@qelos/integrator-next 4.0.0 → 4.1.0

package/README.md

@@ -1,14 +1,18 @@
 # @qelos/integrator-next
 
-Qelos integrator middleware for **Next.js** — supports both the **App Router**
-and the **Pages Router**, on Next.js **14** and **15**. Drop it into your
-Next.js app to identify the user and active workspace via the Qelos SDK
-*before* your own handlers run, and to keep refresh-token cookies fresh on
-every request.
+Next.js integrator for [Qelos](https://qelos.io). It turns your Next.js host into
+a same-origin BFF for a managed Qelos app: Edge middleware resolves the current
+user via `GET /api/me` with inbound cookies forwarded verbatim, a Node catch-all
+route proxies `/api/**` to Qelos with `Set-Cookie` domain rewriting, and the
+SDK reads live `Cookie` / `Authorization` headers on every call — no
+integrator-managed access or refresh tokens.
 
-The package is a sibling of `@qelos/integrator-express` and
-`@qelos/integrator-nuxt` — they all expose the same `QelosRequestContext`
-shape (`{ user, workspace, workspaces, sdk, tokens }`).
+Supports the **App Router** and the **Pages Router** on Next.js **14** and
+**15**.
+
+> Requires **Node 18+** — the middleware and proxy use
+> [`Response.headers.getSetCookie()`](https://developer.mozilla.org/docs/Web/API/Headers/getSetCookie)
+> to forward individual upstream `Set-Cookie` headers.
 
 ## Install
 
@@ -16,13 +20,11 @@ shape (`{ user, workspace, workspaces, sdk, tokens }`).
 pnpm add @qelos/integrator-next @qelos/sdk
 ```
 
-`next` (>=13.4) and `react` are peer dependencies. Tested with Next.js 14.2
-and 15.x on both the App Router and the Pages Router.
+`next` (>=13.4) and `react` are peer dependencies.
 
 ## Quick start
 
-Set `QELOS_APP_URL` (and any optional vars below) in your environment, then
-re-export the pre-built middleware and use the no-arg context loader:
+Set `QELOS_APP_URL`, then wire Edge middleware and a catch-all API proxy route.
 
 ```ts
 // middleware.ts
@@ -33,6 +35,16 @@ export const config = {
 };
 ```
 
+```ts
+// app/api/[...qelos]/route.ts
+import { createQelosApiProxyHandlers } from '@qelos/integrator-next/runtime/api-proxy';
+
+const { runtime, GET, POST, PUT, PATCH, DELETE, OPTIONS } =
+  createQelosApiProxyHandlers({ appUrl: process.env.QELOS_APP_URL! });
+
+export { runtime, GET, POST, PUT, PATCH, DELETE, OPTIONS };
+```
+
 ```tsx
 // app/dashboard/page.tsx
 import { getQelosContext } from '@qelos/integrator-next/context';
@@ -41,86 +53,86 @@ export default async function Dashboard() {
   const { user, sdk } = await getQelosContext();
   if (!user) return <p>Please sign in.</p>;
   const products = await sdk.entities('products').getList();
-  return <div>Welcome {user.fullName}, you have {products.length} products</div>;
+  return (
+    <div>
+      Welcome {user.fullName}, you have {products.length} products
+    </div>
+  );
 }
 ```
 
 ### Environment variables
 
 | Variable | Default | Description |
-|---|---|---|
-| `QELOS_APP_URL` | — (required) | Qelos backend base URL |
-| `QELOS_API_TOKEN` | — | Service-to-service token (skips refresh logic) |
-| `QELOS_ACCESS_TOKEN_COOKIE` | `q_access_token` | Cookie name for the access token |
-| `QELOS_REFRESH_TOKEN_COOKIE` | `q_refresh_token` | Cookie name for the refresh token |
-| `QELOS_REQUIRE_AUTH` | `false` | Set `true` to reject anonymous requests with 401 |
-| `QELOS_SKIP_PATHS` | — | Comma-separated path prefixes to bypass entirely |
+|----------|---------|-------------|
+| `QELOS_APP_URL` | — (required for default exports) | Qelos managed-app base URL |
+| `QELOS_API_TOKEN` | — | Service-to-service token (skips cookie identity for anonymous resolution) |
+| `QELOS_REQUIRE_AUTH` | `false` | `true` / `1` → anonymous requests get `401` from middleware |
+| `QELOS_SKIP_PATHS` | — | Comma-separated path prefixes to bypass middleware |
+| `QELOS_DISABLE_PROXY` | `false` | `true` when you are **not** using the catch-all `/api/**` proxy — skips auto `/api/` in middleware `skipPaths` |
 
-## Explicit configuration (App Router)
+Dev-time proxy target overrides (same resolution order as the proxy):
 
-When you need control over `resolveWorkspace`, `onTokenRefresh`, or any other
-option, call the factory yourself.
