@qelos/integrator-next 4.0.0

package/LICENSE

@@ -0,0 +1,20 @@
+Polyform Shield License 1.0.0
+
+Copyright (c) 2025 Velocitech LTD
+
+Your use of this software is governed by the Polyform Shield License 1.0.0.
+
+You may obtain a copy of the License at:
+https://polyformproject.org/licenses/shield/1.0.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+
+Additional Terms – Exception Notice:
+
+The author of this software grants additional permissions beyond the Polyform Shield License 1.0.0:
+
+✅ All uses of the software are permitted — including modification, distribution, commercial use, and sublicensing — as long as the software is not used to create, offer, or operate any product or service that competes directly with Qelos (https://qelos.io), a no-code platform for building AI-assisted SaaS applications.
+
+❌ "Direct competition" includes platforms, tools, or services that enable users to visually or programmatically create SaaS applications with the assistance of artificial intelligence.
+
+This exception does not modify the terms of the original Polyform Shield License for other users and applies only by explicit permission of the licensor.

package/README.md

@@ -0,0 +1,256 @@
+# @qelos/integrator-next
+
+Qelos integrator middleware for **Next.js** — supports both the **App Router**
+and the **Pages Router**, on Next.js **14** and **15**. Drop it into your
+Next.js app to identify the user and active workspace via the Qelos SDK
+*before* your own handlers run, and to keep refresh-token cookies fresh on
+every request.
+
+The package is a sibling of `@qelos/integrator-express` and
+`@qelos/integrator-nuxt` — they all expose the same `QelosRequestContext`
+shape (`{ user, workspace, workspaces, sdk, tokens }`).
+
+## Install
+
+```bash
+pnpm add @qelos/integrator-next @qelos/sdk
+```
+
+`next` (>=13.4) and `react` are peer dependencies. Tested with Next.js 14.2
+and 15.x on both the App Router and the Pages Router.
+
+## Quick start
+
+Set `QELOS_APP_URL` (and any optional vars below) in your environment, then
+re-export the pre-built middleware and use the no-arg context loader:
+
+```ts
+// middleware.ts
+export { qelosMiddleware as middleware } from '@qelos/integrator-next/middleware';
+
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+};
+```
+
+```tsx
+// app/dashboard/page.tsx
+import { getQelosContext } from '@qelos/integrator-next/context';
+
+export default async function Dashboard() {
+  const { user, sdk } = await getQelosContext();
+  if (!user) return <p>Please sign in.</p>;
+  const products = await sdk.entities('products').getList();
+  return <div>Welcome {user.fullName}, you have {products.length} products</div>;
+}
+```
+
+### Environment variables
+
+| Variable | Default | Description |
+|---|---|---|
+| `QELOS_APP_URL` | — (required) | Qelos backend base URL |
+| `QELOS_API_TOKEN` | — | Service-to-service token (skips refresh logic) |
+| `QELOS_ACCESS_TOKEN_COOKIE` | `q_access_token` | Cookie name for the access token |
+| `QELOS_REFRESH_TOKEN_COOKIE` | `q_refresh_token` | Cookie name for the refresh token |
+| `QELOS_REQUIRE_AUTH` | `false` | Set `true` to reject anonymous requests with 401 |
+| `QELOS_SKIP_PATHS` | — | Comma-separated path prefixes to bypass entirely |
+
+## Explicit configuration (App Router)
+
+When you need control over `resolveWorkspace`, `onTokenRefresh`, or any other
+option, call the factory yourself.
+
+### 1. Edge middleware
+
+```ts
+// middleware.ts
+import { createQelosMiddleware } from '@qelos/integrator-next/middleware';
+
+export default createQelosMiddleware({
+  config: {
+    appUrl: process.env.QELOS_APP_URL!,
+    skipPaths: ['/_next', '/favicon.ico'],
+    requireAuth: false,
+  },
+  resolveWorkspace: ({ req, workspaces }) => {
+    const slug = req.nextUrl.searchParams.get('workspace');
+    return workspaces.find((w) => (w as any).slug === slug) ?? workspaces[0] ?? null;
+  },
+});
+
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+};
+```
+
+The middleware:
+
+- Reads tokens from cookies (`q_access_token`, `q_refresh_token`) or the
+  `Authorization` header.
+- Calls the Qelos SDK to resolve the user and the active workspace.
+- Forwards the resolved ids to downstream handlers via the
+  `x-qelos-user-id` and `x-qelos-workspace-id` request headers.
+- Refreshes the access/refresh token pair when needed and writes the new
+  cookies onto the outbound response.
+- Returns `401` early when `config.requireAuth: true` and the user cannot be
+  resolved.
+
+### 2. Server components (RSC)
+
+`getQelosContext()` is safe to call inside React Server Components on both
+Next.js 14 (sync `cookies()` / `headers()`) and Next.js 15 (async). Wrap it
+with React's `cache()` so re-renders within the same request reuse the result:
+
+```tsx
+// lib/qelos.ts
+import { cache } from 'react';
+import { getQelosContext } from '@qelos/integrator-next/context';
+
+export const loadQelos = cache(() => getQelosContext());
+```
+
+```tsx
+// app/page.tsx
+import { loadQelos } from '../lib/qelos';
+
+export default async function Page() {
