@qelos/integrator-next 4.0.0

package/dist/middleware.d.ts

@@ -0,0 +1,68 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import type { IUser } from '@qelos/sdk/dist/authentication';
+import type { IWorkspace } from '@qelos/sdk/workspaces';
+import type { QelosNextConfig, TokenRefreshHook } from './types';
+export interface PendingCookie {
+    name: string;
+    value: string;
+    options: {
+        httpOnly: boolean;
+        secure: boolean;
+        sameSite: 'lax' | 'strict' | 'none';
+        path: string;
+    };
+}
+/**
+ * Carrier passed to the App Router middleware token-refresh hook. Cookies
+ * pushed onto `pendingCookies` are written to the outbound `NextResponse`
+ * after identification completes — Next.js does not let us mutate the
+ * response headers after `NextResponse.next()` has been constructed, so we
+ * stage them here and flush them once the response object exists.
+ */
+export interface MiddlewareRefreshTarget {
+    req: NextRequest;
+    pendingCookies: PendingCookie[];
+}
+export interface CreateMiddlewareOptions {
+    config: QelosNextConfig;
+    /**
+     * Hook invoked after a successful token refresh. The default implementation
+     * stages new cookies for the outbound response.
+     */
+    onTokenRefresh?: TokenRefreshHook<MiddlewareRefreshTarget>;
+    /**
+     * Resolve the active workspace for a request. Defaults to picking the first
+     * workspace returned from `sdk.workspaces.getList()`.
+     */
+    resolveWorkspace?: (params: {
+        req: NextRequest;
+        user: IUser;
+        workspaces: IWorkspace[];
+    }) => IWorkspace | null | Promise<IWorkspace | null>;
+}
+export type QelosMiddleware = (req: NextRequest) => Promise<NextResponse>;
+/**
+ * Create a Next.js (App Router) edge middleware that identifies the user and
+ * the active workspace via the Qelos SDK before the request reaches the
+ * application's own handler. Resolved identity is forwarded to downstream
+ * handlers via request headers (`x-qelos-user-id`, `x-qelos-workspace-id`);
+ * use `getQelosContext()` from `@qelos/integrator-next/context` to obtain the
+ * full user / workspace objects inside server components or route handlers.
+ */
+export declare function createQelosMiddleware(options: CreateMiddlewareOptions): QelosMiddleware;
+/**
+ * Pre-configured Next.js edge middleware that reads its config from the
+ * environment (see {@link loadQelosConfigFromEnv}). Re-export it from your
+ * `middleware.ts` to opt into Qelos identification with zero setup:
+ *
+ * ```ts
+ * // middleware.ts
+ * export { qelosMiddleware as middleware } from '@qelos/integrator-next/middleware';
+ * export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'] };
+ * ```
+ *
+ * Each invocation lazily instantiates the middleware on the first call so
+ * importing this module does not throw when env vars are not yet loaded.
+ * For full control, call {@link createQelosMiddleware} with an explicit config.
+ */
+export declare const qelosMiddleware: QelosMiddleware;