+1. `NEXT_QELOS_PROXY_TARGET`
+2. `QELOS_IP`
+3. `QELOS_API_IP`
+4. `appUrl` from config / `QELOS_APP_URL`
 
-### 1. Edge middleware
+## BFF proxy (`/api/**`)
 
-```ts
-// middleware.ts
-import { createQelosMiddleware } from '@qelos/integrator-next/middleware';
+Register a catch-all App Router handler (see above) that exports the handlers
+from `createQelosApiProxyHandlers`. Every request your app does not handle
+itself is forwarded to the configured Qelos origin; the response body streams
+back and upstream `Set-Cookie` headers are rewritten so `Domain=` matches the
+inbound `Host` (port stripped).
 
-export default createQelosMiddleware({
-  config: {
-    appUrl: process.env.QELOS_APP_URL!,
-    skipPaths: ['/_next', '/favicon.ico'],
-    requireAuth: false,
-  },
-  resolveWorkspace: ({ req, workspaces }) => {
-    const slug = req.nextUrl.searchParams.get('workspace');
-    return workspaces.find((w) => (w as any).slug === slug) ?? workspaces[0] ?? null;
-  },
-});
+User-defined routes under `app/api/...` still take precedence over the catch-all
+segment — the proxy only runs for paths nothing else matched.
 
-export const config = {
-  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
-};
-```
+### Opting out (`disableProxy`)
 
-The middleware:
+Set `disableProxy: true` on `QelosNextConfig` when you do not use the catch-all
+proxy. Middleware will then **not** auto-prepend `/api/` to `skipPaths`, so you
+can run your own `/api/*` handlers without the integrator skipping them for the
+proxy.
 
-- Reads tokens from cookies (`q_access_token`, `q_refresh_token`) or the
-  `Authorization` header.
-- Calls the Qelos SDK to resolve the user and the active workspace.
-- Forwards the resolved ids to downstream handlers via the
-  `x-qelos-user-id` and `x-qelos-workspace-id` request headers.
-- Refreshes the access/refresh token pair when needed and writes the new
-  cookies onto the outbound response.
-- Returns `401` early when `config.requireAuth: true` and the user cannot be
-  resolved.
+WebSocket upgrades are not proxied.
 
-### 2. Server components (RSC)
+## Edge middleware
 
-`getQelosContext()` is safe to call inside React Server Components on both
-Next.js 14 (sync `cookies()` / `headers()`) and Next.js 15 (async). Wrap it
-with React's `cache()` so re-renders within the same request reuse the result:
+On each matched request, middleware:
 
-```tsx
-// lib/qelos.ts
-import { cache } from 'react';
-import { getQelosContext } from '@qelos/integrator-next/context';
+1. Resolves the upstream origin (`NEXT_QELOS_PROXY_TARGET` → `QELOS_IP` →
+   `QELOS_API_IP` → `appUrl`). If neither that nor `apiToken` is configured and
+   `requireAuth` is false, identity headers are cleared and the request
+   continues anonymously.
+2. When an upstream origin exists, issues `fetch('${origin}/api/me', { redirect:
+   'manual' })` with the inbound `Cookie` and `Authorization` headers forwarded.