+  const { user, workspace } = await loadQelos();
+  return <p>Hello {user?.fullName ?? 'guest'} — {workspace?.name}</p>;
+}
+```
+
+### 3. Route handlers (`app/api/**/route.ts`)
+
+```ts
+// app/api/me/route.ts
+import { NextResponse } from 'next/server';
+import { withQelosRoute } from '@qelos/integrator-next/route';
+
+export const GET = withQelosRoute((_req, _ctx, qelos) => {
+  if (!qelos.user) return NextResponse.json({ user: null });
+  return NextResponse.json({ user: qelos.user, workspace: qelos.workspace });
+});
+```
+
+Anywhere downstream — including modules outside the React tree — can read the
+active context from AsyncLocalStorage via `getStoredQelosContext()`, provided
+execution went through `withQelosRoute`, `withQelosContext`, or one of the
+Pages Router wrappers.
+
+```ts
+// services/products.ts
+import { getStoredQelosContext } from '@qelos/integrator-next/context';
+
+export async function listProducts() {
+  const qelos = getStoredQelosContext();
+  if (!qelos?.sdk) throw new Error('no qelos context');
+  return qelos.sdk.entities('products').getList();
+}
+```
+
+## Pages Router
+
+### API routes
+
+```ts
+// pages/api/me.ts
+import { withQelosApi } from '@qelos/integrator-next/pages';
+
+export default withQelosApi(
+  (req, res) => {
+    res.json({ user: req.qelos!.user, workspace: req.qelos!.workspace });
+  },
+  { config: { appUrl: process.env.QELOS_APP_URL! } },
+);
+```
+
+### `getServerSideProps`
+
+```ts
+// pages/dashboard.tsx
+import { withQelosSSR } from '@qelos/integrator-next/pages';
+
+export const getServerSideProps = withQelosSSR(
+  async (_ctx, qelos) => ({ props: { user: qelos.user, workspace: qelos.workspace } }),
+  { config: { appUrl: process.env.QELOS_APP_URL!, requireAuth: true } },
+);
+```
+
+## Token refresh
+
+When a request arrives with an expired access token, the SDK's failed-auth
+path triggers a refresh, in order:
+
+1. If a refresh token is present, calls
+   `sdk.authentication.refreshToken()` (`POST /api/token/refresh`) — issues a
+   new access + refresh pair.
+2. Otherwise, calls `sdk.authentication.refreshCookieToken()`
+   (`POST /api/cookie/refresh`) — used for cookie-only sessions that do not
+   carry a separate refresh token (e.g. social-auth flows).
+
+The new pair is then written back to cookies using the configured
+`accessTokenCookie` / `refreshTokenCookie` names — automatically in App
+Router middleware (`response.cookies.set`), Pages Router API routes
+(`Set-Cookie` header), and `getServerSideProps` responses.
+
+App Router server components and route handlers cannot mutate cookies after
+rendering starts, so the default refresh hook there is a no-op — the new
+tokens are still applied to the in-memory pair so subsequent SDK calls in the
+same request use the fresh access token. To persist the refreshed pair, hand
+the request off to a route handler that calls `cookies().set(...)`.
+
+Override the behaviour by passing `onTokenRefresh` to any of the wrappers.
+The hook receives:
+
+```ts
+interface TokenRefreshContext<T> {
+  target: T;          // NextResponse | NextApiResponse | ServerResponse | null
+  oldTokens: { accessToken?: string; refreshToken?: string };
+  newTokens: { accessToken: string; refreshToken?: string };
+  sdk: QelosSDK;
+}
+```
+
+### Manual cookie refresh
+
+Long-lived integrator-hosted sessions can also call the SDK directly to
+proactively refresh the cookie token. From a route handler that owns the
+response (so it can mutate cookies):
+
+```ts
+// app/api/session/refresh/route.ts
+import { NextResponse } from 'next/server';
+import { withQelosRoute } from '@qelos/integrator-next/route';
+
+export const POST = withQelosRoute(async (_req, _ctx, qelos) => {
+  const result = await qelos.sdk.authentication.refreshCookieToken();
+  // result.headers['set-cookie'] — fresh cookie value to forward
+  return NextResponse.json({ user: result.payload.user });
+});
+```
+
+## Configuration
+
+```ts
+interface QelosNextConfig {
+  appUrl: string;                 // Qelos backend base URL
+  apiToken?: string;              // service-to-service token (skips refresh logic)
+  accessTokenCookie?: string;     // default 'q_access_token'
+  refreshTokenCookie?: string;    // default 'q_refresh_token'
+  requireAuth?: boolean;          // 401/redirect on anonymous (default false)
+  skipPaths?: string[];           // path prefixes to bypass entirely
+  sdkOptions?: Partial<QelosSDKOptions>;
+}
+```
+
+## Subpath exports
+
+| Import | Purpose |
+|---|---|
+| `@qelos/integrator-next` | Everything (re-exports of all subpaths) |
+| `@qelos/integrator-next/middleware` | Edge middleware (`qelosMiddleware`, `createQelosMiddleware`) |
+| `@qelos/integrator-next/context` | Server-component / route-handler context (`getQelosContext`, `getStoredQelosContext`) |
+| `@qelos/integrator-next/route` | App Router route wrapper (`withQelosRoute`) |
+| `@qelos/integrator-next/pages` | Pages Router wrappers (`withQelosApi`, `withQelosSSR`) |
+| `@qelos/integrator-next/types` | Shared types |

