
+  const headers2 = {};
   if (!context) {
-    return headers;
+    return headers2;
   }
   if (context.ip) {
-    headers["x-sm-forwarded-client-ip"] = context.ip;
-    headers["X-Client-IP"] = context.ip;
+    headers2["x-sm-forwarded-client-ip"] = context.ip;
+    headers2["X-Client-IP"] = context.ip;
   }
   if (context.userAgent) {
-    headers["X-Client-User-Agent"] = context.userAgent;
+    headers2["X-Client-User-Agent"] = context.userAgent;
   }
   if (context.deviceFingerprint) {
-    headers["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
+    headers2["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
   }
   if (context.referrer) {
-    headers["X-Client-Referrer"] = context.referrer;
+    headers2["X-Client-Referrer"] = context.referrer;
   }
-  return headers;
+  return headers2;
 }
 
 // src/server/client.ts
@@ -541,7 +541,7 @@ var ScaleMuleServer = class {
         formData.append("file", blob, file.filename);
         formData.append("sm_user_id", userId);
         const url = `${this.gatewayUrl}/v1/storage/upload`;
-        const headers = {
+        const headers2 = {
           "x-api-key": this.apiKey,
           "x-user-id": userId,
           ...buildClientContextHeaders(options?.clientContext)
@@ -552,7 +552,7 @@ var ScaleMuleServer = class {
         try {
           const response = await fetch(url, {
             method: "POST",
-            headers,
+            headers: headers2,
             body: formData
           });
           const text = await response.text();
@@ -763,14 +763,14 @@ var ScaleMuleServer = class {
    */
   async request(method, path, options = {}) {
     const url = `${this.gatewayUrl}${path}`;
-    const headers = {
+    const headers2 = {
       "x-api-key": this.apiKey,
       "Content-Type": "application/json",
       // Forward client context headers if provided
       ...buildClientContextHeaders(options.clientContext)
     };
     if (options.sessionToken) {
-      headers["Authorization"] = `Bearer ${options.sessionToken}`;
+      headers2["Authorization"] = `Bearer ${options.sessionToken}`;
     }
     if (this.debug) {
       console.log(`[ScaleMule Server] ${method} ${path}`);
@@ -781,7 +781,7 @@ var ScaleMuleServer = class {
     try {
       const response = await fetch(url, {
         method,
-        headers,
+        headers: headers2,
         body: options.body ? JSON.stringify(options.body) : void 0
       });
       const text = await response.text();
@@ -852,45 +852,45 @@ function createClearCookieHeader(name, options = {}) {
   return cookie;
 }
 function withSession(loginResponse, responseBody, options = {}) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append(
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, loginResponse.session_token, options)
   );
-  headers.append(
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, loginResponse.user.id, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers
+    headers: headers2
   });
 }
 function withRefreshedSession(sessionToken, userId, responseBody, options = {}) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append(
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, sessionToken, options)
   );
-  headers.append(
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, userId, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers
+    headers: headers2
   });
 }
 function clearSession(responseBody, options = {}, status = 200) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
-  headers.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
+  headers2.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
   return new Response(JSON.stringify({ success: status < 300, data: responseBody }), {
     status,
-    headers
+    headers: headers2
   });
 }
 async function getSession() {
@@ -1765,6 +1765,52 @@ function createWebhookHandler(config = {}) {
     }
   };
 }
+var _serverClient = null;
+function getClient() {
+  if (!_serverClient) {
+    _serverClient = createServerClient();
+  }
+  return _serverClient;
+}
+var _flagCache = /* @__PURE__ */ new Map();
+var DEFAULT_CACHE_TTL_MS = 6e4;
+async function getBootstrapFlags(flagKeys, environment = "prod", extraContext = {}, cacheTtlMs = DEFAULT_CACHE_TTL_MS) {
+  try {
+    const cacheKey = [...flagKeys].sort().join("|") + ":" + environment;
+    if (cacheTtlMs > 0) {
+      const cached = _flagCache.get(cacheKey);
+      if (cached && Date.now() - cached.timestamp < cacheTtlMs) {
+        return cached.result;
+      }
+    }
+    const hdrs = await headers.headers();
+    const forwardedFor = hdrs.get("x-forwarded-for");
+    const realIp = hdrs.get("x-real-ip") || hdrs.get("x-real-client-ip");
+    const clientIp = realIp || (forwardedFor ? forwardedFor.split(",")[0].trim() : void 0);
+    const context = {
+      ...extraContext
+    };
+    if (clientIp) {
+      context.ip_address = clientIp;
+    }
+    const result = await getClient().flags.evaluateBatch(flagKeys, context, environment);
+    const flagResult = result || {};
+    if (cacheTtlMs > 0) {
+      _flagCache.set(cacheKey, { result: flagResult, timestamp: Date.now() });
+      if (_flagCache.size > 100) {
+        const now = Date.now();
+        for (const [key, entry] of _flagCache) {
+          if (now - entry.timestamp > cacheTtlMs) {
+            _flagCache.delete(key);
+          }
+        }
+      }
+    }
+    return flagResult;
+  } catch {
+    return {};
+  }
+}
 function globToRegex(pattern) {
   const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
   return new RegExp(`^${escaped}$`);
@@ -1892,14 +1938,14 @@ function clearOAuthState(response) {
 }
 
