@qelos/integrator-next 4.0.1 → 4.1.0

package/dist/context.d.ts

@@ -1,6 +1,6 @@
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
-import type { QelosNextConfig, QelosRequestContext, TokenRefreshHook } from './types';
+import type { QelosNextConfig, QelosRequestContext } from './types';
 /**
  * Run `fn` with `ctx` as the active Qelos request context. Code anywhere in
  * the resulting async stack can call `getStoredQelosContext()` to retrieve it
@@ -15,15 +15,9 @@ export declare function getStoredQelosContext(): QelosRequestContext | null;
 export interface GetQelosContextOptions {
     config: QelosNextConfig;
     /**
-     * Hook invoked after a successful token refresh. App Router server
-     * components and route handlers cannot mutate cookies after rendering
-     * starts, so the default is a no-op. Callers handling refresh through a
-     * route handler can override this to call `cookies().set(...)`.
-     */
-    onTokenRefresh?: TokenRefreshHook<null>;
-    /**
-     * Resolve the active workspace for a request. Defaults to picking the first
-     * workspace returned from `sdk.workspaces.getList()`.
+     * Resolve the active workspace for a request. Defaults to whatever
+     * `/api/me` reports on `user.workspace` (the user's currently activated
+     * workspace, or `null` when none is active).
      */
     resolveWorkspace?: (params: {
         user: IUser;
@@ -33,7 +27,7 @@ export interface GetQelosContextOptions {
 /**
  * Identify the user / workspace for the current App Router request and
  * return the Qelos context. Safe to call multiple times within the same
- * request — each call performs its own SDK round-trip, so wrap it with
+ * request — each call performs its own `/api/me` round-trip, so wrap it with
  * React's `cache()` if you want a single resolution per render.
  *
  * Calling without arguments uses the env-derived config (see

package/dist/context.js

@@ -1,8 +1,9 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { rewriteSetCookieDomain } from './cookies';
 import { getDefaultQelosConfig } from './env-config';
+import { fetchMeIdentity } from './me-client';
+import { resolveQelosProxyTarget } from './proxy-target';
 import { createRequestSdk } from './sdk-factory';
-const DEFAULT_ACCESS_COOKIE = 'q_access_token';
-const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
 const storage = new AsyncLocalStorage();
 /**
  * Run `fn` with `ctx` as the active Qelos request context. Code anywhere in
@@ -29,27 +30,46 @@ function loadNextHeaders() {
     }
     return nextHeadersModulePromise;
 }
-async function readTokensFromHeaders(config) {
-    const { cookies, headers } = await loadNextHeaders();
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const jar = await cookies();
-    const hdr = await headers();
-    const cookieAccess = jar.get(accessCookie)?.value;
-    const cookieRefresh = jar.get(refreshCookie)?.value;
-    const authHeader = hdr.get('authorization');
-    const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
-        ? authHeader.slice(7).trim()
-        : undefined;
+async function getInboundAuthHeaders() {
+    const { headers } = await loadNextHeaders();
+    const hdr = await Promise.resolve(headers());
     return {
-        accessToken: headerAccess || cookieAccess || undefined,
-        refreshToken: cookieRefresh || undefined,
+        cookie: hdr.get('cookie') ?? undefined,
+        authorization: hdr.get('authorization') ?? undefined,
+        host: hdr.get('host'),
     };
 }
+async function forwardSetCookieThroughNextCookies(rawLines, originalHost) {
+    const rewritten = rawLines.map((v) => rewriteSetCookieDomain(v, originalHost ?? undefined));
+    try {
+        const { cookies } = await import('next/headers');
+        const jar = await Promise.resolve(cookies());
+        for (const line of rewritten) {
+            const semi = line.indexOf(';');
+            const nv = (semi === -1 ? line : line.slice(0, semi)).trim();
+            const eq = nv.indexOf('=');
+            if (eq <= 0)
+                continue;
+            const name = nv.slice(0, eq).trim();
+            const value = nv.slice(eq + 1).trim();
+            if (!name)
+                continue;
+            try {
+                jar.set(name, value, { path: '/' });
+            }
+            catch {
+                // not writable in this context
+            }
+        }
+    }
+    catch {
+        //
+    }
+}
 /**
  * Identify the user / workspace for the current App Router request and
  * return the Qelos context. Safe to call multiple times within the same
- * request — each call performs its own SDK round-trip, so wrap it with
+ * request — each call performs its own `/api/me` round-trip, so wrap it with
  * React's `cache()` if you want a single resolution per render.
  *
  * Calling without arguments uses the env-derived config (see
@@ -59,49 +79,49 @@ async function readTokensFromHeaders(config) {
 export async function getQelosContext(options) {
     const resolved = options ?? { config: getDefaultQelosConfig() };
     const { config, resolveWorkspace } = resolved;
-    const tokens = await readTokensFromHeaders(config);
-    const sdk = createRequestSdk({
-        config,
-        tokens,
-        refreshTarget: null,
-        onTokenRefresh: resolved.onTokenRefresh,
-    });
+    const getHeaders = () => getInboundAuthHeaders();
+    const sdk = createRequestSdk({ config, getHeaders });
     const ctx = {
         user: null,
         workspace: null,
         workspaces: [],
         sdk,
-        tokens,
     };
-    const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
-    if (!hasAuthMaterial) {
+    const base = resolveQelosProxyTarget(config);
+    if (!base && !config.apiToken) {
         return ctx;
     }
-    try {
-        ctx.user = await sdk.authentication.getLoggedInUser();
+    if (base) {
+        const h = await getInboundAuthHeaders();
+        const { response, user } = await fetchMeIdentity({
+            base,
+            cookie: h.cookie,
+            authorization: h.authorization,
+        });
+        const setCookieValues = response.headers.getSetCookie?.() ?? [];
+        await forwardSetCookieThroughNextCookies(setCookieValues, h.host);
+        ctx.user = user;
     }
-    catch {
+    if (!ctx.user) {
         return ctx;
     }
-    if (!ctx.user)
-        return ctx;
     try {
         ctx.workspaces = await sdk.workspaces.getList();
     }
     catch {
         ctx.workspaces = [];
     }
-    if (ctx.workspaces.length) {
-        if (resolveWorkspace) {
-            ctx.workspace =
-                (await resolveWorkspace({
-                    user: ctx.user,
-                    workspaces: ctx.workspaces,
-                })) || null;
-        }
-        else {
-            ctx.workspace = ctx.workspaces[0] || null;
-        }
+    if (resolveWorkspace) {
+        ctx.workspace =
+            (await resolveWorkspace({
+                user: ctx.user,
+                workspaces: ctx.workspaces,
+            })) || null;
+    }
+    else {
+        ctx.workspace =
+            ctx.user.workspace ||
+                null;
     }
     return ctx;
 }