package/dist/context.d.ts

@@ -0,0 +1,55 @@
+import type { IUser } from '@qelos/sdk/dist/authentication';
+import type { IWorkspace } from '@qelos/sdk/workspaces';
+import type { QelosNextConfig, QelosRequestContext, TokenRefreshHook } from './types';
+/**
+ * Run `fn` with `ctx` as the active Qelos request context. Code anywhere in
+ * the resulting async stack can call `getStoredQelosContext()` to retrieve it
+ * without prop-drilling.
+ */
+export declare function runWithQelosContext<T>(ctx: QelosRequestContext, fn: () => T | Promise<T>): T | Promise<T>;
+/**
+ * Return the Qelos request context stored on the current async stack, or
+ * `null` when no context has been entered.
+ */
+export declare function getStoredQelosContext(): QelosRequestContext | null;
+export interface GetQelosContextOptions {
+    config: QelosNextConfig;
+    /**
+     * Hook invoked after a successful token refresh. App Router server
+     * components and route handlers cannot mutate cookies after rendering
+     * starts, so the default is a no-op. Callers handling refresh through a
+     * route handler can override this to call `cookies().set(...)`.
+     */
+    onTokenRefresh?: TokenRefreshHook<null>;
+    /**
+     * Resolve the active workspace for a request. Defaults to picking the first
+     * workspace returned from `sdk.workspaces.getList()`.
+     */
+    resolveWorkspace?: (params: {
+        user: IUser;
+        workspaces: IWorkspace[];
+    }) => IWorkspace | null | Promise<IWorkspace | null>;
+}
+/**
+ * Identify the user / workspace for the current App Router request and
+ * return the Qelos context. Safe to call multiple times within the same
+ * request — each call performs its own SDK round-trip, so wrap it with
+ * React's `cache()` if you want a single resolution per render.
+ *
+ * Calling without arguments uses the env-derived config (see
+ * {@link loadQelosConfigFromEnv}); pass `{ config }` explicitly when you
+ * need full control or want to override resolution behavior.
+ */
+export declare function getQelosContext(options?: GetQelosContextOptions): Promise<QelosRequestContext>;
+/**
+ * Convenience wrapper: resolve the Qelos context, store it in
+ * AsyncLocalStorage, and run `fn` inside that scope. Useful as the top of an
+ * App Router route handler when you want downstream code (utility modules,
+ * etc.) to read the context via `getStoredQelosContext()`.
+ */
+export declare function withQelosContext<T>(options: GetQelosContextOptions, fn: (ctx: QelosRequestContext) => T | Promise<T>): Promise<T>;
+/**
+ * Throw a 401-like error if the current stored context has no user.
+ * Returns the context for chaining.
+ */
+export declare function requireQelosUser(): QelosRequestContext;