 // src/server/secrets.ts
-var DEFAULT_CACHE_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_CACHE_TTL_MS2 = 5 * 60 * 1e3;
 var secretsCache = {};
 var globalConfig = {};
 function configureSecrets(config) {
   globalConfig = { ...globalConfig, ...config };
 }
 async function getAppSecret(key) {
-  const cacheTtl = globalConfig.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
+  const cacheTtl = globalConfig.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS2;
   const noCache = globalConfig.noCache ?? false;
   if (!noCache) {
     const cached = secretsCache[key];
@@ -1951,14 +1997,14 @@ async function prefetchSecrets(keys) {
 }
 
 // src/server/bundles.ts
-var DEFAULT_CACHE_TTL_MS2 = 5 * 60 * 1e3;
+var DEFAULT_CACHE_TTL_MS3 = 5 * 60 * 1e3;
 var bundlesCache = {};
 var globalConfig2 = {};
 function configureBundles(config) {
   globalConfig2 = { ...globalConfig2, ...config };
 }
 async function getBundle(key, resolve = true) {
-  const cacheTtl = globalConfig2.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS2;
+  const cacheTtl = globalConfig2.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS3;
   const noCache = globalConfig2.noCache ?? false;
   if (!noCache) {
     const cached = bundlesCache[key];
@@ -2077,6 +2123,7 @@ exports.extractClientContextFromReq = extractClientContextFromReq;
 exports.generateCSRFToken = generateCSRFToken;
 exports.getAppSecret = getAppSecret;
 exports.getAppSecretOrDefault = getAppSecretOrDefault;
+exports.getBootstrapFlags = getBootstrapFlags;
 exports.getBundle = getBundle;
 exports.getCSRFToken = getCSRFToken;
 exports.getMySqlBundle = getMySqlBundle;

package/dist/server/index.mjs

@@ -1,4 +1,4 @@
-import { cookies } from 'next/headers';
+import { cookies, headers } from 'next/headers';
 import { NextResponse } from 'next/server';
 import { createHmac, timingSafeEqual } from 'crypto';
 
@@ -26,40 +26,40 @@ function validateIP(ip) {
   return void 0;
 }
 function extractClientContext(request) {
-  const headers = request.headers;
+  const headers2 = request.headers;
   let ip;
-  const cfConnectingIp = headers.get("cf-connecting-ip");
+  const cfConnectingIp = headers2.get("cf-connecting-ip");
   if (cfConnectingIp) {
     ip = validateIP(cfConnectingIp);
   }
   if (!ip) {
-    const doConnectingIp = headers.get("do-connecting-ip");
+    const doConnectingIp = headers2.get("do-connecting-ip");
     if (doConnectingIp) {
       ip = validateIP(doConnectingIp);
     }
   }
   if (!ip) {
-    const realIp = headers.get("x-real-ip");
+    const realIp = headers2.get("x-real-ip");
     if (realIp) {
       ip = validateIP(realIp);
     }
   }
   if (!ip) {
-    const forwardedFor = headers.get("x-forwarded-for");
+    const forwardedFor = headers2.get("x-forwarded-for");
     if (forwardedFor) {
       const firstIp = forwardedFor.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const vercelForwarded = headers.get("x-vercel-forwarded-for");
+    const vercelForwarded = headers2.get("x-vercel-forwarded-for");
     if (vercelForwarded) {
       const firstIp = vercelForwarded.split(",")[0]?.trim();
       ip = validateIP(firstIp);
     }
   }
   if (!ip) {
-    const trueClientIp = headers.get("true-client-ip");
+    const trueClientIp = headers2.get("true-client-ip");
     if (trueClientIp) {
       ip = validateIP(trueClientIp);
     }
@@ -67,9 +67,9 @@ function extractClientContext(request) {
   if (!ip && request.ip) {
     ip = validateIP(request.ip);
   }
-  const userAgent = headers.get("user-agent") || void 0;
-  const deviceFingerprint = headers.get("x-device-fingerprint") || void 0;
-  const referrer = headers.get("referer") || void 0;
+  const userAgent = headers2.get("user-agent") || void 0;
+  const deviceFingerprint = headers2.get("x-device-fingerprint") || void 0;
+  const referrer = headers2.get("referer") || void 0;
   return {
     ip,
     userAgent,
@@ -78,9 +78,9 @@ function extractClientContext(request) {
   };
 }
 function extractClientContextFromReq(req) {
-  const headers = req.headers;
+  const headers2 = req.headers;
   const getHeader = (name) => {
-    const value = headers[name.toLowerCase()];
+    const value = headers2[name.toLowerCase()];
     if (Array.isArray(value)) {
       return value[0];
     }
@@ -137,24 +137,24 @@ function extractClientContextFromReq(req) {
   };
 }
 function buildClientContextHeaders(context) {
-  const headers = {};
+  const headers2 = {};
   if (!context) {
-    return headers;
+    return headers2;
   }
   if (context.ip) {
-    headers["x-sm-forwarded-client-ip"] = context.ip;
-    headers["X-Client-IP"] = context.ip;
+    headers2["x-sm-forwarded-client-ip"] = context.ip;
+    headers2["X-Client-IP"] = context.ip;
   }
   if (context.userAgent) {
-    headers["X-Client-User-Agent"] = context.userAgent;
+    headers2["X-Client-User-Agent"] = context.userAgent;
   }
   if (context.deviceFingerprint) {
-    headers["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
+    headers2["X-Client-Device-Fingerprint"] = context.deviceFingerprint;
   }
   if (context.referrer) {
-    headers["X-Client-Referrer"] = context.referrer;
+    headers2["X-Client-Referrer"] = context.referrer;
   }
-  return headers;
+  return headers2;
 }
 