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQjD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAuB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAwB,EACxB,EAAwB;IAExB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAsCD,IAAI,wBAAwB,GAAsC,IAAI,CAAC;AACvE,SAAS,eAAe;IACtB,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,wBAAwB,GAAG,CAAC,KAAK,IAAI,EAAE;YACrC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAiC,CAAC;YAC3E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;IACpD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,YAAY,GAChB,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1D,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,WAAW,EAAE,YAAY,IAAI,YAAY,IAAI,SAAS;QACtD,YAAY,EAAE,aAAa,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgC;IAEhC,MAAM,QAAQ,GAA2B,OAAO,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC;IACxF,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,gBAAgB,CAAO;QACjC,MAAM;QACN,MAAM;QACN,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,CAAC,CAAC;IACH,MAAM,GAAG,GAAwB;QAC/B,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,EAAE;QACd,GAAG;QACH,MAAM;KACP,CAAC;IAEF,MAAM,eAAe,GAAG,OAAO,CAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAC7D,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IAE1B,IAAI,CAAC;QACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS;gBACX,CAAC,MAAM,gBAAgB,CAAC;oBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA+B,EAC/B,EAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAAgC,CAAC;QACrE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAuB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAwB,EACxB,EAAwB;IAExB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AA4BD,IAAI,wBAAwB,GAAsC,IAAI,CAAC;AACvE,SAAS,eAAe;IACtB,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,wBAAwB,GAAG,CAAC,KAAK,IAAI,EAAE;YACrC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAiC,CAAC;YAC3E,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,qBAAqB;IAKlC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;QACtC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;QACpD,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;KACtB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,QAAkB,EAClB,YAA2B;IAE3B,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACnC,sBAAsB,CAAC,CAAC,EAAE,YAAY,IAAI,SAAS,CAAC,CACrD,CAAC;IACF,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,EAAE,IAAI,CAAC;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,CAAC;gBACF,GAA2D,CAAC,GAAG,CAC9D,IAAI,EACJ,KAAK,EACL,EAAE,IAAI,EAAE,GAAG,EAAE,CACd,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,EAAE;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgC;IAEhC,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC;IAChE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAE9C,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC;IAEjD,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAErD,MAAM,GAAG,GAAwB;QAC/B,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,EAAE;QACd,GAAG;KACJ,CAAC;IAEF,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC;YAC/C,IAAI;YACJ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;QAChE,MAAM,kCAAkC,CAAC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,GAAG,CAAC,SAAS;YACX,CAAC,MAAM,gBAAgB,CAAC;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,SAAS;YACV,GAAG,CAAC,IAAqD,CAAC,SAAS;gBACpE,IAAI,CAAC;IACT,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA+B,EAC/B,EAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,cAAc,CAAgC,CAAC;QACrE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cookies.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export declare function rewriteSetCookieDomain(setCookie: string, newDomain: string | undefined): string;
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export declare function rewriteSetCookieDomains(values: string[], newDomain: string | undefined): string[];