package/dist/context.js

@@ -0,0 +1,131 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { getDefaultQelosConfig } from './env-config';
+import { createRequestSdk } from './sdk-factory';
+const DEFAULT_ACCESS_COOKIE = 'q_access_token';
+const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
+const storage = new AsyncLocalStorage();
+/**
+ * Run `fn` with `ctx` as the active Qelos request context. Code anywhere in
+ * the resulting async stack can call `getStoredQelosContext()` to retrieve it
+ * without prop-drilling.
+ */
+export function runWithQelosContext(ctx, fn) {
+    return storage.run(ctx, fn);
+}
+/**
+ * Return the Qelos request context stored on the current async stack, or
+ * `null` when no context has been entered.
+ */
+export function getStoredQelosContext() {
+    return storage.getStore() || null;
+}
+let nextHeadersModulePromise = null;
+function loadNextHeaders() {
+    if (!nextHeadersModulePromise) {
+        nextHeadersModulePromise = (async () => {
+            const mod = (await import('next/headers'));
+            return mod;
+        })();
+    }
+    return nextHeadersModulePromise;
+}
+async function readTokensFromHeaders(config) {
+    const { cookies, headers } = await loadNextHeaders();
+    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
+    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
+    const jar = await cookies();
+    const hdr = await headers();
+    const cookieAccess = jar.get(accessCookie)?.value;
+    const cookieRefresh = jar.get(refreshCookie)?.value;
+    const authHeader = hdr.get('authorization');
+    const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
+        ? authHeader.slice(7).trim()
+        : undefined;
+    return {
+        accessToken: headerAccess || cookieAccess || undefined,
+        refreshToken: cookieRefresh || undefined,
+    };
+}
+/**
+ * Identify the user / workspace for the current App Router request and
+ * return the Qelos context. Safe to call multiple times within the same
+ * request — each call performs its own SDK round-trip, so wrap it with
+ * React's `cache()` if you want a single resolution per render.
+ *
+ * Calling without arguments uses the env-derived config (see
+ * {@link loadQelosConfigFromEnv}); pass `{ config }` explicitly when you
+ * need full control or want to override resolution behavior.
+ */
+export async function getQelosContext(options) {
+    const resolved = options ?? { config: getDefaultQelosConfig() };
+    const { config, resolveWorkspace } = resolved;
+    const tokens = await readTokensFromHeaders(config);
+    const sdk = createRequestSdk({
+        config,
+        tokens,
+        refreshTarget: null,
+        onTokenRefresh: resolved.onTokenRefresh,
+    });
+    const ctx = {
+        user: null,
+        workspace: null,
+        workspaces: [],
+        sdk,
+        tokens,
+    };
+    const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
+    if (!hasAuthMaterial) {
+        return ctx;
+    }
+    try {
+        ctx.user = await sdk.authentication.getLoggedInUser();
+    }
+    catch {
+        return ctx;
+    }
+    if (!ctx.user)
+        return ctx;
+    try {
+        ctx.workspaces = await sdk.workspaces.getList();
+    }
+    catch {
+        ctx.workspaces = [];
+    }
+    if (ctx.workspaces.length) {
+        if (resolveWorkspace) {
+            ctx.workspace =
+                (await resolveWorkspace({
+                    user: ctx.user,
+                    workspaces: ctx.workspaces,
+                })) || null;
+        }
+        else {
+            ctx.workspace = ctx.workspaces[0] || null;
+        }
+    }
+    return ctx;
+}
+/**