package/dist/middleware.js

@@ -0,0 +1,140 @@
+import { NextResponse } from 'next/server';
+import { applyQelosForwardHeaders } from './forward-headers';
+import { getDefaultQelosConfig } from './env-config';
+import { createRequestSdk } from './sdk-factory';
+const DEFAULT_ACCESS_COOKIE = 'q_access_token';
+const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
+function readTokens(req, config) {
+    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
+    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
+    const cookieAccess = req.cookies.get(accessCookie)?.value;
+    const cookieRefresh = req.cookies.get(refreshCookie)?.value;
+    const authHeader = req.headers.get('authorization');
+    const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
+        ? authHeader.slice(7).trim()
+        : undefined;
+    return {
+        accessToken: headerAccess || cookieAccess || undefined,
+        refreshToken: cookieRefresh || undefined,
+    };
+}
+function stagePendingCookies(pending, config, tokens) {
+    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
+    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
+    const secure = !/^http:\/\//i.test(config.appUrl);
+    const options = {
+        httpOnly: true,
+        secure,
+        sameSite: 'lax',
+        path: '/',
+    };
+    pending.push({ name: accessCookie, value: tokens.accessToken, options });
+    if (tokens.refreshToken) {
+        pending.push({ name: refreshCookie, value: tokens.refreshToken, options });
+    }
+}
+function shouldSkip(req, config) {
+    if (!config.skipPaths?.length)
+        return false;
+    const path = req.nextUrl.pathname;
+    return config.skipPaths.some((prefix) => path.startsWith(prefix));
+}
+function unauthorized() {
+    return new NextResponse(JSON.stringify({ code: 'UNAUTHORIZED' }), {
+        status: 401,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+/**
+ * Create a Next.js (App Router) edge middleware that identifies the user and
+ * the active workspace via the Qelos SDK before the request reaches the
+ * application's own handler. Resolved identity is forwarded to downstream
+ * handlers via request headers (`x-qelos-user-id`, `x-qelos-workspace-id`);
+ * use `getQelosContext()` from `@qelos/integrator-next/context` to obtain the
+ * full user / workspace objects inside server components or route handlers.
+ */
+export function createQelosMiddleware(options) {
+    const { config, resolveWorkspace } = options;
+    const onTokenRefresh = options.onTokenRefresh ||
+        (async ({ target, newTokens }) => {
+            stagePendingCookies(target.pendingCookies, config, newTokens);
+        });
+    return async function qelosMiddleware(req) {
+        if (shouldSkip(req, config)) {
+            return NextResponse.next();
+        }
+        const tokens = readTokens(req, config);
+        const pendingCookies = [];
+        const forwardedHeaders = new Headers(req.headers);
+        const sdk = createRequestSdk({
+            config,
+            tokens,
+            refreshTarget: { req, pendingCookies },
+            onTokenRefresh,
+        });
+        const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
+        let user = null;
+        let workspaces = [];
+        let workspace = null;
+        let identifyFailed = false;
+        if (hasAuthMaterial) {
+            try {
+                user = await sdk.authentication.getLoggedInUser();
+            }
+            catch {
+                identifyFailed = true;
+            }
+            if (user) {
+                try {
+                    workspaces = await sdk.workspaces.getList();
+                }
+                catch {
+                    workspaces = [];
+                }
+                if (workspaces.length) {
+                    if (resolveWorkspace) {
+                        workspace =
+                            (await resolveWorkspace({ req, user, workspaces })) || null;
+                    }
+                    else {
+                        workspace = workspaces[0] || null;
+                    }
+                }
+            }
+        }
+        if (config.requireAuth && (!hasAuthMaterial || identifyFailed)) {
+            return unauthorized();
+        }
+        applyQelosForwardHeaders(forwardedHeaders, user, workspace);
+        const response = NextResponse.next({
+            request: { headers: forwardedHeaders },
+        });
+        for (const cookie of pendingCookies) {
+            response.cookies.set(cookie.name, cookie.value, cookie.options);
+        }
+        return response;
+    };
+}
+let defaultMiddleware = null;
+/**
+ * Pre-configured Next.js edge middleware that reads its config from the
+ * environment (see {@link loadQelosConfigFromEnv}). Re-export it from your
+ * `middleware.ts` to opt into Qelos identification with zero setup:
+ *
+ * ```ts
+ * // middleware.ts
+ * export { qelosMiddleware as middleware } from '@qelos/integrator-next/middleware';
+ * export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'] };
+ * ```
+ *
+ * Each invocation lazily instantiates the middleware on the first call so
+ * importing this module does not throw when env vars are not yet loaded.
+ * For full control, call {@link createQelosMiddleware} with an explicit config.
+ */
+export const qelosMiddleware = (req) => {
+    if (!defaultMiddleware) {
+        defaultMiddleware = createQelosMiddleware({ config: getDefaultQelosConfig() });
+    }
+    return defaultMiddleware(req);
+};
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAG7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQjD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AA6CjD,SAAS,UAAU,CAAC,GAAgB,EAAE,MAAuB;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;IAC1D,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;IAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,YAAY,GAChB,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1D,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,WAAW,EAAE,YAAY,IAAI,YAAY,IAAI,SAAS;QACtD,YAAY,EAAE,aAAa,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAwB,EACxB,MAAuB,EACvB,MAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;KACV,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,MAAuB;IAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE;QAChE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;YAC/B,mBAAmB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IAEL,OAAO,KAAK,UAAU,eAAe,CAAC,GAAG;QACvC,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,cAAc,GAAoB,EAAE,CAAC;QAC3C,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,gBAAgB,CAA0B;YACpD,MAAM;YACN,MAAM;YACN,aAAa,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE;YACtC,cAAc;SACf,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,OAAO,CAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAC7D,CAAC;QAEF,IAAI,IAAI,GAAiB,IAAI,CAAC;QAC9B,IAAI,UAAU,GAAiB,EAAE,CAAC;QAClC,IAAI,SAAS,GAAsB,IAAI,CAAC;QACxC,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,GAAG,EAAE,CAAC;gBAClB,CAAC;gBACD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;oBACtB,IAAI,gBAAgB,EAAE,CAAC;wBACrB,SAAS;4BACP,CAAC,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,eAAe,IAAI,cAAc,CAAC,EAAE,CAAC;YAC/D,OAAO,YAAY,EAAE,CAAC;QACxB,CAAC;QAED,wBAAwB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;SACvC,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,IAAI,iBAAiB,GAA2B,IAAI,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,GAAG,EAAE,EAAE;IACtD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,iBAAiB,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC,CAAC"}

