@qelos/integrator-next 4.1.1 → 4.2.1

package/README.md

@@ -7,9 +7,6 @@ route proxies `/api/**` to Qelos with `Set-Cookie` domain rewriting, and the
 SDK reads live `Cookie` / `Authorization` headers on every call — no
 integrator-managed access or refresh tokens.
 
-Supports the **App Router** and the **Pages Router** on Next.js **14** and
-**15**.
-
 > Requires **Node 18+** — the middleware and proxy use
 > [`Response.headers.getSetCookie()`](https://developer.mozilla.org/docs/Web/API/Headers/getSetCookie)
 > to forward individual upstream `Set-Cookie` headers.
@@ -22,6 +19,20 @@ pnpm add @qelos/integrator-next @qelos/sdk
 
 `next` (>=13.4) and `react` are peer dependencies.
 
+## Version support
+
+| | |
+|---|---|
+| **Minimum** | Next.js **13.4+** (App Router and Pages Router) |
+| **Tested through** | Next.js **15.x** (see `devDependencies.next` in this package) |
+| **Peer range** | `>=13.4.0` — forward-compatible; no upper bound so future Next majors remain supported until a breaking API change requires a new integrator release |
+| **React** | `>=18.2.0` (optional peer) |
+| **Node.js** | `>=18` |
+
+The integrator avoids APIs tied to a single Next major where possible (for
+example, `next/headers` is consumed in a way that accepts both sync and async
+return shapes). Report issues on newer Next releases if you hit a regression.
+
 ## Quick start
 
 Set `QELOS_APP_URL`, then wire Edge middleware and a catch-all API proxy route.
@@ -199,3 +210,11 @@ export const getServerSideProps = withQelosSSR(
 `completeSocialAuthCallback` and the re-exported SDK helpers forward Qelos
 session cookies from `socialCallback` onto your Node response — use them from
 a route handler that owns the response object.
+
+## MCP OAuth
+
+When your app is the MCP OAuth issuer on a custom domain, host `/login` and
+`/mcp/authorize` and use the re-exported MCP helpers (`resolveMcpLoginRedirect`,
+`decodeMcpOAuthStatePayload`, `completeMcpAuthorizationCallback`, …). See
+[MCP OAuth for integrator apps](https://docs.qelos.io/auth/mcp-oauth-integrators)
+in the Qelos docs.

package/dist/index.d.ts

@@ -9,3 +9,4 @@ export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
 export { resolveQelosProxyTarget } from './proxy-target';
 export { createQelosApiProxyHandlers } from './runtime/api-proxy';
 export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from './social-auth';
+export { completeMcpAuthorizationCallback, appendMcpAccessDeniedRedirect, buildMcpAuthorizePath, buildMcpAuthorizePathFromQuery, buildMcpConsentPageUrl, buildMcpLoginRedirectUrl, buildMcpTokenExchangeBody, decodeMcpOAuthStatePayload, parseMcpCallbackParams, resolveMcpLoginRedirect, type CompleteMcpAuthorizationCallbackOptions, type DecodedMcpOAuthStatePayload, type McpAuthorizeOptions, type McpCallbackInput, type McpCallbackParams, type McpPagePathOptions, type McpTokenExchangeOptions, type McpTokenExchangeResult, } from './mcp-auth';

package/dist/index.js

@@ -9,4 +9,5 @@ export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
 export { resolveQelosProxyTarget } from './proxy-target';
 export { createQelosApiProxyHandlers } from './runtime/api-proxy';
 export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, } from './social-auth';
+export { completeMcpAuthorizationCallback, appendMcpAccessDeniedRedirect, buildMcpAuthorizePath, buildMcpAuthorizePathFromQuery, buildMcpConsentPageUrl, buildMcpLoginRedirectUrl, buildMcpTokenExchangeBody, decodeMcpOAuthStatePayload, parseMcpCallbackParams, resolveMcpLoginRedirect, } from './mcp-auth';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAEvE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,GAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAGvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,2BAA2B,EAC3B,+BAA+B,GAGhC,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAEvE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,GAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAGvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,2BAA2B,EAC3B,+BAA+B,GAGhC,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,GASxB,MAAM,YAAY,CAAC"}

package/dist/mcp-auth.d.ts

@@ -0,0 +1,12 @@
+import type QelosSDK from '@qelos/sdk';
+import type { McpCallbackInput, McpTokenExchangeResult } from '@qelos/sdk';
+export interface CompleteMcpAuthorizationCallbackOptions {
+    redirectUri: string;
+    codeVerifier: string;
+}
+/**
+ * Parse an MCP OAuth callback and exchange the authorization code for tokens.
+ * Use when your app owns the MCP client callback URL (e.g. a local loopback server).
+ */
+export declare function completeMcpAuthorizationCallback(sdk: QelosSDK, input: McpCallbackInput, options: CompleteMcpAuthorizationCallbackOptions): Promise<McpTokenExchangeResult>;
+export { appendMcpAccessDeniedRedirect, buildMcpAuthorizePath, buildMcpAuthorizePathFromQuery, buildMcpConsentPageUrl, buildMcpLoginRedirectUrl, buildMcpTokenExchangeBody, decodeMcpOAuthStatePayload, parseMcpCallbackParams, resolveMcpLoginRedirect, type DecodedMcpOAuthStatePayload, type McpAuthorizeOptions, type McpCallbackInput, type McpCallbackParams, type McpPagePathOptions, type McpTokenExchangeOptions, type McpTokenExchangeResult, } from '@qelos/sdk';