+ * Convenience wrapper: resolve the Qelos context, store it in
+ * AsyncLocalStorage, and run `fn` inside that scope. Useful as the top of an
+ * App Router route handler when you want downstream code (utility modules,
+ * etc.) to read the context via `getStoredQelosContext()`.
+ */
+export async function withQelosContext(options, fn) {
+    const ctx = await getQelosContext(options);
+    return await storage.run(ctx, () => Promise.resolve(fn(ctx)));
+}
+/**
+ * Throw a 401-like error if the current stored context has no user.
+ * Returns the context for chaining.
+ */
+export function requireQelosUser() {
+    const ctx = getStoredQelosContext();
+    if (!ctx || !ctx.user) {
+        const err = new Error('UNAUTHORIZED');
+        err.status = 401;
+        throw err;
+    }
+    return ctx;
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQjD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAuB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAwB,EACxB,EAAwB;IAExB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAsCD,IAAI,wBAAwB,GAAsC,IAAI,CAAC;AACvE,SAAS,eAAe;IACtB,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,wBAAwB,GAAG,CAAC,KAAK,IAAI,EAAE;YACrC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAiC,CAAC;YAC3E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;IACpD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,YAAY,GAChB,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1D,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,WAAW,EAAE,YAAY,IAAI,YAAY,IAAI,SAAS;QACtD,YAAY,EAAE,aAAa,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgC;IAEhC,MAAM,QAAQ,GAA2B,OAAO,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC;IACxF,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,gBAAgB,CAAO;QACjC,MAAM;QACN,MAAM;QACN,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAwB;QAC/B,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,EAAE;QACd,GAAG;QACH,MAAM;KACP,CAAC;IAEF,MAAM,eAAe,GAAG,OAAO,CAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAC7D,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IAE1B,IAAI,CAAC;QACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS;gBACX,CAAC,MAAM,gBAAgB,CAAC;oBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA+B,EAC/B,EAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAAgC,CAAC;QACrE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/env-config.d.ts

@@ -0,0 +1,28 @@
+import type { QelosNextConfig } from './types';
+/**
+ * Build a {@link QelosNextConfig} from `process.env`. Used by the
+ * convention-over-configuration entry points (`qelosMiddleware`, the
+ * no-arg `getQelosContext()`) so consumers can re-export the integrator
+ * without writing a factory call.
+ *
+ * Recognized variables:
+ *
+ * - `QELOS_APP_URL` (required) — Qelos backend base URL.
+ * - `QELOS_API_TOKEN` — service-to-service token (skips refresh logic).
+ * - `QELOS_ACCESS_TOKEN_COOKIE` — defaults to `q_access_token`.
+ * - `QELOS_REFRESH_TOKEN_COOKIE` — defaults to `q_refresh_token`.
+ * - `QELOS_REQUIRE_AUTH` — `"true"` to reject anonymous requests.
+ * - `QELOS_SKIP_PATHS` — comma-separated path prefixes to bypass.
+ */
+export declare function loadQelosConfigFromEnv(env?: NodeJS.ProcessEnv): QelosNextConfig;
+/**
+ * Return the env-derived config, memoized after the first call. The cache is
+ * scoped to the current Node process — Next.js dev-mode reloads create a new
+ * module instance, so changes to env vars are picked up on restart.
+ */
+export declare function getDefaultQelosConfig(): QelosNextConfig;
+/**
+ * Reset the memoized env-derived config. Exported for tests; not part of the
+ * stable surface.
+ */
+export declare function __resetDefaultQelosConfig(): void;