package/dist/cookies.js

@@ -0,0 +1,39 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export function rewriteSetCookieDomain(setCookie, newDomain) {
+    const domainSegment = /;\s*Domain\s*=\s*[^;]+/i;
+    if (!domainSegment.test(setCookie))
+        return setCookie;
+    const stripped = newDomain ? stripPort(newDomain) : '';
+    if (!stripped) {
+        return setCookie.replace(domainSegment, '');
+    }
+    return setCookie.replace(/(;\s*Domain\s*=\s*)[^;]+/i, `$1${stripped}`);
+}
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export function rewriteSetCookieDomains(values, newDomain) {
+    return values.map((value) => rewriteSetCookieDomain(value, newDomain));
+}
+function stripPort(host) {
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        return end === -1 ? host : host.slice(1, end);
+    }
+    const colon = host.indexOf(':');
+    return colon === -1 ? host : host.slice(0, colon);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,SAA6B;IAE7B,MAAM,aAAa,GAAG,yBAAyB,CAAC;IAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAErD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CACtB,2BAA2B,EAC3B,KAAK,QAAQ,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgB,EAChB,SAA6B;IAE7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/env-config.d.ts

@@ -8,11 +8,11 @@ import type { QelosNextConfig } from './types';
  * Recognized variables:
  *
  * - `QELOS_APP_URL` (required) — Qelos backend base URL.
- * - `QELOS_API_TOKEN` — service-to-service token (skips refresh logic).
- * - `QELOS_ACCESS_TOKEN_COOKIE` — defaults to `q_access_token`.
- * - `QELOS_REFRESH_TOKEN_COOKIE` — defaults to `q_refresh_token`.
+ * - `QELOS_API_TOKEN` — service-to-service token (skips cookie identity).
  * - `QELOS_REQUIRE_AUTH` — `"true"` to reject anonymous requests.
  * - `QELOS_SKIP_PATHS` — comma-separated path prefixes to bypass.
+ * - `QELOS_DISABLE_PROXY` — `"true"` to disable auto `/api/` skip in middleware
+ *   (when you are not using the BFF catch-all proxy).
  */
 export declare function loadQelosConfigFromEnv(env?: NodeJS.ProcessEnv): QelosNextConfig;
 /**

package/dist/env-config.js

@@ -7,11 +7,11 @@
  * Recognized variables:
  *
  * - `QELOS_APP_URL` (required) — Qelos backend base URL.
- * - `QELOS_API_TOKEN` — service-to-service token (skips refresh logic).
- * - `QELOS_ACCESS_TOKEN_COOKIE` — defaults to `q_access_token`.
- * - `QELOS_REFRESH_TOKEN_COOKIE` — defaults to `q_refresh_token`.
+ * - `QELOS_API_TOKEN` — service-to-service token (skips cookie identity).
  * - `QELOS_REQUIRE_AUTH` — `"true"` to reject anonymous requests.
  * - `QELOS_SKIP_PATHS` — comma-separated path prefixes to bypass.
+ * - `QELOS_DISABLE_PROXY` — `"true"` to disable auto `/api/` skip in middleware
+ *   (when you are not using the BFF catch-all proxy).
  */
 export function loadQelosConfigFromEnv(env = process.env) {
     const appUrl = env.QELOS_APP_URL;
@@ -23,13 +23,12 @@ export function loadQelosConfigFromEnv(env = process.env) {
     const config = { appUrl };
     if (env.QELOS_API_TOKEN)
         config.apiToken = env.QELOS_API_TOKEN;
-    if (env.QELOS_ACCESS_TOKEN_COOKIE)
-        config.accessTokenCookie = env.QELOS_ACCESS_TOKEN_COOKIE;
-    if (env.QELOS_REFRESH_TOKEN_COOKIE)
-        config.refreshTokenCookie = env.QELOS_REFRESH_TOKEN_COOKIE;
     if (env.QELOS_REQUIRE_AUTH === 'true' || env.QELOS_REQUIRE_AUTH === '1') {
         config.requireAuth = true;
     }
+    if (env.QELOS_DISABLE_PROXY === 'true' || env.QELOS_DISABLE_PROXY === '1') {
+        config.disableProxy = true;
+    }
     if (env.QELOS_SKIP_PATHS) {
         config.skipPaths = env.QELOS_SKIP_PATHS.split(',')
             .map((p) => p.trim())

