@qelos/integrator-next 4.2.0 → 4.2.2

package/README.md

@@ -7,9 +7,6 @@ route proxies `/api/**` to Qelos with `Set-Cookie` domain rewriting, and the
 SDK reads live `Cookie` / `Authorization` headers on every call — no
 integrator-managed access or refresh tokens.
 
-Supports the **App Router** and the **Pages Router** on Next.js **14** and
-**15**.
-
 > Requires **Node 18+** — the middleware and proxy use
 > [`Response.headers.getSetCookie()`](https://developer.mozilla.org/docs/Web/API/Headers/getSetCookie)
 > to forward individual upstream `Set-Cookie` headers.
@@ -22,6 +19,20 @@ pnpm add @qelos/integrator-next @qelos/sdk
 
 `next` (>=13.4) and `react` are peer dependencies.
 
+## Version support
+
+| | |
+|---|---|
+| **Minimum** | Next.js **13.4+** (App Router and Pages Router) |
+| **Tested through** | Next.js **15.x** (see `devDependencies.next` in this package) |
+| **Peer range** | `>=13.4.0` — forward-compatible; no upper bound so future Next majors remain supported until a breaking API change requires a new integrator release |
+| **React** | `>=18.2.0` (optional peer) |
+| **Node.js** | `>=18` |
+
+The integrator avoids APIs tied to a single Next major where possible (for
+example, `next/headers` is consumed in a way that accepts both sync and async
+return shapes). Report issues on newer Next releases if you hit a regression.
+
 ## Quick start
 
 Set `QELOS_APP_URL`, then wire Edge middleware and a catch-all API proxy route.
@@ -199,3 +210,11 @@ export const getServerSideProps = withQelosSSR(
 `completeSocialAuthCallback` and the re-exported SDK helpers forward Qelos
 session cookies from `socialCallback` onto your Node response — use them from
 a route handler that owns the response object.
+
+## MCP OAuth
+
+When your app is the MCP OAuth issuer on a custom domain, host `/login` and
+`/mcp/authorize` and use the re-exported MCP helpers (`resolveMcpLoginRedirect`,
+`decodeMcpOAuthStatePayload`, `completeMcpAuthorizationCallback`, …). See
+[MCP OAuth for integrator apps](https://docs.qelos.io/auth/mcp-oauth-integrators)
+in the Qelos docs.

package/dist/index.d.ts

@@ -9,3 +9,4 @@ export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
 export { resolveQelosProxyTarget } from './proxy-target';
 export { createQelosApiProxyHandlers } from './runtime/api-proxy';
 export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from './social-auth';
+export { completeMcpAuthorizationCallback, appendMcpAccessDeniedRedirect, buildMcpAuthorizePath, buildMcpAuthorizePathFromQuery, buildMcpConsentPageUrl, buildMcpLoginRedirectUrl, buildMcpTokenExchangeBody, decodeMcpOAuthStatePayload, parseMcpCallbackParams, resolveMcpLoginRedirect, type CompleteMcpAuthorizationCallbackOptions, type DecodedMcpOAuthStatePayload, type McpAuthorizeOptions, type McpCallbackInput, type McpCallbackParams, type McpPagePathOptions, type McpTokenExchangeOptions, type McpTokenExchangeResult, } from './mcp-auth';

package/dist/index.js

@@ -9,4 +9,5 @@ export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
 export { resolveQelosProxyTarget } from './proxy-target';
 export { createQelosApiProxyHandlers } from './runtime/api-proxy';
 export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, } from './social-auth';
+export { completeMcpAuthorizationCallback, appendMcpAccessDeniedRedirect, buildMcpAuthorizePath, buildMcpAuthorizePathFromQuery, buildMcpConsentPageUrl, buildMcpLoginRedirectUrl, buildMcpTokenExchangeBody, decodeMcpOAuthStatePayload, parseMcpCallbackParams, resolveMcpLoginRedirect, } from './mcp-auth';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAEvE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,GAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAGvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,2BAA2B,EAC3B,+BAA+B,GAGhC,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAEvE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,GAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAGvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,2BAA2B,EAC3B,+BAA+B,GAGhC,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,GASxB,MAAM,YAAY,CAAC"}