package/dist/pages.d.ts

@@ -0,0 +1,54 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { GetServerSideProps, GetServerSidePropsContext, GetServerSidePropsResult, NextApiHandler } from 'next';
+import type { IUser } from '@qelos/sdk/dist/authentication';
+import type { IWorkspace } from '@qelos/sdk/workspaces';
+import type { QelosNextConfig, QelosRequestContext, TokenRefreshHook } from './types';
+type CookieMap = Partial<Record<string, string>>;
+interface RequestWithCookies extends IncomingMessage {
+    cookies?: CookieMap;
+}
+declare module 'http' {
+    interface IncomingMessage {
+        qelos?: QelosRequestContext;
+    }
+}
+export interface PagesIntegratorOptions {
+    config: QelosNextConfig;
+    /**
+     * Hook invoked after a successful token refresh. The default implementation
+     * writes the new tokens back to the response cookies.
+     */
+    onTokenRefresh?: TokenRefreshHook<ServerResponse>;
+    /**
+     * Resolve the active workspace for a request. Defaults to picking the first
+     * workspace returned from `sdk.workspaces.getList()`.
+     */
+    resolveWorkspace?: (params: {
+        req: RequestWithCookies;
+        user: IUser;
+        workspaces: IWorkspace[];
+    }) => IWorkspace | null | Promise<IWorkspace | null>;
+}
+/**
+ * Wrap a Pages Router API route handler so that `req.qelos` is populated
+ * before the handler runs. Anonymous requests pass through with
+ * `req.qelos.user = null` unless `config.requireAuth` is set.
+ */
+export declare function withQelosApi(handler: NextApiHandler, options: PagesIntegratorOptions): NextApiHandler;
+/**
+ * Wrap a Pages Router API route handler so that requests without a resolved
+ * user are rejected with `401`. The handler always sees a populated
+ * `req.qelos.user`.
+ */
+export declare function requireQelosApiUser(handler: NextApiHandler, options: PagesIntegratorOptions): NextApiHandler;
+/**
+ * Wrap a Pages Router `getServerSideProps` so that `context.req.qelos` is
+ * populated and the resolved context is also passed as a second argument for
+ * convenience.
+ */
+export declare function withQelosSSR<P extends {
+    [key: string]: any;
+} = {
+    [key: string]: any;
+}>(handler: (context: GetServerSidePropsContext, qelos: QelosRequestContext) => Promise<GetServerSidePropsResult<P>> | GetServerSidePropsResult<P>, options: PagesIntegratorOptions): GetServerSideProps<P>;
+export {};