package/dist/env-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../src/env-config.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,0EAA0E;YAC1E,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,eAAe;QAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/D,IAAI,GAAG,CAAC,yBAAyB;QAAE,MAAM,CAAC,iBAAiB,GAAG,GAAG,CAAC,yBAAyB,CAAC;IAC5F,IAAI,GAAG,CAAC,0BAA0B;QAAE,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC/F,IAAI,GAAG,CAAC,kBAAkB,KAAK,MAAM,IAAI,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QACxE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,YAAY,GAA2B,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC"}
+{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../src/env-config.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,0EAA0E;YAC1E,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,eAAe;QAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/D,IAAI,GAAG,CAAC,kBAAkB,KAAK,MAAM,IAAI,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QACxE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,mBAAmB,KAAK,MAAM,IAAI,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QAC1E,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,YAAY,GAA2B,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,11 @@
-export { createQelosMiddleware, qelosMiddleware, type CreateMiddlewareOptions, type MiddlewareRefreshTarget, type PendingCookie, type QelosMiddleware, } from './middleware';
+export { createQelosMiddleware, qelosMiddleware, type CreateMiddlewareOptions, type QelosMiddleware, } from './middleware';
 export { loadQelosConfigFromEnv, getDefaultQelosConfig, } from './env-config';
-export { createRequestSdk, type CreateSdkParams, } from './sdk-factory';
+export { createRequestSdk, type CreateSdkParams } from './sdk-factory';
 export { getQelosContext, withQelosContext, runWithQelosContext, getStoredQelosContext, requireQelosUser, type GetQelosContextOptions, } from './context';
 export { withQelosApi, withQelosSSR, requireQelosApiUser, type PagesIntegratorOptions, } from './pages';
 export { withQelosRoute, type AppRouteHandler, type QelosAppRouteHandler, } from './route';
-export { QELOS_USER_HEADER, QELOS_WORKSPACE_HEADER, type QelosNextConfig, type QelosRequestContext, type QelosTokenPair, type ResolvedTokens, type TokenRefreshContext, type TokenRefreshHook, } from './types';
+export { QELOS_USER_HEADER, QELOS_WORKSPACE_HEADER, type QelosNextConfig, type QelosRequestContext, } from './types';
+export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
+export { resolveQelosProxyTarget } from './proxy-target';
+export { createQelosApiProxyHandlers } from './runtime/api-proxy';
 export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from './social-auth';

package/dist/index.js

@@ -1,9 +1,12 @@
 export { createQelosMiddleware, qelosMiddleware, } from './middleware';
 export { loadQelosConfigFromEnv, getDefaultQelosConfig, } from './env-config';
-export { createRequestSdk, } from './sdk-factory';
+export { createRequestSdk } from './sdk-factory';
 export { getQelosContext, withQelosContext, runWithQelosContext, getStoredQelosContext, requireQelosUser, } from './context';
 export { withQelosApi, withQelosSSR, requireQelosApiUser, } from './pages';
 export { withQelosRoute, } from './route';
 export { QELOS_USER_HEADER, QELOS_WORKSPACE_HEADER, } from './types';
+export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
+export { resolveQelosProxyTarget } from './proxy-target';
+export { createQelosApiProxyHandlers } from './runtime/api-proxy';
 export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, } from './social-auth';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAKhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,GAEjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,GAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAOvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,2BAA2B,EAC3B,+BAA+B,GAGhC,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAEvE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,GAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAGvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,2BAA2B,EAC3B,+BAA+B,GAGhC,MAAM,eAAe,CAAC"}