+3. Appends every upstream `Set-Cookie` to the outgoing response after rewriting
+   `Domain=` to the inbound `Host`.
+4. On `200` JSON, uses that body as `IUser`, loads workspaces via the SDK, and
+   sets the active workspace from `user.workspace` (or your `resolveWorkspace`
+   callback) — **not** `workspaces[0]`.
+5. Forwards `x-qelos-user-id` and `x-qelos-workspace-id` on the rewritten request
+   headers for downstream App Router code.
 
-export const loadQelos = cache(() => getQelosContext());
-```
+When the proxy is enabled (`disableProxy !== true`), `/api/` is prepended to
+`skipPaths` so middleware does not run the `/api/me` probe on proxied API
+traffic (avoids double upstream calls).
 
-```tsx
-// app/page.tsx
-import { loadQelos } from '../lib/qelos';
+> Edge middleware runs in the Edge runtime. The `/api/me` round-trip uses the
+> standard `fetch` API with `redirect: 'manual'`. In local dev over plain HTTP,
+> browsers may drop upstream `Secure` cookies — use HTTPS locally or configure
+> Qelos for non-`Secure` cookies in development.
 
-export default async function Page() {
-  const { user, workspace } = await loadQelos();
-  return <p>Hello {user?.fullName ?? 'guest'} — {workspace?.name}</p>;
-}
-```
+## App Router server code
+
+Wrap `getQelosContext()` with React `cache()` if you want one resolution per
+request. It performs the same `/api/me` identification as middleware (with live
+headers) and attempts to apply upstream `Set-Cookie` values through
+`next/headers` `cookies().set` when the runtime allows it.
 
-### 3. Route handlers (`app/api/**/route.ts`)
+### Route handlers
 
 ```ts
 // app/api/me/route.ts
@@ -133,26 +145,8 @@ export const GET = withQelosRoute((_req, _ctx, qelos) => {
 });
 ```
 
-Anywhere downstream — including modules outside the React tree — can read the
-active context from AsyncLocalStorage via `getStoredQelosContext()`, provided
-execution went through `withQelosRoute`, `withQelosContext`, or one of the
-Pages Router wrappers.
-
-```ts
-// services/products.ts
-import { getStoredQelosContext } from '@qelos/integrator-next/context';
-
-export async function listProducts() {
-  const qelos = getStoredQelosContext();
-  if (!qelos?.sdk) throw new Error('no qelos context');
-  return qelos.sdk.entities('products').getList();
-}
-```
-
 ## Pages Router
 
-### API routes
-
 ```ts
 // pages/api/me.ts
 import { withQelosApi } from '@qelos/integrator-next/pages';
@@ -165,92 +159,43 @@ export default withQelosApi(
 );
 ```
 
-### `getServerSideProps`
-
 ```ts
 // pages/dashboard.tsx
 import { withQelosSSR } from '@qelos/integrator-next/pages';
 
 export const getServerSideProps = withQelosSSR(
-  async (_ctx, qelos) => ({ props: { user: qelos.user, workspace: qelos.workspace } }),
+  async (_ctx, qelos) => ({
+    props: { user: qelos.user, workspace: qelos.workspace },
+  }),
   { config: { appUrl: process.env.QELOS_APP_URL!, requireAuth: true } },
 );
 ```
 
-## Token refresh
-
-When a request arrives with an expired access token, the SDK's failed-auth
-path triggers a refresh, in order:
-
-1. If a refresh token is present, calls
-   `sdk.authentication.refreshToken()` (`POST /api/token/refresh`) — issues a
-   new access + refresh pair.
-2. Otherwise, calls `sdk.authentication.refreshCookieToken()`
-   (`POST /api/cookie/refresh`) — used for cookie-only sessions that do not
-   carry a separate refresh token (e.g. social-auth flows).
-
-The new pair is then written back to cookies using the configured
-`accessTokenCookie` / `refreshTokenCookie` names — automatically in App
-Router middleware (`response.cookies.set`), Pages Router API routes
-(`Set-Cookie` header), and `getServerSideProps` responses.