package/dist/pages.js

@@ -0,0 +1,190 @@
+import { createRequestSdk } from './sdk-factory';
+import { runWithQelosContext } from './context';
+const DEFAULT_ACCESS_COOKIE = 'q_access_token';
+const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
+function readCookieFromHeader(header, name) {
+    if (!header)
+        return undefined;
+    const prefix = name + '=';
+    for (const part of header.split(';')) {
+        const trimmed = part.trim();
+        if (trimmed.startsWith(prefix)) {
+            try {
+                return decodeURIComponent(trimmed.slice(prefix.length));
+            }
+            catch {
+                return trimmed.slice(prefix.length);
+            }
+        }
+    }
+    return undefined;
+}
+function readTokens(req, config) {
+    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
+    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
+    const parsed = req.cookies;
+    const cookieAccess = (parsed && typeof parsed[accessCookie] === 'string'
+        ? parsed[accessCookie]
+        : undefined) || readCookieFromHeader(req.headers.cookie, accessCookie);
+    const cookieRefresh = (parsed && typeof parsed[refreshCookie] === 'string'
+        ? parsed[refreshCookie]
+        : undefined) || readCookieFromHeader(req.headers.cookie, refreshCookie);
+    const authHeaderRaw = req.headers.authorization;
+    const authHeader = Array.isArray(authHeaderRaw) ? authHeaderRaw[0] : authHeaderRaw;
+    const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
+        ? authHeader.slice(7).trim()
+        : undefined;
+    return {
+        accessToken: headerAccess || cookieAccess || undefined,
+        refreshToken: cookieRefresh || undefined,
+    };
+}
+function serializeCookie(name, value, secure) {
+    const parts = [
+        `${name}=${encodeURIComponent(value)}`,
+        'Path=/',
+        'HttpOnly',
+        'SameSite=Lax',
+    ];
+    if (secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+function appendSetCookie(res, value) {
+    const existing = res.getHeader('set-cookie');
+    if (Array.isArray(existing)) {
+        res.setHeader('set-cookie', [...existing, value]);
+    }
+    else if (typeof existing === 'string') {
+        res.setHeader('set-cookie', [existing, value]);
+    }
+    else {
+        res.setHeader('set-cookie', [value]);
+    }
+}
+function writeTokensToResponse(res, config, tokens) {
+    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
+    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
+    const secure = !/^http:\/\//i.test(config.appUrl);
+    appendSetCookie(res, serializeCookie(accessCookie, tokens.accessToken, secure));
+    if (tokens.refreshToken) {
+        appendSetCookie(res, serializeCookie(refreshCookie, tokens.refreshToken, secure));
+    }
+}
+function shouldSkip(req, config) {
+    if (!config.skipPaths?.length)
+        return false;
+    const path = req.url || '';
+    return config.skipPaths.some((prefix) => path.startsWith(prefix));
+}
+async function buildContext(req, res, options) {
+    const { config, resolveWorkspace } = options;
+    const onTokenRefresh = options.onTokenRefresh ||
+        (async ({ target, newTokens }) => {
+            writeTokensToResponse(target, config, newTokens);
+        });
+    const tokens = readTokens(req, config);
+    const sdk = createRequestSdk({
+        config,
+        tokens,
+        refreshTarget: res,
+        onTokenRefresh,
+    });
+    const ctx = {
+        user: null,
+        workspace: null,
+        workspaces: [],
+        sdk,
+        tokens,
+    };
+    const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
+    if (!hasAuthMaterial) {
+        return { ctx, identifyFailed: false };
+    }
+    let identifyFailed = false;
+    try {
+        ctx.user = await sdk.authentication.getLoggedInUser();
+    }
+    catch {
+        identifyFailed = true;
+        return { ctx, identifyFailed };
+    }
+    if (!ctx.user)
+        return { ctx, identifyFailed };
+    try {
+        ctx.workspaces = await sdk.workspaces.getList();
+    }
+    catch {
+        ctx.workspaces = [];
+    }
+    if (ctx.workspaces.length) {
+        if (resolveWorkspace) {
+            ctx.workspace =
+                (await resolveWorkspace({
+                    req,
+                    user: ctx.user,
+                    workspaces: ctx.workspaces,
+                })) || null;
+        }
+        else {
+            ctx.workspace = ctx.workspaces[0] || null;
+        }
+    }
+    return { ctx, identifyFailed };
+}
+/**
+ * Wrap a Pages Router API route handler so that `req.qelos` is populated
+ * before the handler runs. Anonymous requests pass through with
+ * `req.qelos.user = null` unless `config.requireAuth` is set.
+ */
+export function withQelosApi(handler, options) {
+    const { config } = options;
+    return async function qelosApiHandler(req, res) {
+        if (shouldSkip(req, config)) {
+            return handler(req, res);
+        }
+        const { ctx, identifyFailed } = await buildContext(req, res, options);
+        req.qelos = ctx;
+        if (config.requireAuth && (!ctx.user || identifyFailed)) {
+            res.status(401).json({ code: 'UNAUTHORIZED' });
+            return;
+        }
+        await runWithQelosContext(ctx, () => handler(req, res));
+    };
+}
+/**
+ * Wrap a Pages Router API route handler so that requests without a resolved
+ * user are rejected with `401`. The handler always sees a populated
+ * `req.qelos.user`.
+ */
+export function requireQelosApiUser(handler, options) {
+    return withQelosApi(handler, { ...options, config: { ...options.config, requireAuth: true } });
+}
+/**
+ * Wrap a Pages Router `getServerSideProps` so that `context.req.qelos` is
+ * populated and the resolved context is also passed as a second argument for
+ * convenience.
+ */
+export function withQelosSSR(handler, options) {
+    const { config } = options;
+    return async function qelosGetServerSideProps(context) {
+        const req = context.req;
+        const res = context.res;
+        if (shouldSkip(req, config)) {
+            return runWithQelosContext({ user: null, workspace: null, workspaces: [], sdk: null, tokens: {} }, () => handler(context, {
+                user: null,
+                workspace: null,
+                workspaces: [],
+                sdk: null,
+                tokens: {},
+            }));
+        }
+        const { ctx, identifyFailed } = await buildContext(req, res, options);
+        req.qelos = ctx;
+        if (config.requireAuth && (!ctx.user || identifyFailed)) {
+            return { redirect: { destination: '/login', permanent: false } };
+        }
+        return (await runWithQelosContext(ctx, () => handler(context, ctx)));
+    };
+}
+//# sourceMappingURL=pages.js.map