package/dist/me-client.d.ts

@@ -0,0 +1,15 @@
+import type { IUser } from '@qelos/sdk/dist/authentication';
+export declare function buildMeUrl(base: string): string;
+export interface FetchMeIdentityParams {
+    base: string;
+    cookie?: string;
+    authorization?: string;
+}
+/**
+ * Server-side `GET /api/me` against Qelos with inbound auth material forwarded.
+ * Does not rewrite `Set-Cookie`; callers apply {@link rewriteSetCookieDomain}.
+ */
+export declare function fetchMeIdentity(params: FetchMeIdentityParams): Promise<{
+    response: Response;
+    user: IUser | null;
+}>;

package/dist/me-client.js

@@ -0,0 +1,35 @@
+export function buildMeUrl(base) {
+    return `${base.replace(/\/+$/, '')}/api/me`;
+}
+/**
+ * Server-side `GET /api/me` against Qelos with inbound auth material forwarded.
+ * Does not rewrite `Set-Cookie`; callers apply {@link rewriteSetCookieDomain}.
+ */
+export async function fetchMeIdentity(params) {
+    const headers = {};
+    if (params.cookie)
+        headers.cookie = params.cookie;
+    if (params.authorization)
+        headers.authorization = params.authorization;
+    let response;
+    try {
+        response = await fetch(buildMeUrl(params.base), {
+            method: 'GET',
+            headers,
+            redirect: 'manual',
+        });
+    }
+    catch {
+        return { response: new Response(null, { status: 502 }), user: null };
+    }
+    if (!response.ok) {
+        return { response, user: null };
+    }
+    try {
+        return { response, user: (await response.json()) };
+    }
+    catch {
+        return { response, user: null };
+    }
+}
+//# sourceMappingURL=me-client.js.map

package/dist/me-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me-client.js","sourceRoot":"","sources":["../src/me-client.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;AAC9C,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA6B;IAE7B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,IAAI,MAAM,CAAC,aAAa;QAAE,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAEvE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO;YACP,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAU,EAAE,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/middleware.d.ts

@@ -1,38 +1,13 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
-import type { QelosNextConfig, TokenRefreshHook } from './types';
-export interface PendingCookie {
-    name: string;
-    value: string;
-    options: {
-        httpOnly: boolean;
-        secure: boolean;
-        sameSite: 'lax' | 'strict' | 'none';
-        path: string;
-    };
-}
-/**
- * Carrier passed to the App Router middleware token-refresh hook. Cookies
- * pushed onto `pendingCookies` are written to the outbound `NextResponse`
- * after identification completes — Next.js does not let us mutate the
- * response headers after `NextResponse.next()` has been constructed, so we
- * stage them here and flush them once the response object exists.
- */
-export interface MiddlewareRefreshTarget {
-    req: NextRequest;
-    pendingCookies: PendingCookie[];
-}
+import type { QelosNextConfig } from './types';
 export interface CreateMiddlewareOptions {
     config: QelosNextConfig;
     /**
-     * Hook invoked after a successful token refresh. The default implementation
-     * stages new cookies for the outbound response.
-     */
-    onTokenRefresh?: TokenRefreshHook<MiddlewareRefreshTarget>;
-    /**
-     * Resolve the active workspace for a request. Defaults to picking the first
-     * workspace returned from `sdk.workspaces.getList()`.
+     * Resolve the active workspace for a request. Defaults to whatever
+     * `/api/me` reports on `user.workspace` (the user's currently activated
+     * workspace, or `null` when none is active).
      */
     resolveWorkspace?: (params: {
         req: NextRequest;
@@ -43,11 +18,12 @@ export interface CreateMiddlewareOptions {
 export type QelosMiddleware = (req: NextRequest) => Promise<NextResponse>;
 /**
  * Create a Next.js (App Router) edge middleware that identifies the user and
- * the active workspace via the Qelos SDK before the request reaches the
- * application's own handler. Resolved identity is forwarded to downstream
- * handlers via request headers (`x-qelos-user-id`, `x-qelos-workspace-id`);
- * use `getQelosContext()` from `@qelos/integrator-next/context` to obtain the
- * full user / workspace objects inside server components or route handlers.
+ * the active workspace via a same-origin BFF round-trip to Qelos `GET /api/me`
+ * before the request reaches the application's own handler. Resolved identity
+ * is forwarded to downstream handlers via request headers (`x-qelos-user-id`,
+ * `x-qelos-workspace-id`); use `getQelosContext()` from
+ * `@qelos/integrator-next/context` to obtain the full user / workspace objects
+ * inside server components or route handlers.
  */
 export declare function createQelosMiddleware(options: CreateMiddlewareOptions): QelosMiddleware;
 /**