-
-App Router server components and route handlers cannot mutate cookies after
-rendering starts, so the default refresh hook there is a no-op — the new
-tokens are still applied to the in-memory pair so subsequent SDK calls in the
-same request use the fresh access token. To persist the refreshed pair, hand
-the request off to a route handler that calls `cookies().set(...)`.
-
-Override the behaviour by passing `onTokenRefresh` to any of the wrappers.
-The hook receives:
-
-```ts
-interface TokenRefreshContext<T> {
-  target: T;          // NextResponse | NextApiResponse | ServerResponse | null
-  oldTokens: { accessToken?: string; refreshToken?: string };
-  newTokens: { accessToken: string; refreshToken?: string };
-  sdk: QelosSDK;
-}
-```
-
-### Manual cookie refresh
-
-Long-lived integrator-hosted sessions can also call the SDK directly to
-proactively refresh the cookie token. From a route handler that owns the
-response (so it can mutate cookies):
+## Configuration (`QelosNextConfig`)
 
-```ts
-// app/api/session/refresh/route.ts
-import { NextResponse } from 'next/server';
-import { withQelosRoute } from '@qelos/integrator-next/route';
-
-export const POST = withQelosRoute(async (_req, _ctx, qelos) => {
-  const result = await qelos.sdk.authentication.refreshCookieToken();
-  // result.headers['set-cookie'] — fresh cookie value to forward
-  return NextResponse.json({ user: result.payload.user });
-});
-```
-
-## Configuration
-
-```ts
-interface QelosNextConfig {
-  appUrl: string;                 // Qelos backend base URL
-  apiToken?: string;              // service-to-service token (skips refresh logic)
-  accessTokenCookie?: string;     // default 'q_access_token'
-  refreshTokenCookie?: string;    // default 'q_refresh_token'
-  requireAuth?: boolean;          // 401/redirect on anonymous (default false)
-  skipPaths?: string[];           // path prefixes to bypass entirely
-  sdkOptions?: Partial<QelosSDKOptions>;
-}
-```
+| Field | Description |
+|-------|-------------|
+| `appUrl` | Qelos managed-app base URL |
+| `apiToken` | Static token — no `/api/me` cookie identity |
+| `requireAuth` | Reject anonymous requests (`401` / redirect) |
+| `skipPaths` | Path prefixes to bypass middleware (and `/api/` is auto-prepended when the proxy is enabled) |
+| `disableProxy` | Opt out of auto `/api/` skip for middleware |
+| `sdkOptions` | Extra `QelosSDK` constructor options |
 
 ## Subpath exports
 
 | Import | Purpose |
-|---|---|
-| `@qelos/integrator-next` | Everything (re-exports of all subpaths) |
-| `@qelos/integrator-next/middleware` | Edge middleware (`qelosMiddleware`, `createQelosMiddleware`) |
-| `@qelos/integrator-next/context` | Server-component / route-handler context (`getQelosContext`, `getStoredQelosContext`) |
-| `@qelos/integrator-next/route` | App Router route wrapper (`withQelosRoute`) |
-| `@qelos/integrator-next/pages` | Pages Router wrappers (`withQelosApi`, `withQelosSSR`) |
-| `@qelos/integrator-next/types` | Shared types |
+|--------|---------|
+| `@qelos/integrator-next` | Barrel |
+| `@qelos/integrator-next/middleware` | Edge middleware |
+| `@qelos/integrator-next/context` | `getQelosContext`, AsyncLocalStorage helpers |
+| `@qelos/integrator-next/route` | `withQelosRoute` |
+| `@qelos/integrator-next/pages` | Pages Router wrappers |
+| `@qelos/integrator-next/runtime/api-proxy` | Catch-all proxy handlers (`runtime = 'nodejs'`) |
+| `@qelos/integrator-next/types` | Types and header name constants |
+
+## Social auth
+
+`completeSocialAuthCallback` and the re-exported SDK helpers forward Qelos
+session cookies from `socialCallback` onto your Node response — use them from
+a route handler that owns the response object.