package/dist/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../src/pages.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAShD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAQjD,SAAS,oBAAoB,CAAC,MAA0B,EAAE,IAAY;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CACjB,GAAuB,EACvB,MAAuB;IAEvB,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;IAC3B,MAAM,YAAY,GAChB,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ;QACjD,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACtB,CAAC,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3E,MAAM,aAAa,GACjB,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ;QAClD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QACvB,CAAC,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IACnF,MAAM,YAAY,GAChB,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1D,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,WAAW,EAAE,YAAY,IAAI,YAAY,IAAI,SAAS;QACtD,YAAY,EAAE,aAAa,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,MAAe;IACnE,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ;QACR,UAAU;QACV,cAAc;KACf,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,KAAa;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxC,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAAmB,EACnB,MAAuB,EACvB,MAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB,EAAE,MAAuB;IAClE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IAC3B,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AA0BD,KAAK,UAAU,YAAY,CACzB,GAAuB,EACvB,GAAmB,EACnB,OAA+B;IAE/B,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;YAC/B,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,gBAAgB,CAAiB;QAC3C,MAAM;QACN,MAAM;QACN,aAAa,EAAE,GAAG;QAClB,cAAc;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAwB;QAC/B,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,EAAE;QACd,GAAG;QACH,MAAM;KACP,CAAC;IAEF,MAAM,eAAe,GAAG,OAAO,CAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAC7D,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,GAAG,IAAI,CAAC;QACtB,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IAE9C,IAAI,CAAC;QACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS;gBACX,CAAC,MAAM,gBAAgB,CAAC;oBACtB,GAAG;oBACH,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAuB,EACvB,OAA+B;IAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,OAAO,KAAK,UAAU,eAAe,CACnC,GAAmB,EACnB,GAAoB;QAEpB,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACtE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;QAEhB,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAuB,EACvB,OAA+B;IAE/B,OAAO,YAAY,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,OAGuE,EACvE,OAA+B;IAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,OAAO,KAAK,UAAU,uBAAuB,CAAC,OAAO;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAyB,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAqB,CAAC;QAE1C,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,mBAAmB,CACxB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,IAAa,EAAE,MAAM,EAAE,EAAE,EAAE,EAC/E,GAAG,EAAE,CACH,OAAO,CAAC,OAAO,EAAE;gBACf,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,EAAE;gBACd,GAAG,EAAE,IAAa;gBAClB,MAAM,EAAE,EAAE;aACX,CAAC,CACmC,CAAC;QAC5C,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACtE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;QAEhB,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,cAAc,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QACnE,CAAC;QAED,OAAO,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAgC,CAAC;IACtG,CAAC,CAAC;AACJ,CAAC"}