package/dist/env-config.js

@@ -0,0 +1,59 @@
+/**
+ * Build a {@link QelosNextConfig} from `process.env`. Used by the
+ * convention-over-configuration entry points (`qelosMiddleware`, the
+ * no-arg `getQelosContext()`) so consumers can re-export the integrator
+ * without writing a factory call.
+ *
+ * Recognized variables:
+ *
+ * - `QELOS_APP_URL` (required) — Qelos backend base URL.
+ * - `QELOS_API_TOKEN` — service-to-service token (skips refresh logic).
+ * - `QELOS_ACCESS_TOKEN_COOKIE` — defaults to `q_access_token`.
+ * - `QELOS_REFRESH_TOKEN_COOKIE` — defaults to `q_refresh_token`.
+ * - `QELOS_REQUIRE_AUTH` — `"true"` to reject anonymous requests.
+ * - `QELOS_SKIP_PATHS` — comma-separated path prefixes to bypass.
+ */
+export function loadQelosConfigFromEnv(env = process.env) {
+    const appUrl = env.QELOS_APP_URL;
+    if (!appUrl) {
+        throw new Error('@qelos/integrator-next: QELOS_APP_URL is required when using the default ' +
+            'qelosMiddleware / getQelosContext() exports. Set it in your environment ' +
+            'or call createQelosMiddleware({ config: ... }) explicitly.');
+    }
+    const config = { appUrl };
+    if (env.QELOS_API_TOKEN)
+        config.apiToken = env.QELOS_API_TOKEN;
+    if (env.QELOS_ACCESS_TOKEN_COOKIE)
+        config.accessTokenCookie = env.QELOS_ACCESS_TOKEN_COOKIE;
+    if (env.QELOS_REFRESH_TOKEN_COOKIE)
+        config.refreshTokenCookie = env.QELOS_REFRESH_TOKEN_COOKIE;
+    if (env.QELOS_REQUIRE_AUTH === 'true' || env.QELOS_REQUIRE_AUTH === '1') {
+        config.requireAuth = true;
+    }
+    if (env.QELOS_SKIP_PATHS) {
+        config.skipPaths = env.QELOS_SKIP_PATHS.split(',')
+            .map((p) => p.trim())
+            .filter(Boolean);
+    }
+    return config;
+}
+let cachedConfig = null;
+/**
+ * Return the env-derived config, memoized after the first call. The cache is
+ * scoped to the current Node process — Next.js dev-mode reloads create a new
+ * module instance, so changes to env vars are picked up on restart.
+ */
+export function getDefaultQelosConfig() {
+    if (!cachedConfig) {
+        cachedConfig = loadQelosConfigFromEnv();
+    }
+    return cachedConfig;
+}
+/**
+ * Reset the memoized env-derived config. Exported for tests; not part of the
+ * stable surface.
+ */
+export function __resetDefaultQelosConfig() {
+    cachedConfig = null;
+}
+//# sourceMappingURL=env-config.js.map

package/dist/env-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../src/env-config.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,0EAA0E;YAC1E,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,eAAe;QAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/D,IAAI,GAAG,CAAC,yBAAyB;QAAE,MAAM,CAAC,iBAAiB,GAAG,GAAG,CAAC,yBAAyB,CAAC;IAC5F,IAAI,GAAG,CAAC,0BAA0B;QAAE,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC/F,IAAI,GAAG,CAAC,kBAAkB,KAAK,MAAM,IAAI,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QACxE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,YAAY,GAA2B,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC"}