 // src/server/client.ts
@@ -539,7 +539,7 @@ var ScaleMuleServer = class {
         formData.append("file", blob, file.filename);
         formData.append("sm_user_id", userId);
         const url = `${this.gatewayUrl}/v1/storage/upload`;
-        const headers = {
+        const headers2 = {
           "x-api-key": this.apiKey,
           "x-user-id": userId,
           ...buildClientContextHeaders(options?.clientContext)
@@ -550,7 +550,7 @@ var ScaleMuleServer = class {
         try {
           const response = await fetch(url, {
             method: "POST",
-            headers,
+            headers: headers2,
             body: formData
           });
           const text = await response.text();
@@ -761,14 +761,14 @@ var ScaleMuleServer = class {
    */
   async request(method, path, options = {}) {
     const url = `${this.gatewayUrl}${path}`;
-    const headers = {
+    const headers2 = {
       "x-api-key": this.apiKey,
       "Content-Type": "application/json",
       // Forward client context headers if provided
       ...buildClientContextHeaders(options.clientContext)
     };
     if (options.sessionToken) {
-      headers["Authorization"] = `Bearer ${options.sessionToken}`;
+      headers2["Authorization"] = `Bearer ${options.sessionToken}`;
     }
     if (this.debug) {
       console.log(`[ScaleMule Server] ${method} ${path}`);
@@ -779,7 +779,7 @@ var ScaleMuleServer = class {
     try {
       const response = await fetch(url, {
         method,
-        headers,
+        headers: headers2,
         body: options.body ? JSON.stringify(options.body) : void 0
       });
       const text = await response.text();
@@ -850,45 +850,45 @@ function createClearCookieHeader(name, options = {}) {
   return cookie;
 }
 function withSession(loginResponse, responseBody, options = {}) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append(
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, loginResponse.session_token, options)
   );
-  headers.append(
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, loginResponse.user.id, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers
+    headers: headers2
   });
 }
 function withRefreshedSession(sessionToken, userId, responseBody, options = {}) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append(
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(SESSION_COOKIE_NAME, sessionToken, options)
   );
-  headers.append(
+  headers2.append(
     "Set-Cookie",
     createCookieHeader(USER_ID_COOKIE_NAME, userId, options)
   );
   return new Response(JSON.stringify({ success: true, data: responseBody }), {
     status: 200,
-    headers
+    headers: headers2
   });
 }
 function clearSession(responseBody, options = {}, status = 200) {
-  const headers = new Headers();
-  headers.set("Content-Type", "application/json");
-  headers.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
-  headers.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
+  const headers2 = new Headers();
+  headers2.set("Content-Type", "application/json");
+  headers2.append("Set-Cookie", createClearCookieHeader(SESSION_COOKIE_NAME, options));
+  headers2.append("Set-Cookie", createClearCookieHeader(USER_ID_COOKIE_NAME, options));
   return new Response(JSON.stringify({ success: status < 300, data: responseBody }), {
     status,
-    headers
+    headers: headers2
   });
 }
 async function getSession() {
@@ -1763,6 +1763,52 @@ function createWebhookHandler(config = {}) {
     }
   };
 }
+var _serverClient = null;
+function getClient() {
+  if (!_serverClient) {
+    _serverClient = createServerClient();
+  }
+  return _serverClient;
+}
+var _flagCache = /* @__PURE__ */ new Map();
+var DEFAULT_CACHE_TTL_MS = 6e4;
+async function getBootstrapFlags(flagKeys, environment = "prod", extraContext = {}, cacheTtlMs = DEFAULT_CACHE_TTL_MS) {
+  try {
+    const cacheKey = [...flagKeys].sort().join("|") + ":" + environment;
+    if (cacheTtlMs > 0) {
+      const cached = _flagCache.get(cacheKey);
+      if (cached && Date.now() - cached.timestamp < cacheTtlMs) {
+        return cached.result;
+      }
+    }
+    const hdrs = await headers();
+    const forwardedFor = hdrs.get("x-forwarded-for");
+    const realIp = hdrs.get("x-real-ip") || hdrs.get("x-real-client-ip");
+    const clientIp = realIp || (forwardedFor ? forwardedFor.split(",")[0].trim() : void 0);
+    const context = {
+      ...extraContext
+    };
+    if (clientIp) {
+      context.ip_address = clientIp;
+    }
+    const result = await getClient().flags.evaluateBatch(flagKeys, context, environment);
+    const flagResult = result || {};
+    if (cacheTtlMs > 0) {
+      _flagCache.set(cacheKey, { result: flagResult, timestamp: Date.now() });
+      if (_flagCache.size > 100) {
+        const now = Date.now();
+        for (const [key, entry] of _flagCache) {
+          if (now - entry.timestamp > cacheTtlMs) {
+            _flagCache.delete(key);
+          }
+        }
+      }
+    }
+    return flagResult;
+  } catch {
+    return {};
+  }
+}
 function globToRegex(pattern) {
   const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
   return new RegExp(`^${escaped}$`);
@@ -1890,14 +1936,14 @@ function clearOAuthState(response) {
 }
 