package/dist/context.d.ts

@@ -1,6 +1,6 @@
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
-import type { QelosNextConfig, QelosRequestContext, TokenRefreshHook } from './types';
+import type { QelosNextConfig, QelosRequestContext } from './types';
 /**
  * Run `fn` with `ctx` as the active Qelos request context. Code anywhere in
  * the resulting async stack can call `getStoredQelosContext()` to retrieve it
@@ -15,15 +15,9 @@ export declare function getStoredQelosContext(): QelosRequestContext | null;
 export interface GetQelosContextOptions {
     config: QelosNextConfig;
     /**
-     * Hook invoked after a successful token refresh. App Router server
-     * components and route handlers cannot mutate cookies after rendering
-     * starts, so the default is a no-op. Callers handling refresh through a
-     * route handler can override this to call `cookies().set(...)`.
-     */
-    onTokenRefresh?: TokenRefreshHook<null>;
-    /**
-     * Resolve the active workspace for a request. Defaults to picking the first
-     * workspace returned from `sdk.workspaces.getList()`.
+     * Resolve the active workspace for a request. Defaults to whatever
+     * `/api/me` reports on `user.workspace` (the user's currently activated
+     * workspace, or `null` when none is active).
      */
     resolveWorkspace?: (params: {
         user: IUser;
@@ -33,7 +27,7 @@ export interface GetQelosContextOptions {
 /**
  * Identify the user / workspace for the current App Router request and
  * return the Qelos context. Safe to call multiple times within the same
- * request — each call performs its own SDK round-trip, so wrap it with
+ * request — each call performs its own `/api/me` round-trip, so wrap it with
  * React's `cache()` if you want a single resolution per render.
  *
  * Calling without arguments uses the env-derived config (see

package/dist/context.js

@@ -1,8 +1,9 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { rewriteSetCookieDomain } from './cookies';
 import { getDefaultQelosConfig } from './env-config';
+import { fetchMeIdentity } from './me-client';
+import { resolveQelosProxyTarget } from './proxy-target';
 import { createRequestSdk } from './sdk-factory';
-const DEFAULT_ACCESS_COOKIE = 'q_access_token';
-const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
 const storage = new AsyncLocalStorage();
 /**
  * Run `fn` with `ctx` as the active Qelos request context. Code anywhere in
@@ -29,27 +30,46 @@ function loadNextHeaders() {
     }
     return nextHeadersModulePromise;
 }
-async function readTokensFromHeaders(config) {
-    const { cookies, headers } = await loadNextHeaders();
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const jar = await cookies();
-    const hdr = await headers();
-    const cookieAccess = jar.get(accessCookie)?.value;
-    const cookieRefresh = jar.get(refreshCookie)?.value;
-    const authHeader = hdr.get('authorization');
-    const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
-        ? authHeader.slice(7).trim()
-        : undefined;
+async function getInboundAuthHeaders() {
+    const { headers } = await loadNextHeaders();
+    const hdr = await Promise.resolve(headers());
     return {
-        accessToken: headerAccess || cookieAccess || undefined,
-        refreshToken: cookieRefresh || undefined,
+        cookie: hdr.get('cookie') ?? undefined,
+        authorization: hdr.get('authorization') ?? undefined,
+        host: hdr.get('host'),
     };
 }
+async function forwardSetCookieThroughNextCookies(rawLines, originalHost) {
+    const rewritten = rawLines.map((v) => rewriteSetCookieDomain(v, originalHost ?? undefined));
+    try {
+        const { cookies } = await import('next/headers');
+        const jar = await Promise.resolve(cookies());
+        for (const line of rewritten) {
+            const semi = line.indexOf(';');
+            const nv = (semi === -1 ? line : line.slice(0, semi)).trim();
+            const eq = nv.indexOf('=');
+            if (eq <= 0)
+                continue;
+            const name = nv.slice(0, eq).trim();
+            const value = nv.slice(eq + 1).trim();
+            if (!name)
+                continue;
+            try {
+                jar.set(name, value, { path: '/' });
+            }
+            catch {
+                // not writable in this context
+            }
+        }
+    }
+    catch {
+        //
+    }
+}
 /**
  * Identify the user / workspace for the current App Router request and
  * return the Qelos context. Safe to call multiple times within the same
- * request — each call performs its own SDK round-trip, so wrap it with
+ * request — each call performs its own `/api/me` round-trip, so wrap it with
  * React's `cache()` if you want a single resolution per render.