package/dist/route.d.ts

@@ -0,0 +1,15 @@
+import { type NextRequest } from 'next/server';
+import { type GetQelosContextOptions } from './context';
+import type { QelosRequestContext } from './types';
+export type AppRouteHandler<TContext = unknown> = (req: NextRequest, context: TContext) => Response | Promise<Response>;
+export type QelosAppRouteHandler<TContext = unknown> = (req: NextRequest, context: TContext, qelos: QelosRequestContext) => Response | Promise<Response>;
+/**
+ * Wrap an App Router route handler (e.g. `app/api/foo/route.ts`) so that the
+ * Qelos context is resolved and made available both as a third argument and
+ * via `getStoredQelosContext()` from anywhere in the handler's async stack.
+ * Anonymous requests pass through with `qelos.user = null` unless
+ * `options.config.requireAuth` is set.
+ *
+ * Omit `options` to use the env-derived default config.
+ */
+export declare function withQelosRoute<TContext = unknown>(handler: QelosAppRouteHandler<TContext>, options?: GetQelosContextOptions): AppRouteHandler<TContext>;

package/dist/route.js

@@ -0,0 +1,21 @@
+import { NextResponse } from 'next/server';
+import { getQelosContext, runWithQelosContext, } from './context';
+/**
+ * Wrap an App Router route handler (e.g. `app/api/foo/route.ts`) so that the
+ * Qelos context is resolved and made available both as a third argument and
+ * via `getStoredQelosContext()` from anywhere in the handler's async stack.
+ * Anonymous requests pass through with `qelos.user = null` unless
+ * `options.config.requireAuth` is set.
+ *
+ * Omit `options` to use the env-derived default config.
+ */
+export function withQelosRoute(handler, options) {
+    return async function qelosRouteHandler(req, ctx) {
+        const qelos = await getQelosContext(options);
+        if (options?.config.requireAuth && !qelos.user) {
+            return NextResponse.json({ code: 'UNAUTHORIZED' }, { status: 401 });
+        }
+        return await runWithQelosContext(qelos, () => Promise.resolve(handler(req, ctx, qelos)));
+    };
+}
+//# sourceMappingURL=route.js.map

package/dist/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../src/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,WAAW,CAAC;AAcnB;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAuC,EACvC,OAAgC;IAEhC,OAAO,KAAK,UAAU,iBAAiB,CAAC,GAAG,EAAE,GAAG;QAC9C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,CAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAC9B,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/sdk-factory.d.ts

@@ -0,0 +1,20 @@
+import QelosSDK from '@qelos/sdk';
+import type { QelosNextConfig, QelosTokenPair, TokenRefreshHook } from './types';
+export interface CreateSdkParams<TRefreshTarget = unknown> {
+    config: QelosNextConfig;
+    /**
+     * Tokens for the current request. The factory mutates this object in place
+     * when a token refresh occurs, so callers can read the latest pair after
+     * the SDK has been used.
+     */
+    tokens: QelosTokenPair;
+    /**
+     * Transport-specific carrier passed through to `onTokenRefresh`. Edge
+     * middleware passes the outbound `NextResponse`; Pages Router passes the
+     * `NextApiResponse` / `ServerResponse`; App Router server components pass
+     * `null` because they cannot mutate cookies after rendering starts.
+     */
+    refreshTarget: TRefreshTarget;
+    onTokenRefresh?: TokenRefreshHook<TRefreshTarget>;
+}
+export declare function createRequestSdk<TRefreshTarget = unknown>({ config, tokens, refreshTarget, onTokenRefresh, }: CreateSdkParams<TRefreshTarget>): QelosSDK;