 // src/server/secrets.ts
-var DEFAULT_CACHE_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_CACHE_TTL_MS2 = 5 * 60 * 1e3;
 var secretsCache = {};
 var globalConfig = {};
 function configureSecrets(config) {
   globalConfig = { ...globalConfig, ...config };
 }
 async function getAppSecret(key) {
-  const cacheTtl = globalConfig.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
+  const cacheTtl = globalConfig.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS2;
   const noCache = globalConfig.noCache ?? false;
   if (!noCache) {
     const cached = secretsCache[key];
@@ -1949,14 +1995,14 @@ async function prefetchSecrets(keys) {
 }
 
 // src/server/bundles.ts
-var DEFAULT_CACHE_TTL_MS2 = 5 * 60 * 1e3;
+var DEFAULT_CACHE_TTL_MS3 = 5 * 60 * 1e3;
 var bundlesCache = {};
 var globalConfig2 = {};
 function configureBundles(config) {
   globalConfig2 = { ...globalConfig2, ...config };
 }
 async function getBundle(key, resolve = true) {
-  const cacheTtl = globalConfig2.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS2;
+  const cacheTtl = globalConfig2.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS3;
   const noCache = globalConfig2.noCache ?? false;
   if (!noCache) {
     const cached = bundlesCache[key];
@@ -2050,4 +2096,4 @@ async function prefetchBundles(keys) {
   await Promise.all(keys.map((key) => getBundle(key)));
 }
 
-export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, OAUTH_STATE_COOKIE_NAME, SESSION_COOKIE_NAME, ScaleMuleError, ScaleMuleServer, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createServerClient, createWebhookHandler, createWebhookRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, parseWebhookEvent, prefetchBundles, prefetchSecrets, registerVideoWebhook, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, verifyWebhookSignature, withAuth, withCSRFProtection, withCSRFToken, withSession };
+export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, OAUTH_STATE_COOKIE_NAME, SESSION_COOKIE_NAME, ScaleMuleError, ScaleMuleServer, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createServerClient, createWebhookHandler, createWebhookRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, parseWebhookEvent, prefetchBundles, prefetchSecrets, registerVideoWebhook, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, verifyWebhookSignature, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/nextjs",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "description": "ScaleMule SDK for Next.js applications - authentication, storage, and user management",
   "main": "dist/index.js",
   "module": "dist/index.mjs",