  *
  * Calling without arguments uses the env-derived config (see
@@ -59,49 +79,49 @@ async function readTokensFromHeaders(config) {
 export async function getQelosContext(options) {
     const resolved = options ?? { config: getDefaultQelosConfig() };
     const { config, resolveWorkspace } = resolved;
-    const tokens = await readTokensFromHeaders(config);
-    const sdk = createRequestSdk({
-        config,
-        tokens,
-        refreshTarget: null,
-        onTokenRefresh: resolved.onTokenRefresh,
-    });
+    const getHeaders = () => getInboundAuthHeaders();
+    const sdk = createRequestSdk({ config, getHeaders });
     const ctx = {
         user: null,
         workspace: null,
         workspaces: [],
         sdk,
-        tokens,
     };
-    const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
-    if (!hasAuthMaterial) {
+    const base = resolveQelosProxyTarget(config);
+    if (!base && !config.apiToken) {
         return ctx;
     }
-    try {
-        ctx.user = await sdk.authentication.getLoggedInUser();
+    if (base) {
+        const h = await getInboundAuthHeaders();
+        const { response, user } = await fetchMeIdentity({
+            base,
+            cookie: h.cookie,
+            authorization: h.authorization,
+        });
+        const setCookieValues = response.headers.getSetCookie?.() ?? [];
+        await forwardSetCookieThroughNextCookies(setCookieValues, h.host);
+        ctx.user = user;
     }
-    catch {
+    if (!ctx.user) {
         return ctx;
     }
-    if (!ctx.user)
-        return ctx;
     try {
         ctx.workspaces = await sdk.workspaces.getList();
     }
     catch {
         ctx.workspaces = [];
     }
-    if (ctx.workspaces.length) {
-        if (resolveWorkspace) {
-            ctx.workspace =
-                (await resolveWorkspace({
-                    user: ctx.user,
-                    workspaces: ctx.workspaces,
-                })) || null;
-        }
-        else {
-            ctx.workspace = ctx.workspaces[0] || null;
-        }
+    if (resolveWorkspace) {
+        ctx.workspace =
+            (await resolveWorkspace({
+                user: ctx.user,
+                workspaces: ctx.workspaces,
+            })) || null;
+    }
+    else {
+        ctx.workspace =
+            ctx.user.workspace ||
+                null;
     }
     return ctx;
 }

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQjD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAuB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAwB,EACxB,EAAwB;IAExB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAsCD,IAAI,wBAAwB,GAAsC,IAAI,CAAC;AACvE,SAAS,eAAe;IACtB,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,wBAAwB,GAAG,CAAC,KAAK,IAAI,EAAE;YACrC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAiC,CAAC;YAC3E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;IACpD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,YAAY,GAChB,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1D,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,WAAW,EAAE,YAAY,IAAI,YAAY,IAAI,SAAS;QACtD,YAAY,EAAE,aAAa,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgC;IAEhC,MAAM,QAAQ,GAA2B,OAAO,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC;IACxF,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,gBAAgB,CAAO;QACjC,MAAM;QACN,MAAM;QACN,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAwB;QAC/B,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,EAAE;QACd,GAAG;QACH,MAAM;KACP,CAAC;IAEF,MAAM,eAAe,GAAG,OAAO,CAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAC7D,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IAE1B,IAAI,CAAC;QACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS;gBACX,CAAC,MAAM,gBAAgB,CAAC;oBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA+B,EAC/B,EAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAAgC,CAAC;QACrE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAuB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAwB,EACxB,EAAwB;IAExB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AA4BD,IAAI,wBAAwB,GAAsC,IAAI,CAAC;AACvE,SAAS,eAAe;IACtB,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,wBAAwB,GAAG