package/dist/mcp-auth.js

@@ -0,0 +1,21 @@
+import { parseMcpCallbackParams } from '@qelos/sdk';
+/**
+ * Parse an MCP OAuth callback and exchange the authorization code for tokens.
+ * Use when your app owns the MCP client callback URL (e.g. a local loopback server).
+ */
+export async function completeMcpAuthorizationCallback(sdk, input, options) {
+    const params = parseMcpCallbackParams(input);
+    if (params.error) {
+        throw new Error(params.errorDescription || params.error);
+    }
+    if (!params.code) {
+        throw new Error('missing authorization code');
+    }
+    return sdk.authentication.exchangeMcpAuthorizationCode({
+        code: params.code,
+        redirectUri: options.redirectUri,
+        codeVerifier: options.codeVerifier,
+    });
+}
+export { appendMcpAccessDeniedRedirect, buildMcpAuthorizePath, buildMcpAuthorizePathFromQuery, buildMcpConsentPageUrl, buildMcpLoginRedirectUrl, buildMcpTokenExchangeBody, decodeMcpOAuthStatePayload, parseMcpCallbackParams, resolveMcpLoginRedirect, } from '@qelos/sdk';
+//# sourceMappingURL=mcp-auth.js.map

package/dist/mcp-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../src/mcp-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAOpD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAa,EACb,KAAuB,EACvB,OAAgD;IAEhD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,CAAC,cAAc,CAAC,4BAA4B,CAAC;QACrD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,GAQxB,MAAM,YAAY,CAAC"}

package/dist/version-support.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Declared Next.js compatibility policy for `@qelos/integrator-next`.
+ * Keep in sync with `peerDependencies.next` in package.json and README.
+ */
+export declare const MIN_NEXT_VERSION = "13.4.0";
+/** Latest major we type-check and unit-test against (see devDependencies.next). */
+export declare const TESTED_NEXT_MAJOR = 15;
+/** Forward-compatible peer range — no upper bound so future majors stay supported. */
+export declare const NEXT_PEER_RANGE = ">=13.4.0";

package/dist/version-support.js

@@ -0,0 +1,10 @@
+/**
+ * Declared Next.js compatibility policy for `@qelos/integrator-next`.
+ * Keep in sync with `peerDependencies.next` in package.json and README.
+ */
+export const MIN_NEXT_VERSION = '13.4.0';
+/** Latest major we type-check and unit-test against (see devDependencies.next). */
+export const TESTED_NEXT_MAJOR = 15;
+/** Forward-compatible peer range — no upper bound so future majors stay supported. */
+export const NEXT_PEER_RANGE = '>=13.4.0';
+//# sourceMappingURL=version-support.js.map

package/dist/version-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-support.js","sourceRoot":"","sources":["../src/version-support.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,sFAAsF;AACtF,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qelos/integrator-next",
-  "version": "4.1.1",
+  "version": "4.2.1",
   "description": "Qelos integrator middleware for Next.js (App Router and Pages Router): identifies the user and workspace via the Qelos SDK before the application's own handler runs.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -60,6 +60,12 @@
     "dist",
     "README.md"
   ],
+  "scripts": {
+    "type-check": "tsc --noEmit",
+    "build": "tsc",
+    "pre-build": "tsc",
+    "test": "node --import tsx --test \"src/**/*.test.ts\""
+  },
   "peerDependencies": {
     "next": ">=13.4.0",
     "react": ">=18.2.0"
@@ -70,11 +76,11 @@
     }
   },
   "dependencies": {
-    "@qelos/sdk": "4.1.1"
+    "@qelos/sdk": "workspace:*"
   },
   "devDependencies": {
     "@types/node": "^22.5.4",
-    "next": "^14.2.5",
+    "next": "^15.5.23",
     "react": "^18.3.1",
     "tsx": "^4.21.0",
     "typescript": "^5.4.5"
@@ -86,11 +92,5 @@
   },
   "engines": {
     "node": ">=18"
-  },
-  "scripts": {
-    "type-check": "tsc --noEmit",
-    "build": "tsc",
-    "pre-build": "tsc",
-    "test": "node --import tsx --test \"src/**/*.test.ts\""
   }
-}
+}

package/LICENSE

@@ -1,20 +0,0 @@
-Polyform Shield License 1.0.0
-
-Copyright (c) 2025 Velocitech LTD
-
-Your use of this software is governed by the Polyform Shield License 1.0.0.
-
-You may obtain a copy of the License at:
-https://polyformproject.org/licenses/shield/1.0.0
-
-Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-
-Additional Terms – Exception Notice:
-
-The author of this software grants additional permissions beyond the Polyform Shield License 1.0.0:
-
-✅ All uses of the software are permitted — including modification, distribution, commercial use, and sublicensing — as long as the software is not used to create, offer, or operate any product or service that competes directly with Qelos (https://qelos.io), a no-code platform for building AI-assisted SaaS applications.
-
-❌ "Direct competition" includes platforms, tools, or services that enable users to visually or programmatically create SaaS applications with the assistance of artificial intelligence.
-
-This exception does not modify the terms of the original Polyform Shield License for other users and applies only by explicit permission of the licensor.