package/dist/sdk-factory.js

@@ -0,0 +1,90 @@
+import QelosSDK from '@qelos/sdk';
+const NO_AUTH_URLS = new Set([
+    '/api/token/refresh',
+    '/api/cookie/refresh',
+    '/api/signin',
+    '/api/signup',
+]);
+export function createRequestSdk({ config, tokens, refreshTarget, onTokenRefresh, }) {
+    let sdk;
+    let refreshInFlight = null;
+    const baseOptions = config.sdkOptions || {};
+    async function performRefresh() {
+        if (!tokens.refreshToken && !tokens.accessToken) {
+            throw new Error('no refresh token available');
+        }
+        const previous = {
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+        };
+        let refreshed;
+        if (tokens.refreshToken) {
+            const result = await sdk.authentication.refreshToken(tokens.refreshToken);
+            refreshed = {
+                accessToken: result.payload.token,
+                refreshToken: result.payload.refreshToken,
+            };
+        }
+        else {
+            const result = await sdk.authentication.refreshCookieToken(tokens.accessToken);
+            refreshed = {
+                accessToken: result.payload.cookieToken,
+            };
+        }
+        tokens.accessToken = refreshed.accessToken;
+        tokens.refreshToken = refreshed.refreshToken;
+        if (onTokenRefresh) {
+            await onTokenRefresh({
+                target: refreshTarget,
+                oldTokens: previous,
+                newTokens: refreshed,
+                sdk,
+            });
+        }
+    }
+    function ensureRefresh() {
+        if (!refreshInFlight) {
+            refreshInFlight = performRefresh().finally(() => {
+                refreshInFlight = null;
+            });
+        }
+        return refreshInFlight;
+    }
+    const options = {
+        appUrl: config.appUrl,
+        fetch: globalThis.fetch.bind(globalThis),
+        forceRefresh: !config.apiToken,
+        ...baseOptions,
+    };
+    if (config.apiToken) {
+        options.apiToken = config.apiToken;
+    }
+    else {
+        if (tokens.accessToken) {
+            options.accessToken = tokens.accessToken;
+        }
+        if (tokens.refreshToken) {
+            options.refreshToken = tokens.refreshToken;
+        }
+        options.extraHeaders = async (relativeUrl, forceRefresh) => {
+            const headers = {};
+            if (NO_AUTH_URLS.has(relativeUrl)) {
+                return headers;
+            }
+            if (forceRefresh && (tokens.refreshToken || tokens.accessToken)) {
+                await ensureRefresh();
+            }
+            const token = sdk?.authentication?.accessToken || tokens.accessToken;
+            if (token) {
+                headers.authorization = 'Bearer ' + token;
+            }
+            return headers;
+        };
+        options.onFailedRefreshToken = async () => {
+            await ensureRefresh();
+        };
+    }
+    sdk = new QelosSDK(options);
+    return sdk;
+}
+//# sourceMappingURL=sdk-factory.js.map

package/dist/sdk-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-factory.js","sourceRoot":"","sources":["../src/sdk-factory.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,YAAY,CAAC;AASlC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,oBAAoB;IACpB,qBAAqB;IACrB,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAoBH,MAAM,UAAU,gBAAgB,CAA2B,EACzD,MAAM,EACN,MAAM,EACN,aAAa,EACb,cAAc,GACkB;IAChC,IAAI,GAAa,CAAC;IAClB,IAAI,eAAe,GAAyB,IAAI,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAE5C,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAmB;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,IAAI,SAAyB,CAAC;QAC9B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1E,SAAS,GAAG;gBACV,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBACjC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;aAC1C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/E,SAAS,GAAG;gBACV,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;aACxC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC3C,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAC7C,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,CAAC;gBACnB,MAAM,EAAE,aAAa;gBACrB,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,SAAS;gBACpB,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS,aAAa;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC9C,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ;QAC9B,GAAG,WAAW;KACf,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YACzD,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChE,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,EAAE,cAAc,EAAE,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;YACrE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,aAAa,GAAG,SAAS,GAAG,KAAK,CAAC;YAC5C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QACF,OAAO,CAAC,oBAAoB,GAAG,KAAK,IAAI,EAAE;YACxC,MAAM,aAAa,EAAE,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC;IAED,GAAG,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/social-auth.d.ts

@@ -0,0 +1,12 @@
+import type QelosSDK from '@qelos/sdk';
+import type { SocialAuthCallbackPayload } from '@qelos/sdk';
+/**
+ * Runs {@link QelosSDK.authentication.socialCallback} for `requestUrl` and
+ * forwards session `Set-Cookie` headers to `res` (Next.js Pages `NextApiResponse`,
+ * App Route handlers using `NextResponse` should set cookies via the Response API
+ * instead — use the SDK helpers from `@qelos/sdk` directly there).
+ */
+export declare function completeSocialAuthCallback(sdk: QelosSDK, requestUrl: string, res: {
+    setHeader(name: string, value: string | string[]): void;
+}): Promise<SocialAuthCallbackPayload>;
+export { applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from '@qelos/sdk';