,CAAC,KAAK,IAAI,EAAE;YACrC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAiC,CAAC;YAC3E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,qBAAqB;IAKlC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;QACtC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;QACpD,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;KACtB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,QAAkB,EAClB,YAA2B;IAE3B,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnC,sBAAsB,CAAC,CAAC,EAAE,YAAY,IAAI,SAAS,CAAC,CACrD,CAAC;IACF,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,EAAE,IAAI,CAAC;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC;gBACF,GAA2D,CAAC,GAAG,CAC9D,IAAI,EACJ,KAAK,EACL,EAAE,IAAI,EAAE,GAAG,EAAE,CACd,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,EAAE;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgC;IAEhC,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC;IAChE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAE9C,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC;IAEjD,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAErD,MAAM,GAAG,GAAwB;QAC/B,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,EAAE;QACd,GAAG;KACJ,CAAC;IAEF,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC;YAC/C,IAAI;YACJ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;QAChE,MAAM,kCAAkC,CAAC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,GAAG,CAAC,SAAS;YACX,CAAC,MAAM,gBAAgB,CAAC;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,SAAS;YACV,GAAG,CAAC,IAAqD,CAAC,SAAS;gBACpE,IAAI,CAAC;IACT,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA+B,EAC/B,EAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAAgC,CAAC;QACrE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cookies.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export declare function rewriteSetCookieDomain(setCookie: string, newDomain: string | undefined): string;
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export declare function rewriteSetCookieDomains(values: string[], newDomain: string | undefined): string[];

package/dist/cookies.js

@@ -0,0 +1,39 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export function rewriteSetCookieDomain(setCookie, newDomain) {
+    const domainSegment = /;\s*Domain\s*=\s*[^;]+/i;
+    if (!domainSegment.test(setCookie))
+        return setCookie;
+    const stripped = newDomain ? stripPort(newDomain) : '';
+    if (!stripped) {
+        return setCookie.replace(domainSegment, '');
+    }
+    return setCookie.replace(/(;\s*Domain\s*=\s*)[^;]+/i, `$1${stripped}`);
+}
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export function rewriteSetCookieDomains(values, newDomain) {
+    return values.map((value) => rewriteSetCookieDomain(value, newDomain));
+}
+function stripPort(host) {
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        return end === -1 ? host : host.slice(1, end);
+    }
+    const colon = host.indexOf(':');
+    return colon === -1 ? host : host.slice(0, colon);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,SAA6B;IAE7B,MAAM,aAAa,GAAG,yBAAyB,CAAC;IAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAErD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CACtB,2BAA2B,EAC3B,KAAK,QAAQ,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgB,EAChB,SAA6B;IAE7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/env-config.d.ts

@@ -8,11 +8,11 @@ import type { QelosNextConfig } from './types';
  * Recognized variables:
  *
  * - `QELOS_APP_URL` (required) — Qelos backend base URL.
- * - `QELOS_API_TOKEN` — service-to-service token (skips refresh logic).
- * - `QELOS_ACCESS_TOKEN_COOKIE` — defaults to `q_access_token`.
- * - `QELOS_REFRESH_TOKEN_COOKIE` — defaults to `q_refresh_token`.
+ * - `QELOS_API_TOKEN` — service-to-service token (skips cookie identity).
  * - `QELOS_REQUIRE_AUTH` — `"true"` to reject anonymous requests.
  * - `QELOS_SKIP_PATHS` — comma-separated path prefixes to bypass.
+ * - `QELOS_DISABLE_PROXY` — `"true"` to disable auto `/api/` skip in middleware
+ *   (when you are not using the BFF catch-all proxy).
  */
 export declare function loadQelosConfigFromEnv(env?: NodeJS.ProcessEnv): QelosNextConfig;
 /**