package/dist/mcp-auth.d.ts

@@ -0,0 +1,12 @@
+import type QelosSDK from '@qelos/sdk';
+import type { McpCallbackInput, McpTokenExchangeResult } from '@qelos/sdk';
+export interface CompleteMcpAuthorizationCallbackOptions {
+    redirectUri: string;
+    codeVerifier: string;
+}
+/**
+ * Parse an MCP OAuth callback and exchange the authorization code for tokens.
+ * Use when your app owns the MCP client callback URL (e.g. a local loopback server).
+ */
+export declare function completeMcpAuthorizationCallback(sdk: QelosSDK, input: McpCallbackInput, options: CompleteMcpAuthorizationCallbackOptions): Promise<McpTokenExchangeResult>;
+export { appendMcpAccessDeniedRedirect, buildMcpAuthorizePath, buildMcpAuthorizePathFromQuery, buildMcpConsentPageUrl, buildMcpLoginRedirectUrl, buildMcpTokenExchangeBody, decodeMcpOAuthStatePayload, parseMcpCallbackParams, resolveMcpLoginRedirect, type DecodedMcpOAuthStatePayload, type McpAuthorizeOptions, type McpCallbackInput, type McpCallbackParams, type McpPagePathOptions, type McpTokenExchangeOptions, type McpTokenExchangeResult, } from '@qelos/sdk';

package/dist/mcp-auth.js

@@ -0,0 +1,21 @@
+import { parseMcpCallbackParams } from '@qelos/sdk';
+/**
+ * Parse an MCP OAuth callback and exchange the authorization code for tokens.
+ * Use when your app owns the MCP client callback URL (e.g. a local loopback server).
+ */
+export async function completeMcpAuthorizationCallback(sdk, input, options) {
+    const params = parseMcpCallbackParams(input);
+    if (params.error) {
+        throw new Error(params.errorDescription || params.error);
+    }
+    if (!params.code) {
+        throw new Error('missing authorization code');
+    }
+    return sdk.authentication.exchangeMcpAuthorizationCode({
+        code: params.code,
+        redirectUri: options.redirectUri,
+        codeVerifier: options.codeVerifier,
+    });
+}
+export { appendMcpAccessDeniedRedirect, buildMcpAuthorizePath, buildMcpAuthorizePathFromQuery, buildMcpConsentPageUrl, buildMcpLoginRedirectUrl, buildMcpTokenExchangeBody, decodeMcpOAuthStatePayload, parseMcpCallbackParams, resolveMcpLoginRedirect, } from '@qelos/sdk';
+//# sourceMappingURL=mcp-auth.js.map

package/dist/mcp-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../src/mcp-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAOpD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAa,EACb,KAAuB,EACvB,OAAgD;IAEhD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,CAAC,cAAc,CAAC,4BAA4B,CAAC;QACrD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,GAQxB,MAAM,YAAY,CAAC"}

package/dist/version-support.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Declared Next.js compatibility policy for `@qelos/integrator-next`.
+ * Keep in sync with `peerDependencies.next` in package.json and README.
+ */
+export declare const MIN_NEXT_VERSION = "13.4.0";
+/** Latest major we type-check and unit-test against (see devDependencies.next). */
+export declare const TESTED_NEXT_MAJOR = 15;
+/** Forward-compatible peer range — no upper bound so future majors stay supported. */
+export declare const NEXT_PEER_RANGE = ">=13.4.0";

package/dist/version-support.js

@@ -0,0 +1,10 @@
+/**
+ * Declared Next.js compatibility policy for `@qelos/integrator-next`.
+ * Keep in sync with `peerDependencies.next` in package.json and README.
+ */
+export const MIN_NEXT_VERSION = '13.4.0';
+/** Latest major we type-check and unit-test against (see devDependencies.next). */
+export const TESTED_NEXT_MAJOR = 15;
+/** Forward-compatible peer range — no upper bound so future majors stay supported. */
+export const NEXT_PEER_RANGE = '>=13.4.0';
+//# sourceMappingURL=version-support.js.map

package/dist/version-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-support.js","sourceRoot":"","sources":["../src/version-support.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,sFAAsF;AACtF,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qelos/integrator-next",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Qelos integrator middleware for Next.js (App Router and Pages Router): identifies the user and workspace via the Qelos SDK before the application's own handler runs.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -70,11 +70,11 @@
     }
   },
   "dependencies": {
-    "@qelos/sdk": "4.2.0"
+    "@qelos/sdk": "4.2.2"
   },
   "devDependencies": {
     "@types/node": "^22.5.4",
-    "next": "^14.2.5",
+    "next": "^15.5.23",
     "react": "^18.3.1",
     "tsx": "^4.21.0",
     "typescript": "^5.4.5"