package/dist/forward-headers.d.ts

@@ -0,0 +1,7 @@
+import type { IUser } from '@qelos/sdk/dist/authentication';
+import type { IWorkspace } from '@qelos/sdk/workspaces';
+/**
+ * Replace forwarded identity headers on the outbound request: strip any
+ * client-supplied values first, then attach ids resolved by the integrator.
+ */
+export declare function applyQelosForwardHeaders(forwardedHeaders: Headers, user: IUser | null, workspace: IWorkspace | null): void;

package/dist/forward-headers.js

@@ -0,0 +1,16 @@
+import { QELOS_USER_HEADER, QELOS_WORKSPACE_HEADER } from './types';
+/**
+ * Replace forwarded identity headers on the outbound request: strip any
+ * client-supplied values first, then attach ids resolved by the integrator.
+ */
+export function applyQelosForwardHeaders(forwardedHeaders, user, workspace) {
+    forwardedHeaders.delete(QELOS_USER_HEADER);
+    forwardedHeaders.delete(QELOS_WORKSPACE_HEADER);
+    if (user) {
+        forwardedHeaders.set(QELOS_USER_HEADER, String(user._id ?? ''));
+    }
+    if (workspace) {
+        forwardedHeaders.set(QELOS_WORKSPACE_HEADER, String(workspace._id ?? ''));
+    }
+}
+//# sourceMappingURL=forward-headers.js.map

package/dist/forward-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-headers.js","sourceRoot":"","sources":["../src/forward-headers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,gBAAyB,EACzB,IAAkB,EAClB,SAA4B;IAE5B,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3C,gBAAgB,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAChD,IAAI,IAAI,EAAE,CAAC;QACT,gBAAgB,CAAC,GAAG,CAClB,iBAAiB,EACjB,MAAM,CAAE,IAA0B,CAAC,GAAG,IAAI,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,gBAAgB,CAAC,GAAG,CAClB,sBAAsB,EACtB,MAAM,CAAE,SAA+B,CAAC,GAAG,IAAI,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { createQelosMiddleware, qelosMiddleware, type CreateMiddlewareOptions, type MiddlewareRefreshTarget, type PendingCookie, type QelosMiddleware, } from './middleware';
+export { loadQelosConfigFromEnv, getDefaultQelosConfig, } from './env-config';
+export { createRequestSdk, type CreateSdkParams, } from './sdk-factory';
+export { getQelosContext, withQelosContext, runWithQelosContext, getStoredQelosContext, requireQelosUser, type GetQelosContextOptions, } from './context';
+export { withQelosApi, withQelosSSR, requireQelosApiUser, type PagesIntegratorOptions, } from './pages';
+export { withQelosRoute, type AppRouteHandler, type QelosAppRouteHandler, } from './route';
+export { QELOS_USER_HEADER, QELOS_WORKSPACE_HEADER, type QelosNextConfig, type QelosRequestContext, type QelosTokenPair, type ResolvedTokens, type TokenRefreshContext, type TokenRefreshHook, } from './types';
+export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from './social-auth';

package/dist/index.js

@@ -0,0 +1,9 @@
+export { createQelosMiddleware, qelosMiddleware, } from './middleware';
+export { loadQelosConfigFromEnv, getDefaultQelosConfig, } from './env-config';
+export { createRequestSdk, } from './sdk-factory';
+export { getQelosContext, withQelosContext, runWithQelosContext, getStoredQelosContext, requireQelosUser, } from './context';
+export { withQelosApi, withQelosSSR, requireQelosApiUser, } from './pages';
+export { withQelosRoute, } from './route';
+export { QELOS_USER_HEADER, QELOS_WORKSPACE_HEADER, } from './types';
+export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, } from './social-auth';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAKhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,GAEjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,GAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAOvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,2BAA2B,EAC3B,+BAA+B,GAGhC,MAAM,eAAe,CAAC"}